Every stage of the pipeline, checked end to end.
Process checks tell you a service is running. IngestProof checks that events are actually moving: into the manager, through analysis, out to the indexer, and into a searchable index.
Where events get lost, and what watches each stage.
What runs on every report.
The agent runs every 2 minutes. Each report carries the result of every check, so a status change reaches you on the next run.
| Check | What it catches |
|---|---|
| End-to-end canary | Any break between the manager and a searchable index, including the ones no single component reports, like a frozen shipper. Tells you whether the break is before or after the manager. |
| Manager daemons | wazuh-db, analysisd, remoted and the rest, checked one by one. Catches a dead daemon while the systemd unit still says "active". |
| wazuh-db memory | Runaway memory growth before the kernel's OOM killer takes the manager down. |
| Event drops | analysisd dropped events and remoted discards, from Wazuh's own counters. |
| UDP syslog loss | Kernel receive-buffer overflows that silently discard syslog before Wazuh ever sees it. |
| Disk | Space on the manager and indexer before it becomes an outage. |
| Indexer health | Cluster status, disk watermarks, read-only index blocks and stuck index management. |
| Agent silent | Raised by IngestProof itself when a manager misses three reports in a row: host down, network cut, or the agent stopped. |
One line on each manager.
Run it as root on the Wazuh manager. Each cluster gets its own token from us. The installer checks every file against published SHA256 sums, and if Wazuh rejects the new rules it rolls everything back.
Requirements
- Wazuh 4.x manager on Linux with systemd
- python3 on the manager
- Outbound HTTPS to api.ingestproof.com
What it adds
- The agent and a 2-minute systemd timer
- Its own rule file (IDs 100850–100869)
- One marked block in ossec.conf, backed up first
- A config file readable by root only
What it never touches
- Your existing rules and decoders
- Endpoint agents
- Firewall or inbound ports
- Your log data
Built to keep working when things break.
Retries and an offline spool
If IngestProof can't be reached, the agent retries, then keeps its reports and replays them when the link is back. Completeness figures survive the outage, and each report is counted exactly once.
Alerts from the outside
Alerts are sent by IngestProof, not by the cluster being watched. A dead manager still produces an alert, because silence is itself a signal.
Local alerts too
Every check result is also written into Wazuh through the agent's own rules, so your SOC sees pipeline problems in the tools it already uses.
See it on your own clusters.
Free for 30 days. We send you the install command; you run one line per manager.
Start a free pilot