docs: document and verify every sink use case (Loki, Wazuh, HTTP, syslog) - #31
docs: document and verify every sink use case (Loki, Wazuh, HTTP, syslog)#31t-desmond wants to merge 2 commits into
Conversation
|
Correction to the scope: the ticket #32 is not just about the Wazuh section. It covers every sink use case claimed in the repo: Grafana Loki, Wazuh syslog, generic HTTP, and generic syslog. Each needs a setup guide with its config and real, reproducible evidence that it works, using |
…log) Expand the sink docs to cover the full sink matrix from issue #32, with complete config, worked examples, and real reproducible text evidence for each sink type. Replace committed screenshots with text output. - docs/SINKS.md: full setup guides for Loki/Grafana, Wazuh (TCP+UDP with copyable decoder and ruleset), generic HTTP webhook, and generic syslog (RFC 3164/5424 over TCP/UDP), each with real delivery evidence - README: rework Verified section to one verified scenario per sink with text evidence; drop the flagged screenshot - examples/local-demo: exercise all five sinks at once (Loki, Wazuh UDP, HTTP webhook, syslog TCP+UDP) with new receivers; commit the Wazuh decoder and ruleset under wazuh/
t-desmond
changed the title
|  | ||
|  | ||
|  | ||
| **Loki / Grafana**: events delivered and queried back via LogQL: |
There was a problem hiding this comment.
where are the images ? we need visual proof right ?
| fired rule `108650`: | ||
|
|
||
| ```json | ||
| {"timestamp":"2026-08-13T11:02:48.532+0000","rule":{"level":3,"description":"NetBird audit: user login by desmondtardzenyuy@gmail.com","id":"108650","firedtimes":1,"groups":["netbird_audit","authentication_success"]},"agent":{"id":"000","name":"wazuh-wazuh-helm-manager-worker-0"},"manager":{"name":"wazuh-wazuh-helm-manager-worker-0"},"id":"1786618968.606","full_log":"2026-08-13T11:02:46.437457Z auditbridge netbird-audit: {\"account_id\":null,\"activity\":\"Dashboard login\",\"activity_code\":\"dashboard.login\",\"event_id\":\"36802451\",\"initiator_email\":\"desmondtardzenyuy@gmail.com\",\"initiator_name\":\"Tardzenyuy Desmond\",\"target_id\":\"google-oauth2|110002193708859160832\",\"timestamp\":\"2026-08-13T11:02:46.437457Z\"}","predecoder":{"program_name":"netbird-audit","timestamp":"2026-08-13T11:02:46.437457Z aud"},"decoder":{"name":"netbird-audit"},"data":{"account_id":"null","activity":"Dashboard login","activity_code":"dashboard.login","event_id":"36802451","initiator_email":"desmondtardzenyuy@gmail.com","initiator_name":"Tardzenyuy Desmond","target_id":"google-oauth2|110002193708859160832","timestamp":"2026-08-13T11:02:46.437457Z"},"location":"10.42.0.27"} |
There was a problem hiding this comment.
Real PII + internal infra in a public repo: a real personal email (desmondtardzenyuy@gmail.com), real names, real NetBird event IDs, internal Wazuh hostnames (wazuh-wazuh-helm-manager-worker-0) and an internal IP (10.42.0.27) in the alert JSON. Either swap in the demo's synthetic data (acc-demo-01 / evt-1001...) or redact the identifying fields - or confirm the account holder is OK with this being public.
| | `SINK_WAZUH_PROTOCOL` | `tcp` or `udp` | `tcp` | | ||
|
|
||
| > [!IMPORTANT] | ||
| > A stock Wazuh manager listens for **syslog on UDP port `11514`** (the TCP |
There was a problem hiding this comment.
11514 looks like a typo for 1514 - verify against the actual ossec.conf <remote> block. It also directly contradicts #40's Wazuh example (TCP 1514, RFC 3164): both can't be right, and the two PRs are the same docs work - settle on one PR and reconcile the port guidance between you.
2 participants
No description provided.