01 · Log Sources
Wazuh Agent, host Mac
02 · Correlation Engine
Wazuh Manager, manager-only mode
03 · Watcher Script
Python + launchd, HMAC-signs escalations
04 · Cloud Webhook Receiver
Apps Script, signature-verified
05 · T2 Analyst
Restricted Google Sheet
06 · Rule Tuning
Weekly report from real decisions