From 375f0689626c091f41e1f965c35065c238355a52 Mon Sep 17 00:00:00 2001
From: jjediny <john.jediny@gsa.gov>
Date: Sun, 26 Jul 2026 15:22:59 -0400
Subject: [PATCH] feat: deploy rsigma daemon sidecar and OTel logging pipeline

---
 alerts/webhook/notify.sh                 | 19 +++++----
 docker-compose.yaml                      | 23 +++++++++++
 otel-collector-config.yaml               |  7 ++++
 rules/sigma/rsigma.yaml                  |  4 +-
 rules/sigma/webhooks/alert_receiver.yaml | 10 +++++
 tests/test_alert_receiver_integration.py | 49 ++++++++++++++++++++++++
 tests/test_infrastructure_health.py      |  4 +-
 tools/health-monitor.sh                  |  2 +-
 8 files changed, 107 insertions(+), 11 deletions(-)
 create mode 100644 rules/sigma/webhooks/alert_receiver.yaml

diff --git a/alerts/webhook/notify.sh b/alerts/webhook/notify.sh
index aa285c7..238b9fd 100644
--- a/alerts/webhook/notify.sh
+++ b/alerts/webhook/notify.sh
@@ -45,16 +45,21 @@ ALERT_ID="$(date +%s%N | cut -c1-13)"
 # --- Output 1: Log to stdout (captured by Docker) ---
 echo "[${TIMESTAMP}] ALERT | ${TITLE} | ${BODY}"
 
-# --- Output 2: File-based bridge for host notifications ---
-# Write alert to a file that the host-side watcher reads and triggers notify-send
+# Escape double quotes for JSON safety
+SAFE_ALERT_NAME=$(echo "$ALERT_NAME" | sed 's/"/\\"/g')
+SAFE_SEVERITY=$(echo "$SEVERITY" | sed 's/"/\\"/g')
+SAFE_DESCRIPTION=$(echo "$DESCRIPTION" | sed 's/"/\\"/g')
+SAFE_TITLE=$(echo "$TITLE" | sed 's/"/\\"/g')
+SAFE_BODY=$(echo "$BODY" | sed 's/"/\\"/g')
+
 cat > "${ALERT_DIR}/${ALERT_ID}.json" <<EOF
 {
   "timestamp": "${TIMESTAMP}",
-  "alert_name": "${ALERT_NAME}",
-  "severity": "${SEVERITY}",
-  "description": "${DESCRIPTION}",
-  "title": "${TITLE}",
-  "body": "${BODY}"
+  "alert_name": "${SAFE_ALERT_NAME}",
+  "severity": "${SAFE_SEVERITY}",
+  "description": "${SAFE_DESCRIPTION}",
+  "title": "${SAFE_TITLE}",
+  "body": "${SAFE_BODY}"
 }
 EOF
 
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 7d0ca76..a89e125 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -230,6 +230,29 @@ services:
       retries: 3
       start_period: 10s
 
+  rsigma:
+    image: ghcr.io/timescale/rsigma:v0.19.0
+    restart: unless-stopped
+    mem_limit: 128m
+    memswap_limit: 128m
+    working_dir: /app
+    volumes:
+      - ./rules/sigma:/app/rules/sigma:ro
+    ports:
+      - "9090:9090"
+    command: [
+      "engine", "daemon",
+      "--config", "/app/rules/sigma/rsigma.yaml"
+    ]
+    networks:
+      - localobserve
+    healthcheck:
+      test: ["CMD", "rsigma", "engine", "status", "--addr", "127.0.0.1:9090"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
   goflow2:
     image: netsampler/goflow2:latest
     restart: unless-stopped
diff --git a/otel-collector-config.yaml b/otel-collector-config.yaml
index 85c6207..b00196f 100644
--- a/otel-collector-config.yaml
+++ b/otel-collector-config.yaml
@@ -222,6 +222,11 @@ processors:
           - set(body, "") where IsMap(body)
 
 exporters:
+  otlp_http/rsigma:
+    endpoint: http://rsigma:9090
+    tls:
+      insecure: true
+
   otlp_http/openobserve_osquery:
     endpoint: http://openobserve:5080/api/default
     headers:
@@ -293,6 +298,7 @@ service:
         - batch
       exporters:
         - otlp_http/openobserve_osquery
+        - otlp_http/rsigma
 
     logs/falco:
       receivers:
@@ -305,6 +311,7 @@ service:
         - batch
       exporters:
         - otlp_http/openobserve_falco
+        - otlp_http/rsigma
 
     logs/clamav:
       receivers:
diff --git a/rules/sigma/rsigma.yaml b/rules/sigma/rsigma.yaml
index f4b14ab..432dcce 100644
--- a/rules/sigma/rsigma.yaml
+++ b/rules/sigma/rsigma.yaml
@@ -12,12 +12,14 @@ daemon:
   api:
     addr: "0.0.0.0:9090"
   input:
-    source: stdin
+    source: http
     format: json
   output:
     sinks:
       - stdout
     include_event: true
+    webhooks:
+      - /app/rules/sigma/webhooks/alert_receiver.yaml
 
