progress update

progress-update.md

 
 The MVP platform is operational and running end-to-end in the lab environment.
 Core integrations are in place:
+
 - Detection: Wazuh
 - Automation: Shuffle
 - Case management: IRIS-web (replacing DFIRTrack)
 ## 2) Completed Work
 
 ### Platform orchestration and operations
+
 - Combined stack runner created and improved (`run-combined-stack.sh`)
 - Added command support for:
   - `up`, `down`, `logs`, `status`, `help`
 - Added consolidated health/status script (`soc-status.sh`)
 
 ### Integration architecture
+
 - Connected Wazuh, Shuffle, IRIS-web, PagerDuty Stub, and soc-integrator on shared network
 - Resolved startup conflicts and runtime issues (port, compose, routing compatibility)
 
 ### SOC Integrator (MVP)
+
 - Added/validated integration APIs for:
   - Wazuh
   - Shuffle
 - Added internal API-key protection for mutation endpoints
 
 ### Persistence layer
+
 - Added PostgreSQL service for soc-integrator (`soc-integrator-db`)
 - Added incident/policy/audit schema and startup initialization
 - Enabled deduplication and audit tracking for incident processing
 
 ### Testing utilities and documentation
+
 - Added Wazuh test-event injection script:
   - `scripts/send-wazuh-test-events.sh`
 - Added root project docs:
 Current stack status: **UP**
 
 Healthy/available components:
+
 - Wazuh manager, indexer, dashboard
 - IRIS-web app/nginx/worker/db/rabbitmq
 - Shuffle backend/frontend/opensearch/orborus
 - soc-integrator + soc-integrator-db
 
 Endpoint checks:
+
 - Wazuh Dashboard: OK
 - Wazuh API: OK (auth-protected, expected 401 on unauthenticated root)
 - IRIS Web: OK
 
 1. Detection content tuning
 - Fine-tune Wazuh rules/decoders for customer log patterns and false-positive reduction
-
 2. Use-case calibration
 - Validate risk/severity mapping per approved use cases
 - Tune exception list and threshold logic (especially VPN geo anomaly)
-
 3. UAT evidence package
 - Capture deterministic UAT scenarios and outputs for:
   - IOC flow
   - VPN outside-TH flow
   - IRIS case creation/update
   - PagerDuty Stub escalation path
-
 4. Production hardening items
 - Rotate default/local secrets used in lab config
 - Lock down internal API keys and access boundaries
 Next milestone: **MVP UAT Completion**
 
 Target outputs:
+
 - Approved UAT checklist execution
 - Tuned policy thresholds for customer environment
 - Signed-off incident lifecycle flow: