DET-H17: Collector host check regressed

A local host check (CCHOST-*, BOOT-IN-*, the host checks) passed on the collector's previous scan and fails now: the host itself changed, e.g. SEV-SNP or TDX host support was switched off, a protection was disabled on the kernel command line, or a boot input became writable. Raised at the regressed check's own severity.

Property	Value
Severity	high
Platform	Hardware fleets
Group	hardware
Log source	Collector · local host scan
Related check	CCHOST-01: SEV-SNP or TDX host support is enabled

Fires when

a collector host check was PASS on the previous scan AND is FAIL now

How it runs

The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.

A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.