Security Audit
📖 Best for: Super admins / security ops — anyone who wants a unified view of platform and host security events (intrusion detection / vulnerabilities / logs / file changes) without switching between multiple external systems.
📖 Reading time: 5 minutes
📖 In one sentence: Security Audit is YingCore's entry point to the external SIEM platform Wazuh — it provides host intrusion detection (HIDS), log analysis, file integrity monitoring (FIM), vulnerability detection, and security alerts. YingCore integrates with Wazuh via JWT single sign-on (SSO), so an admin can click the menu and jump to the Wazuh security dashboard in a new window with no password. Access from the top nav "Security Audit" (opens in a new window) — super admin only.
How it differs from "YingClaw Session Audit": Security Audit = platform/host security events (intrusions, vulnerabilities, file changes, logs); YingClaw Session Audit = digital employee sessions / commands / API usage. The two systems are independent and each handles its own scope — do not confuse them.
Function Overview
1. Core Value
- One entry, straight to the Wazuh dashboard: No need to remember the Wazuh URL or maintain two sets of credentials — click "Security Audit" in YingCore's top nav and JWT SSO jumps you over without typing a password.
- Five security capabilities in one place: HIDS (host intrusion detection) + log analysis + file integrity monitoring (FIM) + vulnerability detection + security alerts — one panel covers all host-side security events.
- Alerts and response in one place: When a Wazuh rule fires, you can drill down into the event, locate the host / time / rule, and respond directly — no need to open a second system.
- Strictly separated from YingClaw Session Audit: Security Audit handles "machine and system security" (attacks, file changes, vulnerabilities), YingClaw handles "what the digital employee did" (which tools were called, which commands ran). Each side owns its own scope — no overlap.
- Super admin only + ticket expiry protection: Only super admins can see it; the SSO ticket is valid for about 1 hour and is re-issued on demand — convenient without leaving long-lived backdoors.
2. Main Capabilities
"Security Audit" itself does not provide a standalone page — clicking the menu opens the Wazuh Dashboard (wz-home application panel) in a new window. On the YingCore side there is 1 entry + 4 integration capabilities; on the Wazuh side there are 5 main modules.
YingCore Integration Layer (4 capabilities)
| Capability | Description |
|---|---|
| Top nav menu | YingCore top nav "Security Audit", visible only to super admin accounts |
| JWT single sign-on (SSO) | Click and jump — no Wazuh username or password required; ticket valid for ~1 hour, click the menu again to get a new one |
| New window jump | Clicking opens the Wazuh Dashboard in a new browser window / tab, without interrupting the current YingCore session |
| Permission isolation | Super admin only; regular users do not see this menu after logging in — isolation at the entry point |
Wazuh Platform Capabilities (5 modules)
| Module | What it provides |
|---|---|
| Security events overview | Host security status, active alerts, risk-level distribution |
| Log analysis | Cross-host log search, filter, aggregation (integrates with syslog / journald / file logs) |
| File integrity monitoring (FIM) | Alerts on changes to critical files / directories (e.g. /etc/passwd, configs, binaries) — who / what / when |
| Vulnerability detection | CVE-based asset vulnerability scan (OS + installed packages), sorted by severity |
| Alerts and response | Rule firing → event drill-down → response (acknowledge / close / escalate), with alert lifecycle management |
Cross-cutting Capabilities (3)
- Multi-source log ingestion: Wazuh agents push to manager, supports Linux / Windows / macOS
- Rule engine: Built-in MITRE ATT&CK mapping, custom rules extendable as needed
- Alert lifecycle: Each alert has 7 states (open / acknowledged / escalated / resolved / closed / false positive / duplicate), supports team collaboration
3. Typical Use Cases
- Host intrusion investigation: A host's CPU suddenly spikes → in Wazuh's "Security events overview" you see the HIDS alert → drill into the alert details → check logs and file changes, trace the intrusion path.
- Critical file change alert: Monitor
/etc/passwd,/etc/shadow, Nginx configs, and other critical files → Wazuh FIM detects a change → alert is pushed → admin immediately confirms whether it's a normal ops change or an attack. - Bulk asset vulnerability remediation: Vulnerability scan finds the same high-severity CVE on 50 hosts → filter by host / severity → schedule remediation → re-scan to confirm closure.
- Cross-host log tracing: A user reports an operation failure → in Wazuh's "Log analysis" search cross-host logs by time window / keyword → locate which service / which machine caused the issue.
4. Usage Guide
1. Entry and Permissions
- Top-level nav "Security Audit" (shield icon), click to open the Wazuh Dashboard in a new window
- Super admin only; regular users do not see this menu after logging in (isolation at the entry point)
- First-time use requires the platform admin to have completed Wazuh service integration and shared-key configuration
2. SSO Jump → View the Wazuh Panel
- Click "Security Audit" in YingCore's top nav → SSO validation runs automatically → the Wazuh home page (
wz-home) opens in a new browser window - Once inside, use the 5 main modules as needed:
- Security events overview — view current alerts and host status
- Log analysis — search logs across hosts (keyword / time window / host filter)
- File integrity monitoring (FIM) — check critical file changes (who / what / when)
- Vulnerability detection — view asset vulnerability list, sorted by CVE severity
- Alerts and response — handle active alerts (acknowledge / escalate / close)
- Wazuh's panel operations are provided by the Wazuh platform; this doc only covers entry and basic navigation
3. Exception Handling and Rollback
| Exception | Handling |
|---|---|
| Click "Security Audit" and see "Failed to get Wazuh redirect URL" | Contact the platform admin to check whether the Wazuh service is online and the shared key is configured correctly |
| After the jump, Wazuh prompts for login / session expired | SSO ticket is valid for about 1 hour; once expired, go back to YingCore and click the menu again to get a new ticket |
| A regular user cannot see the "Security Audit" menu | This is by design, not a bug — the menu is super admin only; if you need to authorize a user, first promote them to super admin |
| You see an alert in Wazuh but not in YingCore | The two audit systems are separate — Wazuh alerts are not pushed back to YingCore; handle them inside Wazuh, not YingCore |
| You want to audit "what the digital employee did" | Use YingClaw Session Audit (covers commands / API usage), not this menu; the two systems handle different scopes |
4. Exit and Re-enter
- Just close the Wazuh window; the YingCore-side SSO ticket expires with the session
- Click "Security Audit" again within 1 hour to jump without logging in; after 1 hour you need to trigger SSO again
5. Best Practices
- Super admin only: The "Security Audit" menu is super admin only — regular users do not see it; do not promote accounts for "convenience", it widens the security attack surface.
- SSO ticket is 1 hour, re-issued on expiry: Do not cache the ticket locally for convenience; the Wazuh ticket defaults to 1 hour, click the menu again to get a new one when it expires.
- Check the key first when the jump fails: Click and get an error → 80% of the time it's a Wazuh service / shared key issue; do not retry YingCore, ask the platform admin to check the Wazuh config.
- Do not confuse the two audit systems: Security Audit = platform / host security events (intrusions / vulnerabilities / file changes); YingClaw Session Audit = digital employee commands / API usage. The two systems each handle their own scope, do not substitute one for the other.
- Wazuh-side accounts managed independently: Do not change the Wazuh password in YingCore; Wazuh has its own user system; changing it does not affect YingCore-side login.
- Shared key kept by the platform admin: The JWT shared key is in the platform admin's hands only, do not distribute it to regular users; rotate regularly (quarterly recommended).
- Group by host when handling alerts in bulk: The same type of alert may span many hosts → in Wazuh, use "group by host" to handle them in bulk, 5–10× faster than handling one by one.