Soc pages (#104)
* added soc pages * added soc api * updated badge component * updated soc alert page * Updated soc alert item component * updated soc alert page * updated soc alert page * added soc cases page * updated soc cases page * improved soc cases assets list * graylog running and configured inputs model fix pydantic model failure when GELF input is configured. Made missing fields optional * remove logging during debugging * soc asset pydantic model fix * add connectors if not exist async * return connector extra data * added soc case note components * influxdb verification check * added soc users page * influxdb get alerts * influxdb alert query * grafana connector * precommit fixes * precommit fixes * grafana dashboard upload test * grafana dashboard provision * GRAFANA WAZUH DASHBOARDS PROVISIONING * Grafana dashboards provisioning improvements * create index set in graylog * graylog index creation refactor * precommit fixes * create graylog stream * updated soc users page * added soc user assign feature * updated soc users page * influxdb alerts fix * get single alert api endpoint * single alret api * get soc alerts assigned to user * updated soc api * bummped up bookmark * updated alert assign feature * graylog stream connection to pipeline * updated soc alert item component * create wazuh groups * configure wazuh agent groups * grafana provisioning * grafana datasource creation * universal connector attribute * updated soc users list component * replace dashboard uid with correct value * provisioning update customermeta table * precommit fixes --------- Co-authored-by: Davide Di Modica <webmaster.ddm@gmail.com>
taylor_socfortress committed
Dec 5, 2023 at 14:54 UTC
d309d2ac6274fbcf278b6da217cc5189c9de2618
106 files changed
+79605
-735
backend/app/connectors/dfir_iris/routes/alerts.py
+36
-6
@@ -9,6 +9,7 @@ from app.connectors.dfir_iris.schema.alerts import AlertResponse
9
from app.connectors.dfir_iris.schema.alerts import AlertsResponse
10
from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse
11
from app.connectors.dfir_iris.services.alerts import bookmark_alert
12
+from app.connectors.dfir_iris.services.alerts import get_alert
13
from app.connectors.dfir_iris.services.alerts import get_alerts
14
from app.connectors.dfir_iris.services.alerts import get_bookmarked_alerts
15
from app.connectors.dfir_iris.utils.universal import check_alert_exists
@@ -17,6 +18,7 @@ from app.connectors.dfir_iris.utils.universal import check_alert_exists
18
19
20
async def verify_alert_exists(alert_id: str) -> str:
21
+ logger.info(f"Verifying alert {alert_id} exists")
22
if not await check_alert_exists(alert_id):
23
raise HTTPException(status_code=400, detail=f"Alert {alert_id} does not exist.")
24
return alert_id
@@ -25,6 +27,17 @@ async def verify_alert_exists(alert_id: str) -> str:
27
dfir_iris_alerts_router = APIRouter()
28
29
30
+@dfir_iris_alerts_router.get(
31
+ "/bookmark",
32
+ response_model=BookmarkedAlertsResponse,
33
+ description="Get all bookmarked alerts",
34
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
35
+)
36
+async def get_all_bookmarked_alerts() -> BookmarkedAlertsResponse:
37
+ logger.info("Fetching all bookmarked alerts")
38
+ return await get_bookmarked_alerts()
39
+
40
+
41
@dfir_iris_alerts_router.get(
42
"",
43
response_model=AlertsResponse,
@@ -37,14 +50,31 @@ async def get_all_alerts() -> AlertsResponse:
50
51
52
@dfir_iris_alerts_router.get(
40
- "/bookmark",
41
- response_model=BookmarkedAlertsResponse,
42
- description="Get all bookmarked alerts",
53
+ "/{alert_id}",
54
+ response_model=AlertResponse,
55
+ description="Get an alert by ID",
56
dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
57
)
45
-async def get_all_bookmarked_alerts() -> BookmarkedAlertsResponse:
46
- logger.info("Fetching all bookmarked alerts")
47
- return await get_bookmarked_alerts()
58
+async def get_alert_by_id(alert_id: str = Depends(verify_alert_exists)) -> AlertResponse:
59
+ logger.info(f"Fetching alert {alert_id}")
60
+ return await get_alert(alert_id=alert_id)
61
+
62
+
63
+@dfir_iris_alerts_router.get(
64
+ "/alerts_by_user/{user_id}",
65
+ response_model=AlertsResponse,
66
+ description="Get all alerts assigned to a user",
67
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
68
+)
69
+async def get_all_alerts_assigned_to_user(user_id: int) -> AlertsResponse:
70
+ logger.info(f"Fetching all alerts assigned to user {user_id}")
71
+ alerts = (await get_alerts()).alerts
72
+ alerts_assigned_to_user = []
73
+ for alert in alerts:
74
+ if alert["alert_owner_id"] == user_id:
75
+ alerts_assigned_to_user.append(alert)
76
+
77
+ return AlertsResponse(success=True, message="Successfully fetched alerts assigned to user", alerts=alerts_assigned_to_user)
78
79
80
@dfir_iris_alerts_router.post(
backend/app/connectors/dfir_iris/routes/users.py
+12
@@ -9,6 +9,7 @@ from app.connectors.dfir_iris.schema.alerts import AlertResponse
9
from app.connectors.dfir_iris.schema.users import User
10
from app.connectors.dfir_iris.schema.users import UsersResponse
11
from app.connectors.dfir_iris.services.users import assign_user_to_alert
12
+from app.connectors.dfir_iris.services.users import delete_user_from_alert
13
from app.connectors.dfir_iris.services.users import get_users
14
from app.connectors.dfir_iris.utils.universal import check_alert_exists
15
from app.connectors.dfir_iris.utils.universal import check_user_exists
@@ -49,3 +50,14 @@ async def get_all_users() -> UsersResponse:
50
async def assign_user_to_alert_route(alert_id: str = Depends(verify_alert_exists), user_id: int = Depends(verify_user_exists)) -> User:
51
logger.info(f"Assigning user {user_id} to alert {alert_id}")
52
return await assign_user_to_alert(alert_id, user_id)
53
+
54
+
55
+@dfir_iris_users_router.delete(
56
+ "/assign/{alert_id}/{user_id}",
57
+ response_model=AlertResponse,
58
+ description="Delete a user from an alert",
59
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
60
+)
61
+async def delete_user_from_alert_route(alert_id: str = Depends(verify_alert_exists), user_id: int = Depends(verify_user_exists)) -> User:
62
+ logger.info(f"Deleting user {user_id} from alert {alert_id}")
63
+ return await delete_user_from_alert(alert_id, user_id)
backend/app/connectors/dfir_iris/schema/assets.py
+5
-4
@@ -2,6 +2,7 @@ from typing import List
2
from typing import Optional
3
4
from pydantic import BaseModel
5
+from pydantic import Field
6
7
8
class AssetState(BaseModel):
@@ -12,16 +13,16 @@ class AssetState(BaseModel):
13
class Asset(BaseModel):
14
analysis_status: str
15
analysis_status_id: int
15
- asset_compromise_status_id: int
16
+ asset_compromise_status_id: Optional[int]
17
asset_description: str
17
- asset_domain: str
18
+ asset_domain: Optional[str]
19
asset_icon_compromised: str
20
asset_icon_not_compromised: str
21
asset_id: int
22
asset_ip: str
23
asset_name: str
23
- asset_tags: str
24
- asset_type: str
24
+ asset_tags: Optional[str]
25
+ asset_type: Optional[str]
26
asset_type_id: int
27
asset_uuid: str
28
ioc_links: Optional[None]
backend/app/connectors/dfir_iris/services/alerts.py
+7
@@ -1,4 +1,5 @@
1
from fastapi import HTTPException
2
+from loguru import logger
3
4
from app.connectors.dfir_iris.schema.alerts import AlertResponse
5
from app.connectors.dfir_iris.schema.alerts import AlertsResponse
@@ -13,6 +14,12 @@ async def get_alerts() -> AlertsResponse:
14
return AlertsResponse(success=True, message="Successfully fetched alerts", alerts=result["data"]["alerts"])
15
16
17
+async def get_alert(alert_id: str) -> AlertResponse:
18
+ client, alert = await initialize_client_and_alert("DFIR-IRIS")
19
+ result = await fetch_and_validate_data(client, alert.get_alert, alert_id)
20
+ return AlertResponse(success=True, message="Successfully fetched alert", alert=result["data"])
21
+
22
+
23
async def bookmark_alert(alert_id: str, bookmarked: bool) -> AlertResponse:
24
client, alert = await initialize_client_and_alert("DFIR-IRIS")
25
if bookmarked:
backend/app/connectors/dfir_iris/services/users.py
+6
@@ -15,3 +15,9 @@ async def assign_user_to_alert(alert_id: str, user_id: int) -> AlertResponse:
15
client, alert = await initialize_client_and_alert("DFIR-IRIS")
16
result = await fetch_and_validate_data(client, alert.update_alert, alert_id, {"alert_owner_id": user_id})
17
return AlertResponse(success=True, message="Successfully assigned user to alert", alert=result["data"])
18
+
19
+
20
+async def delete_user_from_alert(alert_id: str, user_id: int) -> AlertResponse:
21
+ client, alert = await initialize_client_and_alert("DFIR-IRIS")
22
+ result = await fetch_and_validate_data(client, alert.update_alert, alert_id, {"alert_owner_id": None})
23
+ return AlertResponse(success=True, message="Successfully deleted user from alert", alert=result["data"])
backend/app/connectors/grafana/dashboards/Office365/dashboard1.json
new
+843
@@ -0,0 +1,843 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "grafana",
8
+ "uid": "-- Grafana --"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [],
29
+ "liveNow": false,
30
+ "panels": [
31
+ {
32
+ "datasource": {
33
+ "type": "elasticsearch",
34
+ "uid": "wazuh_datasource_uid"
35
+ },
36
+ "fieldConfig": {
37
+ "defaults": {
38
+ "color": {
39
+ "mode": "thresholds"
40
+ },
41
+ "mappings": [],
42
+ "thresholds": {
43
+ "mode": "absolute",
44
+ "steps": [
45
+ {
46
+ "color": "blue",
47
+ "value": null
48
+ }
49
+ ]
50
+ }
51
+ },
52
+ "overrides": []
53
+ },
54
+ "gridPos": {
55
+ "h": 7,
56
+ "w": 4,
57
+ "x": 0,
58
+ "y": 0
59
+ },
60
+ "id": 2,
61
+ "options": {
62
+ "colorMode": "value",
63
+ "graphMode": "none",
64
+ "justifyMode": "auto",
65
+ "orientation": "auto",
66
+ "reduceOptions": {
67
+ "calcs": ["sum"],
68
+ "fields": "",
69
+ "values": false
70
+ },
71
+ "textMode": "auto"
72
+ },
73
+ "pluginVersion": "9.3.1",
74
+ "targets": [
75
+ {
76
+ "alias": "",
77
+ "bucketAggs": [
78
+ {
79
+ "field": "timestamp",
80
+ "id": "2",
81
+ "settings": {
82
+ "interval": "365d"
83
+ },
84
+ "type": "date_histogram"
85
+ }
86
+ ],
87
+ "datasource": {
88
+ "type": "elasticsearch",
89
+ "uid": "wazuh_datasource_uid"
90
+ },
91
+ "metrics": [
92
+ {
93
+ "field": "data_machine_name",
94
+ "id": "1",
95
+ "type": "cardinality"
96
+ }
97
+ ],
98
+ "query": "rule_groups:ad_inventory",
99
+ "refId": "A",
100
+ "timeField": "timestamp"
101
+ }
102
+ ],
103
+ "title": "TOTAL MACHINES",
104
+ "type": "stat"
105
+ },
106
+ {
107
+ "datasource": {
108
+ "type": "elasticsearch",
109
+ "uid": "wazuh_datasource_uid"
110
+ },
111
+ "fieldConfig": {
112
+ "defaults": {
113
+ "color": {
114
+ "mode": "palette-classic"
115
+ },
116
+ "custom": {
117
+ "hideFrom": {
118
+ "legend": false,
119
+ "tooltip": false,
120
+ "viz": false
121
+ }
122
+ },
123
+ "mappings": []
124
+ },
125
+ "overrides": []
126
+ },
127
+ "gridPos": {
128
+ "h": 7,
129
+ "w": 7,
130
+ "x": 4,
131
+ "y": 0
132
+ },
133
+ "id": 6,
134
+ "options": {
135
+ "legend": {
136
+ "displayMode": "table",
137
+ "placement": "right",
138
+ "showLegend": true
139
+ },
140
+ "pieType": "donut",
141
+ "reduceOptions": {
142
+ "calcs": ["sum"],
143
+ "fields": "",
144
+ "values": false
145
+ },
146
+ "tooltip": {
147
+ "mode": "single",
148
+ "sort": "none"
149
+ }
150
+ },
151
+ "targets": [
152
+ {
153
+ "alias": "",
154
+ "bucketAggs": [
155
+ {
156
+ "field": "data_OperatingSystem",
157
+ "id": "3",
158
+ "settings": {
159
+ "min_doc_count": "1",
160
+ "order": "desc",
161
+ "orderBy": "_term",
162
+ "size": "10"
163
+ },
164
+ "type": "terms"
165
+ },
166
+ {
167
+ "field": "timestamp",
168
+ "id": "2",
169
+ "settings": {
170
+ "interval": "auto"
171
+ },
172
+ "type": "date_histogram"
173
+ }
174
+ ],
175
+ "datasource": {
176
+ "type": "elasticsearch",
177
+ "uid": "wazuh_datasource_uid"
178
+ },
179
+ "metrics": [
180
+ {
181
+ "id": "1",
182
+ "type": "count"
183
+ }
184
+ ],
185
+ "query": "rule_groups:ad_inventory",
186
+ "refId": "A",
187
+ "timeField": "timestamp"
188
+ }
189
+ ],
190
+ "title": "COMPUTERS BY OS",
191
+ "type": "piechart"
192
+ },
193
+ {
194
+ "datasource": {
195
+ "type": "elasticsearch",
196
+ "uid": "wazuh_datasource_uid"
197
+ },
198
+ "fieldConfig": {
199
+ "defaults": {
200
+ "color": {
201
+ "mode": "thresholds"
202
+ },
203
+ "mappings": [],
204
+ "thresholds": {
205
+ "mode": "absolute",
206
+ "steps": [
207
+ {
208
+ "color": "green",
209
+ "value": null
210
+ },
211
+ {
212
+ "color": "red",
213
+ "value": 80
214
+ }
215
+ ]
216
+ }
217
+ },
218
+ "overrides": []
219
+ },
220
+ "gridPos": {
221
+ "h": 7,
222
+ "w": 13,
223
+ "x": 11,
224
+ "y": 0
225
+ },
226
+ "id": 7,
227
+ "options": {
228
+ "displayMode": "gradient",
229
+ "minVizHeight": 10,
230
+ "minVizWidth": 0,
231
+ "orientation": "horizontal",
232
+ "reduceOptions": {
233
+ "calcs": ["sum"],
234
+ "fields": "",
235
+ "values": false
236
+ },
237
+ "showUnfilled": true
238
+ },
239
+ "pluginVersion": "9.3.1",
240
+ "targets": [
241
+ {
242
+ "alias": "",
243
+ "bucketAggs": [
244
+ {
245
+ "field": "data_PrimaryGroup",
246
+ "id": "3",
247
+ "settings": {
248
+ "min_doc_count": "1",
249
+ "order": "desc",
250
+ "orderBy": "_term",
251
+ "size": "10"
252
+ },
253
+ "type": "terms"
254
+ },
255
+ {
256
+ "field": "timestamp",
257
+ "id": "2",
258
+ "settings": {
259
+ "interval": "auto"
260
+ },
261
+ "type": "date_histogram"
262
+ }
263
+ ],
264
+ "datasource": {
265
+ "type": "elasticsearch",
266
+ "uid": "wazuh_datasource_uid"
267
+ },
268
+ "metrics": [
269
+ {
270
+ "id": "1",
271
+ "type": "count"
272
+ }
273
+ ],
274
+ "query": "rule_groups:ad_inventory",
275
+ "refId": "A",
276
+ "timeField": "timestamp"
277
+ }
278
+ ],
279
+ "title": "COMPUTERS BY PRIMARY GROUP",
280
+ "type": "bargauge"
281
+ },
282
+ {
283
+ "datasource": {
