1. Architecture & Security Methodology

MrHandy operates as a Security Operations Center (SOC) for Discord servers. Similar to how Wazuh monitors Linux and enterprise infrastructure, MrHandy continuously inspects server settings, role hierarchies, IAM permissions, and administrative events to evaluate risk posture.

2. Discord Bot Slash Commands

• /diagnostico: Executes an on-demand Wazuh security benchmark audit and provides an interactive embed with direct dashboard links.
• /hardening: Returns a prioritized checklist of configuration changes to secure server vulnerabilities.
• /alerta [channel]: Assigns or queries the dedicated channel for real-time security alerts.
• /estado: Displays latency, gateway uptime, monitored guilds, and SIEM engine telemetry.

3. Scoring & Compliance Benchmark

Servers begin with a baseline score of 100. Deductions are weighted according to severity: Critical (-25), High (-15), Medium (-8), Low (-3). Final ratings range from Grade A+ (95-100) down to Grade F (<60).

4. SIEM Event Watcher & Incident Alerts

The SIEM event watcher monitors PRIVILEGE_ESCALATION (Administrator granted to roles), CHANNEL_DELETE (anti-nuke detection), WEBHOOK_MODIFIED (potential token hijacking), and configuration tampering.