From ce5af959ad9e930a054e53dcebac694aa3f84688 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sat, 27 Jun 2026 08:52:17 +0000 Subject: [PATCH] Add SIEM --- CLAUDE.md | 2 + docs/TODO.md | 26 ++++ docs/ssp-annex-a-ism-residual-risk.md | 17 +-- docs/ssp.md | 32 +++-- serving/.env.example | 10 ++ serving/audit-collector/rsyslog.conf | 22 ++++ serving/docker-compose.yml | 4 +- serving/http/default.conf | 5 + serving/siem/.env.example | 24 ++++ serving/siem/.gitignore | 7 ++ serving/siem/README.md | 128 ++++++++++++++++++++ serving/siem/config/fleet-remote-syslog.xml | 27 +++++ serving/siem/config/local_decoder.xml | 45 +++++++ serving/siem/config/local_rules.xml | 51 ++++++++ serving/siem/docker-compose.override.yml | 32 +++++ 15 files changed, 414 insertions(+), 18 deletions(-) create mode 100644 serving/siem/.env.example create mode 100644 serving/siem/.gitignore create mode 100644 serving/siem/README.md create mode 100644 serving/siem/config/fleet-remote-syslog.xml create mode 100644 serving/siem/config/local_decoder.xml create mode 100644 serving/siem/config/local_rules.xml create mode 100644 serving/siem/docker-compose.override.yml diff --git a/CLAUDE.md b/CLAUDE.md index b7118c9..dcf33bc 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -43,6 +43,8 @@ serving/kiosk-app/ Svelte+Tailwind spaceship-terminal SP OS-side kiosk runtime stays in files/kiosk/ serving/dot1x-bench/ Secure-path bench: step-ca + FreeRADIUS + hostapd authenticator + TPM enrolment +serving/siem/ Wazuh SIEM overlay (audit analysis; + agentless relay from audit-collector) .gitea/workflows/ Gitea CI: lint -> packer build -> push OCI docs/ Design PDF and supporting notes ``` diff --git a/docs/TODO.md b/docs/TODO.md index 519a2eb..2233906 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -220,6 +220,32 @@ reconnect — no records lost. Documented in When the **workstation** firewall is re-enabled (#4 / register #4) it needs the reciprocal **egress** allow for 514/tcp to the collector. +**SIEM (Wazuh) added 2026-06-27 — [serving/siem/](../serving/siem/).** Upgrades the +"Detect" pillar from file-collection-only to parse/search/correlate/alert. +**Runs on a DEDICATED node — `wazuh1.bitasylum.org`** (managed independently), +keeping the memory-hungry indexer JVM **off** the serving host so it can't OOM SPDK +(the fleet's root disk / SPOF, #6/#7). **Agentless** (diskless hosts stay stateless, +invariant #1): the serving-host audit-collector **relays a copy** to wazuh1's +manager syslog listener (`omfwd` → `wazuh1.bitasylum.org:514` in +`audit-collector/rsyslog.conf`; rebuild the collector to apply) while still writing +durable per-host files. `serving/siem/` is the INTEGRATION (the `` syslog +block to add on wazuh1 + reference deploy overlay), not a local deployment. +**DECODING BENCH-VERIFIED 2026-06-27** (`wazuh-logtest`): the audisp-syslog records +carry a `node=` prefix (STIG `name_format=hostname`, SSG `auditd_name_format` +— kept, it's compliance) that breaks Wazuh's built-in auditd decoder, so a custom +**`fleet-auditd`** decoder + rules (`serving/siem/config/local_decoder.xml` + +`local_rules.xml`, mounted declaratively via `/wazuh-config-mount`) decode them +into the **`fleet_audit`** group. **Decode + alert confirmed:** `wazuh-logtest` +shows `decoder.name=fleet-auditd` + `audit.type` extracted (base rule `100100`); +and a live `sudo` on a booted host (`cygnus-cruiser-99`) surfaced `USER_CMD` → +rule `100130` and `CRED_*`/`USER_ACCT` → rule `100110` (level 5) in the dashboard +Threat Hunting view. Wazuh runs multi-node on `wazuh1.bitasylum.org`. +**REMAINING (prod):** the relay→wazuh1 hop is **plaintext** — **TLS it** (gtls/6514, +fleet CA; ISM protect-logs-in-transit) since it's now on the wire; rotate all Wazuh +creds; restrict dashboard/API to admin hosts; set `allowed-ips`→/32 of the serving +host; ISM retention/archival; then update the SSP "Detect" + ISM event-logging +controls. + ### Original spec (retained for reference) OpenSCAP + SCAP Security Guide (`xccdf_org.ssgproject.content_profile_stig`), run diff --git a/docs/ssp-annex-a-ism-residual-risk.md b/docs/ssp-annex-a-ism-residual-risk.md index bc59136..e2717ce 100644 --- a/docs/ssp-annex-a-ism-residual-risk.md +++ b/docs/ssp-annex-a-ism-residual-risk.md @@ -14,7 +14,10 @@ > confinement, audit offload verified, PXE/iPXE boot path added, and **UEFI Secure > Boot signing verified enforcing on real hardware** (VM HTTP + 820 PXE) — R-13 > reduced from Medium to Low (residual is making signed + SB-on the standing -> default). +> default); and (2026-06-27) a **Wazuh SIEM** (dedicated multi-node, agentless) +> now decodes + alerts on the fleet auditd stream — "event log analysis/alerting" +> moves Planned → Implemented, R-07 reduced toward Low (residual = TLS transport + +> retention). --- @@ -67,7 +70,7 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the |---|---|---|---|---|---| | System Security Plan | ISM-0041* | An SSP is developed and maintained. | This document set ([SSP](ssp.md) + this annex). | Partial | Formal sign-off, role appointment pending. | | Incident Response Plan | ISM-0043* | An IRP is developed, maintained, exercised. | Not yet authored; inherent recovery via reboot/redeploy. | Planned | R-12 | -| Continuous monitoring plan | ISM-1163* | Continuous monitoring strategy documented. | auditd + log offload exist; plan not formalised. | Partial | R-07 | +| Continuous monitoring plan | ISM-1163* | Continuous monitoring strategy documented. | auditd + centralised offload + **Wazuh SIEM** (analysis/alerting) exist; formal monitoring *plan/runbook* not yet documented. | Partial | R-07 | | Strategies maintained & approved | ISM-0027* | Documentation approved by the authorising authority. | Pending AO appointment & approval. | Planned | — | ### 2.2 Guidelines for Cyber Security Roles @@ -117,11 +120,11 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the | Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual | |---|---|---|---|---|---| -| Centralised event logging | ISM-0988*, ISM-1405* | Logs centrally collected. | `audisp-syslog`→rsyslog `omfwd` (disk-assisted queue) → dedicated collector (`serving/audit-collector/`); **bench-verified end-to-end 2026-06-20**. auditd `space_left_action`→syslog (no MTA). | Partial | R-07 | +| Centralised event logging | ISM-0988*, ISM-1405* | Logs centrally collected. | `audisp-syslog`→rsyslog `omfwd` (disk-assisted queue) → dedicated collector (`serving/audit-collector/`), which **relays to a dedicated multi-node Wazuh SIEM** (`wazuh1.bitasylum.org`). **Agentless** (no agent/state on hosts, invariant #1). Bench-verified end-to-end 2026-06-20 (collector) + 2026-06-27 (Wazuh). | Implemented | R-07 (transport/retention) | | Required events logged | ISM-0582*, ISM-1537* | Log security-relevant events. | STIG auditd rule set; kernel `audit=1`, `audit_backlog_limit=8192`. | Implemented | — | -| Protect logs in transit | ISM-1432*, ISM-0407* | Encrypt/authenticate log transport. | **Plaintext** offload on isolated LAN (rsyslog TLS rules waived — see [STIG #6](stig-deviations.md)). | Waived (lab) | **R-07** | -| Log retention & integrity | ISM-0859*, ISM-1815* | Retain & protect logs. | Per-source-host files on collector; retention policy & tamper-protection not yet defined. | Planned | R-07 | -| Event log analysis / alerting | ISM-0109*, ISM-1228* | Review logs; alert on incidents. | No SIEM correlation/alerting defined. | Planned | R-07, R-12 | +| Protect logs in transit | ISM-1432*, ISM-0407* | Encrypt/authenticate log transport. | **Plaintext** on both hops (host→collector, collector→Wazuh across a routed mgmt LAN); rsyslog TLS rules waived (see [STIG #6](stig-deviations.md)). | Waived (lab) | **R-07** | +| Log retention & integrity | ISM-0859*, ISM-1815* | Retain & protect logs. | Per-source-host files on collector; Wazuh indexer available for retention/ISM but **archival/retention policy not yet configured**. | Planned | R-07 | +| Event log analysis / alerting | ISM-0109*, ISM-1228* | Review logs; alert on incidents. | **Wazuh SIEM** with a custom **`fleet-auditd`** decoder + severity-tiered rules (`fleet_audit` group; auth, privilege/`USER_CMD`, SELinux). **Decode + alert bench-verified 2026-06-27** (`wazuh-logtest` + live `sudo` in the dashboard). Detection content to expand. | Implemented (content to mature) | R-07 | ### 2.7 Guidelines for Networking @@ -177,7 +180,7 @@ asked to accept. Treatments map to [docs/TODO.md](TODO.md) (working POA&M). | **R-04** | NVMe/TCP **root traffic plaintext** on the LAN — exposure of OS content / injection