Wazuh dashboard configurations

Integration

An integration is the top-level organizational unit in security analytics. It groups related decoders and rules that provide support for a specific log source or use case. Each integration is configured through a space policy within a space. The policy must be enabled before the integration can progress through the promotion workflow. It also defines the root decoder used by the normalization engine as the entry point for processing events for the integration in the Test and Custom spaces.

In the Security Analytics section of the Wazuh dashboard, click Overview to display all integrations available across the active spaces (Draft, Test, Custom, and Standard), along with their status and associated metadata.

In the Security Analytics section of the Wazuh dashboard, navigate to Overview > Draft > Actions > Create to create custom integrations.

User-managed content is promoted sequentially from Draft to Test and from Test to Custom after validation. After creating an integration, click Actions at the top-right corner of the Wazuh dashboard and select Promote.

Decoder

A decoder defines how a raw log event is parsed and mapped to normalized fields. Decoders are written in YAML and are validated against the Wazuh Engine schema. Each decoder belongs to an integration.

In the Security Analytics section of the Wazuh dashboard, navigate to Normalization > Decoders to display all decoders available across the active spaces (Draft, Test, Custom, and Standard).

In the Security Analytics section of the Wazuh dashboard, navigate to Decoders > Draft > Actions > Create to create custom decoders. In the creation form, select the integration and provide the decoder definition, then click on Create decoder.

After creating the custom decoder, click Actions at the top-right corner of the Wazuh dashboard and select Promote. User-managed content is promoted sequentially from Draft to Test and from Test to Custom after validation.

KVDB

A KVDB (Key-Value Database) is a lookup table that can be referenced in decoder or rule logic to enrich events with additional context (for example, mapping IP addresses to threat categories).

The KVDB contains a key-value pair consisting of a field (key) and its expected content (value). The key identifies a specific field extracted during decoding, while the value defines the condition used for matching. Wazuh uses key-value pairs to verify whether extracted event fields, such as IP addresses, file hashes, usernames, or process names, match specific values defined in rules.

In the Security Analytics section of the Wazuh dashboard, navigate to KVDBs to display all KVDBs available across the active spaces (Draft, Test, Custom, and Standard).

To create custom KVDBs, navigate to Security Analytics > KVDB > Draft > Actions > Create in the Wazuh dashboard. Perform the following steps:

• Select the Integration.

• Set the KVDB's Title and Author name.

• Under the Content section, set the key:value pair.

• Click on Create KVDB to create the KVDB.

After creating the custom KVDB, click Actions at the top-right corner of the Wazuh dashboard and select Promote. User-managed content is promoted sequentially from Draft to Test and from Test to Custom after validation.

Detectors

A detector connects detection rules to a specific data source (an index or alias) and runs continuously to identify security findings. Detectors operate on top of rules that are already active in the Custom or Standard space.

A detector uses the selected data source to determine which events are analyzed by the associated rules. When incoming events match the configured rule conditions, the detector generates findings for further analysis and monitoring. This allows organizations to apply specific detection logic to selected log sources for continuous threat monitoring.

In the Security Analytics section of the Wazuh dashboard, navigate to Detection > Detectors to view all available detectors.

To create a Detector, navigate to Detection > Detectors > Create detector under the Security Analytics section of the Wazuh dashboard and perform the following actions:

1. Set the Detector Name.

2. Select a Data source.

3. Select an Integration. The Integrations are organized in different spaces, custom integrations are in the Custom space, and Wazuh out-of-the-box integrations are in the Standard space.

4. Select the rules that will be active for this detector under the Selected rules panel. Click Manage to add or remove individual rules.

5. Click on Create detector to create the detector.

Once the detector is created, it will start running against the configured data source using the selected rules.

Rules

A detection rule defines the conditions under which the Wazuh Engine generates a security finding. Rules operate on fields normalized by decoders and support references to compliance frameworks and the MITRE ATT&CK framework.

Rules are written in YAML and follow the same promotion lifecycle as integrations and decoders. The Draft, Test, and Custom spaces are user-managed, while the Standard space is read-only.

