[SSP] monitoring_architecture: Monitoring Architecture
Weekly hardening validation of every in-boundary host with results written to a signed chain; firewall and identity logs forwarded to the workspace; correlation rules for break-glass sign-in, log clearing and new services. Endpoint telemetry forwarding is a POA&M item (3.14.6).

