Docs

Appearance

Runbook: Arctic Wolf Monthly Health Check ​

Purpose ​

Verify Arctic Wolf MDR is operationally healthy: agents are connected, the Azure connector is ingesting, VLCs are receiving syslog, and no Arctic Wolf tickets have been left unresolved. A monthly cadence catches silent failures before they become an IR blind spot.

This complements the quarterly arctic-wolf-cmdb-check.md (which reconciles what should be covered) — this runbook confirms how well the covered assets are actually being monitored.

Estimated time: 45–60 minutes. Cadence: First Monday of each month. Can fold into monthly-security-review.md as its Arctic Wolf section.

1. Agent Status — All Managed Devices ​

  • [ ] Log in to the Arctic Wolf Concierge portal
  • [ ] Navigate to Assets → Endpoint Agents
  • [ ] Sort by Status
  • [ ] Record total agent count and compare to last month's total (file: SharePoint → Compliance → Monthly Reviews → YYYY-MM-aw.pdf)
  • [ ] Total count should match the CMDB count for has_aw_agent=true assets within ±2 (±2 accounts for brief maintenance windows). A drift larger than this means the quarterly CMDB check is due early

Status breakdown ​

  • [ ] Connected count — should be ≥ 95% of total
  • [ ] Warning count — investigate each one (typically agent version behind)
  • [ ] Offline count — every offline agent must be accounted for in the 48-hour check below

2. Disconnected Agents > 48 Hours ​

  • [ ] In Concierge → Assets → Endpoint Agents, filter Last Seen > 48h ago
  • [ ] For each host on the list, classify the reason:
ReasonEvidenceAction
VM powered off (DR standby, dev VM weekends)Azure/AWS portal shows deallocated state, documented as expectedNote in review log, no action
Known maintenance windowCM ticket in SecOps covering the host and windowNote in review log, no action
Agent service stoppedVM is running but Arctic Wolf service not runningInvestigate today — ssh/RDP to host, Get-Service -Name "Arctic Wolf*". Restart the service. If it won't start, open a P3 with Arctic Wolf
Host unreachableVM running, agent service running, but no check-inInvestigate today — check Palo Alto for egress blocks to Arctic Wolf cloud, check firewall rule AW-Agent-Egress
Host decommissioned but not deregisteredTerraform state shows destroyedFollow decommission flow in arctic-wolf-cmdb-check.md
  • [ ] Any agent offline > 48h without an expected-cause classification = open a SecOps finding (aw_agent_offline_48h, priority HIGH) and resolve within the month
  • [ ] Any agent offline > 7 days without an expected cause = escalate to Rory the same day

3. Arctic Wolf Portal Open Tickets ​

  • [ ] Log in to Concierge

  • [ ] Navigate to Tickets (or Investigations)

  • [ ] Filter Status = Open

  • [ ] Record open ticket count

  • [ ] For each open ticket:

    • [ ] Confirm Cirius has a corresponding SecOps incident (the Arctic Wolf → SecOps webhook should have created one; if not, create manually and link back in both directions)
    • [ ] Confirm the assigned owner on Cirius side is known and currently active (Rory by default)
    • [ ] If the ticket is awaiting Cirius response > 72 hours, escalate — Arctic Wolf is waiting for us

  • [ ] Resolved tickets in the past month — pull the closed-tickets report for the review window. Read each resolution summary briefly. Look for:

    • Multiple tickets with the same root cause (add a known-good rule or a defensive control)
    • Tickets classified as "benign" that describe activity we should know about even if benign (good candidates for a SecOps known-good entry)

  • [ ] Capture the monthly ticket volume in the review log for trending

4. Azure Connector Status — Both Tenants ​

Arctic Wolf's Azure connector pulls activity logs from each Azure tenant via a service principal. If the connector fails silently, Arctic Wolf loses the entire control-plane view.

Azure PROD tenant (d477c9f8) ​

  • [ ] Concierge → Integrations → Azure — locate the PROD entry
  • [ ] Status should read Active (green) with Last ingestion within 15 minutes of now
  • [ ] Click into the integration detail. Confirm:
    • [ ] Service principal has not expired (check expiry date, rotate ≥ 30 days before)
    • [ ] No recent error entries in the integration log
    • [ ] Ingestion volume reasonable (roughly constant month-over-month)

Azure DDE tenant (ff1c5d68) ​

  • [ ] Same checks as above, but on the DDE integration entry

If a connector is degraded ​

  1. Check the SP credential — rotate immediately if expiring within 30 days
  2. Verify the SP still has the required Azure role assignments (Arctic Wolf documents these; the standard is Reader at tenant root + Security Reader on the Entra tenant)
  3. Open a P3 with Arctic Wolf if the connector error is their-side

5. VLC Health — Network Sensors ​

Four VLCs across the estate (see arctic-wolf-mdr-scope-gap.md for the inventory). Each one must be ingesting syslog and reachable.

