160 lines
6.5 KiB
JSON
160 lines
6.5 KiB
JSON
{
|
||
"execution_boundaries": {
|
||
"agent_identity_public_display_allowed": false,
|
||
"host_write_authorized": false,
|
||
"internal_ip_public_display_allowed": false,
|
||
"not_authorization": true,
|
||
"raw_wazuh_payload_storage_allowed": false,
|
||
"runtime_execution_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"wazuh_active_response_authorized": false,
|
||
"wazuh_api_live_query_authorized": false
|
||
},
|
||
"forbidden_payloads": [
|
||
"raw_wazuh_payload",
|
||
"raw_log",
|
||
"full_journal",
|
||
"unredacted_screenshot",
|
||
"agent_name",
|
||
"internal_ip",
|
||
"authorization_header",
|
||
"bearer_token",
|
||
"basic_auth",
|
||
"password",
|
||
"token",
|
||
"cookie",
|
||
"private_key",
|
||
"client_keys",
|
||
"raw_dashboard_request",
|
||
"dashboard_api_secret",
|
||
"stored_api_password",
|
||
"api_token",
|
||
"active_response_enable",
|
||
"host_write",
|
||
"firewall_change",
|
||
"nginx_reload"
|
||
],
|
||
"mode": "redacted_metadata_only_no_secret_no_wazuh_query",
|
||
"operator_interpretation": [
|
||
"這是 Wazuh agent registry 脫敏證據收件前的預檢，不代表已收到或已接受 owner evidence。",
|
||
"agent service active、TCP 連線存在、Dashboard 可見或口頭宣稱都不可替代 manager registry counts。",
|
||
"逐主機 registry export 必須使用固定公開節點別名與狀態桶，不能把 agent 原名或內網識別資訊帶到前台。",
|
||
"若 evidence 夾帶 raw log、未脫敏截圖、內網位址、agent 原名或 secret，必須隔離，不得渲染到前台。",
|
||
"Dashboard index pattern 三綠勾不可替代 API connection、API version 或 manager registry 驗收。",
|
||
"任何 active response、host write、firewall、Nginx、Docker、K8s 或 secret 變更都要切獨立人工批准。"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_evidence",
|
||
"request_missing_fields",
|
||
"quarantine_sensitive_payload",
|
||
"reject_runtime_action_request",
|
||
"request_dashboard_api_status_supplement",
|
||
"request_dashboard_api_repair_postcheck",
|
||
"reject_index_pattern_only_green",
|
||
"ready_for_reviewer_validation"
|
||
],
|
||
"registry_export_contract": {
|
||
"allowed_collection_methods": [
|
||
"wazuh_api_readonly_redacted_counts",
|
||
"manager_agent_control_redacted_export"
|
||
],
|
||
"expected_scope_aliases": [
|
||
"managed_core_node_a",
|
||
"managed_core_node_b",
|
||
"managed_dev_node_a",
|
||
"managed_dev_node_b",
|
||
"managed_control_node_a",
|
||
"managed_control_node_b"
|
||
],
|
||
"per_host_required_fields": [
|
||
"node_alias",
|
||
"scope_role",
|
||
"registry_presence",
|
||
"agent_status_bucket",
|
||
"last_seen_state",
|
||
"manager_group_ref",
|
||
"agent_id_redacted_ref",
|
||
"gap_reason",
|
||
"redacted_evidence_ref"
|
||
],
|
||
"redaction_requirements": [
|
||
"只允許公開節點別名，不允許內網位址、主機原名或 agent 原名。",
|
||
"agent id 僅能用不可逆 evidence ref，不得放完整值、雜湊、前後綴或 client key。",
|
||
"每個缺口必須有 gap reason，不得以 Dashboard 空白或口頭說明補成綠燈。",
|
||
"Dashboard API connection / version / index pattern 必須分欄呈現，不得合併成單一 healthy。",
|
||
"Dashboard API 修復證明只能收脫敏 ref，不得收 stored API secret、token、密碼或完整 request。",
