docs: verify and document every sink use case (Loki, Wazuh, HTTP, syslog) - #40
docs: verify and document every sink use case (Loki, Wazuh, HTTP, syslog)#40Donemmanuelo wants to merge 3 commits into
Conversation
…log) (onelrian#34) Implements the acceptance criteria of onelrian#32. Every sink type now has a setup guide with complete config, verification commands, and captured evidence from examples/local-demo: Loki stream query responses with nanosecond timestamps, RFC 3164 frames over TCP at the Wazuh receiver, NDJSON batches at the generic HTTP webhook, and RFC 5424 frames over UDP. The demo grows a webhook receiver and a second AuditBridge instance (auditbridge-generic) exercising the generic http and syslog sinks, with a copyable Wazuh decoder/ruleset outline. The README Verified section moves from committed screenshots (removed) to per-sink text evidence.
The copyable Wazuh decoder anchored on '{' right before "activity_code",
which can never match: AuditBridge emits JSON keys in alphabetical order,
so account_id/activity precede activity_code. Match the key anywhere
after the tag instead. The Loki query evidence now includes the
service_name label Loki 3.x adds to every stream, so the block is the
real captured response rather than an elided copy.
| .vscode/ | ||
| .idea/ | ||
| *.swp | ||
| # Scratch PR/issue bodies used when filing GitHub issues |
There was a problem hiding this comment.
This replaces the entire .gitignore with just the two scratch dirs - target/, debug/, .env, .vscode/, *.pdb are no longer ignored, so cargo build artifacts and local secrets can get committed. Looks accidental: restore the original entries and add .issue-bodies//.pr-bodies/ alongside them.
| -v "$PWD/netbird-token:/run/secrets/netbird-token:ro" \ | ||
| -e NETBIRD_API_TOKEN_FILE=/run/secrets/netbird-token \ | ||
| -e SINKS=wazuh \ | ||
| -e SINK_WAZUH_ADDR=wazuh-manager:1514 \ |
There was a problem hiding this comment.
This contradicts #31 (same docs work by t-desmond): #31 says a stock Wazuh manager's syslog listener is UDP and that TCP 1514 is the agent "secure" port, not a syslog listener - with a real Wazuh alert as proof. The demo's wazuh-receiver is also a Python TCP listener standing in for the manager: it proves the wire format, not that Wazuh accepts it. Reconcile the two PRs and point users at the ossec.conf <remote> block with the port chosen explicitly.
| @@ -57,18 +57,27 @@ names and troubleshooting. | |||
|
|
|||
| ## Verified | |||
There was a problem hiding this comment.
#31 was asked to keep visual proof ("where are the images?") and this PR deletes the three screenshots outright. The captured log output is solid evidence, but decide consciously: keep screenshots + logs, or logs only. Also - #31 already covers this exact work (same title, same files, CHANGES_REQUESTED from the maintainer): pick one PR to carry forward and close the other, or you'll have two conflicting rewrites of the same sections.
2 participants
Closes #34. Implements the acceptance criteria of #32.
User-facing impact
Every sink type now has a setup guide with complete configuration,
verification commands, and captured evidence from a live
examples/local-demo/run: Loki query responses with per-activity streamsand nanosecond timestamps, RFC 3164 frames received over TCP (Wazuh), NDJSON
batches received at a generic HTTP webhook, and RFC 5424 frames received over
UDP (generic syslog). The demo stack grows a
webhook-receiver, a UDP sysloglistener, and an
auditbridge-genericinstance exercising the generic httpand syslog sinks, plus a copyable Wazuh decoder/ruleset outline. The README
"Verified" section moves from committed screenshots (removed) to per-sink
text evidence, per the reviewer direction in #32.
Verification
(
docker compose up -d --buildthen the documented verify commands).docs/SINKS.md's Loki evidence is verbatim from the live query, includingthe
service_namelabel Loki 3.x adds.cargo fmt/clippy/testunaffected.