Split out of #101.
ADR-0007 puts Velociraptor on Saruman alongside Wazuh. The two are not
redundant and the distinction is worth stating, because it is the thing that
decides whether this is worth building: Wazuh tells you an alert fired,
Velociraptor is how you go and ask the endpoint what actually happened. The
loop ADR-0007 exists to close — "did the detection fire?" having a clean answer
— needs both halves.
Blocked behind the domain. Lighter than Wazuh by a wide margin; a single Go
binary and a client on each endpoint.
Worth deciding
- Where the server runs — the lab guest alongside the observability stack,
or its own. Cheaper to co-locate than Wazuh's indexer, and probably fine.
- How clients are deployed to the domain, and whether that is done the way
a real estate would do it (GPO) or the way that is quickest. Doing it the
realistic way is arguably part of the exercise.
- Its own certificates. Velociraptor issues its own CA for client comms by
default; whether that stands or is replaced by the lab CA is a small decision
worth making once rather than discovering later.
Not in scope
Sending anything to 10.0.99.20. Lab telemetry stays in the lab (ADR-0007).
Split out of #101.
ADR-0007 puts Velociraptor on
Sarumanalongside Wazuh. The two are notredundant and the distinction is worth stating, because it is the thing that
decides whether this is worth building: Wazuh tells you an alert fired,
Velociraptor is how you go and ask the endpoint what actually happened. The
loop ADR-0007 exists to close — "did the detection fire?" having a clean answer
— needs both halves.
Blocked behind the domain. Lighter than Wazuh by a wide margin; a single Go
binary and a client on each endpoint.
Worth deciding
or its own. Cheaper to co-locate than Wazuh's indexer, and probably fine.
a real estate would do it (GPO) or the way that is quickest. Doing it the
realistic way is arguably part of the exercise.
default; whether that stands or is replaced by the lab CA is a small decision
worth making once rather than discovering later.
Not in scope
Sending anything to
10.0.99.20. Lab telemetry stays in the lab (ADR-0007).