Alerts
Every alert describes something that should not happen at all, so any hit is worth a look. Each one has a saved search with the same filter, to see the events behind it.
The monitors#
| Alert | Fires when |
|---|---|
| Traffic tried to bypass the VPN | pf blocks anything on the WAN port besides the tunnel, DHCP and the two exceptions |
| VPN tunnel down | No WireGuard handshake for more than three minutes |
| Falco: event of priority Error or higher | Falco reports something serious inside a board, such as a program run that was not in its container's image |
The SSH logins to the firewall are kept as a saved search rather than an alert: with SSH open to the admin network only, they are read, not watched.