feat(dlp): add server-side analyzer, evidence chain, compliance scheduler, and syslog forwarder

ansible/deploy_aw_server.yml

@@ -409,8 +409,10 @@
             mode: "0644"
           loop:
             - cef_exporter.py
+            - syslog_forwarder.py
             - webhook_sender.py
             - cef-config.yaml
+            - syslog-forwarder-config.yaml
             - webhook-config.yaml
             - requirements.txt
           when: aw_dlp_integrations_enabled | default(true) | bool
@@ -423,6 +425,7 @@
             mode: "0755"
           loop:
             - cef_exporter.py
+            - syslog_forwarder.py
             - webhook_sender.py
           when: aw_dlp_integrations_enabled | default(true) | bool
 
@@ -466,6 +469,24 @@
             mode: "0644"
           when: aw_dlp_integrations_enabled | default(true) | bool
 
+        - name: Установить systemd unit syslog forwarder
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-integrations/syslog-forwarder.service"
+            dest: /etc/systemd/system/aw-dlp-syslog-forwarder.service
+            owner: root
+            group: root
+            mode: "0644"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
+        - name: Установить systemd timer syslog forwarder
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/aw-server/dlp-integrations/syslog-forwarder.timer"
+            dest: /etc/systemd/system/aw-dlp-syslog-forwarder.timer
+            owner: root
+            group: root
+            mode: "0644"
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
         - name: Установить systemd unit webhook sender
           ansible.builtin.copy:
             src: "{{ aw_repo_root }}/aw-server/dlp-integrations/webhook-sender.service"
@@ -504,6 +525,7 @@
             - case_service.py
             - case_schema.py
             - case_storage.py
+            - evidence_chain.py
             - requirements.txt
           when: aw_dlp_case_management_enabled | default(true) | bool
 
@@ -559,8 +581,10 @@
             mode: "{{ item.mode }}"
           loop:
             - { src: "report_generator.py", dest: "/opt/activitywatch/dlp-compliance/report_generator.py", mode: "0755" }
+            - { src: "compliance_scheduler.py", dest: "/opt/activitywatch/dlp-compliance/compliance_scheduler.py", mode: "0755" }
             - { src: "requirements.txt", dest: "/opt/activitywatch/dlp-compliance/requirements.txt", mode: "0644" }
             - { src: "templates/152-fz-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html", mode: "0644" }
+            - { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
             - { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
             - { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
           when: aw_dlp_compliance_enabled | default(true) | bool
@@ -676,6 +700,13 @@
             state: restarted
           when: aw_dlp_integrations_enabled | default(true) | bool
 
+        - name: Включить и перезапустить timer syslog forwarder
+          ansible.builtin.systemd:
+            name: aw-dlp-syslog-forwarder.timer
+            enabled: true
+            state: restarted
+          when: aw_dlp_integrations_enabled | default(true) | bool
+
         - name: Включить и перезапустить timer webhook sender
           ansible.builtin.systemd:
             name: aw-dlp-webhook-sender.timer

ansible/roles/dlp-case-management/tasks/main.yml

@@ -18,6 +18,7 @@
     - case_service.py
     - case_schema.py
     - case_storage.py
+    - evidence_chain.py
     - requirements.txt
 
 - name: Make case service executable

ansible/roles/dlp-compliance/tasks/main.yml

@@ -20,8 +20,10 @@
     mode: "{{ item.mode }}"
   loop:
     - { src: "report_generator.py", dest: "/opt/activitywatch/dlp-compliance/report_generator.py", mode: "0755" }
+    - { src: "compliance_scheduler.py", dest: "/opt/activitywatch/dlp-compliance/compliance_scheduler.py", mode: "0755" }
     - { src: "requirements.txt", dest: "/opt/activitywatch/dlp-compliance/requirements.txt", mode: "0644" }
     - { src: "templates/152-fz-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html", mode: "0644" }
+    - { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
     - { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
     - { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
 
@@ -50,4 +52,3 @@
   ansible.builtin.systemd:
     name: aw-dlp-report-scheduler.service
     state: started
-

ansible/roles/dlp-content-analysis/tasks/main.yml

@@ -0,0 +1,37 @@
+---
+- name: Install OCR/system dependencies
+  ansible.builtin.apt:
+    name:
+      - python3-venv
+      - python3-pip
+      - tesseract-ocr
+      - tesseract-ocr-rus
+    state: present
+    update_cache: true
+
+- name: Create content analysis directory
+  ansible.builtin.file:
+    path: /opt/activitywatch/dlp-content-analysis
+    state: directory
+    owner: "{{ aw_server_user | default('activitywatch') }}"
+    group: "{{ aw_server_group | default('activitywatch') }}"
+    mode: "0755"
+
+- name: Copy content analysis sources
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../aw-server/dlp-content-analysis/"
+    dest: /opt/activitywatch/dlp-content-analysis/
+    owner: "{{ aw_server_user | default('activitywatch') }}"
+    group: "{{ aw_server_group | default('activitywatch') }}"
+    mode: "0644"
+
+- name: Create venv for content analysis
+  ansible.builtin.command:
+    cmd: python3 -m venv /opt/activitywatch/dlp-content-analysis/.venv
+  args:
+    creates: /opt/activitywatch/dlp-content-analysis/.venv/bin/python
+
+- name: Install Python dependencies for content analysis
+  ansible.builtin.pip:
+    requirements: /opt/activitywatch/dlp-content-analysis/requirements.txt
+    virtualenv: /opt/activitywatch/dlp-content-analysis/.venv

ansible/roles/dlp-integrations/tasks/main.yml

@@ -16,8 +16,10 @@
     mode: "0644"
   loop:
     - cef_exporter.py
+    - syslog_forwarder.py
     - webhook_sender.py
     - cef-config.yaml
+    - syslog-forwarder-config.yaml
     - webhook-config.yaml
     - requirements.txt
 
@@ -29,6 +31,7 @@
     mode: "0755"
   loop:
     - cef_exporter.py
+    - syslog_forwarder.py
     - webhook_sender.py
 
 - name: Create venv for DLP integrations
@@ -60,6 +63,8 @@
   loop:
     - { src: "cef-exporter.service", dest: "/etc/systemd/system/aw-dlp-cef-exporter.service" }
     - { src: "cef-exporter.timer", dest: "/etc/systemd/system/aw-dlp-cef-exporter.timer" }
+    - { src: "syslog-forwarder.service", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.service" }
+    - { src: "syslog-forwarder.timer", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.timer" }
     - { src: "webhook-sender.service", dest: "/etc/systemd/system/aw-dlp-webhook-sender.service" }
     - { src: "webhook-sender.timer", dest: "/etc/systemd/system/aw-dlp-webhook-sender.timer" }
 
@@ -74,4 +79,5 @@
     state: restarted
   loop:
     - aw-dlp-cef-exporter.timer
+    - aw-dlp-syslog-forwarder.timer
     - aw-dlp-webhook-sender.timer