Checking Agent Status

sudo systemctl status soc-agent

Expected output: Active: active (running)

Viewing Agent Logs

# Recent activity
tail -50 /opt/agentic-soc-agent/agent.log

# Live logs
sudo journalctl -u soc-agent -f

# Actions log (remediation history)
tail -50 /opt/agentic-soc-agent/actions.log

Common Issues and Fixes

Issue: Agent is not running

sudo systemctl start soc-agent
sudo systemctl enable soc-agent  # Auto-start on boot

Issue: No alerts appearing on dashboard

1. Check agent connectivity:

   curl -X POST https://ayzalai.com/api/ingest/events \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_KEY" \
     -d '{"events":[{"event_type":"test","raw_event":{"message":"test"}}]}'

2. Expected response: {"processed":1,"alerts_created":1}
3. If connection fails, check firewall: sudo iptables -L
4. Verify API key is active in Settings

Issue: Agent is not detecting attacks

1. Check that auth logs exist: ls -la /var/log/auth.log or /var/log/secure
2. Trigger a test event: ssh invalid@localhost (try wrong password)
3. Check agent log: tail -f /opt/agentic-soc-agent/agent.log
4. You should see: [DATE] SENT: auth_failure

Issue: Auto-block not working

1. Check that auto-remediation is enabled in Settings
2. Verify the alert severity is CRITICAL or HIGH
3. Check that the IP is not whitelisted or a private IP
4. View actions log: tail -f /opt/agentic-soc-agent/actions.log