soc.example.yaml

---
# Template for secrets/soc.sops.yaml.
#
# EIGHT KEYS, and the list reads as a description of the stack: three Wazuh
# passwords and two of their hashes, the agent enrolment password, and
# Velociraptor's first admin password. No SNMP communities (it polls nothing),
# no Alertmanager URLs (there is none in the lab — ADR-0020), no Grafana
# (the lab's is on alexander). scripts/render-config.sh derives the required
# set per stack, so `make render STACK=soc` asks for these and nothing else.
#
# ---------------------------------------------------------------------------
# Create this ON ODIN, not on the monitoring host
# ---------------------------------------------------------------------------
#
#   make secrets-init STACK=soc    # first time only — creates the age keypair
#   make secrets-edit STACK=soc    # opens the encrypted file in $EDITOR
#
# secrets-init writes odin's public key into the `soc` rule in .sops.yaml —
# its own rule, above the catch-all, so that the SIEM's host can open the
# SIEM's secrets and nothing else: not the lab's Grafana password, not the
# estate's SNMP communities. A guest on the segment that exists to hold
# attackers must not hold the credentials of the estate it is isolated from
# (ADR-0007, ADR-0020, ADR-0030). It refuses if the key it would write is
# already a recipient of another rule; if you see that refusal, you are on
# the wrong machine.
#
# Generate each password with `make gen-secret`. The Wazuh API refuses a
# password without an upper-case letter, a lower-case letter, a digit and a
# symbol, and the image's init pastes API_PASSWORD into a JSON document
# unquoted — so no double quote, no backslash and no `$` in it, whatever
# gen-secret hands you.

# The indexer's `admin` account. The manager's filebeat, the dashboard and this
# guest's Alloy exporter all sign in as it. Its bcrypt hash goes in
# INDEXER_ADMIN_HASH below.
INDEXER_PASSWORD: change-me-to-something-long

# bcrypt of INDEXER_PASSWORD, made with the indexer image's own tool — the
# command is in stacks/soc/wazuh/indexer/internal_users.yml. Rendered into
# .rendered/internal_users.yml; never in a tracked file.
INDEXER_ADMIN_HASH: "$2y$12$replace-with-the-output-of-hash.sh"

# The dashboard's service account on the indexer (`kibanaserver`), and its
# bcrypt hash, made the same way.
DASHBOARD_PASSWORD: change-me-to-something-long
DASHBOARD_PASSWORD_HASH: "$2y$12$replace-with-the-output-of-hash.sh"

# The Wazuh API account (`wazuh-wui`) the dashboard signs in with. Written into
# the API's user store by the manager on its FIRST start and not read again;
# change it in the dashboard afterwards.
API_PASSWORD: change-me-Upper-lower-1-and-a-symbol

# What an agent presents to enrol (ossec.conf: <use_password>yes). Rendered
# into stacks/soc/wazuh/manager/.rendered/authd.pass, and typed into the two
# GPO-deployed MSIs' install parameters (build-the-soc-guest.md).
WAZUH_REGISTRATION_PASSWORD: change-me-to-something-long

# Velociraptor's `admin` GUI account, read ONCE when the server generates its
# config on first start. Change it in the GUI afterwards; this value is then
# inert.
VELOCIRAPTOR_INITIAL_ADMIN_PASSWORD: change-me-to-something-long

# odin's token for the lab's ingest proxy (#834). Not generated here: copy
# INGEST_TOKEN_ODIN out of secrets/lab.sops.yaml on alexander. This Alloy sends
# it on every push to 10.0.30.40, and the proxy refuses a push without it.
INGEST_TOKEN: copy-INGEST_TOKEN_ODIN-from-secrets-lab-sops-yaml