Your SIEM looks fine.
Is it still seeing anything?
Daemons die while the service says "active". Filebeat stalls. Indices go read-only. The dashboard stays calm and your client goes unmonitored. IngestProof proves every client pipeline is delivering events, and alerts you in seconds when one isn't.
Pick a failure. See who notices.
These are real failure modes, reproduced on a real Wazuh 4.x manager. Detection times are what IngestProof measured in those tests.
No errors. No alerts. Looks like a quiet hour.
wazuh-manager.service is active but these
daemons are not running: wazuh-db
wazuh-db killed with SIGKILL while the unit stayed active
Live on a manager in under a minute.
No inbound ports, no endpoint agents, no changes to your detection rules. A small agent runs next to each Wazuh manager and reports over outbound HTTPS.
One command per manager
The installer verifies checksums, adds its own rule file, validates the config, and rolls back if anything fails.
A canary through the whole pipeline
Every few minutes, a marker event must travel from the manager to a searchable index. If it doesn't arrive, something between them is broken.
From outside the cluster
Alerts go to Slack, ntfy or any webhook from IngestProof's side, so they still fire when the manager itself is down.
One view across every client.
Evidence for every SLA.
All clusters, one screen
Every client's pipeline status, canary time and worst check, side by side.
Completeness %
The share of offered events actually processed, per client, over 30 days. A number you can put in front of a client.
Dead man's switch
If a manager stops reporting at all, that is an alert too, raised from outside the client's network.
Nothing sensitive leaves
Only counters and check results. No logs, no alerts, no endpoint data, which keeps your DPA short.
We broke a real Wazuh manager on purpose.
Fault-injection results from a live Wazuh 4.x all-in-one, running the same one-line install and hosted service you would use.
| Fault injected | What IngestProof did | Detected |
|---|---|---|
| wazuh-db killed, unit still "active" | CRITICAL on manager daemons; recovery sent after the restart | 34 s |
| Filebeat stopped | Pipeline alert; alerts not reaching the indexer | 50 s |
| Filebeat frozen (process alive) | Canary missing; pinpointed the break as after the manager | 13 min |
| Manager cut off from the internet | CRITICAL agent silent; spooled reports replayed afterwards and counted once | 6 min |
| Indexer red at boot | CRITICAL, then cleared on its own with a recovery message | next run |
Find out what your pipeline is hiding.
We're onboarding a small number of MSSPs for a free 30-day pilot, in exchange for honest feedback.
- Free for 30 days, no card, on as many clusters as you like
- Set up for you: we send a one-line install command per manager
- Remove it any time with --uninstall
- A real person replies within one working day