if the segment is compromised. | 2.9 (ISM-1139*/1453*) | Unlikely × Major → **Medium** | Isolated boot LAN; MACsec on the access link (once R-01 done) protects the first hop; dm-verity makes injected root blocks fail verification (integrity preserved even if confidentiality isn't). | Production: TLS/IPsec for the storage transport, or rely on MACsec end-to-end across the fabric; document the decision. | **Low–Medium** | Platform/network — *production* | | **R-05** | **NOPASSWD key-only admin**; no per-host or rotatable access model; human admin MFA on the mgmt plane not enforced. | 2.4 (ISM-1507*/1173*) | Possible × Moderate → **Medium** | Single fleet-generic admin, key-only, root disabled, ECDSA/RSA key, **now SELinux-confined to `staff_u`** with sudo role/type elevation, fully audited; no interactive password to attack. | Per-host/rotatable access (SSH CA / config-agent) + admin MFA on the management plane. | **Low–Medium** | Platform team — *roadmap* | | **R-06** | **FIPS off**; ISM **AACA/AACP conformance not formally asserted**; crypto-module evaluation status unconfirmed. | 2.9 (ISM-0471*/1139*/1277*) | Possible × Major → **Medium** | Modern STIG crypto policy; non-exportable TPM key; no deliberately weak algorithms. Acceptable at OFFICIAL; **mandatory to resolve for PROTECTED+.** | Assert AACA/AACP conformance; decide on FIPS module / evaluated crypto alongside Secure Boot signing. | **Low** (at appropriate classification) | Security + Platform — *before PROTECTED+* | -| **R-07** | Audit-log **offload plaintext**, **single-site**, **no SIEM alerting**; logs interceptable/repudiable and not actively reviewed. (Transport **bench-verified working** 2026-06-20.) | 2.6 (ISM-1432*/0109*/0859*) | Possible × Moderate → **Medium** | Isolated LAN; disk-assisted queue (no loss on collector blip); auditd local copy; per-source files; LinuxAudit captures USBGuard events. | rsyslog **TLS** (gtls/6514) + bundle CA in image (re-select the 3 waived `rsyslog_encrypt_offload_*` rules); define retention + integrity; forward to SIEM with alerting. | **Low** | Platform/SecOps — *production* | +| **R-07** | Audit-log **offload plaintext** on both hops (host→collector, collector→Wazuh) and **log retention/archival not yet configured** — logs interceptable in transit and retention/tamper-protection undefined. (**SIEM analysis + alerting now in place** — Wazuh, decode+alert bench-verified 2026-06-27; transport bench-verified 2026-06-20.) | 2.6 (ISM-1432*/0109*/0859*) | Possible × Moderate → **Low–Medium** | Isolated/mgmt LAN; disk-assisted queue (no loss on collector/SIEM blip); auditd local copy; per-source files; **Wazuh now actively decodes + alerts** (`fleet_audit`). | rsyslog **TLS** (gtls/6514) on both hops + bundle CA in image (re-select the 3 waived `rsyslog_encrypt_offload_*` rules); configure Wazuh **retention/archival** (ISM) + rotate default creds + restrict dashboard/API. | **Low** | Platform/SecOps — *production* | | **R-13** | **Boot-chain signing not yet the standing default** — signing + Secure Boot enforcement are **verified end-to-end on real hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22, SB enforcing, `db` enrolled), but unsigned/SB-OFF lab builds remain possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not every host has `db` enrolled, so a substituted artifact could still boot on an un-enrolled/unsigned host. | 2.10 (ISM-1542*/0312*) | Unlikely × Major → **Low** | Capability **proven on hardware**; dm-verity rejects a tampered *root* regardless; isolated lab LAN. | Make signed + Secure-Boot-on the **default for all production builds/hosts**: keep `SB_KEY`/`SB_CERT` CI secrets set; enrol `db` fleet-wide; treat an unsigned build as lab-only. | **Low** | Platform team — *before production* | | **R-08** | **Placeholder RADIUS CA** (`files/etc/dot1x/radius-ca.pem`) — real EAP-TLS trust anchor not provisioned; auth cannot succeed and trust is unestablished. | 2.4 (ISM-1546*) | Certain (lab) × Major → **Medium** | Documented as a placeholder; environment-specific provisioning is the intended path; no real CA committed. | Provision the environment's real RADIUS CA out-of-band (not committed unless classification permits). | **Low** | Environment owner — *before production* | | **R-09** | **Host