In the Security Analytics section of the Wazuh dashboard, navigate to Detection > Rules to display all rules available across the active spaces (Draft, Test, Custom, and Standard).

In the Security Analytics section of the Wazuh dashboard, navigate to Detection > Rules > Draft > Actions > Create to create custom rules. In the creation form, select the integration and provide the decoder definition, then click on Create rules.

After creating the custom rules, click Actions at the top-right corner of the Wazuh dashboard and select Promote. User-managed content is promoted sequentially from Draft to Test and from Test to Custom after validation.

Slack

Prerequisites

This notification channel sends alerts to Slack via an incoming webhook. Create a Slack webhook and obtain the webhook URL.

Configure and enable the notification channel and monitor

1. Go to Explore > Notifications > Channels and open Slack Channel.

   

2. Click Action > Edit, then enter the incoming webhook URL obtained from your Slack workspace in the Slack webhook URL field.

3. Save the Slack channel configuration and unmute the channel.

4. Click Action > Send test message to validate the channel.

   

5. Go to Explore > Alerting > Monitors and open the corresponding Sample: Slack monitor.

   

6. If the monitor has no actions in the default trigger, click Edit, and add a Send notification action using the Add action option. Then select the previously configured channel. If an action already exists, verify that it points to the correct channel. Adjust the subject/message template if necessary, then save and enable the monitor.

   
   

7. Open Dashboard management > Health Check and run the checks. Once channels and monitors are enabled, the related checks should pass to a healthy state.

PagerDuty

Prerequisites

This notification channel sends alerts to PagerDuty via the Events v2 API. Create a PagerDuty Events v2 integration and obtain your Integration Key.

Configure and enable the notification channel and monitor

1. Go to Explore > Notifications > Channels and open PagerDuty Channel.

   

2. Click Action > Edit, leave the default URL, and enter your Integration Key as the X-Routing-Key value.

   

3. Save the PagerDuty channel configuration and unmute the channel.

4. Go to Explore > Alerting > Monitors and open the corresponding Sample: PagerDuty monitor.

   

5. If the monitor has no actions in the default trigger, click Edit, and add a Send notification action using the Add action option. Then select the previously configured channel. If an action already exists, verify that it points to the correct channel. Adjust the subject/message template if necessary, then save and enable the monitor.

   
   

6. Open Dashboard management > Health Check and run the checks. Once channels and monitors are enabled, the related checks should pass to a healthy state.

Jira

Prerequisites

This notification channel sends alerts to Jira using a Jira API token. To configure it, obtain your Jira instance URL and generate a Jira API token. Use a Base64-encoded email:api_token string in the Authorization header.

Configure and enable the notification channel

1. Go to Explore > Notifications > Channels and open Jira Channel.

   

2. Specify your instance URL in the Webhook URL, use the Base64-encoded value of your Jira instance email and API token as the Authorization header value. This will be in the form Authorization: Basic base64(email:api_token).

   

3. Save the Jira channel configuration and unmute the channel.

4. Go to Explore > Alerting > Monitors and open the corresponding Sample: Jira monitor.

   

5. If the monitor has no actions in the default trigger, click Edit, and add a Send notification action using the Add action option. Then select the previously configured channel. If an action already exists, verify that it points to the correct channel. Adjust the subject/message template to match your Jira instance, then save and enable the monitor.

   
   

6. Open Dashboard management > Health Check and run the checks. Once channels and monitors are enabled, the related checks should pass to a healthy state.

Shuffle

Prerequisites

This notification channel sends alerts to Shuffle via the Shuffle webhook URL. Create a Shuffle workflow webhook URL and obtain the Webhook URL.

Configure and enable the notification channel

1. Go to Explore > Notifications > Channels and open Shuffle Channel.

   

2. Specify the Webhook URL of the workflow you will use. You can validate the channel by sending a test message from the Notifications interface.

   

3. Save the Shuffle channel configuration and unmute the channel.

4. Go to Explore > Alerting > Monitors and open the corresponding Sample: Shuffle monitor.

   

5. If the monitor has no actions in the default trigger, click Edit, and add a Send notification action using the Add action option. Then select the previously configured channel. If an action already exists, verify that it points to the correct channel. Adjust the subject/message template if necessary, then save and enable the monitor.

