From ab60ddce6744a32686a26728334e8340dd604363 Mon Sep 17 00:00:00 2001 From: thesabear Date: Tue, 1 Sep 2026 08:39:09 +0300 Subject: [PATCH] security-monitoring.md: agent count and roster refreshed to 12 Live re-ran agent_control -l against the real Wazuh manager - the netbird host (ID 013) is now enrolled and Active, matching the fleet's real current host count. --- docs/security-monitoring.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/security-monitoring.md b/docs/security-monitoring.md index ee75ba9..714751e 100644 --- a/docs/security-monitoring.md +++ b/docs/security-monitoring.md @@ -6,7 +6,7 @@ | | | |---|---| | **Software** | Wazuh (manager/indexer/dashboard), self-hosted | -| **Coverage** | 11 active agents, one per fleet host, no gaps | +| **Coverage** | 12 active agents, one per fleet host, no gaps | | **Detection layers** | Compliance scoring (SCA) · file integrity monitoring (syscheck) · rootkit/anomaly heuristics (rootcheck) | | **Runbook** | 10+ recurring alert types root-caused once, documented, never re-triaged from scratch | | **Query path** | Direct index queries, bypassing the SOC dashboard entirely when needed | @@ -27,6 +27,7 @@ ID: 009, Name: vault, IP: any, Active ID: 010, Name: caddy, IP: any, Active ID: 011, Name: technitium, IP: any, Active ID: 012, Name: file-server, IP: any, Active +ID: 013, Name: netbird, IP: any, Active ``` ## Why agent-based, and why self-hosted @@ -116,4 +117,4 @@ The authentication stack is configured to fail **safe** under a specific failure > The fleet's automated security-benchmark tool (Docker Bench for Security) runs as a **native binary**, not through its own official container image — that image hit a real binary-compatibility wall between two different C library implementations (glibc vs. musl) that made it fail to run reliably. Running it natively instead of debugging a broken official container was the pragmatic call: the tool's job is auditing Docker, not testing container-runtime compatibility edge cases. It runs weekly, deliberately timed against real observed cron load from the other scheduled jobs described in [`docs/cron-scheduler.md`](cron-scheduler.md), rather than an arbitrary default schedule that might collide with heavier jobs. --- -Related: [`docs/firewall-and-network.md`](firewall-and-network.md), [`docs/dashy-soc-board.md`](dashy-soc-board.md), [`docs/notifications.md`](notifications.md), [`docs/iac-pipeline.md`](iac-pipeline.md) · Stacks: [`stacks/identity-and-security/wazuh/`](../stacks/identity-and-security/wazuh/) +Related: [`docs/firewall-and-network.md`](firewall-and-network.md), [`docs/dashy-soc-board.md`](dashy-soc-board.md), [`docs/notifications.md`](notifications.md), [`docs/iac-pipeline.md`](iac-pipeline.md), [`docs/netbird-zero-trust.md`](netbird-zero-trust.md) · Stacks: [`stacks/identity-and-security/wazuh/`](../stacks/identity-and-security/wazuh/)