firewall disabled**; host exposes more network surface than necessary. | 2.7 (ISM-1416*) | Possible × Moderate → **Low–Medium** | Isolated LAN; minimal services; egress controlled at the network/serving layer; no kiosk inbound. | Re-enable firewalld with explicit allow rules (NVMe/TCP `:4420`, DHCP, log offload, SSH) once the secure path is verified. | **Low** | Platform/network — *after R-01* | diff --git a/docs/ssp.md b/docs/ssp.md index e4a3223..050e4e4 100644 --- a/docs/ssp.md +++ b/docs/ssp.md @@ -16,7 +16,7 @@ | System name | Diskless Fleet Boot System ("the fleet") | | Document type | System Security Plan (SSP) | | Version | 0.2 (DRAFT — pre-assessment) | -| Date | 2026-06-22 | +| Date | 2026-06-27 | | Author / maintainer | System Owner (delegate) | | Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. | | Companion documents | [Annex A — ISM control cross-reference & residual risk](ssp-annex-a-ism-residual-risk.md); [Architecture design v2](diskless-fleet-design-v2.pdf); [Design errata](design-v2-errata.md); [STIG deviation register](stig-deviations.md); [Backlog / POA&M source](TODO.md) | @@ -164,15 +164,17 @@ This system follows the ISM A&A lifecycle: Milestones (POA&M)** (this repo's [TODO.md](TODO.md) is the working POA&M source). -**Current status:** Pre-assessment **DRAFT (v0.2, updated 2026-06-22)**. The system +**Current status:** Pre-assessment **DRAFT (v0.2, updated 2026-06-27)**. The system is functional in a lab configuration. **Progress since v0.1 (2026-06-20):** DISA STIG hardening applied and **bench-verified** on a real build (kiosk, key-only SSH, audit offload, DHCP-named host, NVMe/verity root all good with hardening on); -USBGuard device control enabled + verified; admin confined to `staff_u`; and — -newly — **UEFI Secure Boot signing verified enforcing end-to-end on real -hardware**: the CI-signed UKI boots under Secure Boot on a VM (HTTP boot), and the -signed iPXE→UKI chain boots under Secure Boot on an EliteBook 820 G4 (PXE boot), -with `db`/`KEK`/`PK` enrolled via the baked `fleet-sb-enroll` helper. Several +USBGuard device control enabled + verified; admin confined to `staff_u`; **UEFI +Secure Boot signing verified enforcing end-to-end on real hardware** (CI-signed UKI +under SB on a VM/HTTP, and the signed iPXE→UKI chain under SB on an EliteBook 820 +G4/PXE, with `db`/`KEK`/`PK` enrolled via `fleet-sb-enroll`); and — newly — a +**Wazuh SIEM** (dedicated multi-node, agentless) ingesting the fleet auditd stream +with a custom decoder/rules, **decode + alert bench-verified 2026-06-27**, lifting +the "Detect" pillar from log-collection-only to analysis + alerting. Several controls remain **partial or deferred**, tracked as residual risks with treatments (Annex A §3). The largest remaining gates on a production ATO: (a) the secure path (**802.1X/MACsec**) is implemented but **not yet bench-verified** and is disabled @@ -241,8 +243,18 @@ summarises the implementation posture. disk-assisted queue) to a dedicated **audit collector** (`serving/audit-collector/`). **Bench-verified end-to-end 2026-06-20** (records reach the collector, per-source-host files). -- *Gaps:* offload currently **plaintext** (TLS planned, R-07); offload is - **local site only**; no SIEM correlation/alerting defined yet. +- **SIEM analysis + alerting (Wazuh)** — the collector **relays** the auditd + stream to a **dedicated multi-node Wazuh** instance (`wazuh1.bitasylum.org`); + ingestion is **agentless** (no agent/state in the diskless image, invariant #1). + A custom **`fleet-auditd`** decoder + rules handle the STIG `name_format=hostname` + (`node=` prefix) and surface events in the `fleet_audit` group with severity by + type (auth, privilege/`USER_CMD`, SELinux/AVC). **Decode + alert bench-verified + 2026-06-27** (`wazuh-logtest` + a live `sudo` surfacing `USER_CMD`/`CRED_*` in + the dashboard). Config is declarative (`serving/siem/`, mounted via + `/wazuh-config-mount`). +- *Gaps:* both offload hops (host→collector, collector→Wazuh) currently + **plaintext** (TLS planned, R-07); **log retention/archival** (ISM) not yet + configured; default Wazuh credentials to be rotated before production. ### 5.4 Respond - Known-good recovery is **inherent**: a host returns to a verified state on @@ -282,7 +294,7 @@ production