Title
feat(agent): Native AWS EC2 Telemetry Collector
Problem
AWS does not provide a single agent equivalent to Azure Monitor Agent (AMA) that focuses on collecting, filtering and enriching security telemetry across operating systems, applications and custom workloads before forwarding to multiple destinations.
Organisations often deploy several agents (CloudWatch Agent, Fluent Bit, custom scripts, osquery, auditd, etc.) to achieve complete visibility.
Bower should provide a lightweight, security-focused collector that becomes the preferred telemetry agent for EC2 instances.
Goal
Implement a native EC2 agent capable of collecting host, application and cloud telemetry while integrating seamlessly with AWS-native security services.
Features
Windows
Collect:
- Windows Event Logs
- Sysmon
- PowerShell Logs
- Defender for Endpoint
- IIS Logs
- DNS Client Logs
- Firewall Logs
- Custom Application Logs
Linux
Collect:
- Syslog
- Journald
- auditd
- auth.log
- sudo logs
- SSH Logs
- Kernel Events
- Docker Logs
- Container Runtime Logs
- Custom Application Logs
AWS Metadata
Automatically enrich every event with:
- Instance ID
- Account ID
- Region
- Availability Zone
- VPC
- Subnet
- Security Groups
- AMI
- Instance Tags
- Auto Scaling Group
- ECS/EKS Cluster Metadata
Security Services
Integrate with:
- GuardDuty
- Security Hub
- CloudTrail
- CloudWatch Logs
- VPC Flow Logs
- Route53 Resolver Logs
- AWS Config
Processing
Every event passes through:
- Noise Reduction
- Sensitive Data Masking
- Schema Normalisation (OCSF)
- Event Enrichment
- Deduplication
- Risk Scoring
- Compression
- Local Buffering
- Reliable Retry
- Dead Letter Queue
Destinations
Forward telemetry to:
- Microsoft Sentinel
- Amazon Security Lake
- Amazon OpenSearch
- Splunk
- Elastic
- Chronicle
- QRadar
- Kafka
- Syslog
- Generic HTTP endpoints
Deployment
Support:
- RPM
- DEB
- Windows MSI
- Docker
- ECS Sidecar
- EKS DaemonSet
- ARM64
- x64
Success Criteria
- Single lightweight agent
- Minimal CPU and memory usage
- Cross-platform support
- Native AWS enrichment
- Intelligent filtering before ingestion
- Vendor-neutral outputs
Why
Azure has Azure Monitor Agent.
AWS has several different collection mechanisms, but no single security-focused telemetry agent that intelligently processes events before they reach a SIEM.
Bower should become that agent.
Rather than replacing AWS-native services, Bower complements them by collecting host telemetry, enriching cloud context, reducing noise, protecting sensitive data and delivering trusted security signal to any destination.
Title
feat(agent): Native AWS EC2 Telemetry Collector
Problem
AWS does not provide a single agent equivalent to Azure Monitor Agent (AMA) that focuses on collecting, filtering and enriching security telemetry across operating systems, applications and custom workloads before forwarding to multiple destinations.
Organisations often deploy several agents (CloudWatch Agent, Fluent Bit, custom scripts, osquery, auditd, etc.) to achieve complete visibility.
Bower should provide a lightweight, security-focused collector that becomes the preferred telemetry agent for EC2 instances.
Goal
Implement a native EC2 agent capable of collecting host, application and cloud telemetry while integrating seamlessly with AWS-native security services.
Features
Windows
Collect:
Linux
Collect:
AWS Metadata
Automatically enrich every event with:
Security Services
Integrate with:
Processing
Every event passes through:
Destinations
Forward telemetry to:
Deployment
Support:
Success Criteria
Why
Azure has Azure Monitor Agent.
AWS has several different collection mechanisms, but no single security-focused telemetry agent that intelligently processes events before they reach a SIEM.
Bower should become that agent.
Rather than replacing AWS-native services, Bower complements them by collecting host telemetry, enriching cloud context, reducing noise, protecting sensitive data and delivering trusted security signal to any destination.