- compose-service.suricata.json is the authored docker-compose.yml service block (yq-extracted); a profile-filtered docker compose config could not be used because soc-profile wazuh-sidecar-suricata depends_on wazuh.manager and profile filtering invalidates the project. suricata carries no compose-injected environment, so authored and resolved compose values coincide
- Recaptured after ADR-043 (issue #325) on a clean-rebuilt lab: two consecutive 'aptl lab stop -v && aptl lab start' cycles preceded this capture, so the bundle reflects the named-volume-seeded steady state, not the pre-fix host-bind topology
- /var/log/suricata/eve.json and fast.log are unbounded transient sensor telemetry; they are recorded as filesystem metadata (filesystem-tree.txt) only, not content-checksummed, because their bytes change continuously
- mtree/AIDE/Tripwire filesystem manifest tooling was unavailable; filesystem-tree.txt and filesystem-checksums.txt provide the committed stable manifest for the captured suricata config/ruleset scope
- Syft CycloneDX output was deterministically normalized by stripping syft:location:* properties; filesystem provenance is captured in filesystem-tree.txt and filesystem-checksums.txt
- osquery apt_sources table not applicable: the suricata runtime OS is AlmaLinux 9 (rpm/dnf), not apt.
- osquery installed_applications table unavailable in the digest-pinned Linux scanner image.
- osquery programs table unavailable in the digest-pinned Linux scanner image.