284
+ "type": "elasticsearch",
285
+ "uid": "wazuh_datasource_uid"
286
+ },
287
+ "fieldConfig": {
288
+ "defaults": {
289
+ "color": {
290
+ "mode": "thresholds"
291
+ },
292
+ "mappings": [],
293
+ "thresholds": {
294
+ "mode": "absolute",
295
+ "steps": [
296
+ {
297
+ "color": "orange",
298
+ "value": null
299
+ }
300
+ ]
301
+ }
302
+ },
303
+ "overrides": []
304
+ },
305
+ "gridPos": {
306
+ "h": 7,
307
+ "w": 4,
308
+ "x": 0,
309
+ "y": 7
310
+ },
311
+ "id": 8,
312
+ "options": {
313
+ "colorMode": "value",
314
+ "graphMode": "none",
315
+ "justifyMode": "auto",
316
+ "orientation": "auto",
317
+ "reduceOptions": {
318
+ "calcs": ["sum"],
319
+ "fields": "",
320
+ "values": false
321
+ },
322
+ "textMode": "auto"
323
+ },
324
+ "pluginVersion": "9.3.1",
325
+ "targets": [
326
+ {
327
+ "alias": "",
328
+ "bucketAggs": [
329
+ {
330
+ "field": "timestamp",
331
+ "id": "2",
332
+ "settings": {
333
+ "interval": "365d"
334
+ },
335
+ "type": "date_histogram"
336
+ }
337
+ ],
338
+ "datasource": {
339
+ "type": "elasticsearch",
340
+ "uid": "wazuh_datasource_uid"
341
+ },
342
+ "metrics": [
343
+ {
344
+ "id": "1",
345
+ "type": "count"
346
+ }
347
+ ],
348
+ "query": "rule_groups:ad_inventory AND data_LockedOut:true",
349
+ "refId": "A",
350
+ "timeField": "timestamp"
351
+ }
352
+ ],
353
+ "title": "LOCKED OUT MACHINES",
354
+ "type": "stat"
355
+ },
356
+ {
357
+ "datasource": {
358
+ "type": "elasticsearch",
359
+ "uid": "wazuh_datasource_uid"
360
+ },
361
+ "fieldConfig": {
362
+ "defaults": {
363
+ "color": {
364
+ "mode": "palette-classic"
365
+ },
366
+ "custom": {
367
+ "hideFrom": {
368
+ "legend": false,
369
+ "tooltip": false,
370
+ "viz": false
371
+ }
372
+ },
373
+ "mappings": []
374
+ },
375
+ "overrides": [
376
+ {
377
+ "matcher": {
378
+ "id": "byName",
379
+ "options": "13"
380
+ },
381
+ "properties": [
382
+ {
383
+ "id": "color",
384
+ "value": {
385
+ "fixedColor": "orange",
386
+ "mode": "fixed"
387
+ }
388
+ }
389
+ ]
390
+ }
391
+ ]
392
+ },
393
+ "gridPos": {
394
+ "h": 7,
395
+ "w": 7,
396
+ "x": 4,
397
+ "y": 7
398
+ },
399
+ "id": 9,
400
+ "options": {
401
+ "legend": {
402
+ "displayMode": "table",
403
+ "placement": "right",
404
+ "showLegend": true
405
+ },
406
+ "pieType": "donut",
407
+ "reduceOptions": {
408
+ "calcs": ["sum"],
409
+ "fields": "",
410
+ "values": false
411
+ },
412
+ "tooltip": {
413
+ "mode": "single",
414
+ "sort": "none"
415
+ }
416
+ },
417
+ "targets": [
418
+ {
419
+ "alias": "",
420
+ "bucketAggs": [
421
+ {
422
+ "field": "data_asset_criticality",
423
+ "id": "3",
424
+ "settings": {
425
+ "min_doc_count": "1",
426
+ "order": "desc",
427
+ "orderBy": "_term",
428
+ "size": "10"
429
+ },
430
+ "type": "terms"
431
+ },
432
+ {
433
+ "field": "timestamp",
434
+ "id": "2",
435
+ "settings": {
436
+ "interval": "auto"
437
+ },
438
+ "type": "date_histogram"
439
+ }
440
+ ],
441
+ "datasource": {
442
+ "type": "elasticsearch",
443
+ "uid": "wazuh_datasource_uid"
444
+ },
445
+ "metrics": [
446
+ {
447
+ "id": "1",
448
+ "type": "count"
449
+ }
450
+ ],
451
+ "query": "rule_groups:ad_inventory",
452
+ "refId": "A",
453
+ "timeField": "timestamp"
454
+ }
455
+ ],
456
+ "title": "COMPUTERS BY CRITICALITY",
457
+ "type": "piechart"
458
+ },
459
+ {
460
+ "datasource": {
461
+ "type": "elasticsearch",
462
+ "uid": "wazuh_datasource_uid"
463
+ },
464
+ "fieldConfig": {
465
+ "defaults": {
466
+ "color": {
467
+ "mode": "thresholds"
468
+ },
469
+ "mappings": [],
470
+ "thresholds": {
471
+ "mode": "absolute",
472
+ "steps": [
473
+ {
474
+ "color": "green",
475
+ "value": null
476
+ },
477
+ {
478
+ "color": "red",
479
+ "value": 80
480
+ }
481
+ ]
482
+ }
483
+ },
484
+ "overrides": []
485
+ },
486
+ "gridPos": {
487
+ "h": 7,
488
+ "w": 13,
489
+ "x": 11,
490
+ "y": 7
491
+ },
492
+ "id": 10,
493
+ "options": {
494
+ "displayMode": "gradient",
495
+ "minVizHeight": 10,
496
+ "minVizWidth": 0,
497
+ "orientation": "horizontal",
498
+ "reduceOptions": {
499
+ "calcs": ["sum"],
500
+ "fields": "",
501
+ "values": false
502
+ },
503
+ "showUnfilled": true
504
+ },
505
+ "pluginVersion": "9.3.1",
506
+ "targets": [
507
+ {
508
+ "alias": "",
509
+ "bucketAggs": [
510
+ {
511
+ "field": "data_Location",
512
+ "id": "3",
513
+ "settings": {
514
+ "min_doc_count": "1",
515
+ "order": "desc",
516
+ "orderBy": "_term",
517
+ "size": "10"
518
+ },
519
+ "type": "terms"
520
+ },
521
+ {
522
+ "field": "timestamp",
523
+ "id": "2",
524
+ "settings": {
525
+ "interval": "auto"
526
+ },
527
+ "type": "date_histogram"
528
+ }
529
+ ],
530
+ "datasource": {
531
+ "type": "elasticsearch",
532
+ "uid": "wazuh_datasource_uid"
533
+ },
534
+ "metrics": [
535
+ {
536
+ "id": "1",
537
+ "type": "count"
538
+ }
539
+ ],
540
+ "query": "rule_groups:ad_inventory",
541
+ "refId": "A",
542
+ "timeField": "timestamp"
543
+ }
544
+ ],
545
+ "title": "COMPUTERS BY LOCATION",
546
+ "type": "bargauge"
547
+ },
548
+ {
549
+ "datasource": {
550
+ "type": "elasticsearch",
551
+ "uid": "wazuh_datasource_uid"
552
+ },
553
+ "fieldConfig": {
554
+ "defaults": {
555
+ "color": {
556
+ "mode": "thresholds"
557
+ },
558
+ "custom": {
559
+ "align": "auto",
560
+ "displayMode": "auto",
561
+ "filterable": true,
562
+ "inspect": false
563
+ },
564
+ "mappings": [],
565
+ "thresholds": {
566
+ "mode": "absolute",
567
+ "steps": [
568
+ {
569
+ "color": "green",
570
+ "value": null
571
+ },
572
+ {
573
+ "color": "red",
574
+ "value": 80
575
+ }
576
+ ]
577
+ }
578
+ },
579
+ "overrides": [
580
+ {
581
+ "matcher": {
582
+ "id": "byName",
583
+ "options": "CRITICALITY"
584
+ },
585
+ "properties": [
586
+ {
587
+ "id": "custom.width",
588
+ "value": 149
589
+ }
590
+ ]
591
+ },
592
+ {
593
+ "matcher": {
594
+ "id": "byName",
595
+ "options": "LOCATION"
596
+ },
597
+ "properties": [
598
+ {
599
+ "id": "custom.width",
600
+ "value": 124
601
+ }
602
+ ]
603
+ },
604
+ {
605
+ "matcher": {
606
+ "id": "byName",
607
+ "options": "CN"
608
+ },
609
+ "properties": [
610
+ {
611
+ "id": "custom.width",
612
+ "value": 161
613
+ }
614
+ ]
615
+ },
616
+ {
617
+ "matcher": {
618
+ "id": "byName",
619
+ "options": "MEMBER OF"
620
+ },
621
+ "properties": [
622
+ {
623
+ "id": "custom.width",
624
+ "value": 308
625
+ }
626
+ ]
627
+ },
628
+ {
629
+ "matcher": {
630
+ "id": "byName",
631
+ "options": "OS VERSION"
632
+ },
633
+ "properties": [
634
+ {
635
+ "id": "custom.width",
636
+ "value": 169
637
+ }
638
+ ]
639
+ },
640
+ {
641
+ "matcher": {
642
+ "id": "byName",
643
+ "options": "COMPUTER"
644
+ },
645
+ "properties": [
646
+ {
647
+ "id": "custom.width",
648
+ "value": 186
649
+ }
650
+ ]
651
+ }
652
+ ]
653
+ },
654
+ "gridPos": {
655
+ "h": 13,
656
+ "w": 24,
657
+ "x": 0,
658
+ "y": 14
659
+ },
660
+ "id": 4,
661
+ "options": {
662
+ "footer": {
663
+ "enablePagination": true,
664
+ "fields": "",
665
+ "reducer": ["sum"],
666
+ "show": false
667
+ },
668
+ "showHeader": true,
669
+ "sortBy": []
670
+ },
671
+ "pluginVersion": "9.3.1",
672
+ "targets": [
673
+ {
674
+ "alias": "",
675
+ "bucketAggs": [],
676
+ "datasource": {
677
+ "type": "elasticsearch",
678
+ "uid": "wazuh_datasource_uid"
679
+ },
680
+ "metrics": [
681
+ {
682
+ "id": "1",
683
+ "settings": {
684
+ "size": "500"
685
+ },
686
+ "type": "raw_data"
687
+ }
688
+ ],
689
+ "query": "rule_groups:ad_inventory",
690
+ "refId": "A",
691
+ "timeField": "timestamp"
692
+ }
693
+ ],
694
+ "title": "AD INVENTORY",
695
+ "transformations": [
696
+ {
697
+ "id": "organize",
698
+ "options": {
699
+ "excludeByName": {
700
+ "_id": true,
701
+ "_index": true,
702
+ "_type": true,
703
+ "agent_id": true,
704
+ "agent_ip": true,
705
+ "agent_ip_city_name": true,
706
+ "agent_ip_country_code": true,
707
+ "agent_ip_geolocation": true,
708
+ "agent_labels_customer": true,
709
+ "agent_name": true,
710
+ "data_Created": true,
711
+ "data_DNSHostName": true,
712
+ "data_LastLogonDate": true,
713
+ "data_Modified": true,
714
+ "data_Name": true,
715
+ "data_ObjectCategory": true,
716
+ "data_ObjectClass": true,
717
+ "data_collection": true,
718
+ "decoder_name": true,
719
+ "gl2_accounted_message_size": true,
720
+ "gl2_message_id": true,
721
+ "gl2_processing_error": true,
722
+ "gl2_remote_ip": true,
723
+ "gl2_remote_port": true,
724
+ "gl2_source_input": true,
725
+ "gl2_source_node": true,
726
+ "highlight": true,
727
+ "id": true,
728
+ "location": true,
729
+ "manager_name": true,
730
+ "message": true,
731
+ "rule_description": true,
732
+ "rule_firedtimes": true,
733
+ "rule_group1": true,
734
+ "rule_groups": true,
735
+ "rule_id": true,
736
+ "rule_level": true,
737
+ "rule_mail": true,
738
+ "sort": true,
739
+ "source": true,
740
+ "streams": true,
741
+ "syslog_level": true,
742
+ "syslog_type": true,
743
+ "timestamp": true,
744
+ "timestamp_utc": true,
745
+ "true": true
746
+ },
747
+ "indexByName": {
748
+ "_id": 10,
749
+ "_index": 11,
750
+ "_type": 12,
751
+ "agent_id": 13,
752
+ "agent_ip": 14,
753
+ "agent_ip_city_name": 15,
754
+ "agent_ip_country_code": 16,
755
+ "agent_ip_geolocation": 17,
756
+ "agent_labels_customer": 18,
757
+ "agent_name": 19,
758
+ "data_CN": 5,
759
+ "data_Created": 20,
760
+ "data_DNSHostName": 21,
761
+ "data_DistinguishedName": 6,
762
+ "data_LastLogonDate": 22,
763
+ "data_Location": 8,
764
+ "data_LockedOut": 23,
765
+ "data_MemberOf": 9,
766
+ "data_Modified": 24,
767
+ "data_Name": 25,
768
+ "data_ObjectCategory": 26,
769
+ "data_ObjectClass": 27,
770
+ "data_OperatingSystem": 2,
771
+ "data_OperatingSystemVersion": 3,
772
+ "data_PrimaryGroup": 7,
773
+ "data_asset_criticality": 4,
774
+ "data_collection": 28,
775
+ "data_machine_name": 1,
776
+ "decoder_name": 29,
777
+ "gl2_accounted_message_size": 30,
778
+ "gl2_message_id": 31,
779
+ "gl2_processing_error": 32,
780
+ "gl2_remote_ip": 33,
781
+ "gl2_remote_port": 34,
782
+ "gl2_source_input": 35,
783
+ "gl2_source_node": 36,
784
+ "highlight": 37,
785
+ "id": 38,
786
+ "location": 39,
787
+ "manager_name": 40,
788
+ "message": 41,
789
+ "rule_description": 42,
790
+ "rule_firedtimes": 43,
791
+ "rule_group1": 44,
792
+ "rule_groups": 45,
793
+ "rule_id": 46,
794
+ "rule_level": 47,
795
+ "rule_mail": 48,
796
+ "sort": 49,
797
+ "source": 50,
798
+ "streams": 51,
799
+ "syslog_level": 52,
800
+ "syslog_type": 53,
801
+ "timestamp": 0,
802
+ "timestamp_utc": 54,
803
+ "true": 55
804
+ },
805
+ "renameByName": {
806
+ "data_CN": "CN",
807
+ "data_DistinguishedName": "DN",
808
+ "data_LastLogonDate": "",
809
+ "data_Location": "LOCATION",
810
+ "data_LockedOut": "LOCKED OUT",
811
+ "data_MemberOf": "MEMBER OF",
812
+ "data_ObjectCategory": "",
813
+ "data_ObjectClass": "CLASS",
814
+ "data_OperatingSystem": "OS",
815
+ "data_OperatingSystemVersion": "OS VERSION",
816
+ "data_PrimaryGroup": "PRIMARY AD GROUP",
817
+ "data_asset_criticality": "CRITICALITY",
818
+ "data_collection": "",
819
+ "data_machine_name": "COMPUTER",
820
+ "timestamp": "DATE/TIME"
821
+ }
822
+ }
823
+ }
824
+ ],
825
+ "transparent": true,
826
+ "type": "table"
827
+ }
828
+ ],
829
+ "schemaVersion": 37,
830
+ "style": "dark",
831
+ "tags": [],
832
+ "templating": {
833
+ "list": []
834
+ },
835
+ "time": {
836
+ "from": "now-6h",
837
+ "to": "now"
838
+ },
839
+ "timepicker": {},
840
+ "timezone": "",
841
+ "title": "EDR - ACTIVE DIRECTORY INVENTORY",
842
+ "weekStart": ""
843
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_ad_inventory.json
new
+843
@@ -0,0 +1,843 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "grafana",
8
+ "uid": "-- Grafana --"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [],
29
+ "liveNow": false,
30
+ "panels": [
31
+ {
32
+ "datasource": {
33
+ "type": "elasticsearch",
34
+ "uid": "wazuh_datasource_uid"
35
+ },
36
+ "fieldConfig": {
37
+ "defaults": {
38
+ "color": {
39
+ "mode": "thresholds"
40
+ },
41
+ "mappings": [],
42
+ "thresholds": {
43
+ "mode": "absolute",
44
+ "steps": [
45
+ {
46
+ "color": "blue",
47
+ "value": null
48
+ }
49
+ ]
50
+ }
51
+ },
52
+ "overrides": []
53
+ },
54
+ "gridPos": {
55
+ "h": 7,
56
+ "w": 4,
57
+ "x": 0,
58
+ "y": 0
59
+ },
60
+ "id": 2,
61
+ "options": {
62
+ "colorMode": "value",
63
+ "graphMode": "none",
64
+ "justifyMode": "auto",
65
+ "orientation": "auto",
66
+ "reduceOptions": {
67
+ "calcs": ["sum"],
68
+ "fields": "",
69
+ "values": false
70
+ },
71
+ "textMode": "auto"
72
+ },
73
+ "pluginVersion": "9.3.1",
74
+ "targets": [
75
+ {
76
+ "alias": "",
77
+ "bucketAggs": [
78
+ {
79
+ "field": "timestamp",
80
+ "id": "2",
81
+ "settings": {
82
+ "interval": "365d"
83
+ },
84
+ "type": "date_histogram"
85
+ }
86
+ ],
87
+ "datasource": {
88
+ "type": "elasticsearch",
89
+ "uid": "wazuh_datasource_uid"
90
+ },
91
+ "metrics": [
92
+ {
93
+ "field": "data_machine_name",
94
+ "id": "1",
95
+ "type": "cardinality"
96
+ }
97
+ ],
98
+ "query": "rule_groups:ad_inventory",
99
+ "refId": "A",
100
+ "timeField": "timestamp"
101
+ }
102
+ ],
103
+ "title": "TOTAL MACHINES",
104
+ "type": "stat"
105
+ },
106
+ {
107
+ "datasource": {
108
+ "type": "elasticsearch",
109
+ "uid": "wazuh_datasource_uid"
110
+ },
111
+ "fieldConfig": {
112
+ "defaults": {
113
+ "color": {
114
+ "mode": "palette-classic"
115
+ },
116
+ "custom": {
117
+ "hideFrom": {
118
+ "legend": false,
119
+ "tooltip": false,
120
+ "viz": false
121
+ }
122
+ },
123
+ "mappings": []
124
+ },
125
+ "overrides": []
126
+ },
127
+ "gridPos": {
128
+ "h": 7,
129
+ "w": 7,
130
+ "x": 4,
131
+ "y": 0
132
+ },
133
+ "id": 6,
134
+ "options": {
135
+ "legend": {
136
+ "displayMode": "table",
137
+ "placement": "right",
138
+ "showLegend": true
139
+ },
140
+ "pieType": "donut",
141
+ "reduceOptions": {
142
+ "calcs": ["sum"],
143
+ "fields": "",
144
+ "values": false
145
+ },
146
+ "tooltip": {
147
+ "mode": "single",
148
+ "sort": "none"
