Endpoint visibility
Connect device inventory, security events, file changes, and configuration findings. Wazuh supplies endpoint and log-analysis capabilities in the proposed architecture.
- Security events. Rules and decoders organize collected activity into findings for investigation.
- File integrity. Track changes to selected files and configuration paths.
- Device inventory. Review enrolled systems, installed software, and vulnerability findings.
- Configuration assessment. Compare device settings with defined checks and investigate gaps.
Enrolled agents or approved log feeds, configured collection, tuned rules, and a defined retention policy.