Live triage of a Wazuh-monitored host — processes, listening ports, configuration, agent health, persistence locations — with evidence-handling notes; use when a specific endpoint is suspected of compromise.