149
+ }
150
+ },
151
+ "targets": [
152
+ {
153
+ "alias": "",
154
+ "bucketAggs": [
155
+ {
156
+ "field": "data_OperatingSystem",
157
+ "id": "3",
158
+ "settings": {
159
+ "min_doc_count": "1",
160
+ "order": "desc",
161
+ "orderBy": "_term",
162
+ "size": "10"
163
+ },
164
+ "type": "terms"
165
+ },
166
+ {
167
+ "field": "timestamp",
168
+ "id": "2",
169
+ "settings": {
170
+ "interval": "auto"
171
+ },
172
+ "type": "date_histogram"
173
+ }
174
+ ],
175
+ "datasource": {
176
+ "type": "elasticsearch",
177
+ "uid": "wazuh_datasource_uid"
178
+ },
179
+ "metrics": [
180
+ {
181
+ "id": "1",
182
+ "type": "count"
183
+ }
184
+ ],
185
+ "query": "rule_groups:ad_inventory",
186
+ "refId": "A",
187
+ "timeField": "timestamp"
188
+ }
189
+ ],
190
+ "title": "COMPUTERS BY OS",
191
+ "type": "piechart"
192
+ },
193
+ {
194
+ "datasource": {
195
+ "type": "elasticsearch",
196
+ "uid": "wazuh_datasource_uid"
197
+ },
198
+ "fieldConfig": {
199
+ "defaults": {
200
+ "color": {
201
+ "mode": "thresholds"
202
+ },
203
+ "mappings": [],
204
+ "thresholds": {
205
+ "mode": "absolute",
206
+ "steps": [
207
+ {
208
+ "color": "green",
209
+ "value": null
210
+ },
211
+ {
212
+ "color": "red",
213
+ "value": 80
214
+ }
215
+ ]
216
+ }
217
+ },
218
+ "overrides": []
219
+ },
220
+ "gridPos": {
221
+ "h": 7,
222
+ "w": 13,
223
+ "x": 11,
224
+ "y": 0
225
+ },
226
+ "id": 7,
227
+ "options": {
228
+ "displayMode": "gradient",
229
+ "minVizHeight": 10,
230
+ "minVizWidth": 0,
231
+ "orientation": "horizontal",
232
+ "reduceOptions": {
233
+ "calcs": ["sum"],
234
+ "fields": "",
235
+ "values": false
236
+ },
237
+ "showUnfilled": true
238
+ },
239
+ "pluginVersion": "9.3.1",
240
+ "targets": [
241
+ {
242
+ "alias": "",
243
+ "bucketAggs": [
244
+ {
245
+ "field": "data_PrimaryGroup",
246
+ "id": "3",
247
+ "settings": {
248
+ "min_doc_count": "1",
249
+ "order": "desc",
250
+ "orderBy": "_term",
251
+ "size": "10"
252
+ },
253
+ "type": "terms"
254
+ },
255
+ {
256
+ "field": "timestamp",
257
+ "id": "2",
258
+ "settings": {
259
+ "interval": "auto"
260
+ },
261
+ "type": "date_histogram"
262
+ }
263
+ ],
264
+ "datasource": {
265
+ "type": "elasticsearch",
266
+ "uid": "wazuh_datasource_uid"
267
+ },
268
+ "metrics": [
269
+ {
270
+ "id": "1",
271
+ "type": "count"
272
+ }
273
+ ],
274
+ "query": "rule_groups:ad_inventory",
275
+ "refId": "A",
276
+ "timeField": "timestamp"
277
+ }
278
+ ],
279
+ "title": "COMPUTERS BY PRIMARY GROUP",
280
+ "type": "bargauge"
281
+ },
282
+ {
283
+ "datasource": {
284
+ "type": "elasticsearch",
285
+ "uid": "wazuh_datasource_uid"
286
+ },
287
+ "fieldConfig": {
288
+ "defaults": {
289
+ "color": {
290
+ "mode": "thresholds"
291
+ },
292
+ "mappings": [],
293
+ "thresholds": {
294
+ "mode": "absolute",
295
+ "steps": [
296
+ {
297
+ "color": "orange",
298
+ "value": null
299
+ }
300
+ ]
301
+ }
302
+ },
303
+ "overrides": []
304
+ },
305
+ "gridPos": {
306
+ "h": 7,
307
+ "w": 4,
308
+ "x": 0,
309
+ "y": 7
310
+ },
311
+ "id": 8,
312
+ "options": {
313
+ "colorMode": "value",
314
+ "graphMode": "none",
315
+ "justifyMode": "auto",
316
+ "orientation": "auto",
317
+ "reduceOptions": {
318
+ "calcs": ["sum"],
319
+ "fields": "",
320
+ "values": false
321
+ },
322
+ "textMode": "auto"
323
+ },
324
+ "pluginVersion": "9.3.1",
325
+ "targets": [
326
+ {
327
+ "alias": "",
328
+ "bucketAggs": [
329
+ {
330
+ "field": "timestamp",
331
+ "id": "2",
332
+ "settings": {
333
+ "interval": "365d"
334
+ },
335
+ "type": "date_histogram"
336
+ }
337
+ ],
338
+ "datasource": {
339
+ "type": "elasticsearch",
340
+ "uid": "wazuh_datasource_uid"
341
+ },
342
+ "metrics": [
343
+ {
344
+ "id": "1",
345
+ "type": "count"
346
+ }
347
+ ],
348
+ "query": "rule_groups:ad_inventory AND data_LockedOut:true",
349
+ "refId": "A",
350
+ "timeField": "timestamp"
351
+ }
352
+ ],
353
+ "title": "LOCKED OUT MACHINES",
354
+ "type": "stat"
355
+ },
356
+ {
357
+ "datasource": {
358
+ "type": "elasticsearch",
359
+ "uid": "wazuh_datasource_uid"
360
+ },
361
+ "fieldConfig": {
362
+ "defaults": {
363
+ "color": {
364
+ "mode": "palette-classic"
365
+ },
366
+ "custom": {
367
+ "hideFrom": {
368
+ "legend": false,
369
+ "tooltip": false,
370
+ "viz": false
371
+ }
372
+ },
373
+ "mappings": []
374
+ },
375
+ "overrides": [
376
+ {
377
+ "matcher": {
378
+ "id": "byName",
379
+ "options": "13"
380
+ },
381
+ "properties": [
382
+ {
383
+ "id": "color",
384
+ "value": {
385
+ "fixedColor": "orange",
386
+ "mode": "fixed"
387
+ }
388
+ }
389
+ ]
390
+ }
391
+ ]
392
+ },
393
+ "gridPos": {
394
+ "h": 7,
395
+ "w": 7,
396
+ "x": 4,
397
+ "y": 7
398
+ },
399
+ "id": 9,
400
+ "options": {
401
+ "legend": {
402
+ "displayMode": "table",
403
+ "placement": "right",
404
+ "showLegend": true
405
+ },
406
+ "pieType": "donut",
407
+ "reduceOptions": {
408
+ "calcs": ["sum"],
409
+ "fields": "",
410
+ "values": false
411
+ },
412
+ "tooltip": {
413
+ "mode": "single",
414
+ "sort": "none"
415
+ }
416
+ },
417
+ "targets": [
418
+ {
419
+ "alias": "",
420
+ "bucketAggs": [
421
+ {
422
+ "field": "data_asset_criticality",
423
+ "id": "3",
424
+ "settings": {
425
+ "min_doc_count": "1",
426
+ "order": "desc",
427
+ "orderBy": "_term",
428
+ "size": "10"
429
+ },
430
+ "type": "terms"
431
+ },
432
+ {
433
+ "field": "timestamp",
434
+ "id": "2",
435
+ "settings": {
436
+ "interval": "auto"
437
+ },
438
+ "type": "date_histogram"
439
+ }
440
+ ],
441
+ "datasource": {
442
+ "type": "elasticsearch",
443
+ "uid": "wazuh_datasource_uid"
444
+ },
445
+ "metrics": [
446
+ {
447
+ "id": "1",
448
+ "type": "count"
449
+ }
450
+ ],
451
+ "query": "rule_groups:ad_inventory",
452
+ "refId": "A",
453
+ "timeField": "timestamp"
454
+ }
455
+ ],
456
+ "title": "COMPUTERS BY CRITICALITY",
457
+ "type": "piechart"
458
+ },
459
+ {
460
+ "datasource": {
461
+ "type": "elasticsearch",
462
+ "uid": "wazuh_datasource_uid"
463
+ },
464
+ "fieldConfig": {
465
+ "defaults": {
466
+ "color": {
467
+ "mode": "thresholds"
468
+ },
469
+ "mappings": [],
470
+ "thresholds": {
471
+ "mode": "absolute",
472
+ "steps": [
473
+ {
474
+ "color": "green",
475
+ "value": null
476
+ },
477
+ {
478
+ "color": "red",
479
+ "value": 80
480
+ }
481
+ ]
482
+ }
483
+ },
484
+ "overrides": []
485
+ },
486
+ "gridPos": {
487
+ "h": 7,
488
+ "w": 13,
489
+ "x": 11,
490
+ "y": 7
491
+ },
492
+ "id": 10,
493
+ "options": {
494
+ "displayMode": "gradient",
495
+ "minVizHeight": 10,
496
+ "minVizWidth": 0,
497
+ "orientation": "horizontal",
498
+ "reduceOptions": {
499
+ "calcs": ["sum"],
500
+ "fields": "",
501
+ "values": false
502
+ },
503
+ "showUnfilled": true
504
+ },
505
+ "pluginVersion": "9.3.1",
506
+ "targets": [
507
+ {
508
+ "alias": "",
509
+ "bucketAggs": [
510
+ {
511
+ "field": "data_Location",
512
+ "id": "3",
513
+ "settings": {
514
+ "min_doc_count": "1",
515
+ "order": "desc",
516
+ "orderBy": "_term",
517
+ "size": "10"
518
+ },
519
+ "type": "terms"
520
+ },
521
+ {
522
+ "field": "timestamp",
523
+ "id": "2",
524
+ "settings": {
525
+ "interval": "auto"
526
+ },
527
+ "type": "date_histogram"
528
+ }
529
+ ],
530
+ "datasource": {
531
+ "type": "elasticsearch",
532
+ "uid": "wazuh_datasource_uid"
533
+ },
534
+ "metrics": [
535
+ {
536
+ "id": "1",
537
+ "type": "count"
538
+ }
539
+ ],
540
+ "query": "rule_groups:ad_inventory",
541
+ "refId": "A",
542
+ "timeField": "timestamp"
543
+ }
544
+ ],
545
+ "title": "COMPUTERS BY LOCATION",
546
+ "type": "bargauge"
547
+ },
548
+ {
549
+ "datasource": {
550
+ "type": "elasticsearch",
551
+ "uid": "wazuh_datasource_uid"
552
+ },
553
+ "fieldConfig": {
554
+ "defaults": {
555
+ "color": {
556
+ "mode": "thresholds"
557
+ },
558
+ "custom": {
559
+ "align": "auto",
560
+ "displayMode": "auto",
561
+ "filterable": true,
562
+ "inspect": false
563
+ },
564
+ "mappings": [],
565
+ "thresholds": {
566
+ "mode": "absolute",
567
+ "steps": [
568
+ {
569
+ "color": "green",
570
+ "value": null
571
+ },
572
+ {
573
+ "color": "red",
574
+ "value": 80
575
+ }
576
+ ]
577
+ }
578
+ },
579
+ "overrides": [
580
+ {
581
+ "matcher": {
582
+ "id": "byName",
583
+ "options": "CRITICALITY"
584
+ },
585
+ "properties": [
586
+ {
587
+ "id": "custom.width",
588
+ "value": 149
589
+ }
590
+ ]
591
+ },
592
+ {
593
+ "matcher": {
594
+ "id": "byName",
595
+ "options": "LOCATION"
596
+ },
597
+ "properties": [
598
+ {
599
+ "id": "custom.width",
600
+ "value": 124
601
+ }
602
+ ]
603
+ },
604
+ {
605
+ "matcher": {
606
+ "id": "byName",
607
+ "options": "CN"
608
+ },
609
+ "properties": [
610
+ {
611
+ "id": "custom.width",
612
+ "value": 161
613
+ }
614
+ ]
615
+ },
616
+ {
617
+ "matcher": {
618
+ "id": "byName",
619
+ "options": "MEMBER OF"
620
+ },
621
+ "properties": [
622
+ {
623
+ "id": "custom.width",
624
+ "value": 308
625
+ }
626
+ ]
627
+ },
628
+ {
629
+ "matcher": {
630
+ "id": "byName",
631
+ "options": "OS VERSION"
632
+ },
633
+ "properties": [
634
+ {
635
+ "id": "custom.width",
636
+ "value": 169
637
+ }
638
+ ]
639
+ },
640
+ {
641
+ "matcher": {
642
+ "id": "byName",
643
+ "options": "COMPUTER"
644
+ },
645
+ "properties": [
646
+ {
647
+ "id": "custom.width",
648
+ "value": 186
649
+ }
650
+ ]
651
+ }
652
+ ]
653
+ },
654
+ "gridPos": {
655
+ "h": 13,
656
+ "w": 24,
657
+ "x": 0,
658
+ "y": 14
659
+ },
660
+ "id": 4,
661
+ "options": {
662
+ "footer": {
663
+ "enablePagination": true,
664
+ "fields": "",
665
+ "reducer": ["sum"],
666
+ "show": false
667
+ },
668
+ "showHeader": true,
669
+ "sortBy": []
670
+ },
671
+ "pluginVersion": "9.3.1",
672
+ "targets": [
673
+ {
674
+ "alias": "",
675
+ "bucketAggs": [],
676
+ "datasource": {
677
+ "type": "elasticsearch",
678
+ "uid": "wazuh_datasource_uid"
679
+ },
680
+ "metrics": [
681
+ {
682
+ "id": "1",
683
+ "settings": {
684
+ "size": "500"
685
+ },
686
+ "type": "raw_data"
687
+ }
688
+ ],
689
+ "query": "rule_groups:ad_inventory",
690
+ "refId": "A",
691
+ "timeField": "timestamp"
692
+ }
693
+ ],
694
+ "title": "AD INVENTORY",
695
+ "transformations": [
696
+ {
697
+ "id": "organize",
698
+ "options": {
699
+ "excludeByName": {
700
+ "_id": true,
701
+ "_index": true,
702
+ "_type": true,
703
+ "agent_id": true,
704
+ "agent_ip": true,
705
+ "agent_ip_city_name": true,
706
+ "agent_ip_country_code": true,
707
+ "agent_ip_geolocation": true,
708
+ "agent_labels_customer": true,
709
+ "agent_name": true,
710
+ "data_Created": true,
711
+ "data_DNSHostName": true,
712
+ "data_LastLogonDate": true,
713
+ "data_Modified": true,
714
+ "data_Name": true,
715
+ "data_ObjectCategory": true,
716
+ "data_ObjectClass": true,
717
+ "data_collection": true,
718
+ "decoder_name": true,
719
+ "gl2_accounted_message_size": true,
720
+ "gl2_message_id": true,
721
+ "gl2_processing_error": true,
722
+ "gl2_remote_ip": true,
723
+ "gl2_remote_port": true,
724
+ "gl2_source_input": true,
725
+ "gl2_source_node": true,
726
+ "highlight": true,
727
+ "id": true,
728
+ "location": true,
729
+ "manager_name": true,
730
+ "message": true,
731
+ "rule_description": true,
732
+ "rule_firedtimes": true,
733
+ "rule_group1": true,
734
+ "rule_groups": true,
735
+ "rule_id": true,
736
+ "rule_level": true,
737
+ "rule_mail": true,
738
+ "sort": true,
739
+ "source": true,
740
+ "streams": true,
741
+ "syslog_level": true,
742
+ "syslog_type": true,
743
+ "timestamp": true,
744
+ "timestamp_utc": true,
745
+ "true": true
746
+ },
747
+ "indexByName": {
748
+ "_id": 10,
749
+ "_index": 11,
750
+ "_type": 12,
751
+ "agent_id": 13,
752
+ "agent_ip": 14,
753
+ "agent_ip_city_name": 15,
754
+ "agent_ip_country_code": 16,
755
+ "agent_ip_geolocation": 17,
756
+ "agent_labels_customer": 18,
757
+ "agent_name": 19,
758
+ "data_CN": 5,
759
+ "data_Created": 20,
760
+ "data_DNSHostName": 21,
761
+ "data_DistinguishedName": 6,
762
+ "data_LastLogonDate": 22,
763
+ "data_Location": 8,
764
+ "data_LockedOut": 23,
765
+ "data_MemberOf": 9,
766
+ "data_Modified": 24,
767
+ "data_Name": 25,
768
+ "data_ObjectCategory": 26,
769
+ "data_ObjectClass": 27,
770
+ "data_OperatingSystem": 2,
771
+ "data_OperatingSystemVersion": 3,
772
+ "data_PrimaryGroup": 7,
773
+ "data_asset_criticality": 4,
774
+ "data_collection": 28,
775
+ "data_machine_name": 1,
776
+ "decoder_name": 29,
777
+ "gl2_accounted_message_size": 30,
778
+ "gl2_message_id": 31,
779
+ "gl2_processing_error": 32,
780
+ "gl2_remote_ip": 33,
781
+ "gl2_remote_port": 34,
782
+ "gl2_source_input": 35,
783
+ "gl2_source_node": 36,
784
+ "highlight": 37,
785
+ "id": 38,
786
+ "location": 39,
787
+ "manager_name": 40,
788
+ "message": 41,
789
+ "rule_description": 42,
790
+ "rule_firedtimes": 43,
791
+ "rule_group1": 44,
792
+ "rule_groups": 45,
793
+ "rule_id": 46,
794
+ "rule_level": 47,
795
+ "rule_mail": 48,
796
+ "sort": 49,
797
+ "source": 50,
798
+ "streams": 51,
799
+ "syslog_level": 52,
800
+ "syslog_type": 53,
801
+ "timestamp": 0,
802
+ "timestamp_utc": 54,
803
+ "true": 55
804
+ },
805
+ "renameByName": {
806
+ "data_CN": "CN",
807
+ "data_DistinguishedName": "DN",
808
+ "data_LastLogonDate": "",
809
+ "data_Location": "LOCATION",
810
+ "data_LockedOut": "LOCKED OUT",
811
+ "data_MemberOf": "MEMBER OF",
812
+ "data_ObjectCategory": "",
813
+ "data_ObjectClass": "CLASS",
814
+ "data_OperatingSystem": "OS",
815
+ "data_OperatingSystemVersion": "OS VERSION",
816
+ "data_PrimaryGroup": "PRIMARY AD GROUP",
817
+ "data_asset_criticality": "CRITICALITY",
818
+ "data_collection": "",
819
+ "data_machine_name": "COMPUTER",
820
+ "timestamp": "DATE/TIME"
821
+ }
822
+ }
823
+ }
824
+ ],
825
+ "transparent": true,
826
+ "type": "table"
827
+ }
828
+ ],
829
+ "schemaVersion": 37,
830
+ "style": "dark",
831
+ "tags": [],
832
+ "templating": {
833
+ "list": []
834
+ },
835
+ "time": {
836
+ "from": "now-6h",
837
+ "to": "now"
838
+ },
839
+ "timepicker": {},