ATO: | R-04 | NVMe/TCP root traffic **plaintext** on the lab LAN. | **Medium** | Accept (isolated LAN) / treat for production. | | R-05 | NOPASSWD key-only admin (now `staff_u`-confined); no per-host/rotatable access model or admin-MFA. | **Medium** | Accept with compensating controls / roadmap. | | R-06 | **FIPS off**; ASD-approved-cryptography conformance not yet asserted. | **Medium** | Treat — required for PROTECTED+; revisit with signing. | -| R-07 | Audit-log offload **plaintext** (bench-verified working), single-site, no SIEM alerting. | **Medium** | Treat — TLS offload + monitoring on roadmap. | +| R-07 | Audit-log offload **plaintext** on both hops (host→collector, collector→Wazuh); **log retention not yet configured**. SIEM **analysis + alerting now in place** (Wazuh, decode+alert bench-verified 2026-06-27). | **Low–Medium** | Treat — TLS both hops + ISM retention/archival + rotate Wazuh creds before production. | | R-08 | **Placeholder RADIUS CA** in the repo; real trust anchor not yet provisioned. | **Medium** | Treat — environment-specific, before production. | | R-09 | Host **firewall disabled** (workstation). | **Low–Medium** | Accept (isolated LAN) / treat with explicit allow-rules. | | R-13 | **Boot-chain signing not yet the standing default.** Signing + Secure Boot enforcement **verified end-to-end on hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22), but unsigned/SB-OFF lab builds are still possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not all hosts have `db` enrolled. | **Low** | Treat — make signed + Secure-Boot-on the default for all production builds/hosts (set CI secrets; enrol `db` fleet-wide). | diff --git a/serving/.env.example b/serving/.env.example index a2a5f74..9138b40 100644 --- a/serving/.env.example +++ b/serving/.env.example @@ -53,6 +53,16 @@ DHCP_LEASE=12h # 8088 clashes on the serving host (also update http/default.conf proxy_pass). KIOSK_APP_PORT=8088 +# Local testing secrets for the kiosk BFF. This file is GITIGNORED — safe to +# paste a real token here. Template/docs: .env.example. + +HASS_URL=http://cortana.bitasylum.org:8123 + +# 👇 paste your Home Assistant long-lived access token here, then restart the BFF +# (npm run bff). Test it with: curl -s localhost:8787/api/health | jq +HASS_TOKEN= + + # --- DNS names ------------------------------------------------------------- BOOT_DOMAIN=fleet.lab BOOT_HOST=boot.fleet.lab # HTTP boot server name (UKI) diff --git a/serving/audit-collector/rsyslog.conf b/serving/audit-collector/rsyslog.conf index 2767de0..e0bbc2d 100644 --- a/serving/audit-collector/rsyslog.conf +++ b/serving/audit-collector/rsyslog.conf @@ -27,6 +27,28 @@ main_queue( queue.saveOnShutdown="on" ) +# --- relay a COPY of audit records to the Wazuh SIEM (separate node) ----------- +# Forwards audit/local6 records to the Wazuh manager's syslog listener on the +# dedicated SIEM node (wazuh1.bitasylum.org) for parsing/correlation/alerting, +# WHILE still writing the durable per-host files below (no `stop`, so records +# continue to the file actions). Own disk-assisted queue -> a Wazuh outage never +# blocks the file writes or drops records (resumeRetryCount=-1 spools + drains on +# reconnect). The serving host must resolve + route to the SIEM node. After +# editing, rebuild: `docker compose build audit && docker compose up -d audit`. +# +# ⚠ PLAINTEXT 514 — only acceptable if serving-host → SIEM-node is a TRUSTED +# private path. Audit records are sensitive; if this hop crosses any routed/ +# untrusted network, switch to syslog-over-TLS (gtls, port 6514, fleet CA) BEFORE +# relying on it (ISM: protect logs in transit). See serving/siem/README.md. +if ($programname == 'audispd') + or ($programname startswith 'audit') + or ($syslogfacility-text == 'local6') then { + action(type="omfwd" target="wazuh1.bitasylum.org" port="514" protocol="tcp" + action.resumeRetryCount="-1" + queue.type="LinkedList" queue.filename="wazuhfwdq" + queue.maxDiskSpace="256m" queue.saveOnShutdown="on") +} + # --- per-source-host files (keyed by SENDER IP, not the claimed hostname) --- template(name="HostAudit" type="string" string="/var/log/remote/%FROMHOST-IP%/audit.log") template(name="HostMessages" type="string" string="/var/log/remote/%FROMHOST-IP%/messages.log") diff --git