   
   

6. Open Dashboard management > Health Check and run the checks. Once channels and monitors are enabled, the related checks should pass to a healthy state.

Metric aggregation

Metric aggregation calculates metrics by aggregating data values. This contains the actual values of the metric to be calculated. Metric aggregation is typically represented on the Y-axis.

There are different types of metric aggregations as shown below:

• Average: This is the average of a numeric field. It calculates the arithmetic mean of an existing set of data values. The average is obtained by adding up all the data values and dividing their sum by the total count. Average aggregation helps calculate the average duration of security incidents, the average severity score of alerts, the average response time to resolve incidents, and more.

  

• Count: This is the number of data values that match a query within the selected index pattern. It counts the number of data points in a set and provides the total count of a queried event. Count aggregation helps determine the total number of security events, the number of alerts triggered by a specific rule, the number of failed login attempts, and more.

• Max: This is the maximum value of a numeric field within a selected index pattern. Max identifies the highest value among a group of values. Max aggregation helps identify the maximum severity level of alerts, maximum CPU usage, and more.

  

• Median: This is the median value in a numeric field. Median determines the middle value in a sorted set of values within a selected index pattern by separating the higher half from the lower half of the data. Median aggregation provides the middle value of event durations, helping to identify the typical or median response time.

• Min: This is the minimum value in a numeric field set. Min identifies the lowest value among a group of values. Min aggregation determines the minimum severity level of alerts, minimum disk space usage, minimum number of successful logins, and more.

  

• Percentile Ranks: This is the ranking for values within a given numeric field in percentiles. Percentile rank calculates the percentage of values below a specific value in a set and expresses how a given value compares to the distribution of the data. Percentile rank aggregation helps in assessing the relative severity of alerts in comparison to the entire dataset. This determines the percentile rank of a specific severity score.

• Percentile: This aggregation changes numeric field values into percentile bands. Percentile identifies specific data values that correspond to specific percentiles. For example, the 90th percentile represents the value below which 90% of the data falls.

  

• Standard Deviation: This measures the amount of variation in a set of numeric field values. It evaluates the average distance between each value and the mean value. Standard deviation aggregation can help identify changes in event durations. This provides insights into the volatility or stability of security events.

• Sum: This is the total sum of a numeric field. Sum calculates the total sum of a set of values by adding up all the values in the dataset within a selected index pattern. Sum aggregation determines the total count of specific event types, the total number of successful logins, the total disk space used, and more.

• Top Hit: This aggregation identifies the top data point based on a specified criterion or sort order. Top hit is commonly used to extract specific information from the dataset based on the top metric. Top hit aggregation helps in extracting key information from security events, such as retrieving the most recent log entry for a particular host or user.

  

• Unique Count: This is the count of unique values within a designated field. It counts the number of unique or distinct values in a set. Unique count disregards any duplicate events and provides the count of unique values. Unique count aggregation helps in determining the number of distinct IP addresses accessing a system, the number of unique users triggering alerts, the count of unique event types, and more.

Parent pipeline aggregations

This category of pipeline aggregations is able to compute new buckets based on other parent aggregations.

• Cumulative Sum: Calculates the running sum of a metric across a specified set of data points. It shows the progressive total as each data point is added. Cumulative sum aggregation can be used to track the total count of security events over time, providing insights into the cumulative impact of incidents.

• Derivative: Calculates the rate of change of values over time. Derivative is the difference between consecutive values in a time series or dataset. Derivative aggregation helps in calculating the rate of change in event counts or severity scores. This enables the detection of sudden spikes or anomalies.

• Moving Avg: Calculates the average of a metric over a moving window of data points. It provides a neat representation of the data, hence reducing noise or fluctuations. This helps identify trends, patterns, and anomalies in event counts or resource usage over time.

