We failed a security audit over something we actually had. We just couldn't prove it.

Description and use

The company passed the re‑audit by consolidating evidence from Wazuh, CrowdSec, and Restic into a single dashboard.

Problem

Auditors required concrete evidence of security controls, but the company only had informal confirmations, leading to a failed audit.

Outcome

The company passed the re‑audit without relying on verbal confirmation, demonstrating that consolidated evidence from existing tools is sufficient for compliance.

Workflow

• 1. Deploy Wazuh SIEM to capture file integrity alerts. 2. Configure CrowdSec to monitor firewall logs and generate blocked connection reports. 3. Set up Restic backups with an audit dashboard that flags failed or silent jobs. 4. Consolidate outputs into a single dashboard for audit readiness. 5. Use the SMB Security Pack to clone and run the pre‑wired stack. 6. Present the dashboard to auditors during re‑audit.

Evidence

The auditor wants logs. They want to see that change detection fired when a file got modified.

Source

Turns out most of that evidence already lives in three tools small shops already run.

Source