SIEM
The firewall's logs land in OpenSearch within seconds, parsed into structured fields and enriched with names and locations. Two alerts watch the tunnel, the one thing that must never fail quietly, and Falco adds what happens inside the boards. The web server's logs are fetched every 15 minutes.
- Stack
- OpenSearch, OpenSearch Dashboards, Vector
- Transport
- Syslog over TLS from the firewall, verified on both sides
- Web server
- Its journal, fetched over SSH every 15 minutes, read-only
- Storage
- NVMe on one worker, 180 days of retention
- Access
- Dashboards behind Traefik, with a certificate from the home CA
- Users
- Write-only accounts for Vector and Falco, separate from the admin
What a log line becomes#
A raw pf line such as rule 212/(match) pass in on vlan10: 192.168.10.11.62518 > 203.0.113.10.443 … label=allow_trusted_internet becomes an event with the action, the direction, the interface and its network name, source and destination, the rule's name, the source's device name, and for traffic from the internet, its country and network owner.
Daily indices keep pf traffic, the firewall's system events and the web server's logs apart, and a retention policy removes them after 180 days.