28 lines
1.3 KiB
XML
28 lines
1.3 KiB
XML
<!--
|
|
Fleet syslog reception for the Wazuh manager — apply this ON THE SIEM NODE
|
|
(wazuh1.bitasylum.org), inside the <ossec_config> of the manager's ossec.conf
|
|
(upstream single-node: config/wazuh_cluster/wazuh_manager.conf), then restart
|
|
the manager.
|
|
|
|
It makes the manager accept the auditd stream RELAYED by the fleet's
|
|
serving-host audit-collector over TCP/514. The source the manager sees is the
|
|
SERVING HOST's IP (the collector is host-networked there), so set <allowed-ips>
|
|
to that address — confirm the exact source in `docker compose logs wazuh.manager`
|
|
(rejected sources are logged) and tighten to a /32.
|
|
|
|
The diskless hosts stay AGENTLESS (no per-host state, invariant #1); the secure
|
|
agent listener (1514) + enrollment (1515) are left as the manager default for
|
|
any future enrolment-registered ephemeral agents.
|
|
|
|
⚠ PLAINTEXT — pair with a TRUSTED serving→SIEM path, or switch to TLS (see
|
|
README): <protocol>tcp</protocol> on 6514 with the manager's cert + the fleet CA.
|
|
-->
|
|
<remote>
|
|
<connection>syslog</connection>
|
|
<port>514</port>
|
|
<protocol>tcp</protocol>
|
|
<allowed-ips>SET-TO-SERVING-HOST-IP/32</allowed-ips>
|
|
<!-- e.g. <allowed-ips>192.168.50.10/32</allowed-ips> (the serving host as seen
|
|
by wazuh1 — may be its management IP, not SERVER_IP, if a different route) -->
|
|
</remote>
|