up

ops/devops/evidence-locker/alerts.yaml

@@ -0,0 +1,32 @@
+groups:
+  - name: evidence-locker
+    rules:
+      - alert: EvidenceLockerRetentionDrift
+        expr: evidence_retention_days != 180
+        for: 10m
+        labels:
+          severity: warning
+          team: devops
+        annotations:
+          summary: "Evidence locker retention drift"
+          description: "Configured retention {{ $value }}d differs from target 180d."
+
+      - alert: EvidenceLockerWormDisabled
+        expr: evidence_worm_enabled == 0
+        for: 5m
+        labels:
+          severity: critical
+          team: devops
+        annotations:
+          summary: "WORM/immutability disabled"
+          description: "Evidence locker WORM not enabled."
+
+      - alert: EvidenceLockerBackupLag
+        expr: (time() - evidence_last_backup_seconds) > 3600
+        for: 10m
+        labels:
+          severity: warning
+          team: devops
+        annotations:
+          summary: "Evidence locker backup lag > 1h"
+          description: "Last backup older than 1 hour."

ops/devops/evidence-locker/grafana/evidence-locker.json

@@ -0,0 +1,23 @@
+{
+  "title": "Evidence Locker",
+  "time": { "from": "now-24h", "to": "now" },
+  "panels": [
+    {
+      "type": "stat",
+      "title": "WORM enabled",
+      "targets": [{ "expr": "evidence_worm_enabled" }]
+    },
+    {
+      "type": "stat",
+      "title": "Retention days",
+      "targets": [{ "expr": "evidence_retention_days" }]
+    },
+    {
+      "type": "stat",
+      "title": "Backup lag (seconds)",
+      "targets": [{ "expr": "time() - evidence_last_backup_seconds" }]
+    }
+  ],
+  "schemaVersion": 39,
+  "version": 1
+}