840
+ "timezone": "",
841
+ "title": "EDR - ACTIVE DIRECTORY INVENTORY",
842
+ "weekStart": ""
843
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_agent_inventory.json
new
+12383
@@ -0,0 +1,12383 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194066298,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "collapsed": false,
45
+ "datasource": {
46
+ "type": "elasticsearch",
47
+ "uid": "wazuh_datasource_uid"
48
+ },
49
+ "gridPos": {
50
+ "h": 1,
51
+ "w": 24,
52
+ "x": 0,
53
+ "y": 0
54
+ },
55
+ "id": 72,
56
+ "panels": [],
57
+ "title": "AGENTS INVENTORY - SUMMARY",
58
+ "type": "row"
59
+ },
60
+ {
61
+ "datasource": {
62
+ "type": "elasticsearch",
63
+ "uid": "wazuh_datasource_uid"
64
+ },
65
+ "fieldConfig": {
66
+ "defaults": {
67
+ "mappings": [
68
+ {
69
+ "options": {
70
+ "match": "null",
71
+ "result": {
72
+ "text": "N/A"
73
+ }
74
+ },
75
+ "type": "special"
76
+ }
77
+ ],
78
+ "thresholds": {
79
+ "mode": "absolute",
80
+ "steps": [
81
+ {
82
+ "color": "blue",
83
+ "value": null
84
+ }
85
+ ]
86
+ },
87
+ "unit": "short"
88
+ },
89
+ "overrides": []
90
+ },
91
+ "gridPos": {
92
+ "h": 8,
93
+ "w": 4,
94
+ "x": 0,
95
+ "y": 1
96
+ },
97
+ "id": 113,
98
+ "links": [],
99
+ "options": {
100
+ "colorMode": "value",
101
+ "graphMode": "area",
102
+ "justifyMode": "auto",
103
+ "orientation": "horizontal",
104
+ "reduceOptions": {
105
+ "calcs": ["sum"],
106
+ "fields": "",
107
+ "values": false
108
+ },
109
+ "text": {},
110
+ "textMode": "auto"
111
+ },
112
+ "pluginVersion": "9.0.0",
113
+ "targets": [
114
+ {
115
+ "bucketAggs": [
116
+ {
117
+ "$$hashKey": "object:50",
118
+ "field": "timestamp",
119
+ "id": "2",
120
+ "settings": {
121
+ "interval": "auto",
122
+ "min_doc_count": 0,
123
+ "trimEdges": 0
124
+ },
125
+ "type": "date_histogram"
126
+ }
127
+ ],
128
+ "datasource": {
129
+ "type": "elasticsearch",
130
+ "uid": "wazuh_datasource_uid"
131
+ },
132
+ "metrics": [
133
+ {
134
+ "$$hashKey": "object:48",
135
+ "field": "select field",
136
+ "id": "1",
137
+ "type": "count"
138
+ }
139
+ ],
140
+ "query": "agent_name:$agent_name AND rule_groups:*inventory",
141
+ "refId": "A",
142
+ "timeField": "timestamp"
143
+ }
144
+ ],
145
+ "title": "INVENTORY ITEMS",
146
+ "type": "stat"
147
+ },
148
+ {
149
+ "datasource": {
150
+ "type": "elasticsearch",
151
+ "uid": "wazuh_datasource_uid"
152
+ },
153
+ "fieldConfig": {
154
+ "defaults": {
155
+ "color": {
156
+ "mode": "palette-classic"
157
+ },
158
+ "custom": {
159
+ "hideFrom": {
160
+ "legend": false,
161
+ "tooltip": false,
162
+ "viz": false
163
+ }
164
+ },
165
+ "decimals": 0,
166
+ "mappings": [],
167
+ "unit": "short"
168
+ },
169
+ "overrides": [
170
+ {
171
+ "matcher": {
172
+ "id": "byName",
173
+ "options": "1"
174
+ },
175
+ "properties": [
176
+ {
177
+ "id": "color",
178
+ "value": {
179
+ "fixedColor": "#FF9830",
180
+ "mode": "fixed"
181
+ }
182
+ }
183
+ ]
184
+ },
185
+ {
186
+ "matcher": {
187
+ "id": "byName",
188
+ "options": "Alert"
189
+ },
190
+ "properties": [
191
+ {
192
+ "id": "color",
193
+ "value": {
194
+ "fixedColor": "#F2495C",
195
+ "mode": "fixed"
196
+ }
197
+ }
198
+ ]
199
+ },
200
+ {
201
+ "matcher": {
202
+ "id": "byName",
203
+ "options": "Error"
204
+ },
205
+ "properties": [
206
+ {
207
+ "id": "color",
208
+ "value": {
209
+ "fixedColor": "#F2495C",
210
+ "mode": "fixed"
211
+ }
212
+ }
213
+ ]
214
+ },
215
+ {
216
+ "matcher": {
217
+ "id": "byName",
218
+ "options": "Info"
219
+ },
220
+ "properties": [
221
+ {
222
+ "id": "color",
223
+ "value": {
224
+ "fixedColor": "#73BF69",
225
+ "mode": "fixed"
226
+ }
227
+ }
228
+ ]
229
+ },
230
+ {
231
+ "matcher": {
232
+ "id": "byName",
233
+ "options": "NOTICE"
234
+ },
235
+ "properties": [
236
+ {
237
+ "id": "color",
238
+ "value": {
239
+ "fixedColor": "#5794F2",
240
+ "mode": "fixed"
241
+ }
242
+ }
243
+ ]
244
+ },
245
+ {
246
+ "matcher": {
247
+ "id": "byName",
248
+ "options": "Notice"
249
+ },
250
+ "properties": [
251
+ {
252
+ "id": "color",
253
+ "value": {
254
+ "fixedColor": "#5794F2",
255
+ "mode": "fixed"
256
+ }
257
+ }
258
+ ]
259
+ },
260
+ {
261
+ "matcher": {
262
+ "id": "byName",
263
+ "options": "Result"
264
+ },
265
+ "properties": [
266
+ {
267
+ "id": "color",
268
+ "value": {
269
+ "fixedColor": "#B877D9",
270
+ "mode": "fixed"
271
+ }
272
+ }
273
+ ]
274
+ },
275
+ {
276
+ "matcher": {
277
+ "id": "byName",
278
+ "options": "Warning"
279
+ },
280
+ "properties": [
281
+ {
282
+ "id": "color",
283
+ "value": {
284
+ "fixedColor": "#FF9830",
285
+ "mode": "fixed"
286
+ }
287
+ }
288
+ ]
289
+ },
290
+ {
291
+ "matcher": {
292
+ "id": "byName",
293
+ "options": "INFORMATION"
294
+ },
295
+ "properties": [
296
+ {
297
+ "id": "color",
298
+ "value": {
299
+ "fixedColor": "green",
300
+ "mode": "fixed"
301
+ }
302
+ }
303
+ ]
304
+ },
305
+ {
306
+ "matcher": {
307
+ "id": "byName",
308
+ "options": "WARNING"
309
+ },
310
+ "properties": [
311
+ {
312
+ "id": "color",
313
+ "value": {
314
+ "fixedColor": "orange",
315
+ "mode": "fixed"
316
+ }
317
+ }
318
+ ]
319
+ },
320
+ {
321
+ "matcher": {
322
+ "id": "byName",
323
+ "options": "ERROR"
324
+ },
325
+ "properties": [
326
+ {
327
+ "id": "color",
328
+ "value": {
329
+ "fixedColor": "red",
330
+ "mode": "fixed"
331
+ }
332
+ }
333
+ ]
334
+ }
335
+ ]
336
+ },
337
+ "gridPos": {
338
+ "h": 8,
339
+ "w": 5,
340
+ "x": 4,
341
+ "y": 1
342
+ },
343
+ "id": 68,
344
+ "links": [],
345
+ "maxDataPoints": 3,
346
+ "options": {
347
+ "displayLabels": [],
348
+ "legend": {
349
+ "calcs": [],
350
+ "displayMode": "hidden",
351
+ "placement": "bottom",
352
+ "values": ["value"]
353
+ },
354
+ "pieType": "donut",
355
+ "reduceOptions": {
356
+ "calcs": ["sum"],
357
+ "fields": "",
358
+ "values": false
359
+ },
360
+ "text": {},
361
+ "tooltip": {
362
+ "mode": "single",
363
+ "sort": "none"
364
+ }
365
+ },
366
+ "targets": [
367
+ {
368
+ "bucketAggs": [
369
+ {
370
+ "$$hashKey": "object:73",
371
+ "fake": true,
372
+ "field": "data_inventory_module",
373
+ "id": "3",
374
+ "settings": {
375
+ "min_doc_count": 1,
376
+ "order": "desc",
377
+ "orderBy": "_count",
378
+ "size": "0"
379
+ },
380
+ "type": "terms"
381
+ },
382
+ {
383
+ "$$hashKey": "object:74",
384
+ "field": "timestamp",
385
+ "id": "2",
386
+ "settings": {
387
+ "interval": "auto",
388
+ "min_doc_count": 0,
389
+ "trimEdges": 0
390
+ },
391
+ "type": "date_histogram"
392
+ }
393
+ ],
394
+ "datasource": {
395
+ "type": "elasticsearch",
396
+ "uid": "wazuh_datasource_uid"
397
+ },
398
+ "metrics": [
399
+ {
400
+ "$$hashKey": "object:71",
401
+ "field": "select field",
402
+ "id": "1",
403
+ "type": "count"
404
+ }
405
+ ],
406
+ "query": "agent_name:$agent_name AND rule_groups:*inventory",
407
+ "refId": "A",
408
+ "timeField": "timestamp"
409
+ }
410
+ ],
411
+ "title": "INVENTORY ITEMS BY MODULE",
412
+ "type": "piechart"
413
+ },
414
+ {
415
+ "datasource": {
416
+ "type": "elasticsearch",
417
+ "uid": "wazuh_datasource_uid"
418
+ },
419
+ "fieldConfig": {
420
+ "defaults": {
421
+ "color": {
422
+ "mode": "thresholds"
423
+ },
424
+ "custom": {
425
+ "align": "auto",
426
+ "displayMode": "auto",
427
+ "inspect": false
428
+ },
429
+ "decimals": 0,
430
+ "mappings": [],
431
+ "thresholds": {
432
+ "mode": "absolute",
433
+ "steps": [
434
+ {
435
+ "color": "green",
436
+ "value": null
437
+ },
438
+ {
439
+ "color": "red",
440
+ "value": 80
441
+ }
442
+ ]
443
+ },
444
+ "unit": "short"
445
+ },
446
+ "overrides": [
447
+ {
448
+ "matcher": {
449
+ "id": "byName",
450
+ "options": "1"
451
+ },
452
+ "properties": [
453
+ {
454
+ "id": "color",
455
+ "value": {
456
+ "fixedColor": "#FF9830",
457
+ "mode": "fixed"
458
+ }
459
+ }
460
+ ]
461
+ },
462
+ {
463
+ "matcher": {
464
+ "id": "byName",
465
+ "options": "Alert"
466
+ },
467
+ "properties": [
468
+ {
469
+ "id": "color",
470
+ "value": {
471
+ "fixedColor": "#F2495C",
472
+ "mode": "fixed"
473
+ }
474
+ }
475
+ ]
476
+ },
477
+ {
478
+ "matcher": {
479
+ "id": "byName",
480
+ "options": "Error"
481
+ },
482
+ "properties": [
483
+ {
484
+ "id": "color",
485
+ "value": {
486
+ "fixedColor": "#F2495C",
487
+ "mode": "fixed"
488
+ }
489
+ }
490
+ ]
491
+ },
492
+ {
493
+ "matcher": {
494
+ "id": "byName",
495
+ "options": "Info"
496
+ },
497
+ "properties": [
498
+ {
499
+ "id": "color",
500
+ "value": {
501
+ "fixedColor": "#73BF69",
502
+ "mode": "fixed"
503
+ }
504
+ }
505
+ ]
506
+ },
507
+ {
508
+ "matcher": {
509
+ "id": "byName",
510
+ "options": "NOTICE"
511
+ },
512
+ "properties": [
513
+ {
514
+ "id": "color",
515
+ "value": {
516
+ "fixedColor": "#5794F2",
517
+ "mode": "fixed"
518
+ }
519
+ }
520
+ ]
521
+ },
522
+ {
523
+ "matcher": {
524
+ "id": "byName",
525
+ "options": "Notice"
526
+ },
527
+ "properties": [
528
+ {
529
+ "id": "color",
530
+ "value": {
531
+ "fixedColor": "#5794F2",
532
+ "mode": "fixed"
533
+ }
534
+ }
535
+ ]
536
+ },
537
+ {
538
+ "matcher": {
539
+ "id": "byName",
540
+ "options": "Result"
541
+ },
542
+ "properties": [
543
+ {
544
+ "id": "color",
545
+ "value": {
546
+ "fixedColor": "#B877D9",
547
+ "mode": "fixed"
548
+ }
549
+ }
550
+ ]
551
+ },
552
+ {
553
+ "matcher": {
554
+ "id": "byName",
555
+ "options": "Warning"
556
+ },
557
+ "properties": [
558
+ {
559
+ "id": "color",
560
+ "value": {
561
+ "fixedColor": "#FF9830",
562
+ "mode": "fixed"
563
+ }
564
+ }
565
+ ]
566
+ },
567
+ {
568
+ "matcher": {
569
+ "id": "byName",
570
+ "options": "INFORMATION"
571
+ },
572
+ "properties": [
573
+ {
574
+ "id": "color",
575
+ "value": {
576
+ "fixedColor": "green",
577
+ "mode": "fixed"
578
+ }
579
+ }
580
+ ]
581
+ },
582
+ {
583
+ "matcher": {
584
+ "id": "byName",
585
+ "options": "WARNING"
586
+ },
587
+ "properties": [
588
+ {
589
+ "id": "color",
590
+ "value": {
591
+ "fixedColor": "orange",
592
+ "mode": "fixed"
593
+ }
594
+ }
595
+ ]
596
+ },
597
+ {
598
+ "matcher": {
599
+ "id": "byName",
600
+ "options": "ERROR"
601
+ },
602
+ "properties": [
603
+ {
604
+ "id": "color",
605
+ "value": {
606
+ "fixedColor": "red",
607
+ "mode": "fixed"
608
+ }
609
+ }
610
+ ]
611
+ }
612
+ ]
613
+ },
614
+ "gridPos": {
615
+ "h": 8,
616
+ "w": 6,
617
+ "x": 9,
618
+ "y": 1
619
+ },
620
+ "id": 118,
621
+ "links": [],
622
+ "maxDataPoints": 3,
623
+ "options": {
624
+ "footer": {
625
+ "fields": "",
626
+ "reducer": ["sum"],
627
+ "show": false
628
+ },
629
+ "showHeader": true
630
+ },
631
+ "pluginVersion": "9.0.0",
632
+ "targets": [
633
+ {
634
+ "bucketAggs": [
635
+ {
636
+ "$$hashKey": "object:73",
637
+ "fake": true,
638
+ "field": "data_inventory_module",
639
+ "id": "3",
640
+ "settings": {
641
+ "min_doc_count": 1,
642
+ "order": "desc",
643
+ "orderBy": "_count",
644
+ "size": "0"
645
+ },
646
+ "type": "terms"
647
+ }
648
+ ],
649
+ "datasource": {
650
+ "type": "elasticsearch",
651
+ "uid": "wazuh_datasource_uid"
652
+ },
653
+ "metrics": [
654
+ {
655
+ "$$hashKey": "object:71",
656
+ "field": "select field",
657
+ "id": "1",
658
+ "type": "count"
659
+ }
660
+ ],
661
+ "query": "agent_name:$agent_name AND rule_groups:*inventory",
662
+ "refId": "A",
663
+ "timeField": "timestamp"
664
+ }
665
+ ],
666
+ "title": "INVENTORY ITEMS BY MODULE",
667
+ "type": "table"
668
+ },
669
+ {
670
+ "datasource": {
671
+ "type": "elasticsearch",
672
+ "uid": "wazuh_datasource_uid"
673
+ },
674
+ "fieldConfig": {
675
+ "defaults": {
676
+ "custom": {
677
+ "align": "auto",
678
+ "displayMode": "auto",
679
+ "filterable": false,
680
+ "inspect": false
681
+ },
682
+ "mappings": [],
683
+ "thresholds": {
684
+ "mode": "absolute",
685
+ "steps": [
686
+ {
687
+ "color": "blue",
688
+ "value": null
689
+ },
690
+ {
691
+ "color": "red",
692
+ "value": 50
693
+ }
694
+ ]
695
+ }
696
+ },
697
+ "overrides": [
698
+ {
699
+ "matcher": {
700
+ "id": "byName",
701
+ "options": "Count"
702
+ },
703
+ "properties": [
704
+ {
705
+ "id": "custom.displayMode",
706
+ "value": "basic"
707
+ }
708
+ ]
709
+ },
710
+ {
711
+ "matcher": {
712
+ "id": "byName",
713
+ "options": "rule_description"
714
+ },
715
+ "properties": [
716
+ {
717
+ "id": "custom.width",
718
+ "value": 703
719
+ }
720
+ ]
721
+ },
722
+ {
723
+ "matcher": {
724
+ "id": "byName",
725
+ "options": "rule_level"
726
+ },
727
+ "properties": [
728
+ {
729
+ "id": "custom.width",
730
+ "value": 212
731
+ },
732
+ {
733
+ "id": "mappings",
734
+ "value": [
735
+ {
736
+ "options": {
737
+ "from": 1,
738
+ "result": {
739
+ "color": "green",
740
+ "index": 0
741
+ },
742
+ "to": 3
743
+ },
744
+ "type": "range"
745
+ },
746
+ {
747
+ "options": {
748
+ "from": 4,
749
+ "result": {
750
+ "color": "dark-yellow",
751
+ "index": 1
752
+ },
753
+ "to": 6
754
+ },
755
+ "type": "range"
756
+ },
757
+ {
758
+ "options": {
759
+ "from": 7,
760
+ "result": {
761
+ "color": "orange",
762
+ "index": 2
763
+ },
764
+ "to": 9
765
+ },
766
+ "type": "range"
767
+ },
768
+ {
769
+ "options": {
770
+ "from": 10,
771
+ "result": {
772
+ "color": "semi-dark-red",
773
+ "index": 3
774
+ },
775
+ "to": 15
776
+ },
777
+ "type": "range"
778
+ }
779
+ ]
780
+ }
781
+ ]
782
+ }
783
+ ]
784
+ },
785
+ "gridPos": {
786
+ "h": 8,
787
+ "w": 9,
788
+ "x": 15,
789
+ "y": 1
790
+ },
791
+ "id": 115,
792
+ "links": [],
793
+ "maxDataPoints": 3,
794
+ "options": {
795
+ "footer": {
796
+ "fields": "",
797
+ "reducer": ["sum"],
798
+ "show": false
799
+ },
800
+ "showHeader": true,
801
+ "sortBy": []
802
+ },
803
+ "pluginVersion": "9.0.0",
804
+ "targets": [
805
+ {
806
+ "bucketAggs": [
807
+ {
808
+ "$$hashKey": "object:3082",
809
+ "fake": true,
810
+ "field": "agent_name",
811
+ "id": "4",
812
+ "settings": {
813
+ "min_doc_count": 0,
814
+ "order": "desc",
815
+ "orderBy": "_count",
816
+ "size": "10"
817
+ },
818
+ "type": "terms"
819
+ }
820
+ ],
821
+ "datasource": {
822