|
||
"只收計數、狀態桶、時間窗與證據 ref，不收 raw API payload、完整 CLI output 或截圖原文。"
|
||
],
|
||
"registry_export_accepted_count": 0,
|
||
"registry_export_received_count": 0
|
||
},
|
||
"required_fields": [
|
||
"owner_role",
|
||
"team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"collection_method",
|
||
"agent_total",
|
||
"agent_active",
|
||
"agent_disconnected",
|
||
"agent_never_connected",
|
||
"last_seen_window_start",
|
||
"last_seen_window_end",
|
||
"registry_collected_at",
|
||
"registry_export_scope_aliases",
|
||
"per_host_registry_matrix",
|
||
"registry_gap_reason_by_alias",
|
||
"registry_export_summary_ref",
|
||
"manager_health_ref",
|
||
"dashboard_api_status_ref",
|
||
"dashboard_api_connection_check_status",
|
||
"dashboard_api_version_check_status",
|
||
"dashboard_index_pattern_statuses",
|
||
"dashboard_api_degradation_root_cause",
|
||
"dashboard_api_repair_postcheck_ref",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"rollback_owner",
|
||
"postcheck_plan"
|
||
],
|
||
"reviewer_checks": [
|
||
"欄位齊全且皆為脫敏 metadata。",
|
||
"agent_total 不可小於 active + disconnected + never_connected。",
|
||
"collection_method 只能是既有唯讀 API 或 manager 端脫敏 CLI 匯出，不可要求 secret 明文。",
|
||
"registry_export_scope_aliases 必須完整覆蓋 6 個公開節點別名。",
|
||
"per_host_registry_matrix 每列只能使用公開別名，不得包含內網位址、agent 原名或 raw payload。",
|
||
"last_seen 時間窗需能覆蓋事故觀察區間。",
|
||
"manager health ref 與 dashboard API status ref 不可互相替代。",
|
||
"Dashboard API connection 若仍是 pending / spinning，不得接受為 Wazuh 可用。",
|
||
"Dashboard API version 必須獨立驗證；index pattern 三綠勾不可替代 API version。",
|
||
"index pattern 已通過只能代表索引 pattern 可讀，不可替代 manager registry counts。",
|
||
"Dashboard API 退化根因必須至少分類為 stored API、RBAC / run_as、rate-limit、TLS trust 或 readonly account scope 其中之一。",
|
||
"dashboard API repair postcheck 必須包含 API connection、API version、manager registry counts 與 IwoooS readback。",
|
||
"redacted evidence refs 不得包含 raw payload、截圖原文或主機完整輸出。",
|
||
"owner decision 不可直接授權 active response、host write 或 secret rotation。",
|
||
"rollback owner 與 postcheck plan 必須存在。"
|
||
],
|
||
"schema_version": "wazuh_agent_visibility_owner_evidence_preflight_v1",
|
||
"scope": "wazuh_agent_visibility_registry_truth",
|
||
"status": "owner_evidence_preflight_ready_no_runtime_action",
|
||
"summary": {
|
||
"active_response_authorized_count": 0,
|
||
"expected_scope_alias_count": 6,
|
||
"forbidden_payload_count": 22,
|
||
"host_write_authorized_count": 0,
|
||
"outcome_lane_count": 8,
|
||
"owner_evidence_accepted_count": 0,
|
||
"owner_evidence_quarantined_count": 0,
|
||
"owner_evidence_received_count": 0,
|
||
"owner_evidence_rejected_count": 0,
|
||
"per_host_required_field_count": 9,
|
||
"registry_export_accepted_count": 0,
|
||
"registry_export_received_count": 0,
|
||
"required_field_count": 28,
|
||
"reviewer_check_count": 15,
|
||
"runtime_gate_count": 0,
|
||
"secret_value_collection_allowed_count": 0
|
||
}
|
||
}
|