Security Stack - What Blocks, What Only Watches Diagram

What actually blocks

• CrowdSec holds 33,885 active ban decisions, 33,881 of them from the community blocklist
• Three live bouncers: firewall on CT111 and on the LAX host, plus an nginx Lua bouncer
• Fail2ban runs one hardened sshd jail on 24 hosts, escalating to a one-week ban
• AbuseShield auto-suspends only HIGH-confidence findings; MEDIUM is never flag-stored

What only watches

• Wazuh collects from 38 enrolled agents, all Active and all on v4.14.6
• SCA (CIS benchmarks) is the live signal and is current for every agent
• Vulnerability detection silently 401'd for five months; fixed 2026-08-04
• Ubuntu agents still return zero vulnerability states - a feed gap, not a clean bill of health

Known gaps

• node_exporter on tcp/9100 is reachable from the public internet on all three hypervisors
• 8 of 9 Pterodactyl root_admin accounts have no 2FA
• CrowdSec AppSec bans uploads over 10 MiB uninspected and creates no decision or alert, so cscli looks clean while customers are blocked
• Every hardening playbook writes IPv4 rules only