• Serial Diff: Calculates the difference between consecutive values in a time series or ordered dataset. It measures the absolute change from one data point to the next. Serial diff aggregation identifies the difference in event counts or resource usage between consecutive data points, showing changes or trends.

Sibling pipeline aggregations

This category of aggregations computes new aggregations that will be at the same level as the sibling aggregation from which its input was provided.

• Average Bucket: This is the average value of a metric within each bucket of a specified aggregation. The average bucket provides the average value per group or category. Average bucket aggregation helps in calculating the average severity score or event count within specific time intervals or categories.

• Max Bucket: This is the maximum value of a metric within each bucket of a specified aggregation. It identifies the highest value per group. Max bucket aggregation enables the identification of the maximum severity level or event count within specific time intervals or categories.

• Min Bucket: This is the minimum value of a metric within each bucket of a specified aggregation. It identifies the lowest value per group or category. Min bucket aggregation helps identify the minimum severity level or event count within specific time intervals or categories.

• Sum Bucket: This is the total sum of a metric within each bucket of a specified aggregation. It adds up the values per group. Sum bucket aggregation helps in calculating the total count or severity score within specific time intervals or categories.

Bucket aggregation

This is used to determine the type of information we are trying to get from the dataset. The bucket aggregation determines how the data is segmented or grouped, such as by date. It is typically represented on the X-axis.

The following are the types of bucket aggregations:

• Date Histogram: This aggregation is used to display data organized by a date.

• Date Range: This aggregation is used to report the values within a date range which we can specify.

• Filters: This aggregation is used to apply filters to data.

• Histogram: This aggregation is used for numeric fields, where we can provide the integer interval for the selected field.

• IPv4 Range: This aggregation provides us with the option to set the range using IPv4 addresses.

• Range: This aggregation is used to provide the range of numeric field values.

• Significant Terms: This aggregation returns interesting or unusual occurrences of terms in a set.

• Terms: This aggregation enables us to pick the top or bottom n elements of the selected field.

Both the Y-axis and the X-axis are used to plot the data points on a visualization chart.

Bar charts

Bar charts are a type of visualization that is used to compare specific measures for different data categories. These are the most common types of visualization and are easy to create and interpret. Bar charts are used to present categorical data in the form of rectangular bars with heights/lengths that are proportional to the given values.

Creating a Bar chart

Horizontal Bar: This is a type of bar chart where rectangular bars are displayed horizontally. The length or width of each bar corresponds to a particular value. This allows an easy comparison between different data points. Horizontal bar charts are often used to visualize data that has distinct categories or to show rankings.

The steps below show how to create a horizontal bar visualization that shows varying numbers of MITRE tactics detected within a set timeframe.

1. Click Create visualization from the Visualize tab, select the Horizontal Bar visualization format, and use wazuh-findings* as the index pattern name.

2. Set the following value in the Data section, on the Y-axis, in Metrics:

   • Aggregation = Count

3. Add an X-axis in Bucket and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

   • Order = Descending

   • Size = 10

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Vertical Bar: This is a type of bar chart where the bars are displayed vertically, with the length or height of each bar representing a particular value. Vertical bar charts are suitable for comparing data across different categories. They are commonly used to display rankings, comparisons, or the distribution of values.

The steps below show how to create a vertical bar visualization that shows varying numbers of MITRE tactics detected within a set timeframe.

1. Click Create visualization from the Visualize tab, select the Vertical Bar visualization format, and use wazuh-findings* as the index pattern name.

2. Set the following value in the Data section, on the Y-axis, in Metrics:

   • Aggregation = Count

3. Add an X-axis in Bucket and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

   • Order = Descending

   • Size = 10

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Pie charts

This is a circular chart that is divided into sectors, with each sector representing a percentage of the whole data set. They are commonly used to show market share, composition of data, or distribution of categories. The total slice size of a pie chart is calculated by the metrics aggregation. In the case of a pie chart, we use the count, sum, and unique count.

The steps below show how to create a Pie chart visualization that shows MITRE tactics count within a timeframe.

Creating a Pie chart

1. Click Create visualization from the Visualize tab, select the Pie visualization format, and use wazuh-findings* as the index pattern name.

