Add SIEM

docs/TODO.md

@@ -220,6 +220,32 @@ reconnect — no records lost. Documented in
 When the **workstation** firewall is re-enabled (#4 / register #4) it needs the
 reciprocal **egress** allow for 514/tcp to the collector.
 
+**SIEM (Wazuh) added 2026-06-27 — [serving/siem/](../serving/siem/).** Upgrades the
+"Detect" pillar from file-collection-only to parse/search/correlate/alert.
+**Runs on a DEDICATED node — `wazuh1.bitasylum.org`** (managed independently),
+keeping the memory-hungry indexer JVM **off** the serving host so it can't OOM SPDK
+(the fleet's root disk / SPOF, #6/#7). **Agentless** (diskless hosts stay stateless,
+invariant #1): the serving-host audit-collector **relays a copy** to wazuh1's
+manager syslog listener (`omfwd` → `wazuh1.bitasylum.org:514` in
+`audit-collector/rsyslog.conf`; rebuild the collector to apply) while still writing
+durable per-host files. `serving/siem/` is the INTEGRATION (the `<remote>` syslog
+block to add on wazuh1 + reference deploy overlay), not a local deployment.
+**DECODING BENCH-VERIFIED 2026-06-27** (`wazuh-logtest`): the audisp-syslog records
+carry a `node=<host>` prefix (STIG `name_format=hostname`, SSG `auditd_name_format`
+— kept, it's compliance) that breaks Wazuh's built-in auditd decoder, so a custom
+**`fleet-auditd`** decoder + rules (`serving/siem/config/local_decoder.xml` +
+`local_rules.xml`, mounted declaratively via `/wazuh-config-mount`) decode them
+into the **`fleet_audit`** group. **Decode + alert confirmed:** `wazuh-logtest`
+shows `decoder.name=fleet-auditd` + `audit.type` extracted (base rule `100100`);
+and a live `sudo` on a booted host (`cygnus-cruiser-99`) surfaced `USER_CMD` →
+rule `100130` and `CRED_*`/`USER_ACCT` → rule `100110` (level 5) in the dashboard
+Threat Hunting view. Wazuh runs multi-node on `wazuh1.bitasylum.org`.
+**REMAINING (prod):** the relay→wazuh1 hop is **plaintext** — **TLS it** (gtls/6514,
+fleet CA; ISM protect-logs-in-transit) since it's now on the wire; rotate all Wazuh
+creds; restrict dashboard/API to admin hosts; set `allowed-ips`→/32 of the serving
+host; ISM retention/archival; then update the SSP "Detect" + ISM event-logging
+controls.
+
 ### Original spec (retained for reference)
 
 OpenSCAP + SCAP Security Guide (`xccdf_org.ssgproject.content_profile_stig`), run