WAZUH_VERSION="v4.12.0" CLUSTER="soc-prod-01"

Last indexer sync: OK · retention 90d · ILM hot/warm

--- tail -n 12 /var/ossec/logs/alerts/alerts.json ---

{"timestamp":"…Z","rule":{"id":5503,"level":10},"agent":{"name":"edge-fw"},"data":{"srcip":"203.0.113.44"}}

{"timestamp":"…Z","rule":{"id":5710,"level":7},"agent":{"name":"web-srv-01"},"syscheck":{"path":"/etc/nginx/nginx.conf"}}

--- /var/ossec/bin/wazuh-control status ---

wazuh-clusterd not running

wazuh-modulesd is running

wazuh-monitord is running

wazuh-logcollector is running

wazuh-remoted is running

wazuh-syscheckd is running

wazuh-analysisd is running

wazuh-maild not running

wazuh-execd is running

wazuh-db is running

wazuh-authd is running

--- quick host snapshot ---

uptime: 14:22:01 up 38 days, load average: 0.41, 0.36, 0.29

Mem: 31.2Gi used · 4.1Gi avail · Swap 512Mi/2.0Gi

ss -tulpn | head: LISTEN 0.0.0.0:1514(userspace) 0.0.0.0:443(nginx) 127.0.0.1:9200(java)

iptables -L INPUT -n | head: ACCEPT est/rel · DROP invalid · LOG prefix [FW-DROP]

ausearch -m USER_LOGIN --raw 2>/dev/null | tail -1: uid=1000 tty=ssh res=success

grep -c "Failed password" /var/log/auth.log | tail window: 7 (last 15 min)

openssl s_client -connect 127.0.0.1:443 -brief 2>/dev/null | grep "Verification: OK"