Arctic Wolf Portal — Full Ingestion Validation

Cadence: Quarterly (add calendar reminder for Jan 1, Apr 1, Jul 1, Oct 1) Owner: Infrastructure (Rory) Related story: AWMDR-004 Estimated time: 45–60 minutes

Purpose

Verify end-to-end that Arctic Wolf is receiving telemetry from every log source and agent we expect it to. Arctic Wolf is our primary MDR provider — if a source goes silent, detection coverage for that source disappears. This runbook catches silent regressions between Arctic Wolf internal monitoring cycles.

Pairs with the connector-specific runbooks:

• arctic-wolf-onelogin-connector.md
• arctic-wolf-aws-connector.md

What Arctic Wolf ingests at Cirius

Source	Path	Expected volume (order of magnitude)
Azure AD sign-in + audit	App registration c474a690-4186-476e-9c01-b3dcbfdafee9 → AW Azure connector (Graph pull)	Thousands/day, business hours
Microsoft Defender / Exchange alerts	Graph via the Azure connector	Tens to hundreds/day
Endpoint agents (managed Windows + macOS)	Arctic Wolf agent on endpoint → AW cloud	Heartbeat every ~5 min, events as they occur
Palo Alto firewalls (CEF)	PA → syslogdsh (10.5.2.5) → arcticwolfvlc (10.5.2.11) → AW cloud	Millions/day
AWS telemetry	CloudTrail + GuardDuty via AW AWS connector (see AWS connector runbook)	Thousands/day
OneLogin SSO (if active)	OneLogin → AW connector (see OneLogin connector runbook)	Low volume or zero (see runbook)

Pre-flight

• [ ] Log in to the Arctic Wolf portal: https://portal.arcticwolf.com/
• [ ] Confirm you are operating on the correct customer tenant ("Cirius Group")
• [ ] Have the Cirius MDR Concierge email handy in case any check fails

---

Check 1 — Portal "Sensors & Connectors" health

Where: Portal → Configuration → Sensors (or Portal → Environment → Sensors, depending on UI version)

Action:

1. Open the Sensors and Connectors view.
2. Every listed sensor/connector should show status Online / Healthy (green).
3. For any item not green:
   • Note the sensor name, status, and "last reported" timestamp.
   • Open the Cirius internal alerts channel and see if there's already an existing ticket.
   • If not, file one (SecOps → new story tagged AWMDR-validation) and open a case with AW Concierge.

Expected Cirius sensors/connectors:

Name	Type	Location	Notes
arcticwolfvlc (Azure)	VLC sensor	firewall subscription, 10.99.2.11	Primary CEF / syslog collector
arcticwolfvlc (AWS)	VLC sensor	DR environment, us-west-2	AWS-side CEF / syslog
Azure AD / Entra connector	Cloud connector	Cirius tenant	App ID c474a690-4186-476e-9c01-b3dcbfdafee9
AWS connector	Cloud connector	Org account 206820231356	See AWS connector runbook
OneLogin connector (optional)	Cloud connector	—	See OneLogin connector runbook

Any VLC showing Last Contact older than 30 minutes is a high-priority fix — escalate immediately.

Check 2 — "Not Reporting" banner

Where: Portal → Dashboard (top of landing page)

Action:

1. Scan for the "Not Reporting" banner or tile.
2. If present, click through to see which devices / log sources are affected.
3. For each device:
   • Cross-reference the asset in our CMDB (Azure resources + Intune) to confirm it still exists.
   • If retired: trigger a removal from the AW portal via Concierge.
   • If active: investigate local agent health (Azure Monitor / Intune logs; for Palo Alto, check the syslog forwarding path through syslogdsh).
4. Record the list of affected devices, disposition, and action in the validation log at the bottom of this runbook.

Check 3 — Endpoint agent enrollment freshness

Where: Portal → Endpoint → Agents (or equivalent Agents/Devices list)

Action:

1. Sort agents by First Seen descending.
2. Confirm every device enrolled in the last 24 hours matches an actual new Intune enrollment or a VM built in the same window.
   • Cross-check against Intune → Devices → Enrolled in last 24h and against the recent azure-infra / aws-infra merges.
3. Sort agents by Last Seen ascending. Anything older than 7 days on a supposedly active device is stale.
   • Confirm the device is still in use (not decommissioned).
   • If active: open an AW Concierge case to re-push the agent.
4. Spot-check that AW agent count roughly matches Intune managed device count (±5% allowable drift for loaner devices / recently shipped hardware).

Check 4 — Azure connector subscription coverage

Where: Portal → Configuration → Cloud Connectors → Azure → Details

Action:

1. Confirm the connector is using App ID c474a690-4186-476e-9c01-b3dcbfdafee9 (the Arctic Wolf Azure Sensor SP registered in our tenant).

2. Click through to see which subscriptions the connector has Reader / Security Reader access to. Expected set (both tenants combined):

   Cirius Group (prod tenant d477c9f8):

   • Main
   • Logging
   • Firewall
   • DMZ
   • Prod
   • Dashboard
   • Identity
   • Dev

   Cirius DDE (tenant ff1c5d68):

   • Main (DDE)
   • Logging (DDE)
   • Firewall (DDE)
   • Identity (DDE)

3. Any subscription missing from this list → open an AW Concierge case to extend the connector. IAM binding is done via main/iam_arctic_wolf.tf on the Cirius side; record the subscription and follow the IAM-first pattern (grant role, then ask AW to rescan).

4. Confirm Active Response app is also listed and healthy (second app, separate from the monitoring SP — see azure-infra/entra/arctic-wolf-active-response.tf). Active Response grants Graph write for identity containment actions (disable user, remove from group, force password reset, close sessions).

Check 5 — Ingestion volume sanity

Where: Portal → Search / Investigations (or Reports)

Action: run a rolling 24-hour count against each source. Compare against the expected order-of-magnitude from the table at the top. Red-flag if any source is 10x below its expected baseline.

Record the observed numbers:

Source	24h count (previous quarter)	24h count (this quarter)	Delta
Azure AD sign-ins
Azure AD audit
Endpoint agent events
PA traffic (CEF)
AWS CloudTrail
AWS GuardDuty findings
OneLogin (if in use)

Anything >10x low quarter-over-quarter is an escalation.

Check 6 — Cross-reference with LAW

Even though Arctic Wolf is our MDR of record, we also tee the Palo Alto CEF stream to the central Log Analytics workspace cirius-logging-law-ops so detections can be cross-verified.

1. In LAW, run CommonSecurityLog | summarize count() by bin(TimeGenerated, 1h) | render timechart over the last 24 hours.
2. The shape should roughly match the shape of AW's PA ingest. Identical peaks and troughs is the expected pattern.
3. A shape divergence means the CEF stream has partially broken — investigate syslogdsh rsyslog and the arcticwolfvlc 10.5.2.11 listener.

Escalation

Severity	Path
Sensor offline >30min	Arctic Wolf Concierge (email + portal case)
Azure connector missing subscription	Rory (IAM) + Concierge (connector scan)
Ingestion volume 10x low on any source	Rory — page directly if during business hours
"Not Reporting" device on known-active asset	Concierge + Intune re-push
Silent failure (no alert fired for a known-noisy source 24h+)	Rory + Concierge P1

Validation log

Append each quarter's run below. Keep the last 8 quarters.

Quarter	Date	Operator	Sensors green?	Azure subs covered?	Ingestion volumes OK?	Issues opened
Q2 2026	2026-04-16	kobe	☐	☐	☐	—