sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Add SIEM

Browse Source
This commit is contained in:
Audiobuzz
2026-06-27 08:52:17 +00:00
parent 4d51fa97c2
commit ce5af959ad
15 changed files with 414 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/siem/config/local_rules.xml
+51
View File
@@ -0,0 +1,51 @@
<!--
Fleet auditd rules — install on the SIEM node (wazuh.master) at
/var/ossec/etc/rules/local_rules.xml, then restart the manager. Pairs with
local_decoder.xml.
Design: the BASE rule is level 0 — every decoded fleet auditd record is captured
(searchable, archived) but does NOT raise an alert, so the high-volume
SYSCALL/PATH/PROCTITLE/EOE stream (e.g. Chromium) doesn't flood alerts.json.
Security-relevant record TYPES are bumped to alerting levels below. Tune to your
detection needs. To see the FULL audit trail (not just alerts) in the dashboard,
enable archive indexing (wazuh-archives-*) — see README.
-->
<group name="fleet_audit,">
<!-- base: any decoded fleet auditd record (level 0 = logged, not alerted) -->
<rule id="100100" level="0">
<decoded_as>fleet-auditd</decoded_as>
<description>Fleet auditd: $(audit.type) on $(audit.node)</description>
</rule>
<!-- authentication / credential events -->
<rule id="100110" level="5">
<if_sid>100100</if_sid>
<field name="audit.type">^USER_LOGIN$|^USER_AUTH$|^USER_ACCT$|^USER_ERR$|^CRED_</field>
<description>Fleet audit: authentication event $(audit.type) on $(audit.node)</description>
<group>authentication,</group>
</rule>
<!-- failed auth (res/success = failed/no/0) -> higher -->
<rule id="100111" level="8">
<if_sid>100110</if_sid>
<field name="audit.res">^failed$|^no$|^0$</field>
<description>Fleet audit: FAILED authentication $(audit.type) on $(audit.node)</description>
<group>authentication_failed,</group>
</rule>
<!-- SELinux denials / kernel anomaly records -->
<rule id="100120" level="7">
<if_sid>100100</if_sid>
<field name="audit.type">^AVC$|^SELINUX_ERR$|^ANOM_|^USER_AVC$</field>
<description>Fleet audit: SELinux/anomaly $(audit.type) on $(audit.node)</description>
</rule>
<!-- privilege use / config changes worth surfacing -->
<rule id="100130" level="5">
<if_sid>100100</if_sid>
<field name="audit.type">^USER_CMD$|^USYS_CONFIG$|^ADD_USER$|^DEL_USER$|^ADD_GROUP$|^ROLE_</field>
<description>Fleet audit: privileged/config event $(audit.type) on $(audit.node)</description>
</rule>
</group>