Shepherd

Auth, system, application, and firewall logs across all agents

Process, registry, and network anomalies on endpoints

Rootkit, trojan, and policy violation scans

YARA rules, hash matching, and suspicious file activity

Known-bad IPs, domains, and file hashes from threat feeds

OS packages, libraries, and CVE mapping

CIS benchmarks and hardening policy compliance

Critical system and config file changes

PCI-DSS and GDPR control mapping from Wazuh checks

Automated countermeasures — requires Bangkaew approval for high impact

Alert-to-tactic mapping for incident correlation

Endpoint enrollment, health, groups, and agent versions

AWS CloudTrail and IAM policy monitoring

Docker daemon events and image vulnerability alerts

GitHub audit logs and SaaS sign-in anomalies

Visualizations, custom views, and alert dashboards

OpenSearch cluster storing all alerts and events (port 9200)

REST API for agent management and config (port 55000)