From 06679d9a0c254e09663f2469f8a5c4d6230e4d36 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Thu, 3 Sep 2026 06:30:25 -0500
Subject: [PATCH] =?UTF-8?q?feat(siem):=20fleet=20rollout=20tooling=20?=
 =?UTF-8?q?=E2=80=94=20agents=20+=20PVE=20rsyslog=20forwarding=20[#335]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

deploy-agent.sh (Ubuntu VMs) + deploy-rsyslog.sh (PVE hosts, TCP/514 via
Tailscale). Landed: agents on netinfra-01/02, librenms, awx (7 total
active on manager); rsyslog forwarding verified on all 7 PVE hosts
(persistent 514 sessions on the manager). Deferred: k8s nodes (k8s-chat
coordination), docker json-log caps (needs daemon restart window).
Meat + verification: https://projects.knownelement.com/issues/335#note-4006
---
 AGENTS.md              |  1 +
 siem/deploy-agent.sh   | 34 ++++++++++++++++++++++++++++++++++
 siem/deploy-rsyslog.sh | 30 ++++++++++++++++++++++++++++++
 3 files changed, 65 insertions(+)
 create mode 100644 siem/deploy-agent.sh
 create mode 100644 siem/deploy-rsyslog.sh

diff --git a/AGENTS.md b/AGENTS.md
index b1ef94f..185e80e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -363,6 +363,7 @@ oam/                OAM platform tooling (oxidized, unpoller, smokeping, netdisc
                     librenms-agent: check_mk agent + snmp-extend scripts ported from KNELServerBuild [#474])
 proxmox/            Proxmox fleet docs (hardware audit, capacity, storage) + perf tuning (perf/)
 awx/                Ansible AWX deployment (k3s + AWX Operator)
+siem/               Wazuh/SIEM deploy tooling (agents on VMs, rsyslog forwarding on PVE) [#335]
 cmdb/               GLPI/CMDB seed tooling (inventory→CSV converter; design: Discourse t/319, #705)
 tests/              Test suite + VM validation harness + remote.sh SSH chokepoint
 scripts/            Framework: git hooks, rule engine (check-rules.sh), shared lib
diff --git a/siem/deploy-agent.sh b/siem/deploy-agent.sh
new file mode 100644
index 0000000..e3fe0e2
--- /dev/null
+++ b/siem/deploy-agent.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+#
+# deploy-agent.sh — Wazuh agent rollout for Ubuntu VMs [#335]
+# Run as root on the target VM. Idempotent; safe to re-run.
+# Manager: tsys-wazuh.knel.net (syslog/agent ports verified 2026-09-02).
+#
+set -euo pipefail
+
+MGR="tsys-wazuh.knel.net"
+VER="4.14.7-1"
+
+if ! dpkg -s wazuh-agent >/dev/null 2>&1; then
+  echo "installing wazuh-agent $VER (manager: $MGR)"
+  curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb \
+    "https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_${VER}_amd64.deb"
+  WAZUH_MANAGER="$MGR" WAZUH_REGISTRATION_SERVER="$MGR" \
+    DEBIAN_FRONTEND=noninteractive dpkg -i /tmp/wazuh-agent.deb
+  rm -f /tmp/wazuh-agent.deb
+else
+  echo "wazuh-agent already installed: $(dpkg -l wazuh-agent | tail -1 | awk '{print $3}')"
+fi
+
+CONF=/var/ossec/etc/ossec.conf
+if ! grep -q "<address>$MGR</address>" "$CONF"; then
+  echo "correcting manager address in ossec.conf"
+  cp "$CONF" "$CONF.bak.$(date +%Y%m%d%H%M%S)"
+  sed -i "s|<address>[^<]*</address>|<address>$MGR</address>|" "$CONF"
+fi
+
+systemctl enable wazuh-agent >/dev/null 2>&1 || true
+systemctl restart wazuh-agent
+sleep 8
+systemctl -q is-active wazuh-agent && echo "wazuh-agent ACTIVE"
+grep -iE "enroll|connected to" /var/ossec/logs/ossec.log | tail -3 || echo "(no enrollment lines yet — check manager side)"
diff --git a/siem/deploy-rsyslog.sh b/siem/deploy-rsyslog.sh
new file mode 100644
index 0000000..4f2272b
--- /dev/null
+++ b/siem/deploy-rsyslog.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# deploy-rsyslog.sh — rsyslog forwarding to Wazuh for PVE hosts [#335]
+# Run as root on the target host. Idempotent; safe to re-run.
+# Forwards everything via TCP/514 to tsys-wazuh.knel.net (Tailscale
+# overlay; manager allowlist = 100.64.0.0/10). journald stays the local SoR.
+#
+set -euo pipefail
+
+MGR="tsys-wazuh.knel.net"
+
+if ! dpkg -s rsyslog >/dev/null 2>&1; then
+  echo "installing rsyslog"
+  DEBIAN_FRONTEND=noninteractive apt-get install -y rsyslog
+fi
+
+F=/etc/rsyslog.d/90-forward-wazuh.conf
+if [ ! -f "$F" ]; then
+  printf '# Wazuh syslog forwarding (Tailscale overlay) [#335]\n*.* @@%s:514\n' "$MGR" > "$F"
+  echo "forward rule installed"
+else
+  echo "forward rule already present"
+fi
+
+systemctl enable --now rsyslog >/dev/null 2>&1 || true
+systemctl restart rsyslog
+sleep 2
+systemctl -q is-active rsyslog && echo "rsyslog ACTIVE"
+logger -p auth.warning "wazuh-trail-test host=$(hostname) stamp=$(date +%s)"
+echo "trail event sent from $(hostname)"