<!--
  XplicitTrust Network Access - Wazuh Decoder
  Copyright (C) 2026 XplicitTrust GmbH

  Decodes syslog messages forwarded by the XplicitTrust event forwarder
  (protocol: Syslog over TLS, RFC 5424 / RFC 5425).

  The syslog message body is a JSON object containing all event fields.
  The JSON_Decoder plugin automatically extracts all fields into data.*.

  Fields available after decoding (always):
    data.event_id, data.event_class, data.event_type, data.session_type,
    data.message, data.created_at
  Per event (see the event reference in the documentation):
    data.remote_address, data.session_id, data.client, data.user,
    data.user_email, data.auth_type, data.role, data.client_name,
    data.tenant_name, data.object_type, data.object_id, data.object_name,
    data.reason, data.city, data.country, data.asn, data.asn_organization,
    data.client_version, data.os, data.interface_name, data.ip, data.port,
    data.severity

  data.event_id identifies the event; delivery is at-least-once, so two
  alerts with the same data.event_id are the same event. data.created_at
  is the event time (RFC 3339, UTC, milliseconds); see the Wazuh page of the
  documentation for indexing alerts at that time instead of arrival time.

  Installation:
    cp 0585-xplicittrust_decoders.xml /var/ossec/etc/decoders/
    systemctl restart wazuh-manager
-->

<!-- Base decoder: match XplicitTrust syslog messages and parse JSON body -->
<decoder name="xplicittrust">
    <prematch>^xplicittrust </prematch>
    <plugin_decoder offset="after_prematch">JSON_Decoder</plugin_decoder>
</decoder>
