Update README.md

README.md

@@ -2,6 +2,33 @@
 
 Self-hosted Wazuh all-in-one deployment (Manager + Indexer + Dashboard) running on a Proxmox VM converted from the official Wazuh Amazon Machine Image (AMI) OVA.
 
+## **From the Proxmox host, download the official Wazuh AMI ova file.**
+### 1. Download the official AMI. (Version 4.14.5 at time of this commit. Edit as required)
+`wget https://packages.wazuh.com/4.x/vm/wazuh-4.14.5.ova`
+
+### 2. Extract the OVA (it's just a tar archive)
+`tar xvf wazuh-*.ova`
+
+### 3. Create a VM shell (no disk yet) — adjust VMID/resources to taste
+```
+qm create 110 --name wazuh-server --memory 4096 --cores 2 \
+  --net0 virtio,bridge=vmbr0 --ostype l26 --scsihw virtio-scsi-single
+```
+
+### 4. Import the extracted VMDK into the VM's storage
+Replace "local-lvm" with your target storage
+
+`qm importdisk 110 wazuh-*.vmdk local-lvm --format raw`
+
+### 5. Attach the imported disk (importdisk leaves it as "unused0")
+`qm set 110 --scsi0 local-lvm:vm-110-disk-0,discard=on,ssd=1`
+
+### 6. Set boot order and add a display
+`qm set 110 --boot order=scsi0 --serial0 socket --vga serial0`
+
+### 7. Start it
+`qm start 110`
+
 ---
 
 ## Repository Contents
@@ -41,7 +68,7 @@ wazuh/
 | `email_notification` | `yes` |
 | `email_to` | `chris@wittenberger.us` |
 | `smtp_server` | `localhost` (Postfix relay - see email setup below) |
-| `email_from` | `<redacted>` |
+| `email_from` | `wazuh-manager@wittenberger.us` |
 | `email_maxperhour` | `12` |
 | `email_alert_level` | **12** |
 | `log_alert_level` | `3` |
@@ -333,17 +360,19 @@ systemctl restart postfix
 
 ---
 
-## pfSense Syslog Integration
+## pfSense Syslog Integration with Syslog-ng
 
-pfSense does **not** run a Wazuh agent - it ships firewall logs over the network via **syslog-ng** to the Wazuh manager's syslog listener on **UDP 514**.
+pfSense does **not** run a Wazuh agent - it ships firewall logs over the network via **syslog**.  Syslog-ng provides a better pfSense log ingestion to the Wazuh manager's syslog listener on **UDP 514**.
 
-### pfSense Side (syslog-ng)
+### pfSense Side (remote logging options)
 
 In pfSense: **Status → System Logs → Settings → Remote Logging**
 
+**Syslog-ng listens on port 5140, therefore we must set pfSense to forward syslog to its loopback on port 5140 in order to reach Syslog-ng**
+
 | Setting | Value |
 |---------|-------|
-| Remote log server | `<wazuh-ip>:514` |
+| Remote log server | `127.0.0.1:5140` |
 | Protocol | UDP |
 | Log contents | Firewall events (filterlog) |
 
@@ -352,6 +381,33 @@ syslog-ng wraps the filterlog lines in a standard syslog envelope before forward
 <134>May 29 12:00:01 pfsense.local filterlog[1234]: 5,,,,...
 ```
 
+### Syslog-ng (must download package in pfSense)
+
+In pfSense: **Services > Syslog-ng > Advanced**
+
+| Setting | Value |
+|---------|-------|
+|Object Type | `Destination` |
+|Object Name | `wazuh` |
+|Description | `Connect to wazuh` |
+|Object Parameters | <see below> |
+
+``` 
+{ 
+    network("10.20.30.40"  // Change to your wazuh-manager VM IP
+        transport(udp) 
+        localip(10.1.2.3)  // Change to your pfSense IP
+    ); 
+```
+
+| Setting | Value |
+|---------|-------|
+|Object Type | `log` |
+|Object Name | `wazuh_route` |
+|Description | `Route default to "wazuh" destination` |
+|Object Parameters | `{ source(_DEFAULT); destination(wazuh); };` |
+
+
 ### Wazuh Side
 
 The syslog remote listener in `ossec.conf` accepts these:
@@ -360,7 +416,7 @@ The syslog remote listener in `ossec.conf` accepts these:
   <connection>syslog</connection>
   <port>514</port>
   <protocol>udp</protocol>
-  <allowed-ips>10.0.0.0/8</allowed-ips>
+  <allowed-ips>10.0.0.0/8</allowed-ips>   // Change to match your network range
   <local_ip>WAZUH_SERVER_IP</local_ip>
 </remote>
 ```