Wazuh SIEM (retired)

Wazuh is no longer the security monitoring path. The infra-services stack was torn down, its Docker volumes were deleted, and the wazuh-agent package was removed from managed hosts. site.yml does not install it again.

Logs: Graylog remains the central syslog path for network gear and unmanaged senders. Loki remains the container ops log store.

Historical restic snapshots of the old Wazuh data stay where they were written. Do not forget that repository as part of this retirement, and do not restore the stack from them.