# Day-1 SIEM: decoy-touch webhook + SOP

Time: ~10-15 minutes · Plane: **Ops** (optional) or sensor file/syslog forwarder

This tutorial wires a **Day-1** SIEM path for `decoy.touch` events. It does **not**
claim that the sensor `ctiexport` worker emits OCSF: OCSF mappers live on the
Ops plugin catalog only.

## Option A: Ops plugin (webhook + SOP)

1. Enable the Ops catalog plugin `siem-decoy-touch-sop` (default off).
2. Point `webhook_url` at your SIEM/SOAR collector that accepts JSON.
3. On a decoy-touch fan-out, Ops formats a `decoy_touch_sop_v1` body with:
   - `event_type: decoy.touch`
   - closed `sop_steps` checklist
   - `auto_contain: false` (SEC-AG-003: human/policy gate only)
4. Golden payload coverage: `ops/internal/plugins/catalog/decoy_touch_siem_tdd324_test.go`.

## Option B: Sensor → file / syslog (no Ops)

When Ops is not installed, keep the engine field-trial path:

1. Run the sensor with JSON stdout or a Class B spool directory (see
   [POC overlay](../../scripts/field_trial/stacks/chn/overlays/docker-compose.poc.yml)).
2. Forward the JSONL / syslog file with your existing collector agent
   (rsyslog, Vector, Fluent Bit, etc.).
3. Map `event_type` / `session_id` / `source_ip` in the SIEM; treat scores as
   advisory only (SEC-AI-001).

## Honesty bounds

| Claim | Status |
|-------|--------|
| Ops decoy-touch SOP webhook | Present (TDD-324) |
| Sensor `ctiexport` emits OCSF | **No**, never claimed |
| Auto-containment from AI score | **Forbidden** (SEC-AG-003 / SEC-AI-001) |

See also: [blue-team-advanced.md](blue-team-advanced.md),
[ot-wws-beginner.md](ot-wws-beginner.md).