  • [ ] Concierge → Assets → Network Sensors

  • [ ] Confirm all four VLCs show Connected

  • [ ] Confirm Events per second figure for each VLC is within expected range (trending month-over-month in the review log)

  • [ ] If a VLC shows Idle (connected but no events), trace the syslog path:

    • PROD (ARCTICWOLFVLC) — expect traffic from SYSLOGAZP forwarding Palo Alto + CEF from the SecOps pipeline
    • DDE (ARCTICWOLFVLCDDE) — expect traffic from SYSLOGDDE
    • AWS Logging (ARCTICWOLFVLCAWP) — expect traffic from SYSLOGAWP
    • AWS DR (ARCTICWOLFVLCDR) — expect traffic from SYSLOG-VM

  • [ ] Verify the corresponding syslog forwarder VM is up and the syslog-ng service is running

  • [ ] Verify firewall rule allowing syslog VM → VLC:514 (UDP) or :6514 (TCP TLS) is still in place and hit-counter advancing

6. New Device Enrollment — Past 30 Days ​

Catch any device that was deployed this month but never registered with Arctic Wolf.

  • [ ] Pull CMDB assets with created_at in the past 30 days and system_type IN ('SERVER','WORKSTATION'):

    ```
curl -s -H "X-API-Key: $SECOPS_API_KEY" \
  "https://soc.bedrockcybersecurity.org/api/cmdb/assets?created_since=30d&in_scope_aw=true" \
  | jq -r '.items[] | "\(.system) \(.source_system) \(.has_aw_agent)"'
```

  • [ ] Every row should show has_aw_agent=true. For any row showing false:

    • Confirm the device actually exists (not a stub record)
    • Run the onboarding flow in arctic-wolf-cmdb-check.md — "New Resource Onboarding"
    • Re-verify on the next check-in

  • [ ] Cross-check CI/CD change tickets — every merged PR that introduced an in-scope resource should have an onboarding CM ticket in SecOps. Any missing = process gap, log and fix

7. SecOps Integration Health ​

The SecOps aw_coverage_agent runs on the 4-hour cycle and flags any CMDB asset with has_aw_agent=true where Arctic Wolf has not checked in. Verify the agent itself is healthy.

  • [ ] SecOps → Findings → filter source=aw_coverage_agent
  • [ ] Findings count should be approaching zero (one or two transient findings per cycle is normal during maintenance)
  • [ ] Confirm the aw_coverage_agent last-run timestamp is within the last 4 hours — if stale, the Container Apps Job is unhealthy

8. Sign-Off ​

  • [ ] Summarize the month's findings in one paragraph (new devices, agent status, VLC events, notable tickets)

  • [ ] Export the review to PDF and file in SharePoint → Compliance → Monthly Reviews → YYYY-MM → arctic-wolf-health.pdf

  • [ ] Post the summary to SecOps as evidence:

    ```
POST /api/evidence
{ "source": "arctic-wolf-health-check",
  "period": "YYYY-MM",
  "summary": "...",
  "archive_uri": "<sharepoint-url>" }
```

  • [ ] Update any trending metrics in the compliance dashboard

Signed off by: __________________ Date: __________________

Quick Checklist (Printable) ​

[ ] Total agent count vs CMDB (±2)
[ ] Connected ≥ 95%
[ ] Zero unexplained agents offline > 48h
[ ] Zero unexplained agents offline > 7d
[ ] All open AW tickets mapped to SecOps incidents
[ ] Azure connector PROD — Active, ingesting
[ ] Azure connector DDE — Active, ingesting
[ ] VLC PROD — Connected, EPS in range
[ ] VLC DDE — Connected, EPS in range
[ ] VLC AWS Logging — Connected, EPS in range
[ ] VLC AWS DR — Connected, EPS in range
[ ] Every new-this-month CMDB asset has has_aw_agent=true
[ ] aw_coverage_agent findings at/near zero
[ ] Monthly summary filed to SharePoint + SecOps evidence

Change History ​

DateChangeAuthor
April 2026Initial monthly health check runbookKobe

Internal use only — Cirius Group