2. Set the following value in the Data section, on the Slice size, in Metrics:

   • Aggregation = Count

3. Add a Split slices in Bucket and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

   • Order = Descending

   • Size = 10

4. Customize the Pie chart by toggling on show label in the Options section.

5. Click the Update button.

   

6. Click the Save button in the top right corner and assign a title to save the visualization.

Area charts

This is used to display graphically quantitative data using filled-in areas. The areas between axes and lines are typically filled with colors or patterns to differentiate between different categories or data points. This emphasizes the quantity beneath a line chart. Area charts are useful for showing the magnitude and distribution of data over time or categories. They are often used to display trends, comparisons, or cumulative values.

The steps below show how to create an Area chart that visualizes a histogram of Wazuh rule levels and their maximum fired times.

Creating an Area chart

1. Click Create visualization from the Visualize tab, select the Area visualization format, and use wazuh-events* as the index pattern name.

2. Set the following value in the Data section, on the Y-axis, in Metrics:

   • Aggregation = Max

   • Field = event.severity

3. Add another Y-axis in Metric and set the following values:

   • Aggregation = Max

   • Field = rule.firedtimes

4. Add an X-axis in Bucket and set the following values:

   • Aggregation = Date Histogram

   • Field = timestamp

5. Click the Update button.

   

6. Click the Save button in the top right corner and assign a title to save the visualization.

Line charts

This visualization represents data points connected by straight lines. It is commonly used to display trends, patterns, relationships over time, or a continuous range. By plotting data along a Cartesian coordinate system, lines are drawn to connect the data points. This provides a clear depiction of how the values change.

The steps below show how to create a Line chart that visualizes the Wazuh rule levels triggered the maximum times within a timeframe.

Creating a Line chart

1. Click Create visualization from the Visualize tab, select the Line visualization format, and use wazuh-events* as the index pattern name.

2. Set the following value in the Data section, on the Y-axis, in Metrics:

   • Aggregation = Max

   • Field = event.severity

3. Add an X-axis in Buckets and set the following values:

   • Aggregation = Date Histogram

   • Field = timestamp

   • Minimum interval = Minute

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Heat maps

This is a graphical representation that uses colors to visualize the density of certain variables. Heat maps display data points as colored cells, with each color representing a different value or level of intensity. Heat maps are useful for identifying patterns, trends, or variations within a dataset.

The steps below show how to create a Heat map that visualizes the mapping of Wazuh integrations and event categories.

Creating a Heat Map

1. Click Create visualization from the Visualize tab, select the Heat Map visualization format, and use wazuh-events* as the index pattern name.

2. Set the following value in the Data section, on the Y-axis, in Metrics:

   • Aggregation = Count

3. Add an X-axis in Buckets and set the following values:

   • Aggregation = Terms

   • Field = wazuh.integration.name

   • Order by = Metric: Count

   • Order = Descending

   • Size = 5

4. Add a Y-axis in Buckets and set the following values:

   • Aggregation = Terms

   • Field = wazuh.integration.category

   • Order by = Metric: Count

   • Order = Descending

   • Size = 5

5. Click the Update button.

   

6. Click the Save button in the top right corner and assign a title to save the visualization.

Data table

This is a tabular representation of data that is organized into rows and columns. It provides a structured format to display and analyze data. Each row represents a specific entry, and each column represents a different variable. Data tables are widely used for data analysis, reporting, and providing a clear overview of multiple variables.

The following steps show how to create a Data table to visualize the maximum count of Wazuh rule levels that were triggered.

Creating a Data table

1. Click Create visualization from the Visualize tab, select the Data Table visualization format, and use wazuh-findings-v5* as the index pattern name.

2. Set the following metrics in the Data section:

   • Aggregation = Count

3. Add a Split rows in Buckets and set the following values:

   • Aggregation = Terms

   • Field = wazuh.rule.level

   • Order by = Metric: Count

   • Order = Descending

   • Size = 5

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Metric

This is a quantifiable measurement that is used to evaluate performance, progress, or specific characteristics. A metric represents a calculation as a single numerical value. They are applicable in various domains, including business analytics, key performance indicators (KPIs), and performance monitoring.

The following steps show how to create a Metric to visualize the number of SCA checks.

Creating a Metric

1. Click Create visualization from the Visualize tab, select the Metric visualization format, and use wazuh-states-sca* as the index pattern name.

2. Set the following metrics in the Data section:

   • Aggregation = count

3. Add a Split group in Buckets and set the following values:

   • Aggregation = Filters

   • Filter = check.result: "Passed"

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Gauge

This is a visualization that is represented as a meter. It is commonly used to display a single value within a specific range. The gauge consists of a pointer that shows the current value. This is displayed as a position along a circular or linear scale. Gauges are used to indicate progress, performance metrics, or levels of achievement. It shows how a metric’s value relates to reference threshold values.

The steps below show how to create a Gauge to visualize the SCA failed counts.

Creating a Gauge

1. Click Create visualization from the Visualize tab, select the Metric visualization format, and use wazuh-states-sca* as the index pattern name.

2. Set the following metrics in the Data section:

   • Aggregation = count

3. Add a Split group in Buckets and set the following values:

   • Aggregation = Filters

   • Filter = check.result: "Failed"

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Coordinate Map

This uses geographic coordinates to display data points or regions on a map. Coordinate maps allow you to plot and visualize information in relation to specific locations or geographical areas. By using latitude and longitude coordinates, you can represent data in a spatial context.

Coordinate maps are ideal for plotting latitude and longitude coordinates. This allows the visualization of spatial data, such as locations, regions, or density. They are commonly used in geographical analysis, tracking data by location, or displaying demographic information.

The steps below show how to create a coordinate map based on the origin location.

Creating a Coordinate map

1. Click Create visualization from the Visualize tab, select the Coordinate Map visualization format, and use wazuh-events* as the index pattern name.

   

2. Set the following values on the Metric in Data:

   • Aggregation = Count

3. Add a Geo coordinate in Buckets and set the following values:

   • Aggregation = Geohash

   • Field = destination.geo.location

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Region Map

This is a map-based visualization that displays data by dividing regions into distinct boundaries. Region maps are suitable for displaying data at a territorial level. They are often used in geopolitical analysis, demographic comparisons, or election results.

The steps below show how to create a region map based on the destination country.

Create region map

1. Click Create visualization from the Visualize tab, select the Region Map visualization format, and use wazuh-events* as the index pattern name.

   

2. Set the following values on the Metric in Data:

   • Aggregation = Count

3. Add a Shape field in Buckets and set the following values:

   • Aggregation = Terms

   • Field = destination.geo.country_name

   • Order by = Metric: Count

   • Order = Descending

4. Select Name as Join field under the Layer Options tab.

5. Click the Update button.

   

6. Click the Save button in the top right corner and assign a title to save the visualization.

VisBuilder

Visualization Builder is an intuitive tool that allows users to create customized visualizations without programming knowledge. It is beneficial for users who want to quickly generate visual representations of their data without extensive technical knowledge.

As of the time of writing this document, this visualization is experimental. The design and implementation are less mature than stable visualizations and might be subject to change.

The steps below show how to use Visualization Builder to present the Wazuh integration name and category.

Creating a Visualization Builder

1. Click Create visualization from the Visualize tab, select the VisBuilder visualization format, and use wazuh-events* as the index pattern name.

   

2. Drag a field to the configuration panel to generate a visualization.

3. Set aggregation to count on the Y-axis.

4. Set wazuh.integration.name on an X-axis.

5. Set wazuh.integration.category on the Split series.

   

6. Click the Save button in the top right corner and assign a title to save the visualization.

TSVB

Time Series Visual Builder (TSVB) is a component of the Wazuh dashboard that allows users to create visualizations and analyze time series data using a visual pipeline interface. It provides features such as aggregations, filters, and metrics specifically tailored for time-based analysis.

The steps below show how to use Time Series Visual Builder to visualize Wazuh integration count within a timeframe.

Creating a TSVB

1. Select the TSVB visualization format from the Visualize tab.

   

2. Set the following values on the Metric tab in Data:

   • Aggregation = Count

   • Group by = Terms

   • By = wazuh.integration.category

   • Top = 10

   • Order by = Doc Count (default)

   • Direction = Descending

   

3. Click the Save button in the top right corner and assign a title to save the visualization.

Tag Cloud

This is a visual representation of text data where words are displayed in varying sizes based on their importance. Tag clouds are often used in data visualization, text analysis, or content analysis.

Creating a tag cloud

1. Click Create visualization from the Visualize tab, select the Tag cloud visualization format, and use wazuh-events* as the index pattern name.

   

2. Set the following value on the Metric in Metrics data:

   • Tag size = Count

3. Add a new Tag in Bucket data and set the following values:

   • Aggregation = Terms

   • Field = wazuh.integration.name

   • Order by = Metric: Count

4. Click the Update button.

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Markdown

Markdown is a lightweight markup language that is used for formatting text. It allows users to add structure, emphasis, and styling to plain text documents without the need for complex coding. Markdown is often utilized in documentation, websites, and note-taking applications to create easily readable and formatted content.

Creating a markdown

1. Click Create visualization from the Visualize tab, select the Markdown visualization format, and use wazuh-events* as the index pattern name.

   

2. Add the text content in the given text area on the Data tab.

3. Increase or decrease the font using the controller on the Options tab.

4. Click on the Update button to show the markdown:

   

5. Click the Save button in the top right corner and assign a title to save the visualization.

Controls

These are interactive tools that provide users with the ability to manipulate or adjust parameters or settings within a software application or user interface. These controls enable users to customize their experience or modify certain aspects of the system according to their preferences. Controls are typically used in interactive applications or interfaces where users need to adjust settings, parameters, or filters to customize their experience or analyze specific aspects of the data.

At the time of writing this document, this visualization is experimental. The design and implementation are less mature than stable visualizations and might be subject to change.

Creating controls

1. Click Create visualization from the Visualize tab, and select the Controls visualization format.

   

2. Click on the Add button to add a new Options list and set the Control Label as MITRE tactic.

3. Set wazuh-events* as the Index Pattern name.

4. Select the field rule.mitre.tactic.

   

5. Click the Update button.

6. In the dropdown list, select Range slider and click on the Add button. Set the Control Label as Quantity.

   

7. Select wazuh-events* as the Index Pattern name.

8. Select event.severity as the Field.

9. Click the Update button.

   

10. Click the Save button in the top right corner and assign a title to save the visualization.

Timeline

This is a chronological display of events or activities, often depicted as a horizontal line with dates or time periods marked along it. Timeline builds a time-series using functional expressions.

They are commonly used in historical analysis, project planning, or storytelling.

Creating Timeline

1. Click Create visualization from the Visualize tab, and select the Timeline visualization format.

   

2. Choose a source for the chart. In the Timeline expression windows, within .opensearch(*). The expression .opensearch(*) is a wildcard value that represents all the indexes currently within the Wazuh indexer, combined together. Here we selected wazuh-events* as the index to use.

   .opensearch(index=wazuh-events-*)
   

   

   Where:

   • Index represents the data storage unit containing the data to be used for visualization.

   • Interval represents the time duration between data points or events.

   • Timefield represents a specific field in a dataset that holds timestamp or time information for each data point.

   • Metric represents the quantitative measure to be used from the data.

   • Offset is used to adjust the time displayed on the timeline for aligning with specific events.

   • opensearchDashboards represents a platform that provides a web-based interface for visualizing and exploring real-time data.

   • Q represents a query or set of queries used to filter and retrieve specific data for display.

   • Split represents the function that divides or groups data into segments based on a specified parameter for visualization and analysis.

   A sample query:

   .opensearch(index=wazuh-alerts-*, timefield=@timestamp, metric=count:request).aggregate(function=avg)
   

Vega

This is a versatile declarative language for creating interactive visualizations. It allows users to define visualizations using JSON syntax. It allows users to define complex visualizations using JSON syntax and is suitable for advanced data visualization needs.