feat. entrega final

.editorconfig

@@ -0,0 +1,6 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true

.env.sentinel.example

@@ -0,0 +1,14 @@
+# Copiar a .env.sentinel y completar con las salidas del despliegue Azure CLI.
+# No agregar .env.sentinel al repositorio.
+
+AZURE_TENANT_ID=
+AZURE_CLIENT_ID=
+AZURE_CLIENT_SECRET=
+
+SENTINEL_DCE_ENDPOINT=
+SENTINEL_DCR_IMMUTABLE_ID=
+SENTINEL_STREAM_NAME=Custom-CloudSIEM
+
+SENTINEL_POLL_SECONDS=10
+SENTINEL_BATCH_SIZE=500
+SENTINEL_LOOKBACK_MINUTES=15

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/AGENTS.md

@@ -0,0 +1,40 @@
+# AGENTS.md
+
+## Repo Shape
+- Read `README.md` and `.github/copilot-instructions.md` first; they define the project scope, required detections, and documentation language.
+- The stack lives at the repository root; do not assume a nested `siem-elk/` directory.
+- `develop` is the working branch; `main` is stable and PR-only.
+
+## Run The Stack
+- For Podman on Linux, use `bash setup/run-podman-sentinel-stack.sh --build --force-recreate --no-sentinel` for the local stack, or remove `--no-sentinel` when Sentinel is enabled.
+- Stop the matching stack with `podman-compose -f docker-compose.yml -f docker-compose-podman.yml down`, or add `-f docker-compose-sentinel.yml -f docker-compose-sentinel-podman.yml` for Sentinel.
+- `docker-compose.yml` is the universal base; `docker-compose-podman.yml` is the Linux + Podman override and owns SELinux relabeling.
+- The Podman override maps `$XDG_RUNTIME_DIR/podman/podman.sock` to `/var/run/docker.sock` for Filebeat metadata enrichment.
+- The cluster bootstrap takes about 90 seconds before health checks are meaningful.
+
+## Verify
+- From the repository root: `bash setup/verify-cluster.sh`, `python3 setup/check-cluster-health.py`, `python3 setup/verify-ecs-mapping.py`.
+- From the repository root: `bash logstash/test-pipeline.sh`.
+- Run Filebeat config checks with Podman, not Docker:
+  `podman run --rm --user 0 -e ELASTIC_PASSWORD=test -v "$PWD/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro,Z" docker.elastic.co/beats/filebeat:9.3.3 filebeat test config -e -c /usr/share/filebeat/filebeat.yml`
+
+## Filebeat And Logs
+- Filebeat configs should stay on `filestream`; use `parsers` for multiline and container parsing.
+- Do not reintroduce `type: log` or `type: container` in Filebeat configs.
+- `logs/` contains live sample inputs for Filebeat.
+- `setup/generate-test-logs.py` writes directly to log files; its defaults point at `/var/log/...`, so override paths before using it on the host.
+
+## Scripts With Relative Paths
+- `setup/import-rules.py` has brittle relative-path defaults; check `RULES_DIR` and `CACERT` before invoking it.
+- Several helper scripts read `.env` from the current directory, so run them from the directory shown above.
+
+## Coding Approach
+- Think before coding: state assumptions explicitly. If something is unclear or has multiple plausible interpretations, ask instead of guessing.
+- Keep solutions minimal: implement only what was requested. Avoid speculative abstractions, configurability, or error handling for impossible scenarios.
+- Make surgical changes: touch only what is necessary, match existing style, and do not refactor unrelated code or comments. Remove only unused imports, variables, or functions created by your own changes.
+- Be goal-driven: for multi-step work, outline a brief plan and define how each step will be verified.
+
+## Content Rules
+- Keep docs in Spanish and code/config identifiers in English.
+- Do not use emojis under any circumstance.
+- Preserve the 5 required detections, 3 attack simulations, and 2 response playbooks when editing project scope docs.

.github/copilot-instructions.md

@@ -5,7 +5,7 @@ applyTo: "**"
 # CloudSIEM Copilot Instructions
 
 ## Project scope
-- This repository is an academic SIEM project built around `Elasticsearch`, `Logstash`, `Kibana`, `Filebeat` and/or `Metricbeat`, `Docker Compose`, Python log generators, and optional `Wazuh`.
+- This repository is an academic SIEM project built around `Elasticsearch`, `Logstash`, `Kibana`, `Filebeat`, `Docker Compose` and Python log generators.
 - Follow the project scope, requirements, deliverables, and acceptance criteria defined in [`README.md`](../README.md).
 
