Add SIEM

serving/siem/.env.example

@@ -0,0 +1,24 @@
+# REFERENCE for deploying the SIEM node (wazuh1.bitasylum.org) with the upstream
+# Wazuh single-node compose. Wazuh is managed on that node, NOT by the fleet
+# serving stack — so these creds live there, not in the serving repo's runtime.
+# Copy to upstream/single-node/.env on the SIEM node and CHANGE every password.
+
+# Wazuh release — pin to current stable (github.com/wazuh/wazuh-docker/releases).
+WAZUH_VERSION=4.12.0
+
+# --- credentials (ROTATE — these are public defaults) ----------------------
+INDEXER_USERNAME=admin
+INDEXER_PASSWORD=ChangeMe-Indexer-Adm1n!
+API_USERNAME=wazuh-wui
+API_PASSWORD=ChangeMe-Api-Passw0rd!
+DASHBOARD_USERNAME=kibanaserver
+DASHBOARD_PASSWORD=ChangeMe-Dash-Passw0rd!
+
+# --- fleet integration (set ON the node / in the manager config) -----------
+# TCP syslog ingest port the manager listens on (config/fleet-remote-syslog.xml)
+# and the override publishes. The serving-host audit-collector relays here.
+WAZUH_SYSLOG_PORT=514
+# Source the manager accepts syslog from = the SERVING HOST's IP (goes in the
+# <allowed-ips> of config/fleet-remote-syslog.xml). Confirm the real source in the
+# manager logs and tighten to /32.
+WAZUH_ALLOWED_IPS=SET-TO-SERVING-HOST-IP/32