diff --git a/docs/security-monitoring.md b/docs/security-monitoring.md index 188e354..4023529 100644 --- a/docs/security-monitoring.md +++ b/docs/security-monitoring.md @@ -1,5 +1,5 @@ - @@ -57,6 +57,8 @@ The alternative to an agent on every host is a purely network-level monitoring a > # during that night's role redeploys, confirmed via the indexer across > # 9 of the fleet's agents. > ``` +> +> The same role found a second gap a month later, in itself this time: it silently skipped tuning the wazuh host's own agent, because that agent runs inside the manager's Docker container rather than natively on the VM — the role's own "is the agent installed" check only ever looked for a native install. That let the wazuh host's own queue sit at the untuned default until a real queue-full alert exposed it, the same class of bug the role was originally written to fix, this time hiding in the one host built differently from the rest. Fixed by giving that host its own branch instead of assuming every agent looks the same. ## How An Alert Gets Handled