Feature request: RFC 3161 timestamping the logs

[zbalkan]

Wazuh version	Component	Install type	Install method	Platform
4.3.1	Wazuh manager	Manager	N/A	N/A

Summary

Current log rotation solution compresses the logs and then calculates checksums for files. However, the log files can be tampered, new checksums can be generated and mtime value also can be modified. In forensic evidence perspective, these checksums are not reliable.

Proposal

Implement RFC3161 Time-Stamp Protocol (TSP) for Wazuh log archives to ensure integrity.

However, the RFC 3161 is an old standard and is updated. For a greenfield improvement like this, RFC 5816 should also be considered to be able to use better algorithms other than SHA-1.

Also, for the sake of TSAs , it does not have to be a commercial service provider as free TSAs exist.

Creating a timestamp

Checking the timestamp

Images: https://en.wikipedia.org/wiki/Trusted_timestamping

[ClementCastel]

+1

[cloudgitaware]

I would say this is not just a feature, but a requirement. If you cannot trust your logs, there is no need to gather them. PLEASE put this on the featurelist asap. Btw: this does not need to be RFC 3161 timestamping, but any (external) signing of the logs will suffice.