[Gerrrt]

Closes #437.

The host side of #437 was built tonight following build-the-sensor-guest.md. This PR writes it up and closes the issue.

The proof the issue asked for

reboot Saruman and confirm the gauge goes to zero and an alert fires. If it does not, the unit is decorative.

1. homelab-zeek-mirror.timer was disabled at 19:11:31, and Saruman rebooted.
2. Saruman was back up at 19:15:46.
3. The gauge read 0 on all eleven runs from 19:20 to 20:05. The guests were up and fenrir's tap was up, but 0 of 9 ports were mirrored and the packet count stayed flat.
4. ZeekMirrorInactive fired, confirmed on the estate's Alertmanager.
5. The timer was re-enabled at 20:10:26. The gauge read 1, with 11 of 11 ports mirrored, at 20:11:31.

The other checks (§6)

• East-west traffic: net view \\titan from carbuncle showed up in Zeek as:

  • a Kerberos TGS for cifs/titan via leviathan;
  • the AP exchange at titan;
  • an IPC$ mapping;
  • srvsvc NetrShareEnum.

  None of this crosses a router, so Suricata on morpheus never sees it.

• Loki: 20 Zeek log types arrive in the lab's Loki, and | json queries return fields. fenrir's Alloy points only at alexander.

• Stop test: stopping the sensor removed all 11 filters within 19 s and the gauge read 0. ZeekMirrorInactive fired at about 19:02, then cleared after the restart.

Two things the changelog records

• The first stop test was invalid. The VM was started again 38 s before the gauge's first post-stop run, so the gauge never read 0. The alert reported at that moment was a different one, described next.
• Running the collector installer on Saruman fired SshLoginFromUnexpectedSubnet. The installer SSHes to root@10.0.30.110 from 10.0.30.110, and that login comes from VLAN 30. It was not a breach. Runbook §5 now says to run the installer from Hicks.

Changes

• docs/changelog.md: §3–§7 as run, with times.
• docs/architecture.md, docs/network.md: fenrir is marked built, and has a row in the VLAN 30 table.
• docs/hardware.md: eight Alloy agents, as check_docs.py now counts.
• docs/runbooks/build-the-sensor-guest.md §5: run the installer from Hicks, and how to verify Saruman's own host key if not.
• docs/roadmap.md: Run Zeek on a mirror port, and see the VLAN 30 traffic the firewall never will #437's entry is removed, since the issue closes with this PR.

Also done on the host: the temporary passwordless sudo on fenrir is removed.

Still open, as a separate follow-up: JA4 fingerprints, which need a derived Zeek image.

Checks: check_docs.py and markdownlint-cli2 pass.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The architecture table’s Saruman guest totals contradict the newly documented deployment state.

Review effort: Balanced
Findings: 1

Open (1)

• Update Saruman summary to reflect built and planned guests · New

What changed in this PR

Documents fenrir’s completed Zeek deployment and closes #437.

Changes:

• Records deployment and reboot/alert validation.
• Marks fenrir built across architecture and network documentation.
• Updates the runbook, Alloy count, and roadmap.

File	Description
docs/​architecture.md	Marks fenrir built and validated.
docs/​changelog.md	Records deployment evidence and checks.
docs/​hardware.md	Updates the Alloy agent count.
docs/​network.md	Adds fenrir to VLAN 30 inventory.
docs/​roadmap.md	Removes completed issue #437.
docs/​runbooks/​build-the-sensor-guest.md	Documents the safe installer host.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gerrrt]

Copilot review overview

🟡 Changes recommended

The architecture table’s Saruman guest totals contradict the newly documented deployment state.

Review effort: Balanced
Findings: 1

Open (1)

• Update Saruman summary to reflect built and planned guests · New

What changed in this PR

Documents fenrir’s completed Zeek deployment and closes #437.

Changes:

• Records deployment and reboot/alert validation.
• Marks fenrir built across architecture and network documentation.
• Updates the runbook, Alloy count, and roadmap.

| File | Description |

| ---- | ----------- |

| docs/​architecture.md | Marks fenrir built and validated. |

| docs/​changelog.md | Records deployment evidence and checks. |

| docs/​hardware.md | Updates the Alloy agent count. |

| docs/​network.md | Adds fenrir to VLAN 30 inventory. |

| docs/​roadmap.md | Removes completed issue #437. |

| docs/​runbooks/​build-the-sensor-guest.md | Documents the safe installer host. |

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Fixed