Endpoint monitoring for air-gapped networks

Each administrator should log in with a named account, and the platform should record who did what. Wazuh keeps its own audit trail of dashboard and API activity, and Velociraptor records actions taken in its GUI and API, including artifact collections and hunts. Auditors typically want these records exported to a location the administrators cannot edit, and they want a sample reconciled against the account list. Confirm with your platform team how each component logs authentication and whether logs forward to an enclave-local store. Under the HIPAA Security Rule at 45 CFR 164.312, unique user identification and audit controls are explicit technical safeguards, so this evidence maps directly to that requirement. DeployOpen prepares the evidence and configuration, but auditors issue any opinion on whether it is sufficient.

You need records of logins, privilege changes, configuration edits and monitoring actions performed by authorized users. In this design, Wazuh records administrative and rule changes on the server and indexer, while Velociraptor logs hunts, collections and artifact changes. The FTC Safeguards Rule at 16 CFR 314.4 requires covered financial institutions to monitor and log the activity of authorized users, so these logs are often the first thing examiners request. Define a retention period with your compliance team, and confirm that logs from both platforms land inside the enclave with timestamps synchronized to an internal time source. DeployOpen can configure log export and document the retention settings, and your auditors decide whether coverage meets your obligations.

Record a cryptographic hash and the source of every transferred file, then verify it again on arrival inside the enclave. Each transfer should have a manifest listing package names, versions, hashes, the person who approved the transfer and the date. Verification should be repeated before installation, and failed checks should be logged and escalated. NERC CIP-013-2 requires supply chain processes to address verification of software integrity and authenticity for vendor software and patches, which is the control behind this check. Confirm with your procurement or grid compliance team which verification method and signing keys they accept. DeployOpen can script the manifest and verification steps and prepare the procedure documents, while the auditor evaluates whether the process is adequate.

Keep a dated record of each vulnerability data import, the source it came from, and the hash of the file imported. Wazuh vulnerability detection can use an offline vulnerability repository instead of the Wazuh Cyber Threat Intelligence platform, so the import log and the repository version become the evidence of currency. Show the time between each import and the most recent vendor release you were able to obtain, and document any gaps with the compensating controls you used. Auditors usually look for a defined update cadence and proof that it was followed, not perfect freshness. Confirm the update cadence with your security governance team before you set a target. DeployOpen can build the import workflow and reporting, and the cadence itself is your decision.

In an air-gapped design, telemetry should be stored only inside the enclave, on storage you control, with retention rules written down and enforced. Wazuh stores alerts in its indexer, and Velociraptor keeps its data in files on the server filesystem, so both locations should be named in the system security plan. Auditors typically ask for the retention period, the storage location, who can access the data and how deletion is recorded. Confirm with your legal and records teams what period applies to your sector, because regulators set different minimums. DeployOpen can configure storage paths, access controls and retention settings, and can document them for assessment.

Preserve each collection with its original output, a hash, the artifact definition used, the collector identity and the time of collection. Velociraptor offline collectors can write results to JSONL or CSV, and the export package should be hashed and stored in write-once or access-restricted storage. Keep a chain-of-custody log that records each person who handled the data and each transfer inside the enclave. Confirm with your incident response counsel what format and handling your insurers, regulators or law enforcement expect, since those requirements vary. DeployOpen can set up collection handling and document the procedure, while the adequacy of evidence is determined by the parties receiving it.

No. DeployOpen plans, implements, hardens and documents the monitoring system and prepares the evidence an assessor will request, including configuration records, logs, procedures and test results. It does not issue audit reports, attestations or certifications. Independent auditors and certification bodies make those determinations. Before scoping the work, ask your assessor which evidence formats they accept and which controls they expect to test. Scope, deliverables and timelines are agreed in writing before work starts, so the evidence list can be fixed in the statement of work.

The main cost drivers are endpoint count, server and storage sizing, the media transfer process, the offline vulnerability workflow and detection tuning. The software itself is open source, so the spend goes to infrastructure, engineering labor and ongoing operations. Wazuh is distributed under GPL-2.0 and Velociraptor under AGPL-3.0, so neither carries a per-endpoint license fee to pay for the build. Ask any quote to break out hardware, implementation, documentation, and recurring update work separately, so each driver can be tested against your own enclave.

A team with Linux administration, Windows endpoint management and a clear change process can deploy it internally, because Wazuh documents an offline installation guide and Velociraptor offers offline collectors built from its GUI. The harder parts are usually not the installers. They are building a trusted transfer path for packages and rules, keeping an offline vulnerability repository current, sizing the indexer, and tuning detections so analysts trust the alerts. Organizations often decide based on how many people can own these tasks after go-live, and that answer should appear in any scope agreement.

The timeline depends on scope, including how many enclaves are involved, how many endpoint types need coverage, whether staging hardware exists, and how long your approval and media-handling process takes. No general duration is supported by the sources used for this page, so do not accept a schedule that is not written against a defined scope. DeployOpen works on fixed-scope engagements, with scope, deliverables and timelines agreed in writing before work starts. Ask for milestones tied to a pilot enclave and a documented acceptance test.

Prepare an inventory of the enclave boundary, the list of systems and endpoints in scope, the network segments and their allowed flows, and the approval path for bringing software and data across the boundary. You will also need staging hardware or virtual machines that match the target sizing, and a named owner for media transfers. Confirm which operating systems and legacy hosts are present, since agent support varies by platform. The clearer this inventory, the fewer assumptions a quote has to carry.

One-time work includes architecture, the initial offline installation, staging, agent rollout across the estate, documentation and the first set of detection and dashboard tuning. Recurring work follows the vendor release cycle and your own process. Wazuh shipped 4.14 patch releases on 17 March, 23 April, 1 July, 29 July, 23 September and 14 October 2026, so the update cycle is a steady operating task. Each update, rule set, vulnerability feed and Velociraptor artifact update must be validated, packaged, transferred and tested. Ask a partner to price these cycles separately, and to say whether they are included in a retainer.

Every update crosses the boundary on approved media, so the transfer process sets much of the recurring effort. Each cycle includes packaging, hashing, malware scanning, approval, import and verification. NERC CIP-013-2 requires supply chain procurement processes that address verification of software integrity and authenticity for vendor software and patches, which is the reason many organizations verify every package before it enters. Confirm how many transfer cycles per month your change board allows and who signs off, because that determines how often the enclave can be patched.

It adds recurring work rather than a license fee. Wazuh vulnerability detection can use an offline vulnerability repository instead of the Wazuh Cyber Threat Intelligence platform, so the enclave must receive a current copy of that data through the transfer process. The effort depends on how often you refresh it, how many systems depend on it, and how you prove the data was current at a given date. Ask for the refresh cadence, the staging and checksum steps, and a method for showing which feed date each alert was based on.

Tuning drives the amount of analyst time needed after go-live, because an offline environment has no fast external feed to fall back on when rules are noisy. Expect work on decoders, rules, suppression lists, file integrity settings and Velociraptor artifacts for each host type. Velociraptor artifacts can be modified in the GUI without rebuilding clients or servers, which keeps tuning inside the enclave. Ask a partner how many tuning cycles are included in the build, and how they will document each change for auditors.

For Wazuh and Velociraptor, the sources used here describe open-source licenses and documented offline procedures, so the core tools do not depend on a commercial tier to run offline. Other vendors do gate air-gapped deployment behind paid editions, including Mattermost Enterprise Advanced, Metabase Enterprise and Element's Sovereign edition, so the licensing question is different for each product in your stack. Confirm the license for every component you plan to add, including any commercial threat intelligence, storage or support subscription, before you finalize the budget.