+ "type": "elasticsearch",
823
+ "uid": "wazuh_datasource_uid"
824
+ },
825
+ "metrics": [
826
+ {
827
+ "$$hashKey": "object:71",
828
+ "field": "select field",
829
+ "id": "1",
830
+ "type": "count"
831
+ }
832
+ ],
833
+ "query": "agent_name:$agent_name AND rule_groups:*inventory",
834
+ "refId": "A",
835
+ "timeField": "timestamp"
836
+ }
837
+ ],
838
+ "title": "INVENTORY ITEMS BY AGENT",
839
+ "type": "table"
840
+ },
841
+ {
842
+ "datasource": {
843
+ "type": "elasticsearch",
844
+ "uid": "wazuh_datasource_uid"
845
+ },
846
+ "fieldConfig": {
847
+ "defaults": {
848
+ "mappings": [
849
+ {
850
+ "options": {
851
+ "match": "null",
852
+ "result": {
853
+ "text": "N/A"
854
+ }
855
+ },
856
+ "type": "special"
857
+ }
858
+ ],
859
+ "thresholds": {
860
+ "mode": "absolute",
861
+ "steps": [
862
+ {
863
+ "color": "orange",
864
+ "value": null
865
+ }
866
+ ]
867
+ },
868
+ "unit": "short"
869
+ },
870
+ "overrides": []
871
+ },
872
+ "gridPos": {
873
+ "h": 8,
874
+ "w": 4,
875
+ "x": 0,
876
+ "y": 9
877
+ },
878
+ "id": 117,
879
+ "links": [],
880
+ "options": {
881
+ "colorMode": "value",
882
+ "graphMode": "area",
883
+ "justifyMode": "auto",
884
+ "orientation": "horizontal",
885
+ "reduceOptions": {
886
+ "calcs": ["sum"],
887
+ "fields": "",
888
+ "values": false
889
+ },
890
+ "text": {},
891
+ "textMode": "auto"
892
+ },
893
+ "pluginVersion": "9.0.0",
894
+ "targets": [
895
+ {
896
+ "bucketAggs": [
897
+ {
898
+ "$$hashKey": "object:50",
899
+ "field": "timestamp",
900
+ "id": "2",
901
+ "settings": {
902
+ "interval": "auto",
903
+ "min_doc_count": 0,
904
+ "trimEdges": 0
905
+ },
906
+ "type": "date_histogram"
907
+ }
908
+ ],
909
+ "datasource": {
910
+ "type": "elasticsearch",
911
+ "uid": "wazuh_datasource_uid"
912
+ },
913
+ "metrics": [
914
+ {
915
+ "$$hashKey": "object:48",
916
+ "field": "select field",
917
+ "id": "1",
918
+ "type": "count"
919
+ }
920
+ ],
921
+ "query": "agent_name:$agent_name AND data_restart_pending:True",
922
+ "refId": "A",
923
+ "timeField": "timestamp"
924
+ }
925
+ ],
926
+ "title": "PENDING RESTARTS",
927
+ "type": "stat"
928
+ },
929
+ {
930
+ "datasource": {
931
+ "type": "elasticsearch",
932
+ "uid": "wazuh_datasource_uid"
933
+ },
934
+ "fieldConfig": {
935
+ "defaults": {
936
+ "color": {
937
+ "mode": "thresholds"
938
+ },
939
+ "custom": {
940
+ "align": "auto",
941
+ "displayMode": "auto",
942
+ "inspect": false
943
+ },
944
+ "decimals": 0,
945
+ "mappings": [],
946
+ "thresholds": {
947
+ "mode": "absolute",
948
+ "steps": [
949
+ {
950
+ "color": "green",
951
+ "value": null
952
+ },
953
+ {
954
+ "color": "red",
955
+ "value": 80
956
+ }
957
+ ]
958
+ },
959
+ "unit": "short"
960
+ },
961
+ "overrides": [
962
+ {
963
+ "matcher": {
964
+ "id": "byName",
965
+ "options": "1"
966
+ },
967
+ "properties": [
968
+ {
969
+ "id": "color",
970
+ "value": {
971
+ "fixedColor": "#FF9830",
972
+ "mode": "fixed"
973
+ }
974
+ }
975
+ ]
976
+ },
977
+ {
978
+ "matcher": {
979
+ "id": "byName",
980
+ "options": "Alert"
981
+ },
982
+ "properties": [
983
+ {
984
+ "id": "color",
985
+ "value": {
986
+ "fixedColor": "#F2495C",
987
+ "mode": "fixed"
988
+ }
989
+ }
990
+ ]
991
+ },
992
+ {
993
+ "matcher": {
994
+ "id": "byName",
995
+ "options": "Error"
996
+ },
997
+ "properties": [
998
+ {
999
+ "id": "color",
1000
+ "value": {
1001
+ "fixedColor": "#F2495C",
1002
+ "mode": "fixed"
1003
+ }
1004
+ }
1005
+ ]
1006
+ },
1007
+ {
1008
+ "matcher": {
1009
+ "id": "byName",
1010
+ "options": "Info"
1011
+ },
1012
+ "properties": [
1013
+ {
1014
+ "id": "color",
1015
+ "value": {
1016
+ "fixedColor": "#73BF69",
1017
+ "mode": "fixed"
1018
+ }
1019
+ }
1020
+ ]
1021
+ },
1022
+ {
1023
+ "matcher": {
1024
+ "id": "byName",
1025
+ "options": "NOTICE"
1026
+ },
1027
+ "properties": [
1028
+ {
1029
+ "id": "color",
1030
+ "value": {
1031
+ "fixedColor": "#5794F2",
1032
+ "mode": "fixed"
1033
+ }
1034
+ }
1035
+ ]
1036
+ },
1037
+ {
1038
+ "matcher": {
1039
+ "id": "byName",
1040
+ "options": "Notice"
1041
+ },
1042
+ "properties": [
1043
+ {
1044
+ "id": "color",
1045
+ "value": {
1046
+ "fixedColor": "#5794F2",
1047
+ "mode": "fixed"
1048
+ }
1049
+ }
1050
+ ]
1051
+ },
1052
+ {
1053
+ "matcher": {
1054
+ "id": "byName",
1055
+ "options": "Result"
1056
+ },
1057
+ "properties": [
1058
+ {
1059
+ "id": "color",
1060
+ "value": {
1061
+ "fixedColor": "#B877D9",
1062
+ "mode": "fixed"
1063
+ }
1064
+ }
1065
+ ]
1066
+ },
1067
+ {
1068
+ "matcher": {
1069
+ "id": "byName",
1070
+ "options": "Warning"
1071
+ },
1072
+ "properties": [
1073
+ {
1074
+ "id": "color",
1075
+ "value": {
1076
+ "fixedColor": "#FF9830",
1077
+ "mode": "fixed"
1078
+ }
1079
+ }
1080
+ ]
1081
+ },
1082
+ {
1083
+ "matcher": {
1084
+ "id": "byName",
1085
+ "options": "INFORMATION"
1086
+ },
1087
+ "properties": [
1088
+ {
1089
+ "id": "color",
1090
+ "value": {
1091
+ "fixedColor": "green",
1092
+ "mode": "fixed"
1093
+ }
1094
+ }
1095
+ ]
1096
+ },
1097
+ {
1098
+ "matcher": {
1099
+ "id": "byName",
1100
+ "options": "WARNING"
1101
+ },
1102
+ "properties": [
1103
+ {
1104
+ "id": "color",
1105
+ "value": {
1106
+ "fixedColor": "orange",
1107
+ "mode": "fixed"
1108
+ }
1109
+ }
1110
+ ]
1111
+ },
1112
+ {
1113
+ "matcher": {
1114
+ "id": "byName",
1115
+ "options": "ERROR"
1116
+ },
1117
+ "properties": [
1118
+ {
1119
+ "id": "color",
1120
+ "value": {
1121
+ "fixedColor": "red",
1122
+ "mode": "fixed"
1123
+ }
1124
+ }
1125
+ ]
1126
+ }
1127
+ ]
1128
+ },
1129
+ "gridPos": {
1130
+ "h": 8,
1131
+ "w": 8,
1132
+ "x": 4,
1133
+ "y": 9
1134
+ },
1135
+ "id": 119,
1136
+ "links": [],
1137
+ "maxDataPoints": 3,
1138
+ "options": {
1139
+ "footer": {
1140
+ "fields": "",
1141
+ "reducer": ["sum"],
1142
+ "show": false
1143
+ },
1144
+ "showHeader": true
1145
+ },
1146
+ "pluginVersion": "9.0.0",
1147
+ "targets": [
1148
+ {
1149
+ "bucketAggs": [
1150
+ {
1151
+ "$$hashKey": "object:73",
1152
+ "fake": true,
1153
+ "field": "agent_name",
1154
+ "id": "3",
1155
+ "settings": {
1156
+ "min_doc_count": 1,
1157
+ "order": "desc",
1158
+ "orderBy": "_count",
1159
+ "size": "0"
1160
+ },
1161
+ "type": "terms"
1162
+ }
1163
+ ],
1164
+ "datasource": {
1165
+ "type": "elasticsearch",
1166
+ "uid": "wazuh_datasource_uid"
1167
+ },
1168
+ "metrics": [
1169
+ {
1170
+ "$$hashKey": "object:71",
1171
+ "field": "select field",
1172
+ "id": "1",
1173
+ "type": "count"
1174
+ }
1175
+ ],
1176
+ "query": "agent_name:$agent_name AND data_restart_pending:True",
1177
+ "refId": "A",
1178
+ "timeField": "timestamp"
1179
+ }
1180
+ ],
1181
+ "title": "RESTARTS PENDING - AGENTS",
1182
+ "type": "table"
1183
+ },
1184
+ {
1185
+ "datasource": {
1186
+ "type": "elasticsearch",
1187
+ "uid": "wazuh_datasource_uid"
1188
+ },
1189
+ "fieldConfig": {
1190
+ "defaults": {
1191
+ "mappings": [
1192
+ {
1193
+ "options": {
1194
+ "match": "null",
1195
+ "result": {
1196
+ "text": "N/A"
1197
+ }
1198
+ },
1199
+ "type": "special"
1200
+ }
1201
+ ],
1202
+ "thresholds": {
1203
+ "mode": "absolute",
1204
+ "steps": [
1205
+ {
1206
+ "color": "orange",
1207
+ "value": null
1208
+ }
1209
+ ]
1210
+ },
1211
+ "unit": "short"
1212
+ },
1213
+ "overrides": []
1214
+ },
1215
+ "gridPos": {
1216
+ "h": 8,
1217
+ "w": 4,
1218
+ "x": 12,
1219
+ "y": 9
1220
+ },
1221
+ "id": 120,
1222
+ "links": [],
1223
+ "options": {
1224
+ "colorMode": "value",
1225
+ "graphMode": "area",
1226
+ "justifyMode": "auto",
1227
+ "orientation": "horizontal",
1228
+ "reduceOptions": {
1229
+ "calcs": ["sum"],
1230
+ "fields": "",
1231
+ "values": false
1232
+ },
1233
+ "text": {},
1234
+ "textMode": "auto"
1235
+ },
1236
+ "pluginVersion": "9.0.0",
1237
+ "targets": [
1238
+ {
1239
+ "bucketAggs": [
1240
+ {
1241
+ "$$hashKey": "object:50",
1242
+ "field": "timestamp",
1243
+ "id": "2",
1244
+ "settings": {
1245
+ "interval": "auto",
1246
+ "min_doc_count": 0,
1247
+ "trimEdges": 0
1248
+ },
1249
+ "type": "date_histogram"
1250
+ }
1251
+ ],
1252
+ "datasource": {
1253
+ "type": "elasticsearch",
1254
+ "uid": "wazuh_datasource_uid"
1255
+ },
1256
+ "metrics": [
1257
+ {
1258
+ "$$hashKey": "object:48",
1259
+ "field": "select field",
1260
+ "id": "1",
1261
+ "type": "count"
1262
+ }
1263
+ ],
1264
+ "query": "agent_name:$agent_name AND data_service_start_mode:Auto AND data_service_state:Stopped",
1265
+ "refId": "A",
1266
+ "timeField": "timestamp"
1267
+ }
1268
+ ],
1269
+ "title": "SERVICES STOPPED",
1270
+ "type": "stat"
1271
+ },
1272
+ {
1273
+ "datasource": {
1274
+ "type": "elasticsearch",
1275
+ "uid": "wazuh_datasource_uid"
1276
+ },
1277
+ "fieldConfig": {
1278
+ "defaults": {
1279
+ "color": {
1280
+ "mode": "thresholds"
1281
+ },
1282
+ "custom": {
1283
+ "align": "auto",
1284
+ "displayMode": "auto",
1285
+ "inspect": false
1286
+ },
1287
+ "decimals": 0,
1288
+ "mappings": [],
1289
+ "thresholds": {
1290
+ "mode": "absolute",
1291
+ "steps": [
1292
+ {
1293
+ "color": "green",
1294
+ "value": null
1295
+ },
1296
+ {
1297
+ "color": "red",
1298
+ "value": 80
1299
+ }
1300
+ ]
1301
+ },
1302
+ "unit": "short"
1303
+ },
1304
+ "overrides": [
1305
+ {
1306
+ "matcher": {
1307
+ "id": "byName",
1308
+ "options": "1"
1309
+ },
1310
+ "properties": [
1311
+ {
1312
+ "id": "color",
1313
+ "value": {
1314
+ "fixedColor": "#FF9830",
1315
+ "mode": "fixed"
1316
+ }
1317
+ }
1318
+ ]
1319
+ },
1320
+ {
1321
+ "matcher": {
1322
+ "id": "byName",
1323
+ "options": "Alert"
1324
+ },
1325
+ "properties": [
1326
+ {
1327
+ "id": "color",
1328
+ "value": {
1329
+ "fixedColor": "#F2495C",
1330
+ "mode": "fixed"
1331
+ }
1332
+ }
1333
+ ]
1334
+ },
1335
+ {
1336
+ "matcher": {
1337
+ "id": "byName",
1338
+ "options": "Error"
1339
+ },
1340
+ "properties": [
1341
+ {
1342
+ "id": "color",
1343
+ "value": {
1344
+ "fixedColor": "#F2495C",
1345
+ "mode": "fixed"
1346
+ }
1347
+ }
1348
+ ]
1349
+ },
1350
+ {
1351
+ "matcher": {
1352
+ "id": "byName",
1353
+ "options": "Info"
1354
+ },
1355
+ "properties": [
1356
+ {
1357
+ "id": "color",
1358
+ "value": {
1359
+ "fixedColor": "#73BF69",
1360
+ "mode": "fixed"
1361
+ }
1362
+ }
1363
+ ]
1364
+ },
1365
+ {
1366
+ "matcher": {
1367
+ "id": "byName",
1368
+ "options": "NOTICE"
1369
+ },
1370
+ "properties": [
1371
+ {
1372
+ "id": "color",
1373
+ "value": {
1374
+ "fixedColor": "#5794F2",
1375
+ "mode": "fixed"
1376
+ }
1377
+ }
1378
+ ]
1379
+ },
1380
+ {
1381
+ "matcher": {
1382
+ "id": "byName",
1383
+ "options": "Notice"
1384
+ },
1385
+ "properties": [
1386
+ {
1387
+ "id": "color",
1388
+ "value": {
1389
+ "fixedColor": "#5794F2",
1390
+ "mode": "fixed"
1391
+ }
1392
+ }
1393
+ ]
1394
+ },
1395
+ {
1396
+ "matcher": {
1397
+ "id": "byName",
1398
+ "options": "Result"
1399
+ },
1400
+ "properties": [
1401
+ {
1402
+ "id": "color",
1403
+ "value": {
1404
+ "fixedColor": "#B877D9",
1405
+ "mode": "fixed"
1406
+ }
1407
+ }
1408
+ ]
1409
+ },
1410
+ {
1411
+ "matcher": {
1412
+ "id": "byName",
1413
+ "options": "Warning"
1414
+ },
1415
+ "properties": [
1416
+ {
1417
+ "id": "color",
1418
+ "value": {
1419
+ "fixedColor": "#FF9830",
1420
+ "mode": "fixed"
1421
+ }
1422
+ }
1423
+ ]
1424
+ },
1425
+ {
1426
+ "matcher": {
1427
+ "id": "byName",
1428
+ "options": "INFORMATION"
1429
+ },
1430
+ "properties": [
1431
+ {
1432
+ "id": "color",
1433
+ "value": {
1434
+ "fixedColor": "green",
1435
+ "mode": "fixed"
1436
+ }
1437
+ }
1438
+ ]
1439
+ },
1440
+ {
1441
+ "matcher": {
1442
+ "id": "byName",
1443
+ "options": "WARNING"
1444
+ },
1445
+ "properties": [
1446
+ {
1447
+ "id": "color",
1448
+ "value": {
1449
+ "fixedColor": "orange",
1450
+ "mode": "fixed"
1451
+ }
1452
+ }
1453
+ ]
1454
+ },
1455
+ {
1456
+ "matcher": {
1457
+ "id": "byName",
1458
+ "options": "ERROR"
1459
+ },
1460
+ "properties": [
1461
+ {
1462
+ "id": "color",
1463
+ "value": {
1464
+ "fixedColor": "red",
1465
+ "mode": "fixed"
1466
+ }
1467
+ }
1468
+ ]
1469
+ }
1470
+ ]
1471
+ },
1472
+ "gridPos": {
1473
+ "h": 8,
1474
+ "w": 8,
1475
+ "x": 16,
1476
+ "y": 9
1477
+ },
1478
+ "id": 129,
1479
+ "links": [],
1480
+ "maxDataPoints": 3,
1481
+ "options": {
1482
+ "footer": {
1483
+ "fields": "",
1484
+ "reducer": ["sum"],
1485
+ "show": false
1486
+ },
1487
+ "showHeader": true
1488
+ },
1489
+ "pluginVersion": "9.0.0",
1490
+ "targets": [
1491
+ {
1492
+ "bucketAggs": [
1493
+ {
1494
+ "$$hashKey": "object:73",
1495
+ "fake": true,
1496
+ "field": "data_service_name",
1497
+ "id": "3",
1498
+ "settings": {
1499
+ "min_doc_count": 1,
1500
+ "order": "desc",
1501
+ "orderBy": "_count",
1502
+ "size": "0"
1503
+ },
1504
+ "type": "terms"
1505
+ }
1506
+ ],
1507
+ "datasource": {
1508
+ "type": "elasticsearch",
1509
+ "uid": "wazuh_datasource_uid"
1510
+ },
1511
+ "metrics": [
1512
+ {
1513
+ "$$hashKey": "object:71",
1514
+ "field": "select field",
1515
+ "id": "1",
1516
+ "type": "count"
1517
+ }
1518
+ ],
1519
+ "query": "agent_name:$agent_name AND data_service_start_mode:Auto AND data_service_state:Stopped",
1520
+ "refId": "A",
1521
+ "timeField": "timestamp"
1522
+ }
1523
+ ],
1524
+ "title": "STOPPED SERVICES",
1525
+ "type": "table"
1526
+ },
1527
+ {
1528
+ "datasource": {
1529
+ "type": "elasticsearch",
1530
+ "uid": "wazuh_datasource_uid"
1531
+ },
1532
+ "fieldConfig": {
1533
+ "defaults": {
1534
+ "color": {
1535
+ "mode": "thresholds"
1536
+ },
1537
+ "custom": {
1538
+ "align": "auto",
1539
+ "displayMode": "auto",
1540
+ "inspect": false
1541
+ },
1542
+ "mappings": [],
1543
+ "thresholds": {
1544
+ "mode": "absolute",
1545
+ "steps": [
1546
+ {
1547
+ "color": "green",
1548
+ "value": null
1549
+ },
1550
+ {
1551
+ "color": "red",
1552
+ "value": 80
1553
+ }
1554
+ ]
1555
+ }
1556
+ },
1557
+ "overrides": [
1558
+ {
1559
+ "matcher": {
1560
+ "id": "byName",
1561
+ "options": "AGENT"
1562
+ },
1563
+ "properties": [
1564
+ {
1565
