Add SIEM

serving/siem/config/local_decoder.xml

@@ -0,0 +1,45 @@
+<!--
+  Fleet auditd-over-syslog decoder — install on the SIEM node (wazuh.master) at
+  /var/ossec/etc/decoders/local_decoder.xml, then restart the manager.
+
+  WHY: the fleet ships auditd agentlessly via audisp-syslog. STIG hardening sets
+  auditd `name_format = hostname` (SSG auditd_name_format — keep it, it's
+  compliance), which prepends `node=<host>` to every record. Wazuh's BUILT-IN
+  auditd decoder expects the line to start with `type=`, so the node= prefix made
+  it match nothing (`"decoder":{}`). This decoder handles the node= variant.
+
+  Pre-decoding strips the syslog header + program (`... audispd[709]: `), so the
+  text these decoders see starts at `node=...`.
+
+  Verify with:  docker exec -it <master> /var/ossec/bin/wazuh-logtest
+  (paste a full_log line from archives.json; confirm decoder.name = fleet-auditd
+  and audit.type is extracted, then adjust if your build reports the child name).
+-->
+<decoder name="fleet-auditd">
+  <program_name>audispd</program_name>
+</decoder>
+
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2">^node=(\S+) type=(\w+) msg=audit\(([\d.]+):(\d+)\):</regex>
+  <order>audit.node,audit.type,audit.timestamp,audit.serial</order>
+</decoder>
+
+<!-- best-effort common fields (present depending on record type) -->
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2"> auid=(\d+)</regex>
+  <order>audit.auid</order>
+</decoder>
+
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2"> (?:res|success)=(\S+)</regex>
+  <order>audit.res</order>
+</decoder>
+
+<decoder name="fleet-auditd">
+  <parent>fleet-auditd</parent>
+  <regex type="pcre2"> exe="([^"]+)"</regex>
+  <order>audit.exe</order>
+</decoder>