Tagged: Monitoring
6 posts · browse all tags
-
Host-Based Detection Part 7: How a Log Line Becomes an Alert
A raw log line becomes an alert in exactly two steps: decode, then match. How Wazuh's default ruleset already covers SSH, PAM, and sudo with zero custom rules, and where a shipped check turned out to be wrong.
-
Host-Based Detection Part 6: File Integrity Monitoring and Rootcheck
FIM, rootcheck, and SCA all answer some version of is this system still what I think it is, and none of them should be trusted blind. What each one actually checks, with real findings from a real run.
-
From Dropbox to Daily Driver Part 6: Standing Up a Wazuh Manager, and Why the VM Wouldn't Boot
Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
Proxmox Deep Dive Part 13: Monitoring, Maintenance, and Homelab Best Practices
Closing the deep dive: watching the whole stack with Prometheus and Grafana, ongoing repository and certificate maintenance, and a homelab best-practices checklist pulling every part of this series into one place.
-
NSE4 Part 5: Logging, Monitoring & Diagnostics
Part 5 of the NSE4 study series — log categories and severity, local vs remote storage, FortiAnalyzer and syslog forwarding, threat weight scoring, and the diagnostic commands you actually reach for under pressure.