 eval:
   rules: ./rules/sigma/active_rules
diff --git a/rules/sigma/webhooks/alert_receiver.yaml b/rules/sigma/webhooks/alert_receiver.yaml
new file mode 100644
index 0000000..76a7dbc
--- /dev/null
+++ b/rules/sigma/webhooks/alert_receiver.yaml
@@ -0,0 +1,10 @@
+webhooks:
+  - id: localobserve-alerts
+    kind: detection
+    url: http://alert-receiver:9000/hooks/security-alert-open
+    body: |
+      {
+        "alert_name": "${detection.rule.title}",
+        "severity": "${detection.rule.level}",
+        "description": "Rule ID: ${detection.rule.id} triggered. Tags: ${detection.tags}"
+      }
diff --git a/tests/test_alert_receiver_integration.py b/tests/test_alert_receiver_integration.py
index 4599556..d7b9f3f 100644
--- a/tests/test_alert_receiver_integration.py
+++ b/tests/test_alert_receiver_integration.py
@@ -76,3 +76,52 @@ def test_falco_payload_processing():
         newest.unlink()
     except OSError:
         pass
+
+
+def test_rsigma_payload_processing():
+    # Ensure alert dir exists
+    ALERT_DIR.mkdir(parents=True, exist_ok=True)
+
+    assert wait_for_stack(), "Alert receiver did not become reachable in time"
+
+    # Capture the files existing BEFORE we trigger the webhook
+    existing_files = set(ALERT_DIR.glob("*.json"))
+
+    url = f"{BASE_URL}/hooks/security-alert-open"
+    headers = {"Content-Type": "application/json"}
+    rsigma_payload = {
+        "alert_name": "Suspicious Namespace Unshare Command",
+        "severity": "high",
+        "description": "Rule ID: 718c5dbc-b1a3-419b-a329-e7721d294257 triggered. Tags: ['attack.t1059', 'attack.t1071']"
+    }
+
+    start = time.time()
+    r = requests.post(url, headers=headers, json=rsigma_payload, timeout=5)
+    assert r.status_code == 200, f"Unexpected response: {r.status_code} {r.text}"
+
+    # Wait for a new alert file to appear
+    deadline = time.time() + 10
+    newest = None
+    while time.time() < deadline:
+        current_files = set(ALERT_DIR.glob("*.json"))
+        new_files = current_files - existing_files
+        if new_files:
+            sorted_new = sorted(list(new_files), key=lambda p: p.stat().st_mtime, reverse=True)
+            candidate = sorted_new[0]
+            if candidate.stat().st_mtime >= start - 1:
+                newest = candidate
+                break
+        time.sleep(0.5)
+
+    assert newest is not None, "No alert file created by alert-receiver for RSigma"
+
+    data = json.loads(newest.read_text(encoding="utf-8"))
+    assert data.get("alert_name") == "Suspicious Namespace Unshare Command"
+    assert data.get("severity") == "high"
+    assert "Rule ID: 718c5dbc-b1a3-419b-a329-e7721d294257" in data.get("description", "")
+
+    # cleanup the alert file created by this test
+    try:
+        newest.unlink()
+    except OSError:
+        pass
diff --git a/tests/test_infrastructure_health.py b/tests/test_infrastructure_health.py
index 6df10ba..8424550 100644
--- a/tests/test_infrastructure_health.py
+++ b/tests/test_infrastructure_health.py
@@ -27,7 +27,7 @@ def test_compose_has_healthchecks_for_critical_services() -> None:
     compose = _load_compose()
     services = compose.get("services", {})
 
-    critical_services = {"falco", "openobserve", "otel-collector", "alert-receiver"}
+    critical_services = {"falco", "openobserve", "otel-collector", "alert-receiver", "rsigma"}
     for svc_name in critical_services:
         svc = services.get(svc_name, {})
         assert "healthcheck" in svc, (
@@ -71,7 +71,7 @@ def test_health_monitor_has_dead_mans_switch() -> None:
 def test_health_monitor_checks_all_services() -> None:
     """Health monitor must check required services and account for optional scan services."""
     script = (REPO_ROOT / "tools" / "health-monitor.sh").read_text()
-    for svc in ("falco", "openobserve", "otel-collector"):
+    for svc in ("falco", "openobserve", "otel-collector", "rsigma"):
         assert svc in script, f"Health monitor should check {svc}"
     for svc in ("clamav", "clamav-scanner"):
         assert svc in script, f"Health monitor should mention optional service {svc}"
diff --git a/tools/health-monitor.sh b/tools/health-monitor.sh
index 4a69076..36cf05a 100755
--- a/tools/health-monitor.sh
+++ b/tools/health-monitor.sh
@@ -14,7 +14,7 @@ DISK_WARN_PERCENT=85
 DISK_CRIT_PERCENT=95
 LOG_FILE="${DATA_DIR}/health/health-monitor.log"
 
-SERVICES=("falco" "openobserve" "otel-collector")
+SERVICES=("falco" "openobserve" "otel-collector" "rsigma")
 OPTIONAL_SERVICES=("clamav" "clamav-scanner")
 
 mkdir -p "$(dirname "$HEARTBEAT_FILE")"