Production hardening checklist

Most of these are built in; the checklist confirms they are in effect for your deployment.

Built in, verify

All telemetry listeners that cross untrusted networks use TLS. Plain syslog is bound only to trusted segments or disabled.
Every agent has enrolled with its own credential. The bootstrap token in the environment file has been rotated after the initial rollout.
The operator token exists only in the environment file and is never placed in a browser or a script that runs outside the deployment.
Analysts have individual accounts with the least role that fits their work; the bootstrap administrator account is used only for recovery.
Organization grants are set for every analyst who should not see every tenant.

Backups run on a schedule and a restore has been rehearsed at least once. See Backups.
Retention is set per data type to what your policy and disk allow. See Retention.
The environment file and the ingest CA private key are stored with restricted permissions and backed up.
Host firewall allows only the listeners you use.
Time is synchronised on the host and on senders; SLA measurement depends on it.
Notification channels have been tested end to end with a test alert.
If a model endpoint is configured, it is reachable only from the deployment and its data handling matches your policy. See Model setup.

Someone other than the installer has reviewed the environment file for leftover CHANGE_ME values.
The audit log shows the expected sign-ins and nothing surprising after the first week.