a/serving/docker-compose.yml b/serving/docker-compose.yml index c0bf4a6..688ef75 100644 --- a/serving/docker-compose.yml +++ b/serving/docker-compose.yml @@ -203,7 +203,9 @@ services: restart: unless-stopped ports: - "127.0.0.1:${KIOSK_APP_PORT:-8088}:80" # loopback only; main nginx proxies here - + environment: + HASS_URL: ${HASS_URL} + HASS_TOKEN: ${HASS_TOKEN} # --- NTP server (serves time to the boot LAN; handed out via DHCP opt 42) --- ntp: build: ./chrony diff --git a/serving/http/default.conf b/serving/http/default.conf index 2eef56b..6619536 100644 --- a/serving/http/default.conf +++ b/serving/http/default.conf @@ -29,5 +29,10 @@ server { proxy_set_header Host $host; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Connection ""; # SSE is plain HTTP — no WebSocket upgrade needed + proxy_buffering off; + proxy_cache off; + proxy_read_timeout 1h; + chunked_transfer_encoding off; } } diff --git a/serving/siem/.env.example b/serving/siem/.env.example new file mode 100644 index 0000000..fb4ee39 --- /dev/null +++ b/serving/siem/.env.example @@ -0,0 +1,24 @@ +# REFERENCE for deploying the SIEM node (wazuh1.bitasylum.org) with the upstream +# Wazuh single-node compose. Wazuh is managed on that node, NOT by the fleet +# serving stack — so these creds live there, not in the serving repo's runtime. +# Copy to upstream/single-node/.env on the SIEM node and CHANGE every password. + +# Wazuh release — pin to current stable (github.com/wazuh/wazuh-docker/releases). +WAZUH_VERSION=4.12.0 + +# --- credentials (ROTATE — these are public defaults) ---------------------- +INDEXER_USERNAME=admin +INDEXER_PASSWORD=ChangeMe-Indexer-Adm1n! +API_USERNAME=wazuh-wui +API_PASSWORD=ChangeMe-Api-Passw0rd! +DASHBOARD_USERNAME=kibanaserver +DASHBOARD_PASSWORD=ChangeMe-Dash-Passw0rd! + +# --- fleet integration (set ON the node / in the manager config) ----------- +# TCP syslog ingest port the manager listens on (config/fleet-remote-syslog.xml) +# and the override publishes. The serving-host audit-collector relays here. +WAZUH_SYSLOG_PORT=514 +# Source the manager accepts syslog from = the SERVING HOST's IP (goes in the +# of config/fleet-remote-syslog.xml). Confirm the real source in the +# manager logs and tighten to /32. +WAZUH_ALLOWED_IPS=SET-TO-SERVING-HOST-IP/32 diff --git a/serving/siem/.gitignore b/serving/siem/.gitignore new file mode 100644 index 0000000..4dcb83b --- /dev/null +++ b/serving/siem/.gitignore @@ -0,0 +1,7 @@ +# The upstream Wazuh deployment is cloned in, not vendored — never commit it, +# its generated TLS certs, or any data/volumes. +upstream/ +*.pem +*.key +.env +data/ diff --git a/serving/siem/README.md b/serving/siem/README.md new file mode 100644 index 0000000..68027dd --- /dev/null +++ b/serving/siem/README.md @@ -0,0 +1,128 @@ +# Wazuh SIEM — fleet integration + +The fleet's auditd stream is analysed by **Wazuh running on its own node: +`wazuh1.bitasylum.org`** (deployed + managed independently — keeping the +memory-hungry indexer off the serving host, which runs SPDK = the fleet's root +disk / a SPOF; see TODO #6/#7). This directory is the **fleet ↔ Wazuh +integration**, not a deployment of Wazuh. + +**Ingestion is agentless** (no agent in the diskless image — that would carry +per-host registration state, breaking invariant #1). The host side is unchanged; +the serving-host collector relays a copy to the SIEM node: + +``` +host: auditd → audisp-syslog (LOCAL6) → rsyslog omfwd ─┐ + ▼ TCP/514 +serving host: audit-collector (rsyslog) ──relay(omfwd)──► wazuh1.bitasylum.org + │ still writes durable per-host files (manager :514 syslog + └ disk-assisted queue (store-and-forward) → indexer → dashboard) +``` + +The collector keeps its durable file copy + disk queue and **relays a copy**, so a +SIEM outage never drops audit records or blocks the file writes. + +## To turn it on (two ends) + +**1. On the SIEM node (`wazuh1`):** add the syslog reception block — insert +[config/fleet-remote-syslog.xml](config/fleet-remote-syslog.xml) into the +manager's `ossec.conf`, set `` to the **serving host's IP**, and make +sure the manager's TCP syslog port is reachable (the upstream single-node compose + +[docker-compose.override.yml](docker-compose.override.yml) publish `514/tcp`). +Restart the manager. + +**2. On the serving host:** the relay is already wired in +[../audit-collector/rsyslog.conf](../audit-collector/rsyslog.conf), targeting +`wazuh1.bitasylum.org:514`. Apply it by rebuilding the collector image (the conf +is COPY'd in at build): + +```bash +cd serving && docker compose build audit && docker compose up -d audit +# the serving host must RESOLVE + ROUTE to wazuh1.bitasylum.org +``` + +## Decode the fleet's auditd (custom decoder + rules) + +The fleet ships auditd **agentlessly** via audisp-syslog, and STIG sets +`name_format = hostname` (keep it — compliance), which prepends `node=` to +each record. Wazuh's built-in auditd decoder expects the line to start with +`type=`, so it decodes **nothing** (`"decoder":{}`) — `rule.groups: audit` stays +empty. Install the fleet decoder + rules **on the master** so the records decode + alert. + +**Declarative (recommended) — bind-mount via compose**, using the image's +`/wazuh-config-mount` mechanism (entrypoint copies the tree into `/var/ossec` at +startup; correct ownership, survives `--force-recreate`, no `docker cp`). Add to +the `wazuh.master` service (see [docker-compose.override.yml](docker-compose.override.yml)) — +put the files next to your compose / `wazuh_manager.conf`: + +```yaml + volumes: + - ./config/local_decoder.xml:/wazuh-config-mount/etc/decoders/local_decoder.xml + - ./config/local_rules.xml:/wazuh-config-mount/etc/rules/local_rules.xml +``` +```bash +docker compose up -d --force-recreate wazuh.master +docker exec grep -iE 'error|rules|decoder' /var/ossec/logs/ossec.log | tail # no errors +# verify decoding interactively — paste a full_log line (the `Jun 27 ... node=...`): +docker exec -it /var/ossec/bin/wazuh-logtest +``` +In a cluster, mount on the **master only** — Wazuh syncs `etc/decoders` + `etc/rules` +to the workers. A config change needs a recreate/restart (the copy is at startup). + +> Quick one-off test without editing compose (lost on recreate): +> `docker cp config/local_decoder.xml :/var/ossec/etc/decoders/ && docker cp config/local_rules.xml :/var/ossec/etc/rules/ && docker exec /var/ossec/bin/wazuh-control restart` +`wazuh-logtest` should show `decoder 'fleet-auditd'` and `audit.type` extracted, +firing rule `100100` (+ a higher rule for auth/SELinux types). Then in the +dashboard: **`rule.groups: fleet_audit`** populates. (The base rule is **level 0** +— captured but not alerted — so the high-volume SYSCALL/PATH stream doesn't flood +alerts; only security-relevant types alert. Tune `config/local_rules.xml`.) + +**Full audit trail (not just alerts):** to make *every* record searchable +(forensics / ISM retention), enable archive indexing — `yes` +on the manager **and** `archives.enabled: true` in the manager's +`/etc/filebeat/filebeat.yml`, then add the `wazuh-archives-*` index pattern in the +dashboard. High-volume — slim the auditd rules on the host or filter before +indexing. + +## Verify + +```bash +# on the SIEM node, after a diskless host has booted + generated auditd events: +docker compose logs wazuh.manager | grep -i syslog # listener up, source accepted +# Wazuh dashboard → Security events: auditd records from the boot-LAN hosts appear, +# decoded (type=SYSCALL/USER_LOGIN/...) and rule-tagged. +``` + +If nothing arrives: the manager logs rejected sources — confirm `` +matches the serving host's IP **as wazuh1 sees it** (may be its management IP, not +`SERVER_IP`), then tighten to a /32. + +## ⚠ Protect the hop — it's now on the wire + +Co-located it was loopback; serving-host → `wazuh1` now crosses the network, and +audit records are sensitive (ISM: protect logs in transit). The relay ships +**plaintext 514** for first bring-up — only acceptable on a **trusted private +path**. Before relying on it, switch to **syslog-over-TLS** (`gtls`, port 6514, +the manager's cert + the fleet CA) on both the relay (`omfwd` with the TLS driver) +and the manager `` block. Same CA work as the secure-path / audit-offload +TLS TODO. + +## Production checklist + +- **TLS the relay → wazuh1 hop** (above). +- **Rotate all Wazuh credentials** on the node (indexer admin, API, dashboard). +- **Restrict the dashboard/API** (`:443`/`:55000`) to admin hosts / VPN — never the + boot LAN. +- **`allowed-ips` → /32** of the serving host. +- **Retention/archival**: indexer