We watch the pipeline. Never what flows through it.
A monitoring tool for security teams has to be easy to approve. IngestProof is designed so your clients' data never leaves their environment, and so you can verify that yourself.
What IngestProof receives
- Check names and status (ok, warn, high, critical)
- Short check messages, such as "wazuh-db is not running"
- Counters: events received, dropped and discarded
- Canary arrival time
- Indexer health, disk usage and watermark state
- Agent version, the cluster name you choose, and the manager's hostname
- Indexer node and index names where a message needs them, and the indexer URL if it can't be reached
What it never receives
- Log lines or event payloads
- Alerts or rule matches about your clients
- Endpoint hostnames, IPs or agent inventories
- Credentials for Wazuh, the indexer or anything else
- Anything sent inbound to your network: there is no inbound connection
How it's built.
Outbound only
The agent sends reports over HTTPS with TLS certificate verification. Nothing connects into your network, and no ports need opening.
Hashed secrets
Every cluster has its own push token. We store only a SHA-256 hash of each token and dashboard key, never the secret itself.
EU-region storage
Health data is stored in a Western Europe database region on Cloudflare's infrastructure.
Readable agent
The agent is a plain Python script and its rules are plain XML. Read every line before you install it, at ingestproof.com/agent/.
Verified installs
The installer checks every downloaded file against published SHA256 sums and refuses to continue on a mismatch.
Clean removal
One command removes the agent, its rules, its timer and its ossec.conf block, and checks that Wazuh still validates afterwards.
Exactly what one report looks like.
A trimmed example of one report. Every report has this shape: check results with short messages and a few counters, nothing else.
Questions from your security team?
We'll answer them before you install anything.