+ "id": "custom.width",
1566
+ "value": 171
1567
+ }
1568
+ ]
1569
+ },
1570
+ {
1571
+ "matcher": {
1572
+ "id": "byName",
1573
+ "options": "SRC IP"
1574
+ },
1575
+ "properties": [
1576
+ {
1577
+ "id": "custom.width",
1578
+ "value": 167
1579
+ }
1580
+ ]
1581
+ },
1582
+ {
1583
+ "matcher": {
1584
+ "id": "byName",
1585
+ "options": "MESSAGE"
1586
+ },
1587
+ "properties": [
1588
+ {
1589
+ "id": "custom.width",
1590
+ "value": 1519
1591
+ }
1592
+ ]
1593
+ },
1594
+ {
1595
+ "matcher": {
1596
+ "id": "byName",
1597
+ "options": "rule_description"
1598
+ },
1599
+ "properties": [
1600
+ {
1601
+ "id": "custom.width",
1602
+ "value": 524
1603
+ }
1604
+ ]
1605
+ },
1606
+ {
1607
+ "matcher": {
1608
+ "id": "byName",
1609
+ "options": "OS TYPE"
1610
+ },
1611
+ "properties": [
1612
+ {
1613
+ "id": "custom.width",
1614
+ "value": 431
1615
+ }
1616
+ ]
1617
+ }
1618
+ ]
1619
+ },
1620
+ "gridPos": {
1621
+ "h": 10,
1622
+ "w": 24,
1623
+ "x": 0,
1624
+ "y": 17
1625
+ },
1626
+ "id": 85,
1627
+ "options": {
1628
+ "footer": {
1629
+ "fields": "",
1630
+ "reducer": ["sum"],
1631
+ "show": false
1632
+ },
1633
+ "showHeader": true,
1634
+ "sortBy": []
1635
+ },
1636
+ "pluginVersion": "9.0.0",
1637
+ "targets": [
1638
+ {
1639
+ "alias": "",
1640
+ "bucketAggs": [],
1641
+ "datasource": {
1642
+ "type": "elasticsearch",
1643
+ "uid": "wazuh_datasource_uid"
1644
+ },
1645
+ "metrics": [
1646
+ {
1647
+ "id": "1",
1648
+ "settings": {
1649
+ "size": "500"
1650
+ },
1651
+ "type": "raw_data"
1652
+ }
1653
+ ],
1654
+ "query": "agent_name:$agent_name AND (data_inventory_module:operating_system)",
1655
+ "queryType": "lucene",
1656
+ "refId": "A",
1657
+ "timeField": "timestamp"
1658
+ }
1659
+ ],
1660
+ "title": "AGENTS BY OS",
1661
+ "transformations": [
1662
+ {
1663
+ "id": "organize",
1664
+ "options": {
1665
+ "excludeByName": {
1666
+ "@metadata_beat": true,
1667
+ "@metadata_type": true,
1668
+ "@metadata_version": true,
1669
+ "_id": true,
1670
+ "_index": true,
1671
+ "_type": true,
1672
+ "agent_ephemeral_id": true,
1673
+ "agent_hostname": true,
1674
+ "agent_id": true,
1675
+ "agent_ip": false,
1676
+ "agent_ip_city_name": true,
1677
+ "agent_ip_country_code": true,
1678
+ "agent_ip_geolocation": true,
1679
+ "agent_labels_customer": true,
1680
+ "agent_name": false,
1681
+ "agent_type": true,
1682
+ "agent_version": true,
1683
+ "beats_type": true,
1684
+ "collector_node_id": true,
1685
+ "data_inventory_module": true,
1686
+ "data_os_architecture": true,
1687
+ "data_os_boot_time": true,
1688
+ "data_os_install_date": true,
1689
+ "data_os_lang": true,
1690
+ "data_os_locale": true,
1691
+ "data_os_sku": true,
1692
+ "data_os_sn": true,
1693
+ "data_os_system_memory": true,
1694
+ "data_os_system_name": true,
1695
+ "data_win_eventdata_domain": true,
1696
+ "data_win_eventdata_imagePath": true,
1697
+ "data_win_eventdata_sID": true,
1698
+ "data_win_eventdata_serviceName": true,
1699
+ "data_win_eventdata_serviceType": true,
1700
+ "data_win_eventdata_startType": true,
1701
+ "data_win_eventdata_timestamp": true,
1702
+ "data_win_eventdata_user": true,
1703
+ "data_win_system_channel": true,
1704
+ "data_win_system_computer": true,
1705
+ "data_win_system_eventID": true,
1706
+ "data_win_system_eventRecordID": true,
1707
+ "data_win_system_eventSourceName": true,
1708
+ "data_win_system_keywords": true,
1709
+ "data_win_system_level": true,
1710
+ "data_win_system_opcode": true,
1711
+ "data_win_system_processID": true,
1712
+ "data_win_system_providerGuid": true,
1713
+ "data_win_system_providerName": true,
1714
+ "data_win_system_severityValue": true,
1715
+ "data_win_system_systemTime": true,
1716
+ "data_win_system_task": true,
1717
+ "data_win_system_threadID": true,
1718
+ "data_win_system_version": true,
1719
+ "date": true,
1720
+ "decoder_name": true,
1721
+ "ecs_version": true,
1722
+ "gl2_accounted_message_size": true,
1723
+ "gl2_message_id": true,
1724
+ "gl2_processing_error": true,
1725
+ "gl2_remote_ip": true,
1726
+ "gl2_remote_port": true,
1727
+ "gl2_source_collector": true,
1728
+ "gl2_source_input": true,
1729
+ "gl2_source_node": true,
1730
+ "highlight": true,
1731
+ "host_name": true,
1732
+ "id": true,
1733
+ "location": true,
1734
+ "log_file_path": true,
1735
+ "log_offset": true,
1736
+ "manager_name": true,
1737
+ "message": true,
1738
+ "previous_output": true,
1739
+ "rule_description": true,
1740
+ "rule_firedtimes": true,
1741
+ "rule_frequency": true,
1742
+ "rule_gdpr": true,
1743
+ "rule_gpg13": true,
1744
+ "rule_group1": true,
1745
+ "rule_group2": true,
1746
+ "rule_groups": true,
1747
+ "rule_hipaa": true,
1748
+ "rule_id": true,
1749
+ "rule_level": true,
1750
+ "rule_mail": true,
1751
+ "rule_mitre_id": true,
1752
+ "rule_mitre_tactic": true,
1753
+ "rule_mitre_technique": true,
1754
+ "rule_nist_800_53": true,
1755
+ "rule_pci_dss": true,
1756
+ "rule_tsc": true,
1757
+ "sort": true,
1758
+ "source": true,
1759
+ "src_ip": true,
1760
+ "src_ip_city_name": true,
1761
+ "src_ip_country_code": true,
1762
+ "src_ip_geolocation": true,
1763
+ "streams": true,
1764
+ "syslog_tag": true,
1765
+ "syslog_type": true,
1766
+ "timestamp": true,
1767
+ "user_name": true,
1768
+ "win_system_eventID": true,
1769
+ "windows_event_id": true,
1770
+ "windows_event_severity": false
1771
+ },
1772
+ "indexByName": {
1773
+ "_id": 1,
1774
+ "_index": 2,
1775
+ "_type": 3,
1776
+ "agent_id": 4,
1777
+ "agent_ip": 5,
1778
+ "agent_labels_customer": 30,
1779
+ "agent_name": 0,
1780
+ "data_inventory_module": 31,
1781
+ "data_os_architecture": 32,
1782
+ "data_os_boot_time": 33,
1783
+ "data_os_build_number": 34,
1784
+ "data_os_install_date": 35,
1785
+ "data_os_lang": 36,
1786
+ "data_os_locale": 37,
1787
+ "data_os_product_type": 38,
1788
+ "data_os_sku": 39,
1789
+ "data_os_sn": 40,
1790
+ "data_os_system_memory": 41,
1791
+ "data_os_system_name": 42,
1792
+ "data_os_type": 6,
1793
+ "data_os_version": 43,
1794
+ "date": 44,
1795
+ "decoder_name": 7,
1796
+ "gl2_accounted_message_size": 8,
1797
+ "gl2_message_id": 9,
1798
+ "gl2_processing_error": 45,
1799
+ "gl2_remote_ip": 10,
1800
+ "gl2_remote_port": 11,
1801
+ "gl2_source_input": 12,
1802
+ "gl2_source_node": 13,
1803
+ "highlight": 14,
1804
+ "id": 15,
1805
+ "location": 16,
1806
+ "manager_name": 17,
1807
+ "message": 18,
1808
+ "rule_description": 19,
1809
+ "rule_firedtimes": 20,
1810
+ "rule_groups": 21,
1811
+ "rule_id": 22,
1812
+ "rule_level": 23,
1813
+ "rule_mail": 24,
1814
+ "sort": 25,
1815
+ "source": 26,
1816
+ "streams": 27,
1817
+ "syslog_type": 28,
1818
+ "timestamp": 29
1819
+ },
1820
+ "renameByName": {
1821
+ "agent_ip": "SRC IP",
1822
+ "agent_name": "AGENT",
1823
+ "data_os_build_number": "BUILD",
1824
+ "data_os_product_type": "OS WINDOWS TYPE",
1825
+ "data_os_type": "OS TYPE",
1826
+ "data_os_version": "OS VERSION",
1827
+ "data_win_system_message": "MESSAGE",
1828
+ "data_win_system_providerGuid": "",
1829
+ "rule_level": "RULE LEVEL",
1830
+ "timestamp": "DATE/TIME",
1831
+ "windows_event_severity": "EVENT LOG SEVERITY"
1832
+ }
1833
+ }
1834
+ }
1835
+ ],
1836
+ "type": "table"
1837
+ },
1838
+ {
1839
+ "collapsed": true,
1840
+ "datasource": {
1841
+ "type": "elasticsearch",
1842
+ "uid": "wazuh_datasource_uid"
1843
+ },
1844
+ "gridPos": {
1845
+ "h": 1,
1846
+ "w": 24,
1847
+ "x": 0,
1848
+ "y": 27
1849
+ },
1850
+ "id": 112,
1851
+ "panels": [
1852
+ {
1853
+ "datasource": {
1854
+ "type": "elasticsearch",
1855
+ "uid": "wazuh_datasource_uid"
1856
+ },
1857
+ "fieldConfig": {
1858
+ "defaults": {
1859
+ "color": {
1860
+ "mode": "palette-classic"
1861
+ },
1862
+ "custom": {
1863
+ "hideFrom": {
1864
+ "legend": false,
1865
+ "tooltip": false,
1866
+ "viz": false
1867
+ }
1868
+ },
1869
+ "decimals": 0,
1870
+ "mappings": [],
1871
+ "unit": "short"
1872
+ },
1873
+ "overrides": [
1874
+ {
1875
+ "matcher": {
1876
+ "id": "byName",
1877
+ "options": "1"
1878
+ },
1879
+ "properties": [
1880
+ {
1881
+ "id": "color",
1882
+ "value": {
1883
+ "fixedColor": "#FF9830",
1884
+ "mode": "fixed"
1885
+ }
1886
+ }
1887
+ ]
1888
+ },
1889
+ {
1890
+ "matcher": {
1891
+ "id": "byName",
1892
+ "options": "Alert"
1893
+ },
1894
+ "properties": [
1895
+ {
1896
+ "id": "color",
1897
+ "value": {
1898
+ "fixedColor": "#F2495C",
1899
+ "mode": "fixed"
1900
+ }
1901
+ }
1902
+ ]
1903
+ },
1904
+ {
1905
+ "matcher": {
1906
+ "id": "byName",
1907
+ "options": "Error"
1908
+ },
1909
+ "properties": [
1910
+ {
1911
+ "id": "color",
1912
+ "value": {
1913
+ "fixedColor": "#F2495C",
1914
+ "mode": "fixed"
1915
+ }
1916
+ }
1917
+ ]
1918
+ },
1919
+ {
1920
+ "matcher": {
1921
+ "id": "byName",
1922
+ "options": "Info"
1923
+ },
1924
+ "properties": [
1925
+ {
1926
+ "id": "color",
1927
+ "value": {
1928
+ "fixedColor": "#73BF69",
1929
+ "mode": "fixed"
1930
+ }
1931
+ }
1932
+ ]
1933
+ },
1934
+ {
1935
+ "matcher": {
1936
+ "id": "byName",
1937
+ "options": "NOTICE"
1938
+ },
1939
+ "properties": [
1940
+ {
1941
+ "id": "color",
1942
+ "value": {
1943
+ "fixedColor": "#5794F2",
1944
+ "mode": "fixed"
1945
+ }
1946
+ }
1947
+ ]
1948
+ },
1949
+ {
1950
+ "matcher": {
1951
+ "id": "byName",
1952
+ "options": "Notice"
1953
+ },
1954
+ "properties": [
1955
+ {
1956
+ "id": "color",
1957
+ "value": {
1958
+ "fixedColor": "#5794F2",
1959
+ "mode": "fixed"
1960
+ }
1961
+ }
1962
+ ]
1963
+ },
1964
+ {
1965
+ "matcher": {
1966
+ "id": "byName",
1967
+ "options": "Result"
1968
+ },
1969
+ "properties": [
1970
+ {
1971
+ "id": "color",
1972
+ "value": {
1973
+ "fixedColor": "#B877D9",
1974
+ "mode": "fixed"
1975
+ }
1976
+ }
1977
+ ]
1978
+ },
1979
+ {
1980
+ "matcher": {
1981
+ "id": "byName",
1982
+ "options": "Warning"
1983
+ },
1984
+ "properties": [
1985
+ {
1986
+ "id": "color",
1987
+ "value": {
1988
+ "fixedColor": "#FF9830",
1989
+ "mode": "fixed"
1990
+ }
1991
+ }
1992
+ ]
1993
+ },
1994
+ {
1995
+ "matcher": {
1996
+ "id": "byName",
1997
+ "options": "INFORMATION"
1998
+ },
1999
+ "properties": [
2000
+ {
2001
+ "id": "color",
2002
+ "value": {
2003
+ "fixedColor": "green",
2004
+ "mode": "fixed"
2005
+ }
2006
+ }
2007
+ ]
2008
+ },
2009
+ {
2010
+ "matcher": {
2011
+ "id": "byName",
2012
+ "options": "WARNING"
2013
+ },
2014
+ "properties": [
2015
+ {
2016
+ "id": "color",
2017
+ "value": {
2018
+ "fixedColor": "orange",
2019
+ "mode": "fixed"
2020
+ }
2021
+ }
2022
+ ]
2023
+ },
2024
+ {
2025
+ "matcher": {
2026
+ "id": "byName",
2027
+ "options": "ERROR"
2028
+ },
2029
+ "properties": [
2030
+ {
2031
+ "id": "color",
2032
+ "value": {
2033
+ "fixedColor": "red",
2034
+ "mode": "fixed"
2035
+ }
2036
+ }
2037
+ ]
2038
+ }
2039
+ ]
2040
+ },
2041
+ "gridPos": {
2042
+ "h": 8,
2043
+ "w": 5,
2044
+ "x": 0,
2045
+ "y": 28
2046
+ },
2047
+ "id": 138,
2048
+ "links": [],
2049
+ "maxDataPoints": 3,
2050
+ "options": {
2051
+ "displayLabels": [],
2052
+ "legend": {
2053
+ "calcs": [],
2054
+ "displayMode": "hidden",
2055
+ "placement": "bottom",
2056
+ "values": ["value"]
2057
+ },
2058
+ "pieType": "pie",
2059
+ "reduceOptions": {
2060
+ "calcs": ["sum"],
2061
+ "fields": "",
2062
+ "values": false
2063
+ },
2064
+ "text": {},
2065
+ "tooltip": {
2066
+ "mode": "single"
2067
+ }
2068
+ },
2069
+ "targets": [
2070
+ {
2071
+ "bucketAggs": [
2072
+ {
2073
+ "$$hashKey": "object:73",
2074
+ "fake": true,
2075
+ "field": "data_system_manufacturer",
2076
+ "id": "3",
2077
+ "settings": {
2078
+ "min_doc_count": 1,
2079
+ "order": "desc",
2080
+ "orderBy": "_count",
2081
+ "size": "0"
2082
+ },
2083
+ "type": "terms"
2084
+ },
2085
+ {
2086
+ "$$hashKey": "object:74",
2087
+ "field": "timestamp",
2088
+ "id": "2",
2089
+ "settings": {
2090
+ "interval": "auto",
2091
+ "min_doc_count": 0,
2092
+ "trimEdges": 0
2093
+ },
2094
+ "type": "date_histogram"
2095
+ }
2096
+ ],
2097
+ "datasource": {
2098
+ "type": "elasticsearch",
2099
+ "uid": "wazuh_datasource_uid"
2100
+ },
2101
+ "metrics": [
2102
+ {
2103
+ "$$hashKey": "object:71",
2104
+ "field": "select field",
2105
+ "id": "1",
2106
+ "type": "count"
2107
+ }
2108
+ ],
2109
+ "query": "agent_name:$agent_name AND data_inventory_module:computer_info",
2110
+ "refId": "A",
2111
+ "timeField": "timestamp"
2112
+ }
2113
+ ],
2114
+ "title": "HARDWARE MANUFACTURERS",
2115
+ "type": "piechart"
2116
+ },
2117
+ {
2118
+ "datasource": {
2119
+ "type": "elasticsearch",
2120
+ "uid": "wazuh_datasource_uid"
2121
+ },
2122
+ "fieldConfig": {
2123
+ "defaults": {
2124
+ "color": {
2125
+ "mode": "palette-classic"
2126
+ },
2127
+ "custom": {
2128
+ "hideFrom": {
2129
+ "legend": false,
2130
+ "tooltip": false,
2131
+ "viz": false
2132
+ }
2133
+ },
2134
+ "decimals": 0,
2135
+ "mappings": [],
2136
+ "unit": "short"
2137
+ },
2138
+ "overrides": [
2139
+ {
2140
+ "matcher": {
2141
+ "id": "byName",
2142
+ "options": "1"
2143
+ },
2144
+ "properties": [
2145
+ {
2146
+ "id": "color",
2147
+ "value": {
2148
+ "fixedColor": "#FF9830",
2149
+ "mode": "fixed"
2150
+ }
2151
+ }
2152
+ ]
2153
+ },
2154
+ {
2155
+ "matcher": {
2156
+ "id": "byName",
2157
+ "options": "Alert"
2158
+ },
2159
+ "properties": [
2160
+ {
2161
+ "id": "color",
2162
+ "value": {
2163
+ "fixedColor": "#F2495C",
2164
+ "mode": "fixed"
2165
+ }
2166
+ }
2167
+ ]
2168
+ },
2169
+ {
2170
+ "matcher": {
2171
+ "id": "byName",
2172
+ "options": "Error"
2173
+ },
2174
+ "properties": [
2175
+ {
2176
+ "id": "color",
2177
+ "value": {
2178
+ "fixedColor": "#F2495C",
2179
+ "mode": "fixed"
2180
+ }
2181
+ }
2182
+ ]
2183
+ },
2184
+ {
2185
+ "matcher": {
2186
+ "id": "byName",
2187
+ "options": "Info"
2188
+ },
2189
+ "properties": [
2190
+ {
2191
+ "id": "color",
2192
+ "value": {
2193
+ "fixedColor": "#73BF69",
2194
+ "mode": "fixed"
2195
+ }
2196
+ }
2197
+ ]
2198
+ },
2199
+ {
2200
+ "matcher": {
2201
+ "id": "byName",
2202