 ## Source of truth
@@ -14,10 +14,16 @@ applyTo: "**"
 
 ## Communication style
 - Use clear, direct, and concise language.
-- Do not use emojis.
+- Do not use emojis under any circumstance.
 - Prefer factual statements over promotional or decorative wording.
 - Keep explanations practical and focused on what exists, what is missing, and what should be implemented next.
 
+## Coding approach
+- Think before coding: state assumptions explicitly. If something is unclear or multiple interpretations exist, ask instead of guessing.
+- Keep solutions minimal: implement only what was requested. Avoid speculative abstractions, configurability, or error handling for impossible scenarios.
+- Make surgical changes: touch only what is necessary, match existing style, and do not refactor unrelated code or comments. Clean up only unused imports, variables, or functions created by your own changes.
+- Be goal-driven: for multi-step work, outline a brief plan and define how each step will be verified.
+
 ## Documentation rules
 - Write project documentation in Spanish.
 - Keep code, configuration keys, service names, index names, and technical identifiers in English.

.github/workflows/ci.yml

@@ -0,0 +1,144 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install lint tools
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ruff yamllint
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+
+      - name: Lint Python
+        run: ruff check --select E9,F63,F7,F82 setup
+
+      - name: Lint shell scripts
+        run: |
+          shellcheck -S error \
+            logstash/test-pipeline.sh \
+            setup/run-podman-sentinel-stack.sh \
+            setup/provisioning/*.sh \
+            setup/verify-cluster.sh
+
+      - name: Lint YAML
+        run: |
+          yamllint -d '{
+            extends: relaxed,
+            rules: {
+              colons: disable,
+              document-start: disable,
+              indentation: disable,
+              line-length: disable,
+              truthy: disable
+            }
+          }' \
+            .github/workflows/ci.yml \
+            docker-compose.yml \
+            docker-compose-podman.yml \
+            docker-compose-sentinel.yml \
+            docker-compose-sentinel-podman.yml \
+            filebeat/filebeat.yml \
+            filebeat/filebeat-k8s.yml \
+            filebeat/filebeat-daemonset.yaml \
+            kibana/kibana.yml \
+            logstash/config/logstash.yml \
+            setup/provisioning/cert-instances.yml
+
+      - name: Check line endings
+        run: |
+          bad=0
+          while IFS=$'\t' read -r meta path; do
+            case "$meta" in
+              *"w/crlf"*|*"i/crlf"*)
+                printf 'CRLF detected: %s\t%s\n' "$meta" "$path" >&2
+                bad=1
+                ;;
+            esac
+          done < <(git ls-files --eol)
+          exit "$bad"
+
+      - name: Validate JSON files
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          for path in sorted(Path('.').rglob('*.json')):
+              with path.open(encoding='utf-8') as handle:
+                  json.load(handle)
+              print(path)
+          PY
+
+  static-tests:
+    name: Static Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Compile Python scripts
+        run: python -m compileall setup
+
+      - name: Validate dashboard generation
+        run: |
+          python setup/create-dashboards-complete.py
+          git diff --exit-code setup/dashboards/executive-operational-dashboards.ndjson
+
+      - name: Validate dashboard references
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          path = Path('setup/dashboards/executive-operational-dashboards.ndjson')
+          objects = [json.loads(line) for line in path.read_text(encoding='utf-8').splitlines() if line.strip()]
+          ids = {(item['type'], item['id']) for item in objects}
+          missing = []
+
+          for item in objects:
+              if item.get('type') != 'dashboard':
+                  continue
+              panels = json.loads(item['attributes']['panelsJSON'])
+              references = {ref['name']: (ref['type'], ref['id']) for ref in item.get('references', [])}
+              for panel in panels:
+                  ref = references.get(panel.get('panelRefName'))
+                  if ref not in ids:
+                      missing.append((item['id'], panel.get('panelRefName'), ref))
+
+          if missing:
+              raise SystemExit(f'Missing dashboard references: {missing}')
+          print(f'Validated {len(objects)} saved objects')
+          PY
+
+      - name: Validate Compose files
+        run: |
+          docker compose -f docker-compose.yml config --quiet
+          docker compose -f docker-compose.yml -f docker-compose-podman.yml config --quiet

.gitignore

@@ -0,0 +1,10 @@
+# Directorios y archivos a ignorar
+setup/__pycache__/
+.ruff_cache/
+
+# Ignorar variables de entorno
+.env
+.env.sentinel
+
+# Logs
+logs