WireGuard
Free · OSSVPN & remote access
Modern kernel VPN — tiny attack surface, clean session telemetry.
WireGuard homepage ↗Modern kernel-space VPN. Tiny attack surface, fast handshake, journald-logged session events — the security stack's preferred remote-access tool.
Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.
What it watches
- Peer handshake + session events (journald)
- New + unexpected peer connections
- Endpoint IP changes for a peer
- Allowed-IP + config changes
- Connection-rate anomalies
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
11 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| wireguard_handshake | WireGuard handshake on wireguard |
| wireguard_handshake_response | WireGuard handshake response on wireguard |
| wireguard_handshake_failed | WireGuard handshake failed on wireguard |
| wireguard_invalid_handshake | WireGuard invalid handshake on wireguard |
| wireguard_interface_up | WireGuard interface up on wireguard |
| wireguard_interface_down | WireGuard interface down on wireguard |
| wireguard_keepalive | WireGuard keepalive on wireguard |
| wireguard_keypair_destroyed | WireGuard keypair destroyed on wireguard |
| wireguard_quick_command | WireGuard quick command on wireguard |
| wireguard_malformed | Malformed WireGuard log on wireguard |
| wireguard_other | WireGuard activity on wireguard |
What it helps you catch
What you'd see in CyberCLI
illustrativeSurfaces a remote-access session from an unexpected location or new device.
Routed to Warden (triage) → Knight (detection)
⛓ every step hash-chained · replayable
What CyberCLI reads from WireGuard
audit our mathWireGuard's kernel module logs a tight, declarative trace of every peer interaction through journald. The 16 fields we read carry the interface (wg0, wg1...), peer ID, src/dst IP + port for handshakes/keepalives/timeouts, plus the systemd-unit lifecycle for interface up/down. Enough to spot an endpoint shifting under a peer (compromised key), invalid-handshake scans against your public listener, and unplanned interface drops — without parsing PCAPs.
Full field index · 16 fields ↓
.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.dst_port.event_id.event_type.rule_level.src_port.wireguard_interface.wireguard_keypair_id.wireguard_peer_id.wireguard_planned_shutdown.wireguard_timeout_sec MITRE techniques typically mapped
- T1133 ↗
External Remote ServicesInitial Access · Persistence
- T1021 ↗
Remote ServicesLateral Movement
- T1572 ↗
Protocol TunnelingCommand and Control
- T1090.003 ↗
Multi-hop ProxyCommand and Control
- T1078 ↗
Valid AccountsInitial Access · Persistence
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest peer events, notify on invalid-handshake bursts and unplanned interface-down, summarize endpoint changes for the case
- ·L3 (Knight verification): geo-IP + reputation lookup on src_ip of invalid handshakes, correlate peer endpoint shifts with M365/UniFi identity events — read-only
- ·L4+: peer key revocation, AllowedIPs edits, interface restart — WireGuard config stays operator-owned (no controller API surface to authorize against)
- ·Even on Pro+, Paladin does not mutate wg0.conf or wg set; the operator owns the cryptographic membership decision
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/wireguard/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
WireGuard covers 2 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 WireGuard logs handshakes to the kernel / journald.
- 2 Ship the journal to CyberCLI.
- 3 Run `cybercli onboard wireguard`.
- 4 Confirm session events in the dashboard's Connectors panel.
sudo apt install wireguard wireguard-tools
Fully local. Session events read from your host's journal — never leaves the box.