+ "options": "NOTICE"
2203
+ },
2204
+ "properties": [
2205
+ {
2206
+ "id": "color",
2207
+ "value": {
2208
+ "fixedColor": "#5794F2",
2209
+ "mode": "fixed"
2210
+ }
2211
+ }
2212
+ ]
2213
+ },
2214
+ {
2215
+ "matcher": {
2216
+ "id": "byName",
2217
+ "options": "Notice"
2218
+ },
2219
+ "properties": [
2220
+ {
2221
+ "id": "color",
2222
+ "value": {
2223
+ "fixedColor": "#5794F2",
2224
+ "mode": "fixed"
2225
+ }
2226
+ }
2227
+ ]
2228
+ },
2229
+ {
2230
+ "matcher": {
2231
+ "id": "byName",
2232
+ "options": "Result"
2233
+ },
2234
+ "properties": [
2235
+ {
2236
+ "id": "color",
2237
+ "value": {
2238
+ "fixedColor": "#B877D9",
2239
+ "mode": "fixed"
2240
+ }
2241
+ }
2242
+ ]
2243
+ },
2244
+ {
2245
+ "matcher": {
2246
+ "id": "byName",
2247
+ "options": "Warning"
2248
+ },
2249
+ "properties": [
2250
+ {
2251
+ "id": "color",
2252
+ "value": {
2253
+ "fixedColor": "#FF9830",
2254
+ "mode": "fixed"
2255
+ }
2256
+ }
2257
+ ]
2258
+ },
2259
+ {
2260
+ "matcher": {
2261
+ "id": "byName",
2262
+ "options": "INFORMATION"
2263
+ },
2264
+ "properties": [
2265
+ {
2266
+ "id": "color",
2267
+ "value": {
2268
+ "fixedColor": "green",
2269
+ "mode": "fixed"
2270
+ }
2271
+ }
2272
+ ]
2273
+ },
2274
+ {
2275
+ "matcher": {
2276
+ "id": "byName",
2277
+ "options": "WARNING"
2278
+ },
2279
+ "properties": [
2280
+ {
2281
+ "id": "color",
2282
+ "value": {
2283
+ "fixedColor": "orange",
2284
+ "mode": "fixed"
2285
+ }
2286
+ }
2287
+ ]
2288
+ },
2289
+ {
2290
+ "matcher": {
2291
+ "id": "byName",
2292
+ "options": "ERROR"
2293
+ },
2294
+ "properties": [
2295
+ {
2296
+ "id": "color",
2297
+ "value": {
2298
+ "fixedColor": "red",
2299
+ "mode": "fixed"
2300
+ }
2301
+ }
2302
+ ]
2303
+ }
2304
+ ]
2305
+ },
2306
+ "gridPos": {
2307
+ "h": 8,
2308
+ "w": 5,
2309
+ "x": 5,
2310
+ "y": 28
2311
+ },
2312
+ "id": 139,
2313
+ "links": [],
2314
+ "maxDataPoints": 3,
2315
+ "options": {
2316
+ "displayLabels": [],
2317
+ "legend": {
2318
+ "calcs": [],
2319
+ "displayMode": "hidden",
2320
+ "placement": "bottom",
2321
+ "values": ["value"]
2322
+ },
2323
+ "pieType": "donut",
2324
+ "reduceOptions": {
2325
+ "calcs": ["sum"],
2326
+ "fields": "",
2327
+ "values": false
2328
+ },
2329
+ "text": {},
2330
+ "tooltip": {
2331
+ "mode": "single"
2332
+ }
2333
+ },
2334
+ "targets": [
2335
+ {
2336
+ "bucketAggs": [
2337
+ {
2338
+ "$$hashKey": "object:73",
2339
+ "fake": true,
2340
+ "field": "data_system_model",
2341
+ "id": "3",
2342
+ "settings": {
2343
+ "min_doc_count": 1,
2344
+ "order": "desc",
2345
+ "orderBy": "_count",
2346
+ "size": "0"
2347
+ },
2348
+ "type": "terms"
2349
+ },
2350
+ {
2351
+ "$$hashKey": "object:74",
2352
+ "field": "timestamp",
2353
+ "id": "2",
2354
+ "settings": {
2355
+ "interval": "auto",
2356
+ "min_doc_count": 0,
2357
+ "trimEdges": 0
2358
+ },
2359
+ "type": "date_histogram"
2360
+ }
2361
+ ],
2362
+ "datasource": {
2363
+ "type": "elasticsearch",
2364
+ "uid": "wazuh_datasource_uid"
2365
+ },
2366
+ "metrics": [
2367
+ {
2368
+ "$$hashKey": "object:71",
2369
+ "field": "select field",
2370
+ "id": "1",
2371
+ "type": "count"
2372
+ }
2373
+ ],
2374
+ "query": "agent_name:$agent_name AND data_inventory_module:computer_info",
2375
+ "refId": "A",
2376
+ "timeField": "timestamp"
2377
+ }
2378
+ ],
2379
+ "title": "HARDWARE MODELS",
2380
+ "type": "piechart"
2381
+ },
2382
+ {
2383
+ "datasource": {
2384
+ "type": "elasticsearch",
2385
+ "uid": "wazuh_datasource_uid"
2386
+ },
2387
+ "fieldConfig": {
2388
+ "defaults": {
2389
+ "color": {
2390
+ "mode": "thresholds"
2391
+ },
2392
+ "custom": {
2393
+ "align": "auto",
2394
+ "displayMode": "auto"
2395
+ },
2396
+ "mappings": [],
2397
+ "thresholds": {
2398
+ "mode": "absolute",
2399
+ "steps": [
2400
+ {
2401
+ "color": "green"
2402
+ },
2403
+ {
2404
+ "color": "red",
2405
+ "value": 80
2406
+ }
2407
+ ]
2408
+ }
2409
+ },
2410
+ "overrides": [
2411
+ {
2412
+ "matcher": {
2413
+ "id": "byName",
2414
+ "options": "rule_level"
2415
+ },
2416
+ "properties": [
2417
+ {
2418
+ "id": "custom.width",
2419
+ "value": 93
2420
+ }
2421
+ ]
2422
+ },
2423
+ {
2424
+ "matcher": {
2425
+ "id": "byName",
2426
+ "options": "windows_event_id"
2427
+ },
2428
+ "properties": [
2429
+ {
2430
+ "id": "custom.width",
2431
+ "value": 186
2432
+ }
2433
+ ]
2434
+ },
2435
+ {
2436
+ "matcher": {
2437
+ "id": "byName",
2438
+ "options": "DATE/TIME"
2439
+ },
2440
+ "properties": [
2441
+ {
2442
+ "id": "custom.width",
2443
+ "value": 202
2444
+ }
2445
+ ]
2446
+ },
2447
+ {
2448
+ "matcher": {
2449
+ "id": "byName",
2450
+ "options": "AGENT"
2451
+ },
2452
+ "properties": [
2453
+ {
2454
+ "id": "custom.width",
2455
+ "value": 171
2456
+ }
2457
+ ]
2458
+ },
2459
+ {
2460
+ "matcher": {
2461
+ "id": "byName",
2462
+ "options": "SRC IP"
2463
+ },
2464
+ "properties": [
2465
+ {
2466
+ "id": "custom.width",
2467
+ "value": 167
2468
+ }
2469
+ ]
2470
+ },
2471
+ {
2472
+ "matcher": {
2473
+ "id": "byName",
2474
+ "options": "MESSAGE"
2475
+ },
2476
+ "properties": [
2477
+ {
2478
+ "id": "custom.width",
2479
+ "value": 1519
2480
+ }
2481
+ ]
2482
+ },
2483
+ {
2484
+ "matcher": {
2485
+ "id": "byName",
2486
+ "options": "rule_description"
2487
+ },
2488
+ "properties": [
2489
+ {
2490
+ "id": "custom.width",
2491
+ "value": 524
2492
+ }
2493
+ ]
2494
+ }
2495
+ ]
2496
+ },
2497
+ "gridPos": {
2498
+ "h": 8,
2499
+ "w": 8,
2500
+ "x": 10,
2501
+ "y": 28
2502
+ },
2503
+ "id": 140,
2504
+ "options": {
2505
+ "footer": {
2506
+ "fields": "",
2507
+ "reducer": ["sum"],
2508
+ "show": false
2509
+ },
2510
+ "showHeader": true,
2511
+ "sortBy": []
2512
+ },
2513
+ "pluginVersion": "8.3.3",
2514
+ "targets": [
2515
+ {
2516
+ "alias": "",
2517
+ "bucketAggs": [],
2518
+ "datasource": {
2519
+ "type": "elasticsearch",
2520
+ "uid": "wazuh_datasource_uid"
2521
+ },
2522
+ "metrics": [
2523
+ {
2524
+ "id": "1",
2525
+ "settings": {
2526
+ "size": "500"
2527
+ },
2528
+ "type": "raw_data"
2529
+ }
2530
+ ],
2531
+ "query": "agent_name:$agent_name AND data_inventory_module:computer_info",
2532
+ "queryType": "lucene",
2533
+ "refId": "A",
2534
+ "timeField": "timestamp"
2535
+ }
2536
+ ],
2537
+ "title": "SYSTEM INFO",
2538
+ "transformations": [
2539
+ {
2540
+ "id": "organize",
2541
+ "options": {
2542
+ "excludeByName": {
2543
+ "@metadata_beat": true,
2544
+ "@metadata_type": true,
2545
+ "@metadata_version": true,
2546
+ "_id": true,
2547
+ "_index": true,
2548
+ "_type": true,
2549
+ "agent_ephemeral_id": true,
2550
+ "agent_hostname": true,
2551
+ "agent_id": true,
2552
+ "agent_ip": false,
2553
+ "agent_ip_city_name": true,
2554
+ "agent_ip_country_code": true,
2555
+ "agent_ip_geolocation": true,
2556
+ "agent_labels_customer": true,
2557
+ "agent_name": false,
2558
+ "agent_type": true,
2559
+ "agent_version": true,
2560
+ "beats_type": true,
2561
+ "collector_node_id": true,
2562
+ "data_base_indicator_access_type": true,
2563
+ "data_base_indicator_id": false,
2564
+ "data_base_indicator_indicator_city_name": true,
2565
+ "data_base_indicator_indicator_country_code": true,
2566
+ "data_base_indicator_indicator_geolocation": true,
2567
+ "data_inventory_module": true,
2568
+ "data_type": true,
2569
+ "data_win_eventdata_domain": true,
2570
+ "data_win_eventdata_imagePath": true,
2571
+ "data_win_eventdata_sID": true,
2572
+ "data_win_eventdata_serviceName": true,
2573
+ "data_win_eventdata_serviceType": true,
2574
+ "data_win_eventdata_startType": true,
2575
+ "data_win_eventdata_timestamp": true,
2576
+ "data_win_eventdata_user": true,
2577
+ "data_win_system_channel": true,
2578
+ "data_win_system_computer": true,
2579
+ "data_win_system_eventID": true,
2580
+ "data_win_system_eventRecordID": true,
2581
+ "data_win_system_eventSourceName": true,
2582
+ "data_win_system_keywords": true,
2583
+ "data_win_system_level": true,
2584
+ "data_win_system_opcode": true,
2585
+ "data_win_system_processID": true,
2586
+ "data_win_system_providerGuid": true,
2587
+ "data_win_system_providerName": true,
2588
+ "data_win_system_severityValue": true,
2589
+ "data_win_system_systemTime": true,
2590
+ "data_win_system_task": true,
2591
+ "data_win_system_threadID": true,
2592
+ "data_win_system_version": true,
2593
+ "date": true,
2594
+ "decoder_name": true,
2595
+ "ecs_version": true,
2596
+ "gl2_accounted_message_size": true,
2597
+ "gl2_message_id": true,
2598
+ "gl2_processing_error": true,
2599
+ "gl2_remote_ip": true,
2600
+ "gl2_remote_port": true,
2601
+ "gl2_source_collector": true,
2602
+ "gl2_source_input": true,
2603
+ "gl2_source_node": true,
2604
+ "highlight": true,
2605
+ "host_name": true,
2606
+ "id": true,
2607
+ "location": true,
2608
+ "log_file_path": true,
2609
+ "log_offset": true,
2610
+ "manager_name": true,
2611
+ "message": true,
2612
+ "previous_output": true,
2613
+ "rule_description": true,
2614
+ "rule_firedtimes": true,
2615
+ "rule_frequency": true,
2616
+ "rule_gdpr": true,
2617
+ "rule_gpg13": true,
2618
+ "rule_group1": true,
2619
+ "rule_group2": true,
2620
+ "rule_groups": true,
2621
+ "rule_hipaa": true,
2622
+ "rule_id": true,
2623
+ "rule_level": true,
2624
+ "rule_mail": true,
2625
+ "rule_mitre_id": true,
2626
+ "rule_mitre_tactic": true,
2627
+ "rule_mitre_technique": true,
2628
+ "rule_nist_800_53": true,
2629
+ "rule_pci_dss": true,
2630
+ "rule_tsc": true,
2631
+ "sort": true,
2632
+ "source": true,
2633
+ "src_ip": true,
2634
+ "src_ip_city_name": true,
2635
+ "src_ip_country_code": true,
2636
+ "src_ip_geolocation": true,
2637
+ "streams": true,
2638
+ "syslog_tag": true,
2639
+ "syslog_type": true,
2640
+ "timestamp": true,
2641
+ "user_name": true,
2642
+ "win_system_eventID": true,
2643
+ "windows_event_id": true,
2644
+ "windows_event_severity": false
2645
+ },
2646
+ "indexByName": {
2647
+ "_id": 1,
2648
+ "_index": 2,
2649
+ "_type": 3,
2650
+ "agent_id": 4,
2651
+ "agent_ip": 5,
2652
+ "agent_labels_customer": 29,
2653
+ "agent_name": 0,
2654
+ "data_inventory_module": 30,
2655
+ "data_processor_cores": 33,
2656
+ "data_processor_logical_nbr": 34,
2657
+ "data_processor_name": 31,
2658
+ "data_processor_status": 32,
2659
+ "date": 35,
2660
+ "decoder_name": 6,
2661
+ "gl2_accounted_message_size": 7,
2662
+ "gl2_message_id": 8,
2663
+ "gl2_processing_error": 36,
2664
+ "gl2_remote_ip": 9,
2665
+ "gl2_remote_port": 10,
2666
+ "gl2_source_input": 11,
2667
+ "gl2_source_node": 12,
2668
+ "highlight": 13,
2669
+ "id": 14,
2670
+ "location": 15,
2671
+ "manager_name": 16,
2672
+ "message": 17,
2673
+ "rule_description": 18,
2674
+ "rule_firedtimes": 19,
2675
+ "rule_groups": 20,
2676
+ "rule_id": 21,
2677
+ "rule_level": 22,
2678
+ "rule_mail": 23,
2679
+ "sort": 24,
2680
+ "source": 25,
2681
+ "streams": 26,
2682
+ "syslog_type": 27,
2683
+ "timestamp": 28
2684
+ },
2685
+ "renameByName": {
2686
+ "agent_ip": "SRC IP",
2687
+ "agent_name": "AGENT",
2688
+ "data_base_indicator_access_type": "",
2689
+ "data_base_indicator_id": "OTX IoC ID",
2690
+ "data_base_indicator_indicator": "IoC",
2691
+ "data_base_indicator_indicator_country_code": "",
2692
+ "data_base_indicator_type": "IoC TYPE",
2693
+ "data_bios_sn": "BIOS S/N",
2694
+ "data_processor_cores": "CORES",
2695
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
2696
+ "data_processor_name": "PROCESSOR",
2697
+ "data_processor_status": "STATUS",
2698
+ "data_sections": "OTX SECTIONS",
2699
+ "data_system_manufacturer": "VENDOR",
2700
+ "data_system_model": "MODEL",
2701
+ "data_type": "",
2702
+ "data_win_system_message": "MESSAGE",
2703
+ "data_win_system_providerGuid": "",
2704
+ "rule_level": "RULE LEVEL",
2705
+ "timestamp": "DATE/TIME",
2706
+ "windows_event_severity": "EVENT LOG SEVERITY"
2707
+ }
2708
+ }
2709
+ }
2710
+ ],
2711
+ "type": "table"
2712
+ },
2713
+ {
2714
+ "datasource": {
2715
+ "type": "elasticsearch",
2716
+ "uid": "wazuh_datasource_uid"
2717
+ },
2718
+ "fieldConfig": {
2719
+ "defaults": {
2720
+ "color": {
2721
+ "mode": "thresholds"
2722
+ },
2723
+ "custom": {
2724
+ "align": "auto",
2725
+ "displayMode": "auto"
2726
+ },
2727
+ "decimals": 0,
2728
+ "mappings": [
2729
+ {
2730
+ "options": {
2731
+ "False": {
2732
+ "color": "red",
2733
+ "index": 0
2734
+ },
2735
+ "True": {
2736
+ "color": "green",
2737
+ "index": 1
2738
+ }
2739
+ },
2740
+ "type": "value"
2741
+ }
2742
+ ],
2743
+ "thresholds": {
2744
+ "mode": "absolute",
2745
+ "steps": [
2746
+ {
2747
+ "color": "green"
2748
+ }
2749
+ ]
2750
+ },
2751
+ "unit": "short"
2752
+ },
2753
+ "overrides": [
2754
+ {
2755
+ "matcher": {
2756
+ "id": "byName",
2757
+ "options": "UEFI ENABLED"
2758
+ },
2759
+ "properties": [
2760
+ {
2761
+ "id": "custom.displayMode",
2762
+ "value": "color-text"
2763
+ }
2764
+ ]
2765
+ }
2766
+ ]
2767
+ },
2768
+ "gridPos": {
2769
+ "h": 8,
2770
+ "w": 6,
2771
+ "x": 18,
2772
+ "y": 28
2773
+ },
2774
+ "id": 148,
2775
+ "links": [],
2776
+ "maxDataPoints": 3,
2777
+ "options": {
2778
+ "footer": {
2779
+ "fields": "",
2780
+ "reducer": ["sum"],
2781
+ "show": false
2782
+ },
2783
+ "showHeader": true
2784
+ },
2785
+ "pluginVersion": "8.3.3",
2786
+ "targets": [
2787
+ {
2788
+ "bucketAggs": [
2789
+ {
2790
+ "$$hashKey": "object:73",
2791
+ "fake": true,
2792
+ "field": "agent_name",
2793
+ "id": "3",
2794
+ "settings": {
2795
+ "min_doc_count": 1,
2796
+ "order": "desc",
2797
+ "orderBy": "_count",
2798
+ "size": "0"
2799
+ },
2800
+ "type": "terms"
2801
+ },
2802
+ {
2803
+ "field": "data_uefi_enabled",
2804
+ "id": "4",
2805
+ "settings": {
2806
+ "min_doc_count": "1",
2807
+ "order": "desc",
2808
+ "orderBy": "_term",
2809
+ "size": "10"
2810
+ },
2811
+ "type": "terms"
2812
+ }
2813
+ ],
2814
+ "datasource": {
2815
+ "type": "elasticsearch",
2816
+ "uid": "wazuh_datasource_uid"
2817
+ },
2818
+ "metrics": [
2819
+ {
2820
+ "$$hashKey": "object:71",
