Add SIEM

serving/siem/config/fleet-remote-syslog.xml

@@ -0,0 +1,27 @@
+<!--
+  Fleet syslog reception for the Wazuh manager — apply this ON THE SIEM NODE
+  (wazuh1.bitasylum.org), inside the <ossec_config> of the manager's ossec.conf
+  (upstream single-node: config/wazuh_cluster/wazuh_manager.conf), then restart
+  the manager.
+
+  It makes the manager accept the auditd stream RELAYED by the fleet's
+  serving-host audit-collector over TCP/514. The source the manager sees is the
+  SERVING HOST's IP (the collector is host-networked there), so set <allowed-ips>
+  to that address — confirm the exact source in `docker compose logs wazuh.manager`
+  (rejected sources are logged) and tighten to a /32.
+
+  The diskless hosts stay AGENTLESS (no per-host state, invariant #1); the secure
+  agent listener (1514) + enrollment (1515) are left as the manager default for
+  any future enrolment-registered ephemeral agents.
+
+  ⚠ PLAINTEXT — pair with a TRUSTED serving→SIEM path, or switch to TLS (see
+  README): <protocol>tcp</protocol> on 6514 with the manager's cert + the fleet CA.
+-->
+<remote>
+  <connection>syslog</connection>
+  <port>514</port>
+  <protocol>tcp</protocol>
+  <allowed-ips>SET-TO-SERVING-HOST-IP/32</allowed-ips>
+  <!-- e.g. <allowed-ips>192.168.50.10/32</allowed-ips> (the serving host as seen
+       by wazuh1 — may be its management IP, not SERVER_IP, if a different route) -->
+</remote>