Restoring and operating Wazuh monitoring

Starting point

Where it started

Monitoring depended on a healthy central manager and narrow agent paths across separated network roles. A failed manager start and silent reporting gaps could remove visibility without breaking the monitored service itself.

What I did

What I worked on

1. Investigated a manager startup failure, identified stale processes from an earlier crash, restarted the Wazuh control plane, and checked agent state afterward.
2. Validated that each network role could reach only the required agent and log-ingestion paths instead of receiving broad inter-VLAN access.
3. Documented a review sequence for active alerts, affected endpoint, event context, severity, related activity, notes, and escalation.
4. Kept real alert contents, internal addresses, account details, and full firewall policy out of public evidence.

Evidence

What I checked and recorded

Result

What changed

Central monitoring returned with 22 active lab agents at the validation point, the required segmented paths remained narrow, and future reviews have a consistent investigation sequence.

What I learned

What I took from it

• Monitoring needs health checks for the monitoring system itself.
• An agent count is a starting signal, not proof that every source is useful or current.
• A consistent triage record makes escalation easier and prevents the next review from starting from zero.