Add SIEM

serving/siem/config/fleet-remote-syslog.xml

@@ -0,0 +1,27 @@
+<!--
+  Fleet syslog reception for the Wazuh manager — apply this ON THE SIEM NODE
+  (wazuh1.bitasylum.org), inside the <ossec_config> of the manager's ossec.conf
+  (upstream single-node: config/wazuh_cluster/wazuh_manager.conf), then restart
+  the manager.
+
+  It makes the manager accept the auditd stream RELAYED by the fleet's
+  serving-host audit-collector over TCP/514. The source the manager sees is the
+  SERVING HOST's IP (the collector is host-networked there), so set <allowed-ips>
+  to that address — confirm the exact source in `docker compose logs wazuh.manager`
+  (rejected sources are logged) and tighten to a /32.
+
+  The diskless hosts stay AGENTLESS (no per-host state, invariant #1); the secure
+  agent listener (1514) + enrollment (1515) are left as the manager default for
+  any future enrolment-registered ephemeral agents.
+
+  ⚠ PLAINTEXT — pair with a TRUSTED serving→SIEM path, or switch to TLS (see
+  README): <protocol>tcp</protocol> on 6514 with the manager's cert + the fleet CA.
+-->
+<remote>
+  <connection>syslog</connection>
+  <port>514</port>
+  <protocol>tcp</protocol>
+  <allowed-ips>SET-TO-SERVING-HOST-IP/32</allowed-ips>
+  <!-- e.g. <allowed-ips>192.168.50.10/32</allowed-ips> (the serving host as seen
+       by wazuh1 — may be its management IP, not SERVER_IP, if a different route) -->
+</remote>

serving/siem/config/local_decoder.xml

@@ -0,0 +1,45 @@
+<!--
+  Fleet auditd-over-syslog decoder — install on the SIEM node (wazuh.master) at
+  /var/ossec/etc/decoders/local_decoder.xml, then restart the manager.
+
+  WHY: the fleet ships auditd agentlessly via audisp-syslog. STIG hardening sets
+  auditd `name_format = hostname` (SSG auditd_name_format — keep it, it's
+  compliance), which prepends `node=<host>` to every record. Wazuh's BUILT-IN
+  auditd decoder expects the line to start with `type=`, so the node= prefix made
+  it match nothing (`"decoder":{}`). This decoder handles the node= variant.
+
+  Pre-decoding strips the syslog header + program (`... audispd[709]: `), so the
+  text these decoders see starts at `node=...`.
+
+  Verify with:  docker exec -it <master> /var/ossec/bin/wazuh-logtest
+  (paste a full_log line from archives.json; confirm decoder.name = fleet-auditd
+  and audit.type is extracted, then adjust if your build reports the child name).
+-->
+<decoder name="fleet-auditd">
+  <program_name>audispd</program_name>
+</decoder>
+
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2">^node=(\S+) type=(\w+) msg=audit\(([\d.]+):(\d+)\):</regex>
+  <order>audit.node,audit.type,audit.timestamp,audit.serial</order>
+</decoder>
+
+<!-- best-effort common fields (present depending on record type) -->
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2"> auid=(\d+)</regex>
+  <order>audit.auid</order>
+</decoder>
+
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2"> (?:res|success)=(\S+)</regex>
+  <order>audit.res</order>
+</decoder>
+
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2"> exe="([^"]+)"</regex>
+  <order>audit.exe</order>
+</decoder>

serving/siem/config/local_rules.xml

@@ -0,0 +1,51 @@
+<!--
+  Fleet auditd rules — install on the SIEM node (wazuh.master) at
+  /var/ossec/etc/rules/local_rules.xml, then restart the manager. Pairs with
+  local_decoder.xml.
+
+  Design: the BASE rule is level 0 — every decoded fleet auditd record is captured
+  (searchable, archived) but does NOT raise an alert, so the high-volume
+  SYSCALL/PATH/PROCTITLE/EOE stream (e.g. Chromium) doesn't flood alerts.json.
+  Security-relevant record TYPES are bumped to alerting levels below. Tune to your
+  detection needs. To see the FULL audit trail (not just alerts) in the dashboard,
+  enable archive indexing (wazuh-archives-*) — see README.
+-->
+<group name="fleet_audit,">
+
+  <!-- base: any decoded fleet auditd record (level 0 = logged, not alerted) -->
+  <rule id="100100" level="0">
+    <decoded_as>fleet-auditd</decoded_as>
+    <description>Fleet auditd: $(audit.type) on $(audit.node)</description>
+  </rule>
+
+  <!-- authentication / credential events -->
+  <rule id="100110" level="5">
+    <if_sid>100100</if_sid>
+    <field name="audit.type">^USER_LOGIN$|^USER_AUTH$|^USER_ACCT$|^USER_ERR$|^CRED_</field>
+    <description>Fleet audit: authentication event $(audit.type) on $(audit.node)</description>
+    <group>authentication,</group>
+  </rule>
+
+  <!-- failed auth (res/success = failed/no/0) -> higher -->
+  <rule id="100111" level="8">
+    <if_sid>100110</if_sid>
+    <field name="audit.res">^failed$|^no$|^0$</field>
+    <description>Fleet audit: FAILED authentication $(audit.type) on $(audit.node)</description>
+    <group>authentication_failed,</group>
+  </rule>
+
+  <!-- SELinux denials / kernel anomaly records -->
+  <rule id="100120" level="7">
+    <if_sid>100100</if_sid>
+    <field name="audit.type">^AVC$|^SELINUX_ERR$|^ANOM_|^USER_AVC$</field>
+    <description>Fleet audit: SELinux/anomaly $(audit.type) on $(audit.node)</description>
+  </rule>
+
+  <!-- privilege use / config changes worth surfacing -->
+  <rule id="100130" level="5">
+    <if_sid>100100</if_sid>
+    <field name="audit.type">^USER_CMD$|^USYS_CONFIG$|^ADD_USER$|^DEL_USER$|^ADD_GROUP$|^ROLE_</field>
+    <description>Fleet audit: privileged/config event $(audit.type) on $(audit.node)</description>
+  </rule>
+
+</group>