sbx/panw-siem-telemetry-kit:20260922-5e076b79ff12e17f40d1cc93f53825a705d2b7da

schemaVersion: "2"
kind: mixin
name: panw-siem-telemetry
displayName: PANW SIEM Telemetry Forwarder
description: Ships sandbox observability (process, network, file, and agent-activity logs) to a SIEM HTTP event collector for dashboards, correlation, and automated response. Closes the visibility gap for what runs inside the sandbox.
licenses:
    - Apache-2.0
args:
    siemCollectorAuthId:
        default: ""
        description: Cortex XSIAM HTTP Collector API key ID (numeric, non-secret), sent as the x-xdr-auth-id header alongside the Authorization token. XSIAM requires both; leave empty for collectors that authenticate with the Authorization header alone.
        pattern: ^[0-9]*$
    siemCollectorHost:
        default: siem-collector.example.com
        description: SIEM HTTP event collector ingestion host (FQDN, no scheme). Defaults to a placeholder; set it to your collector or telemetry has nowhere to ship.
        pattern: ^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$
    siemCollectorPath:
        default: /logs/v1/event
        description: HTTP path on the collector to POST events to.
        pattern: ^/[A-Za-z0-9._~/-]*$
agentInstructions:
    content: |
        ## SIEM telemetry

        This sandbox forwards its observability data to an external SIEM HTTP event
        collector via a Fluent Bit forwarder running in the background. Process,
        network, file, and agent-activity logs written under `/var/log/sandbox/` and
        `~/.sandbox/logs/` are tailed and shipped continuously.

        To emit a custom event into the pipeline, append a JSON line to a `.log`
        file under `~/.sandbox/logs/`. The collector token is proxy-managed - the
        container never holds the real credential.
permissions:
    network:
        allow:
            - ${{ kit.args.siemCollectorHost }}
            - raw.githubusercontent.com
            - packages.fluentbit.io
            - github.com
            - codeload.github.com
            - archive.ubuntu.com
            - security.ubuntu.com
            - ports.ubuntu.com
            - download.docker.com
setup:
    install:
        - command: mkdir -p /var/log/sandbox && chmod 0755 /var/log/sandbox
          description: Ensure the host-side sandbox log directory exists for the forwarder to tail
        - command: if command -v fluent-bit >/dev/null 2>&1 || [ -x /opt/fluent-bit/bin/fluent-bit ]; then exit 0; fi; if [ "$(getconf PAGESIZE)" = "4096" ]; then curl -fsSL https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh || true; /opt/fluent-bit/bin/fluent-bit --version >/dev/null 2>&1 && exit 0; fi; set -e; apt-get update -qq; DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential cmake flex bison libssl-dev libyaml-dev pkg-config ca-certificates curl; curl -fsSL https://github.com/fluent/fluent-bit/archive/refs/tags/v5.1.2.tar.gz -o /tmp/fluent-bit-src.tar.gz; mkdir -p /tmp/fluent-bit-src; tar xzf /tmp/fluent-bit-src.tar.gz -C /tmp/fluent-bit-src --strip-components=1; cmake -S /tmp/fluent-bit-src -B /tmp/fluent-bit-build -DFLB_JEMALLOC=Off -DFLB_RELEASE=On -DFLB_EXAMPLES=Off -DFLB_TESTS_INTERNAL=Off -DFLB_TESTS_RUNTIME=Off -DCMAKE_INSTALL_PREFIX=/opt/fluent-bit; cmake --build /tmp/fluent-bit-build -j"$(nproc)"; cmake --install /tmp/fluent-bit-build; rm -rf /tmp/fluent-bit-src /tmp/fluent-bit-src.tar.gz /tmp/fluent-bit-build
          description: Install Fluent Bit - prebuilt on 4KB-page hosts, source build (jemalloc off) on 16KB-page hosts
    startup:
        - command:
            - sh
            - /home/agent/.config/fluent-bit/run-telemetry.sh
          user: "1000"
          background: true
          description: Forward sandbox telemetry to the SIEM collector