ISM for the ISM-mandated retention + cold archive. +- **SSP**: update the "Detect" section + ISM event-logging controls once + bench-verified, and record the retention design. + +## Files here + +| File | Where it's used | +|---|---| +| `config/fleet-remote-syslog.xml` | the `` block to add to the **manager** on wazuh1 | +| `docker-compose.override.yml` | reference overlay if wazuh1 uses the upstream single-node compose | +| `.env.example` | reference env for deploying the wazuh1 node | + +(The actual fleet-side relay lives in `../audit-collector/rsyslog.conf`.) diff --git a/serving/siem/config/fleet-remote-syslog.xml b/serving/siem/config/fleet-remote-syslog.xml new file mode 100644 index 0000000..28cb7eb --- /dev/null +++ b/serving/siem/config/fleet-remote-syslog.xml @@ -0,0 +1,27 @@ + + + syslog + 514 + tcp + SET-TO-SERVING-HOST-IP/32 + + diff --git a/serving/siem/config/local_decoder.xml b/serving/siem/config/local_decoder.xml new file mode 100644 index 0000000..a427f40 --- /dev/null +++ b/serving/siem/config/local_decoder.xml @@ -0,0 +1,45 @@ + + + audispd + + + + fleet-auditd + ^node=(\S+) type=(\w+) msg=audit\(([\d.]+):(\d+)\): + audit.node,audit.type,audit.timestamp,audit.serial + + + + + fleet-auditd + auid=(\d+) + audit.auid + + + + fleet-auditd + (?:res|success)=(\S+) + audit.res + + + + fleet-auditd + exe="([^"]+)" + audit.exe + diff --git a/serving/siem/config/local_rules.xml b/serving/siem/config/local_rules.xml new file mode 100644 index 0000000..ca5d471 --- /dev/null +++ b/serving/siem/config/local_rules.xml @@ -0,0 +1,51 @@ + + + + + + fleet-auditd + Fleet auditd: $(audit.type) on $(audit.node) + + + + + 100100 + ^USER_LOGIN$|^USER_AUTH$|^USER_ACCT$|^USER_ERR$|^CRED_ + Fleet audit: authentication event $(audit.type) on $(audit.node) + authentication, + + + + + 100110 + ^failed$|^no$|^0$ + Fleet audit: FAILED authentication $(audit.type) on $(audit.node) + authentication_failed, + + + + + 100100 + ^AVC$|^SELINUX_ERR$|^ANOM_|^USER_AVC$ + Fleet audit: SELinux/anomaly $(audit.type) on $(audit.node) + + + + + 100100 + ^USER_CMD$|^USYS_CONFIG$|^ADD_USER$|^DEL_USER$|^ADD_GROUP$|^ROLE_ + Fleet audit: privileged/config event $(audit.type) on $(audit.node) + + + diff --git a/serving/siem/docker-compose.override.yml b/serving/siem/docker-compose.override.yml new file mode 100644 index 0000000..5c20a42 --- /dev/null +++ b/serving/siem/docker-compose.override.yml @@ -0,0 +1,32 @@ +# REFERENCE (applied ON the SIEM node, wazuh1.bitasylum.org, if you deploy it with +# the upstream Wazuh single-node compose). NOT used by the fleet serving stack — +# Wazuh runs on its own node, managed independently. The only fleet-specific bit +# is publishing the manager's TCP syslog listener so the serving-host +# audit-collector relay can reach it: +# +# cd upstream/single-node +# docker compose -f docker-compose.yml -f /path/to/docker-compose.override.yml up -d +# +# On a dedicated node the indexer gets full resources — no co-location memory caps. +# +# ⚠ SERVICE NAME depends on the upstream deployment you used: +# - single-node compose -> service is `wazuh.manager` +# - multi-node compose -> service is `wazuh.master` (the syslog receiver) +# Match your deployment. The upstream publishes 514/UDP only — the fleet relay is +# TCP, so the ONE required change is adding 514/tcp on whichever node runs the +# syslog `` block. (Recreate the container after a port change.) +services: + wazuh.master: # rename to wazuh.manager for a single-node deployment + restart: unless-stopped + ports: + - "514:514/tcp" # TCP syslog ingest for the fleet audit relay + volumes: + # Declarative custom decoder + rules via the image's /wazuh-config-mount + # mechanism (entrypoint copies the tree into /var/ossec at startup — correct + # ownership, survives --force-recreate, no docker cp). In a cluster, put them + # on the master only; Wazuh syncs etc/decoders + etc/rules to the workers. + # NOTE: relative bind paths resolve to the COMPOSE PROJECT DIR, so keep these + # files alongside the compose you run (or use an absolute path). A config + # change needs a recreate/restart (the copy happens at startup). + - ./config/local_decoder.xml:/wazuh-config-mount/etc/decoders/local_decoder.xml + - ./config/local_rules.xml:/wazuh-config-mount/etc/rules/local_rules.xml