decnet-clusterer.service.j2 ships the identity clusterer that landed last session (was overlooked) — bus-woken on attacker.>, publishes identity.> events. decnet-campaign-clusterer.service.j2 ships the campaign clusterer from this session — bus-woken on identity.>, publishes campaign.> events plus the cross-family identity.campaign.assigned. After= decnet-clusterer.service so the identity layer is up before the campaign layer reads its rows. decnet.target Wants both new units. Both follow the same security hardening profile as enrich + reuse-correlator.
1.5 KiB
1.5 KiB