From 8187e9c1b7aac547b105d4a3af5291de6661753a Mon Sep 17 00:00:00 2001 From: thesabear Date: Fri, 28 Aug 2026 08:05:07 +0300 Subject: [PATCH] docs: update security-monitoring alert-flow diagram --- assets/security-monitoring-alert-flow.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/security-monitoring-alert-flow.svg b/assets/security-monitoring-alert-flow.svg index 45c4393..b1c116b 100644 --- a/assets/security-monitoring-alert-flow.svg +++ b/assets/security-monitoring-alert-flow.svg @@ -1,4 +1,4 @@ -
Fleet Host
Wazuh agent installed
DETECTION LAYERS
SCA compliance scoring
12h benchmark scan
File integrity monitoring
12h scan cycle
Rootkit / anomaly
heuristics
Alert fires
Matches a known,
root-caused pattern?
Runbook entry
no re-investigation
Investigated fresh
wazuh-logtest + direct index query
yes
no
becomes routine
Known — straight to runbook
Unknown — investigated fresh
Fresh finding folded back in
 \ No newline at end of file +
Fleet Host
Wazuh agent installed
DETECTION LAYERS
SCA compliance scoring
12h benchmark scan
File integrity monitoring
12h scan cycle
Rootkit / anomaly
heuristics
Alert fires
Matches a known,
root-caused pattern?
Runbook entry
no re-investigation
Investigated fresh
wazuh-logtest + direct index query
yes
no
becomes routine
Known — straight to runbook
Unknown — investigated fresh
Fresh finding folded back in
 \ No newline at end of file