# CodeB -- Splunk Universal Forwarder inputs.conf
# Docs: https://www.aloaha.com/siem-cookbook.html
# Point at the tenant log directories; CodeB never pushes to Splunk,
# your UF tails our files. European Digital Identity Wallet audit
# events land in codeb-oidc-*.log and tmp/wallet-*.log.
#
# Deploy to $SPLUNK_HOME/etc/apps/codeb/local/inputs.conf on each
# CodeB IIS host. Restart the Universal Forwarder.

# ----- Per-tenant connection log (SIP-WS + WebRTC join events) -----
[monitor://C:\\inetpub\\wwwroot\\WebPhone\\App_Data\\*\\logs\\codeb-conn-*.log]
disabled       = false
sourcetype     = codeb:conn
index          = codeb
crcSalt        = <SOURCE>

# ----- Per-tenant OIDC + EU Wallet audit log -----
# Contains LOUD [OIDC-*] and [vp-*] events; European Digital Identity
# Wallet flows land here.
[monitor://C:\\inetpub\\wwwroot\\WebPhone\\App_Data\\*\\logs\\codeb-oidc-*.log]
disabled       = false
sourcetype     = codeb:oidc
index          = codeb

# ----- Per-tenant dial log (SIP INVITEs, transfers, hangups) -----
[monitor://C:\\inetpub\\wwwroot\\WebPhone\\App_Data\\*\\logs\\codeb-dial-*.log]
disabled       = false
sourcetype     = codeb:dial
index          = codeb

# ----- Per-tenant CDR CSV (durable call detail records) -----
[monitor://C:\\inetpub\\wwwroot\\WebPhone\\App_Data\\*\\logs\\cdr\\cdr-*.csv]
disabled       = false
sourcetype     = codeb:cdr
index          = codeb

# ----- SIP bridge log (WebRTC <-> SIP trunk bridge) -----
[monitor://C:\\inetpub\\wwwroot\\WebPhone\\tmp\\codeb-bridge-*.log]
disabled       = false
sourcetype     = codeb:bridge
index          = codeb

# ----- Wallet / mDoc verifier audit -----
[monitor://C:\\inetpub\\wwwroot\\WebPhone\\tmp\\wallet-*.log]
disabled       = false
sourcetype     = codeb:wallet
index          = codeb

# ----- IIS weblogs (for W3C access log correlation) -----
[monitor://C:\\inetpub\\wwwroot\\WebPhone\\App_Data\\weblogs\\W3SVC*\\*.log]
disabled       = false
sourcetype     = iis
index          = codeb

# ----- Suggested props.conf for parsing LOUD-diag tags -----
# Add to $SPLUNK_HOME/etc/apps/codeb/local/props.conf:
#
# [codeb:oidc]
# EXTRACT-tag = \[(?<loud_tag>[A-Z][A-Z0-9\-]+)\]
# EXTRACT-corr = corr=(?<corr_id>[A-Za-z0-9\-]+)
#
# Then LOUD tags become searchable fields.

# ----- Suggested alert searches (savedsearches.conf) -----
#
# [codeb - RASP anomaly]
# search = index=codeb loud_tag=RASP-* earliest=-15m | stats count by loud_tag,host
# cron_schedule = */5 * * * *
# alert.suppress = 1
# action.email = 1
#
# [codeb - Tenant isolation breach]
# search = index=codeb "TENANT-ISOLATION-BREACH" earliest=-5m
# cron_schedule = */5 * * * *
# alert_condition = search count > 0
#
# [codeb - mDoc verify failure]
# search = index=codeb sourcetype=codeb:oidc "MDOC-VERIFY" ("fail" OR "denied") earliest=-15m
#
# [codeb - LOTL chain break]
# search = index=codeb "LOTL-CHAIN" ("broken" OR "untrusted") earliest=-1h
#
# [codeb - ACL auto-blacklist trip]
# search = index=codeb sourcetype=codeb:conn "ACL" ("BLACKLIST" OR "auto-blacklist")