Catching an Attack in Progress: Deploying Wazuh HIDS and Watching It Work

Every firewall lab I'd worked through up to this point answered the same basic question: was a connection allowed or blocked? This lab asked a different one entirely: if an attack gets through anyway,