Security Lab — operations dashboard

Daily operator dashboard for service URLs, health checks, evidence paths, timers, and triage.

Use this page as the first daily operator view.

First Commands

Run from the private lab repo:

cd /home/ze/codex-security-lab-agent
./scripts/resume-lab-session.sh
git status --short --branch
tmux ls

Service URLs

Daily Health Commands

Run from /home/ze/codex-security-lab-agent:

./scripts/run-nexus-services-vrf-guard.sh
./scripts/run-nexus-daily-validation.sh

Run from /home/ze/security-lab-gitops/detection-content:

python3 tools/soc_daily_health_report.py --live
python3 tools/summarize_scenario_evidence.py \
  --evidence-dir /home/ze/security-lab-evidence/soc-scenarios

Healthy output should show:

• services VRF guard ready: true;
• Oxidized/Nautobot drift report ready: true;
• Nexus full validation complete;
• SOC daily health ready: true;
• no failed or partial scenario evidence.

Fast Endpoint Check

curl -Is http://30.30.30.62/
curl -kIs https://30.30.30.64/
curl -kIs https://30.30.30.65/
curl -Is http://30.30.30.68/
curl -Is http://30.30.30.69:3000/

Expected results:

Evidence Paths

Timer Checks

Host-side timer:

systemctl status security-lab-nexus-daily-validation.timer --no-pager
systemctl list-timers 'security-lab-*' --no-pager

Runtime VM timers:

ssh 30.30.30.70 'sudo systemctl list-timers "security-lab-*" --no-pager'

Runtime services:

ssh 30.30.30.70 'sudo docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"'

Triage Order

If EVE-NG or Nexus validation fails:

1. Check EVE-NG reachability and node state.
2. Inspect tmux ls for live validation sessions.
3. Review the latest logs/nexus-* file.
4. Run the services VRF guard to separate route-leak drift from broader fabric failure.

If SOC daily health fails:

1. Read the generated Markdown health report.
2. Check rule sync, staged file drift, Oxidized status, and backup status first.
3. Reconcile from Git-owned repos unless this is approved break-glass work.

If backup status fails:

1. Check local backup directories on security-lab-runtime-01.
2. Check the MinIO/Restic environment file exists on the runtime VM.
3. Re-run the backup-restore pipeline only after confirming secrets are present.

Guardrails

• Do not install packages on dl385.
• Do not use docker-runtime-vm for security-lab services.
• Do not alter shared HAProxy, PowerDNS, or MinIO without explicit approval.
• Do not publish credentials, private keys, generated passwords, ISO images, cloud images, logs, or VM disk images.
• Do not resume NetApp or StorageGRID software installation until official evaluation media and license are staged.