Hybrid SIEM-RF Node - Control Plane README

1) Purpose

This repository defines a cyber-physical SIEM node that fuses:

• RF spatial telemetry (Wi-Fi CSI, device-free sensing)
• Packet-level network telemetry (L2-L7 emissions)
• Security analytics (SIEM/XDR normalization, timeline forensics)

Primary objective: correlate "what happened in physical space" with "what happened on the network" in the same investigation window.

2) Conceptual Modules to Physical Folder Mapping

Conceptual Module	Physical Folder(s) in this Repo	Primary Repositories
Wi-Fi Sensing and CSI Data Extraction	Wi-Fi Sensing & CSI Data Extraction	linux-80211n-csitool-master, RuView-main, openclaw-ruview-presence-main
Network Reconnaissance and Pen-Testing	Network Reconnaissance & Penetration Testing	awesome-scapy-main, hackthelan-main, bettercap-master, NetworkOptimizer-main
Automated Deployment and Infrastructure	Automated Deployment & Infrastructure	ansible-role-ubuntu_autoinstall-main, algo-main
Forensic Logging and Monitoring	Automated Deployment & Infrastructure, Additional Services	timesketch-master, systeminformer-master, wazuh-main, sshesame (staged)
Secure Tunnels and Proxies	Additional Services	ghostunnel-master, mitmproxy-main, sozu-main

Notes:

• linux-80211n-csitool-supplementary is a required upstream dependency for CSI firmware/tools and is staged by offline payload scripts.
• sshesame is included in conceptual architecture and should be staged/deployed as a honeypot sidecar.

3) High-Level Architecture

flowchart LR
    subgraph RF["RF Sensing Plane"]
      A[Intel 5300 CSI Extractor<br/>Ubuntu 18.04 + Kernel 4.15]
      B[RuView Inference Engine<br/>UDP CSI Ingest]
      C[Presence Events<br/>openclaw-ruview-presence]
    end

    subgraph NET["Network Emissions Plane"]
      D[Scapy Passive Sniffer]
      E[Bettercap Probe + MITM Detection]
      F[Hackthelan/NetworkOptimizer Recon]
    end

    subgraph SEC["Security Analytics Plane"]
      G[Wazuh Event Normalization]
      H[Timesketch Timeline Correlation]
      I[Analyst/Automation Actions]
    end

    subgraph TRANS["Secure Transport Plane"]
      J[ghostunnel mTLS]
      K[sozu/mitmproxy Controlled Proxies]
    end

    A -->|CSI frames -> UDP stream| B
    B -->|presence / vitals / occupancy events| C
    C -->|RF event JSON| G

    D -->|packet metadata| G
    E -->|rogue AP / arp / protocol anomalies| G
    F -->|asset + emission context| G

    G -->|normalized SIEM events| H
    H -->|cross-domain timeline<br/>RF + network| I

    B -. wrapped by .-> J
    C -. wrapped by .-> J
    G -. transport hardening .-> K

Loading

Correlation Path (critical)

1. CSI extractor emits RF micro-variation stream over UDP.
2. RuView transforms CSI into presence and motion features.
3. Packet sensors (Scapy/Bettercap/Hackthelan) emit MAC/ARP/probe/service telemetry.
4. Wazuh normalizes both RF-derived and packet-derived events into a common schema/timestamp base.
5. Timesketch correlates:
   • RF occupancy transition (room-level)
   • MAC/probe appearance
   • ARP/network anomalies
   • tunnel/proxy alerts
6. Investigator gets a single timeline: "physical change + digital emission" with aligned event time.

4) Dataflow Contract

Upstream sources

• RF input: Intel 5300 CSI captures via modified iwlwifi/firmware.
• Network input: passive packet/sniffer outputs (MAC, ARP, probe requests, service metadata).

Message classes

• csi_raw: subcarrier/signal metrics (high-rate UDP).
• rf_presence: occupancy/motion/vitals event outputs from RuView.
• net_telemetry: packet metadata from recon sensors.
• siem_alert: normalized detection/alarm records from Wazuh.
• forensic_timeline_event: indexed event for Timesketch analysis.

Storage and correlation sinks

• SIEM/XDR normalization: Wazuh.
• Timeline and collaborative forensics: Timesketch.

5) Phase 5 Runtime Port Contract (RuView Bridge)

This contract is the active Infrastructure -> Intelligence bridge and must be treated as deployment-pinned:

1. Linux CSI producer emits UDP to 127.0.0.1:5005.
2. Linux socat bridge forwards UDP 5005 -> TCP 127.0.0.1:6505.
3. Linux ghostunnel client forwards 127.0.0.1:6505 -> csi-hub-server:9443 (mTLS, CN=csi-hub-server).
4. Windows ghostunnel server decrypts on TCP 9443 and targets TCP 127.0.0.1:5505.
5. Windows TCP->UDP relay forwards 127.0.0.1:5505 -> UDP 127.0.0.1:5005.
6. RuView ingests CSI on UDP 5005 and serves API on HTTP 3000 + WebSocket 3001.

Named services/tasks in this contract:

• Linux: csi-mtls-proxy.service, csi-udp-bridge.service
• Windows: CSI-Ghostunnel-Server, CSI-TCP-UDP-Relay

6) Pipeline Runbook

Step A - Capture Plane Bring-Up

1. Boot headless CSI node on Ubuntu 18.04 LTS with Linux Kernel 4.15.
2. Load Intel 5300 CSI firmware/toolchain.
3. Start CSI UDP stream producer.
4. Start packet collectors in passive mode on monitoring interface(s).

Step B - Transport and Integrity

1. Wrap CSI and event transport in ghostunnel mTLS where crossing trust boundaries.
2. Apply proxy policy controls via sozu/mitmproxy for inspection/segmentation paths.

Step C - Ingest and Normalize

1. Ingest RF and network events into Wazuh decoders/rules.
2. Ensure both event families carry:
   • monotonic/local timestamp
   • synchronized UTC timestamp
   • sensor identifier
   • node identifier

Step D - Correlate and Investigate

1. Export/index into Timesketch.
2. Build investigation pivots:
   • same time window
   • same physical zone / AP domain
   • same MAC/device identity signals
3. Confirm or reject incident hypotheses using both physical and digital evidence.

Step E - Alert and Response

1. Trigger correlation rules for coupled anomalies (for example, occupancy shift + rogue MAC + ARP poisoning).
2. Escalate to incident workflow with full event traceability.

7) Offline Deployment Payload (32GB USB)

See:

• Automated Deployment & Infrastructure/stage_offline_payload.ps1
• Automated Deployment & Infrastructure/setup_node.sh

Payload root on USB:

offline_payload/
  docker/ruvnet-wifi-densepose_latest.tar
  apt/pool/*.deb
  apt/manifest/packages.txt
  git/linux-80211n-csitool/
  git/linux-80211n-csitool-supplementary/
  git/RuView/
  git/openclaw-ruview-presence/
  checksums/SHA256SUMS

8) Manifest Index

• docs/manifests/wifi-csi/manifest.md
• docs/manifests/net-recon/manifest.md
• docs/manifests/deployment-infra/manifest.md
• docs/manifests/forensic-logging/manifest.md
• docs/manifests/secure-tunnels/manifest.md
• docs/runbooks/phase5-ruview-bridge.md