Add SIEM

serving/siem/docker-compose.override.yml

@@ -0,0 +1,32 @@
+# REFERENCE (applied ON the SIEM node, wazuh1.bitasylum.org, if you deploy it with
+# the upstream Wazuh single-node compose). NOT used by the fleet serving stack —
+# Wazuh runs on its own node, managed independently. The only fleet-specific bit
+# is publishing the manager's TCP syslog listener so the serving-host
+# audit-collector relay can reach it:
+#
+#   cd upstream/single-node
+#   docker compose -f docker-compose.yml -f /path/to/docker-compose.override.yml up -d
+#
+# On a dedicated node the indexer gets full resources — no co-location memory caps.
+#
+# ⚠ SERVICE NAME depends on the upstream deployment you used:
+#   - single-node compose -> service is `wazuh.manager`
+#   - multi-node compose  -> service is `wazuh.master` (the syslog receiver)
+# Match your deployment. The upstream publishes 514/UDP only — the fleet relay is
+# TCP, so the ONE required change is adding 514/tcp on whichever node runs the
+# syslog `<remote>` block. (Recreate the container after a port change.)
+services:
+  wazuh.master:            # rename to wazuh.manager for a single-node deployment
+    restart: unless-stopped
+    ports:
+      - "514:514/tcp"      # TCP syslog ingest for the fleet audit relay
+    volumes:
+      # Declarative custom decoder + rules via the image's /wazuh-config-mount
+      # mechanism (entrypoint copies the tree into /var/ossec at startup — correct
+      # ownership, survives --force-recreate, no docker cp). In a cluster, put them
+      # on the master only; Wazuh syncs etc/decoders + etc/rules to the workers.
+      # NOTE: relative bind paths resolve to the COMPOSE PROJECT DIR, so keep these
+      # files alongside the compose you run (or use an absolute path). A config
+      # change needs a recreate/restart (the copy happens at startup).
+      - ./config/local_decoder.xml:/wazuh-config-mount/etc/decoders/local_decoder.xml
+      - ./config/local_rules.xml:/wazuh-config-mount/etc/rules/local_rules.xml