CR-2026-06-25: Verification

Verification

Agent Registration

DOMAIN="inside.domusdigitalis.dev"
TOKEN=$(curl -sk -u "wazuh-wui:$(gopass show -o v3/domains/d000/k3s/wazuh/api)" \
  -X POST "https://wazuh.${DOMAIN}:55000/security/user/authenticate" \
  | jq -r '.data.token')
curl -sk -H "Authorization: Bearer ${TOKEN}" \
  "https://wazuh.${DOMAIN}:55000/agents" \
  | jq '.data.affected_items[] | select(.name == "modestus-p16g") | {id, name, status, ip, os}' \
  | tee /tmp/wazuh-agent-verify.json

Expected: Agent modestus-p16g with status: "active".

Agent Service Health

systemctl is-active wazuh-agent
systemctl is-enabled wazuh-agent
sudo tail -5 /var/ossec/logs/ossec.log

Expected: active, enabled, no ERROR lines in log.

Indexer Data Verification

Confirm the Wazuh indexer receives alert indices with actual agent data, not just self-monitoring noise.

DOMAIN="inside.domusdigitalis.dev"
curl -sk -u admin:admin \
  "https://wazuh-indexer.${DOMAIN}:9200/_cat/indices/wazuh-alerts*" \
  -H 'Accept: application/json' | jq '.' | head -30

Expected: wazuh-alerts-4.x-YYYY.MM.DD indices with non-zero document counts.

AppArmor Profile Status

sudo aa-status 2>&1 | grep -B1 -A1 ossec

Expected: ossec-agentd in complain mode.

After 48 hours with no AppArmor denials in the agent’s operation, transition to enforce:

# Run ONLY after 48h clean observation
sudo aa-enforce /etc/apparmor.d/usr.local.wazuh-agent
sudo aa-status 2>&1 | grep -B1 -A1 ossec

nftables Egress Rules

sudo nft list ruleset | grep -i wazuh

Expected: Two rules — registration (1515) and events (1514).

Fortress Verification (No Regressions)

fortress-verification is not a standalone command. It is the script block from the fortress-verification/fortress-script.adoc sub-partial. Copy the script to /tmp/fortress-verify.sh and execute: 
bash /tmp/fortress-verify.sh | tee /tmp/fortress-post-wazuh.txt

All existing hardening checks must pass. The only acceptable new entries are the wazuh-agent service and its AppArmor profile.

Alert Generation Test

Trigger a known alert and verify end-to-end pipeline from agent to dashboard.

Generate a failed SSH login

ssh invalid-user@localhost 2>&1 || true

Wait for alert propagation (30-60 seconds)

sleep 60

Query indexer for the alert

DOMAIN="inside.domusdigitalis.dev"
curl -sk -u admin:admin "https://wazuh-indexer.${DOMAIN}:9200/wazuh-alerts-*/_search" \
  -H 'Content-Type: application/json' \
  -d '{"query":{"bool":{"must":[{"match":{"agent.name":"modestus-p16g"}},{"match":{"rule.description":"sshd"}}]}},"size":3,"sort":[{"timestamp":{"order":"desc"}}]}' \
  | tee /tmp/wazuh-ssh-alert-test.json \
  | jq '.hits.hits[]._source | {timestamp, agent_name: .agent.name, rule_id: .rule.id, rule_description: .rule.description, rule_level: .rule.level}'

Expected: At least one alert from modestus-p16g matching the failed SSH login attempt.

Verification Checklist

Check Expected Status

Agent in manager list

modestus-p16g present

❌ Not started

Agent status

active

❌ Not started

Indexer alert indices

Non-zero document counts

❌ Not started

AppArmor profile

Loaded in complain mode

❌ Not started

nftables egress rules

1514 + 1515 allowed

❌ Not started

fortress-verification

No regressions

❌ Not started

SSH alert test

Alert visible in indexer

❌ Not started

AppArmor enforce (48h)

Transition to enforce mode

❌ Not started