Add SIEM

serving/audit-collector/rsyslog.conf

@@ -27,6 +27,28 @@ main_queue(
     queue.saveOnShutdown="on"
 )
 
+# --- relay a COPY of audit records to the Wazuh SIEM (separate node) -----------
+# Forwards audit/local6 records to the Wazuh manager's syslog listener on the
+# dedicated SIEM node (wazuh1.bitasylum.org) for parsing/correlation/alerting,
+# WHILE still writing the durable per-host files below (no `stop`, so records
+# continue to the file actions). Own disk-assisted queue -> a Wazuh outage never
+# blocks the file writes or drops records (resumeRetryCount=-1 spools + drains on
+# reconnect). The serving host must resolve + route to the SIEM node. After
+# editing, rebuild: `docker compose build audit && docker compose up -d audit`.
+#
+# ⚠ PLAINTEXT 514 — only acceptable if serving-host → SIEM-node is a TRUSTED
+# private path. Audit records are sensitive; if this hop crosses any routed/
+# untrusted network, switch to syslog-over-TLS (gtls, port 6514, fleet CA) BEFORE
+# relying on it (ISM: protect logs in transit). See serving/siem/README.md.
+if ($programname == 'audispd')
+   or ($programname startswith 'audit')
+   or ($syslogfacility-text == 'local6') then {
+    action(type="omfwd" target="wazuh1.bitasylum.org" port="514" protocol="tcp"
+           action.resumeRetryCount="-1"
+           queue.type="LinkedList" queue.filename="wazuhfwdq"
+           queue.maxDiskSpace="256m" queue.saveOnShutdown="on")
+}
+
 # --- per-source-host files (keyed by SENDER IP, not the claimed hostname) ---
 template(name="HostAudit"    type="string" string="/var/log/remote/%FROMHOST-IP%/audit.log")
 template(name="HostMessages" type="string" string="/var/log/remote/%FROMHOST-IP%/messages.log")