Add SIEM

docs/ssp.md

@@ -16,7 +16,7 @@
 | System name | Diskless Fleet Boot System ("the fleet") |
 | Document type | System Security Plan (SSP) |
 | Version | 0.2 (DRAFT — pre-assessment) |
-| Date | 2026-06-22 |
+| Date | 2026-06-27 |
 | Author / maintainer | System Owner (delegate) |
 | Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. |
 | Companion documents | [Annex A — ISM control cross-reference & residual risk](ssp-annex-a-ism-residual-risk.md); [Architecture design v2](diskless-fleet-design-v2.pdf); [Design errata](design-v2-errata.md); [STIG deviation register](stig-deviations.md); [Backlog / POA&M source](TODO.md) |
@@ -164,15 +164,17 @@ This system follows the ISM A&A lifecycle:
    Milestones (POA&M)** (this repo's [TODO.md](TODO.md) is the working POA&M
    source).
 
-**Current status:** Pre-assessment **DRAFT (v0.2, updated 2026-06-22)**. The system
+**Current status:** Pre-assessment **DRAFT (v0.2, updated 2026-06-27)**. The system
 is functional in a lab configuration. **Progress since v0.1 (2026-06-20):** DISA
 STIG hardening applied and **bench-verified** on a real build (kiosk, key-only SSH,
 audit offload, DHCP-named host, NVMe/verity root all good with hardening on);
-USBGuard device control enabled + verified; admin confined to `staff_u`; and —
-newly — **UEFI Secure Boot signing verified enforcing end-to-end on real
-hardware**: the CI-signed UKI boots under Secure Boot on a VM (HTTP boot), and the
-signed iPXE→UKI chain boots under Secure Boot on an EliteBook 820 G4 (PXE boot),
-with `db`/`KEK`/`PK` enrolled via the baked `fleet-sb-enroll` helper. Several
+USBGuard device control enabled + verified; admin confined to `staff_u`; **UEFI
+Secure Boot signing verified enforcing end-to-end on real hardware** (CI-signed UKI
+under SB on a VM/HTTP, and the signed iPXE→UKI chain under SB on an EliteBook 820
+G4/PXE, with `db`/`KEK`/`PK` enrolled via `fleet-sb-enroll`); and — newly — a
+**Wazuh SIEM** (dedicated multi-node, agentless) ingesting the fleet auditd stream
+with a custom decoder/rules, **decode + alert bench-verified 2026-06-27**, lifting
+the "Detect" pillar from log-collection-only to analysis + alerting. Several
 controls remain **partial or deferred**, tracked as residual risks with treatments
 (Annex A §3). The largest remaining gates on a production ATO: (a) the secure path
 (**802.1X/MACsec**) is implemented but **not yet bench-verified** and is disabled
@@ -241,8 +243,18 @@ summarises the implementation posture.
   disk-assisted queue) to a dedicated **audit collector** (`serving/audit-collector/`).
   **Bench-verified end-to-end 2026-06-20** (records reach the collector,
   per-source-host files).
-- *Gaps:* offload currently **plaintext** (TLS planned, R-07); offload is
-  **local site only**; no SIEM correlation/alerting defined yet.
+- **SIEM analysis + alerting (Wazuh)** — the collector **relays** the auditd
+  stream to a **dedicated multi-node Wazuh** instance (`wazuh1.bitasylum.org`);
+  ingestion is **agentless** (no agent/state in the diskless image, invariant #1).
+  A custom **`fleet-auditd`** decoder + rules handle the STIG `name_format=hostname`
+  (`node=` prefix) and surface events in the `fleet_audit` group with severity by
+  type (auth, privilege/`USER_CMD`, SELinux/AVC). **Decode + alert bench-verified
+  2026-06-27** (`wazuh-logtest` + a live `sudo` surfacing `USER_CMD`/`CRED_*` in
+  the dashboard). Config is declarative (`serving/siem/`, mounted via
+  `/wazuh-config-mount`).
+- *Gaps:* both offload hops (host→collector, collector→Wazuh) currently
+  **plaintext** (TLS planned, R-07); **log retention/archival** (ISM) not yet
+  configured; default Wazuh credentials to be rotated before production.
 
 ### 5.4 Respond
 - Known-good recovery is **inherent**: a host returns to a verified state on
@@ -282,7 +294,7 @@ production ATO:
 | R-04 | NVMe/TCP root traffic **plaintext** on the lab LAN. | **Medium** | Accept (isolated LAN) / treat for production. |
 | R-05 | NOPASSWD key-only admin (now `staff_u`-confined); no per-host/rotatable access model or admin-MFA. | **Medium** | Accept with compensating controls / roadmap. |
 | R-06 | **FIPS off**; ASD-approved-cryptography conformance not yet asserted. | **Medium** | Treat — required for PROTECTED+; revisit with signing. |
-| R-07 | Audit-log offload **plaintext** (bench-verified working), single-site, no SIEM alerting. | **Medium** | Treat — TLS offload + monitoring on roadmap. |
+| R-07 | Audit-log offload **plaintext** on both hops (host→collector, collector→Wazuh); **log retention not yet configured**. SIEM **analysis + alerting now in place** (Wazuh, decode+alert bench-verified 2026-06-27). | **Low–Medium** | Treat — TLS both hops + ISM retention/archival + rotate Wazuh creds before production. |
 | R-08 | **Placeholder RADIUS CA** in the repo; real trust anchor not yet provisioned. | **Medium** | Treat — environment-specific, before production. |
 | R-09 | Host **firewall disabled** (workstation). | **Low–Medium** | Accept (isolated LAN) / treat with explicit allow-rules. |
 | R-13 | **Boot-chain signing not yet the standing default.** Signing + Secure Boot enforcement **verified end-to-end on hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22), but unsigned/SB-OFF lab builds are still possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not all hosts have `db` enrolled. | **Low** | Treat — make signed + Secure-Boot-on the default for all production builds/hosts (set CI secrets; enrol `db` fleet-wide). |