AZiT

Cluster and SIEM

Six Raspberry Pi boards, a Kubernetes cluster run from Git, and the SIEM that watches the firewall.

Needs The Firewall guide: the boards live in its server network, and its logs are what the SIEM collects.

  1. 1The boards: flash and configureSix Raspberry Pi CM5 boards with the same base, configured by Ansible.
  2. 2The Kubernetes clusterkubeadm with three control planes behind a floating address, and Cilium.
  3. 3Flux and SOPSThe cluster kept in step with Git, with secrets encrypted in the repository.
  4. 4Certificates and ingressYour own CA, cert-manager, and HTTPS for every web interface.
  5. 5OpenSearch and DashboardsThe SIEM's storage and search, with its own users, certificates and retention.
  6. 6Firewall logs into the SIEMsyslog over TLS from the firewall to Vector, parsed, named and enriched.
  7. 7Alerts and saved searchesTwo alerts for the things that must never go unnoticed, each with a search to see what happened.
  8. 8Falco: what happens inside the boardsRuntime detection on every node, its events in the SIEM, and an alert for the serious ones.