2821
+ "field": "select field",
2822
+ "id": "1",
2823
+ "type": "count"
2824
+ }
2825
+ ],
2826
+ "query": "agent_name:$agent_name AND data_inventory_module:uefi",
2827
+ "refId": "A",
2828
+ "timeField": "timestamp"
2829
+ }
2830
+ ],
2831
+ "title": "UEFI",
2832
+ "transformations": [
2833
+ {
2834
+ "id": "organize",
2835
+ "options": {
2836
+ "excludeByName": {},
2837
+ "indexByName": {},
2838
+ "renameByName": {
2839
+ "agent_name": "AGENT",
2840
+ "data_uefi_enabled": "UEFI ENABLED"
2841
+ }
2842
+ }
2843
+ }
2844
+ ],
2845
+ "type": "table"
2846
+ },
2847
+ {
2848
+ "datasource": {
2849
+ "type": "elasticsearch",
2850
+ "uid": "wazuh_datasource_uid"
2851
+ },
2852
+ "fieldConfig": {
2853
+ "defaults": {
2854
+ "color": {
2855
+ "mode": "palette-classic"
2856
+ },
2857
+ "custom": {
2858
+ "hideFrom": {
2859
+ "legend": false,
2860
+ "tooltip": false,
2861
+ "viz": false
2862
+ }
2863
+ },
2864
+ "decimals": 0,
2865
+ "mappings": [],
2866
+ "unit": "short"
2867
+ },
2868
+ "overrides": [
2869
+ {
2870
+ "matcher": {
2871
+ "id": "byName",
2872
+ "options": "1"
2873
+ },
2874
+ "properties": [
2875
+ {
2876
+ "id": "color",
2877
+ "value": {
2878
+ "fixedColor": "#FF9830",
2879
+ "mode": "fixed"
2880
+ }
2881
+ }
2882
+ ]
2883
+ },
2884
+ {
2885
+ "matcher": {
2886
+ "id": "byName",
2887
+ "options": "Alert"
2888
+ },
2889
+ "properties": [
2890
+ {
2891
+ "id": "color",
2892
+ "value": {
2893
+ "fixedColor": "#F2495C",
2894
+ "mode": "fixed"
2895
+ }
2896
+ }
2897
+ ]
2898
+ },
2899
+ {
2900
+ "matcher": {
2901
+ "id": "byName",
2902
+ "options": "Error"
2903
+ },
2904
+ "properties": [
2905
+ {
2906
+ "id": "color",
2907
+ "value": {
2908
+ "fixedColor": "#F2495C",
2909
+ "mode": "fixed"
2910
+ }
2911
+ }
2912
+ ]
2913
+ },
2914
+ {
2915
+ "matcher": {
2916
+ "id": "byName",
2917
+ "options": "Info"
2918
+ },
2919
+ "properties": [
2920
+ {
2921
+ "id": "color",
2922
+ "value": {
2923
+ "fixedColor": "#73BF69",
2924
+ "mode": "fixed"
2925
+ }
2926
+ }
2927
+ ]
2928
+ },
2929
+ {
2930
+ "matcher": {
2931
+ "id": "byName",
2932
+ "options": "NOTICE"
2933
+ },
2934
+ "properties": [
2935
+ {
2936
+ "id": "color",
2937
+ "value": {
2938
+ "fixedColor": "#5794F2",
2939
+ "mode": "fixed"
2940
+ }
2941
+ }
2942
+ ]
2943
+ },
2944
+ {
2945
+ "matcher": {
2946
+ "id": "byName",
2947
+ "options": "Notice"
2948
+ },
2949
+ "properties": [
2950
+ {
2951
+ "id": "color",
2952
+ "value": {
2953
+ "fixedColor": "#5794F2",
2954
+ "mode": "fixed"
2955
+ }
2956
+ }
2957
+ ]
2958
+ },
2959
+ {
2960
+ "matcher": {
2961
+ "id": "byName",
2962
+ "options": "Result"
2963
+ },
2964
+ "properties": [
2965
+ {
2966
+ "id": "color",
2967
+ "value": {
2968
+ "fixedColor": "#B877D9",
2969
+ "mode": "fixed"
2970
+ }
2971
+ }
2972
+ ]
2973
+ },
2974
+ {
2975
+ "matcher": {
2976
+ "id": "byName",
2977
+ "options": "Warning"
2978
+ },
2979
+ "properties": [
2980
+ {
2981
+ "id": "color",
2982
+ "value": {
2983
+ "fixedColor": "#FF9830",
2984
+ "mode": "fixed"
2985
+ }
2986
+ }
2987
+ ]
2988
+ },
2989
+ {
2990
+ "matcher": {
2991
+ "id": "byName",
2992
+ "options": "INFORMATION"
2993
+ },
2994
+ "properties": [
2995
+ {
2996
+ "id": "color",
2997
+ "value": {
2998
+ "fixedColor": "green",
2999
+ "mode": "fixed"
3000
+ }
3001
+ }
3002
+ ]
3003
+ },
3004
+ {
3005
+ "matcher": {
3006
+ "id": "byName",
3007
+ "options": "WARNING"
3008
+ },
3009
+ "properties": [
3010
+ {
3011
+ "id": "color",
3012
+ "value": {
3013
+ "fixedColor": "orange",
3014
+ "mode": "fixed"
3015
+ }
3016
+ }
3017
+ ]
3018
+ },
3019
+ {
3020
+ "matcher": {
3021
+ "id": "byName",
3022
+ "options": "ERROR"
3023
+ },
3024
+ "properties": [
3025
+ {
3026
+ "id": "color",
3027
+ "value": {
3028
+ "fixedColor": "red",
3029
+ "mode": "fixed"
3030
+ }
3031
+ }
3032
+ ]
3033
+ }
3034
+ ]
3035
+ },
3036
+ "gridPos": {
3037
+ "h": 8,
3038
+ "w": 5,
3039
+ "x": 0,
3040
+ "y": 36
3041
+ },
3042
+ "id": 136,
3043
+ "links": [],
3044
+ "maxDataPoints": 3,
3045
+ "options": {
3046
+ "displayLabels": [],
3047
+ "legend": {
3048
+ "calcs": [],
3049
+ "displayMode": "hidden",
3050
+ "placement": "bottom",
3051
+ "values": ["value"]
3052
+ },
3053
+ "pieType": "donut",
3054
+ "reduceOptions": {
3055
+ "calcs": ["sum"],
3056
+ "fields": "",
3057
+ "values": false
3058
+ },
3059
+ "text": {},
3060
+ "tooltip": {
3061
+ "mode": "single"
3062
+ }
3063
+ },
3064
+ "targets": [
3065
+ {
3066
+ "bucketAggs": [
3067
+ {
3068
+ "$$hashKey": "object:73",
3069
+ "fake": true,
3070
+ "field": "data_processor_cores",
3071
+ "id": "3",
3072
+ "settings": {
3073
+ "min_doc_count": 1,
3074
+ "order": "desc",
3075
+ "orderBy": "_count",
3076
+ "size": "0"
3077
+ },
3078
+ "type": "terms"
3079
+ },
3080
+ {
3081
+ "$$hashKey": "object:74",
3082
+ "field": "timestamp",
3083
+ "id": "2",
3084
+ "settings": {
3085
+ "interval": "auto",
3086
+ "min_doc_count": 0,
3087
+ "trimEdges": 0
3088
+ },
3089
+ "type": "date_histogram"
3090
+ }
3091
+ ],
3092
+ "datasource": {
3093
+ "type": "elasticsearch",
3094
+ "uid": "wazuh_datasource_uid"
3095
+ },
3096
+ "metrics": [
3097
+ {
3098
+ "$$hashKey": "object:71",
3099
+ "field": "select field",
3100
+ "id": "1",
3101
+ "type": "count"
3102
+ }
3103
+ ],
3104
+ "query": "agent_name:$agent_name AND data_inventory_module:processor",
3105
+ "refId": "A",
3106
+ "timeField": "timestamp"
3107
+ }
3108
+ ],
3109
+ "title": "AGENTS BY NBR OF PROCESSORS",
3110
+ "type": "piechart"
3111
+ },
3112
+ {
3113
+ "datasource": {
3114
+ "type": "elasticsearch",
3115
+ "uid": "wazuh_datasource_uid"
3116
+ },
3117
+ "fieldConfig": {
3118
+ "defaults": {
3119
+ "color": {
3120
+ "mode": "thresholds"
3121
+ },
3122
+ "custom": {
3123
+ "align": "auto",
3124
+ "displayMode": "auto"
3125
+ },
3126
+ "mappings": [],
3127
+ "thresholds": {
3128
+ "mode": "absolute",
3129
+ "steps": [
3130
+ {
3131
+ "color": "green"
3132
+ },
3133
+ {
3134
+ "color": "red",
3135
+ "value": 80
3136
+ }
3137
+ ]
3138
+ }
3139
+ },
3140
+ "overrides": [
3141
+ {
3142
+ "matcher": {
3143
+ "id": "byName",
3144
+ "options": "rule_level"
3145
+ },
3146
+ "properties": [
3147
+ {
3148
+ "id": "custom.width",
3149
+ "value": 93
3150
+ }
3151
+ ]
3152
+ },
3153
+ {
3154
+ "matcher": {
3155
+ "id": "byName",
3156
+ "options": "windows_event_id"
3157
+ },
3158
+ "properties": [
3159
+ {
3160
+ "id": "custom.width",
3161
+ "value": 186
3162
+ }
3163
+ ]
3164
+ },
3165
+ {
3166
+ "matcher": {
3167
+ "id": "byName",
3168
+ "options": "DATE/TIME"
3169
+ },
3170
+ "properties": [
3171
+ {
3172
+ "id": "custom.width",
3173
+ "value": 202
3174
+ }
3175
+ ]
3176
+ },
3177
+ {
3178
+ "matcher": {
3179
+ "id": "byName",
3180
+ "options": "AGENT"
3181
+ },
3182
+ "properties": [
3183
+ {
3184
+ "id": "custom.width",
3185
+ "value": 171
3186
+ }
3187
+ ]
3188
+ },
3189
+ {
3190
+ "matcher": {
3191
+ "id": "byName",
3192
+ "options": "SRC IP"
3193
+ },
3194
+ "properties": [
3195
+ {
3196
+ "id": "custom.width",
3197
+ "value": 167
3198
+ }
3199
+ ]
3200
+ },
3201
+ {
3202
+ "matcher": {
3203
+ "id": "byName",
3204
+ "options": "MESSAGE"
3205
+ },
3206
+ "properties": [
3207
+ {
3208
+ "id": "custom.width",
3209
+ "value": 1519
3210
+ }
3211
+ ]
3212
+ },
3213
+ {
3214
+ "matcher": {
3215
+ "id": "byName",
3216
+ "options": "rule_description"
3217
+ },
3218
+ "properties": [
3219
+ {
3220
+ "id": "custom.width",
3221
+ "value": 524
3222
+ }
3223
+ ]
3224
+ },
3225
+ {
3226
+ "matcher": {
3227
+ "id": "byName",
3228
+ "options": "PROCESSOR"
3229
+ },
3230
+ "properties": [
3231
+ {
3232
+ "id": "custom.width",
3233
+ "value": 418
3234
+ }
3235
+ ]
3236
+ }
3237
+ ]
3238
+ },
3239
+ "gridPos": {
3240
+ "h": 8,
3241
+ "w": 19,
3242
+ "x": 5,
3243
+ "y": 36
3244
+ },
3245
+ "id": 116,
3246
+ "options": {
3247
+ "footer": {
3248
+ "fields": "",
3249
+ "reducer": ["sum"],
3250
+ "show": false
3251
+ },
3252
+ "showHeader": true,
3253
+ "sortBy": []
3254
+ },
3255
+ "pluginVersion": "8.3.3",
3256
+ "targets": [
3257
+ {
3258
+ "alias": "",
3259
+ "bucketAggs": [],
3260
+ "datasource": {
3261
+ "type": "elasticsearch",
3262
+ "uid": "wazuh_datasource_uid"
3263
+ },
3264
+ "metrics": [
3265
+ {
3266
+ "id": "1",
3267
+ "settings": {
3268
+ "size": "500"
3269
+ },
3270
+ "type": "raw_data"
3271
+ }
3272
+ ],
3273
+ "query": "agent_name:$agent_name AND data_inventory_module:processor",
3274
+ "queryType": "lucene",
3275
+ "refId": "A",
3276
+ "timeField": "timestamp"
3277
+ }
3278
+ ],
3279
+ "title": "PROCESSORS INFO",
3280
+ "transformations": [
3281
+ {
3282
+ "id": "organize",
3283
+ "options": {
3284
+ "excludeByName": {
3285
+ "@metadata_beat": true,
3286
+ "@metadata_type": true,
3287
+ "@metadata_version": true,
3288
+ "_id": true,
3289
+ "_index": true,
3290
+ "_type": true,
3291
+ "agent_ephemeral_id": true,
3292
+ "agent_hostname": true,
3293
+ "agent_id": true,
3294
+ "agent_ip": false,
3295
+ "agent_ip_city_name": true,
3296
+ "agent_ip_country_code": true,
3297
+ "agent_ip_geolocation": true,
3298
+ "agent_labels_customer": true,
3299
+ "agent_name": false,
3300
+ "agent_type": true,
3301
+ "agent_version": true,
3302
+ "beats_type": true,
3303
+ "collector_node_id": true,
3304
+ "data_base_indicator_access_type": true,
3305
+ "data_base_indicator_id": false,
3306
+ "data_base_indicator_indicator_city_name": true,
3307
+ "data_base_indicator_indicator_country_code": true,
3308
+ "data_base_indicator_indicator_geolocation": true,
3309
+ "data_inventory_module": true,
3310
+ "data_type": true,
3311
+ "data_win_eventdata_domain": true,
3312
+ "data_win_eventdata_imagePath": true,
3313
+ "data_win_eventdata_sID": true,
3314
+ "data_win_eventdata_serviceName": true,
3315
+ "data_win_eventdata_serviceType": true,
3316
+ "data_win_eventdata_startType": true,
3317
+ "data_win_eventdata_timestamp": true,
3318
+ "data_win_eventdata_user": true,
3319
+ "data_win_system_channel": true,
3320
+ "data_win_system_computer": true,
3321
+ "data_win_system_eventID": true,
3322
+ "data_win_system_eventRecordID": true,
3323
+ "data_win_system_eventSourceName": true,
3324
+ "data_win_system_keywords": true,
3325
+ "data_win_system_level": true,
3326
+ "data_win_system_opcode": true,
3327
+ "data_win_system_processID": true,
3328
+ "data_win_system_providerGuid": true,
3329
+ "data_win_system_providerName": true,
3330
+ "data_win_system_severityValue": true,
3331
+ "data_win_system_systemTime": true,
3332
+ "data_win_system_task": true,
3333
+ "data_win_system_threadID": true,
3334
+ "data_win_system_version": true,
3335
+ "date": true,
3336
+ "decoder_name": true,
3337
+ "ecs_version": true,
3338
+ "gl2_accounted_message_size": true,
3339
+ "gl2_message_id": true,
3340
+ "gl2_processing_error": true,
3341
+ "gl2_remote_ip": true,
3342
+ "gl2_remote_port": true,
3343
+ "gl2_source_collector": true,
3344
+ "gl2_source_input": true,
3345
+ "gl2_source_node": true,
3346
+ "highlight": true,
3347
+ "host_name": true,
3348
+ "id": true,
3349
+ "location": true,
3350
+ "log_file_path": true,
3351
+ "log_offset": true,
3352
+ "manager_name": true,
3353
+ "message": true,
3354
+ "previous_output": true,
3355
+ "rule_description": true,
3356
+ "rule_firedtimes": true,
3357
+ "rule_frequency": true,
3358
+ "rule_gdpr": true,
3359
+ "rule_gpg13": true,
3360
+ "rule_group1": true,
3361
+ "rule_group2": true,
3362
+ "rule_groups": true,
3363
+ "rule_hipaa": true,
3364
+ "rule_id": true,
3365
+ "rule_level": true,
3366
+ "rule_mail": true,
3367
+ "rule_mitre_id": true,
3368
+ "rule_mitre_tactic": true,
3369
+ "rule_mitre_technique": true,
3370
+ "rule_nist_800_53": true,
3371
+ "rule_pci_dss": true,
3372
+ "rule_tsc": true,
3373
+ "sort": true,
3374
+ "source": true,
3375
+ "src_ip": true,
3376
+ "src_ip_city_name": true,
3377
+ "src_ip_country_code": true,
3378
+ "src_ip_geolocation": true,
3379
+ "streams": true,
3380
+ "syslog_tag": true,
3381
+ "syslog_type": true,
3382
+ "timestamp": true,
3383
+ "user_name": true,
3384
+ "win_system_eventID": true,
3385
+ "windows_event_id": true,
3386
+ "windows_event_severity": false
3387
+ },
3388
+ "indexByName": {
3389
+ "_id": 1,
3390
+ "_index": 2,
3391
+ "_type": 3,
3392
+ "agent_id": 4,
3393
+ "agent_ip": 5,
3394
+ "agent_labels_customer": 29,
3395
+ "agent_name": 0,
3396
+ "data_inventory_module": 30,
3397
+ "data_processor_cores": 33,
3398
+ "data_processor_logical_nbr": 34,
3399
+ "data_processor_name": 31,
3400
+ "data_processor_status": 32,
3401
+ "date": 35,
3402
+ "decoder_name": 6,
3403
+ "gl2_accounted_message_size": 7,
3404
+ "gl2_message_id": 8,
3405
+ "gl2_processing_error": 36,
3406
+ "gl2_remote_ip": 9,
3407
+ "gl2_remote_port": 10,
3408
+ "gl2_source_input": 11,
3409
+ "gl2_source_node": 12,
3410
+ "highlight": 13,
3411
+ "id": 14,
3412
+ "location": 15,
3413
+ "manager_name": 16,
3414
+ "message": 17,
3415
+ "rule_description": 18,
3416
+ "rule_firedtimes": 19,
3417
+ "rule_groups": 20,
3418
+ "rule_id": 21,
3419
+ "rule_level": 22,
3420
+ "rule_mail": 23,
3421
+ "sort": 24,
3422
+ "source": 25,
3423
+ "streams": 26,
3424
+ "syslog_type": 27,
3425
+ "timestamp": 28
3426
+ },
3427
+ "renameByName": {
3428
+ "agent_ip": "SRC IP",
3429
+ "agent_name": "AGENT",
3430
+ "data_base_indicator_access_type": "",
3431
+ "data_base_indicator_id": "OTX IoC ID",
3432
+ "data_base_indicator_indicator": "IoC",
3433
+ "data_base_indicator_indicator_country_code": "",
3434
+ "data_base_indicator_type": "IoC TYPE",
3435
+ "data_processor_cores": "CORES",
3436
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
3437
+ "data_processor_name": "PROCESSOR",
3438
+ "data_processor_status": "STATUS",
3439
+ "data_sections": "OTX SECTIONS",
3440
+ "data_type": "",
3441
+ "data_win_system_message": "MESSAGE",
3442
+ "data_win_system_providerGuid": "",
3443
+ "rule_level": "RULE LEVEL",
3444
+ "timestamp": "DATE/TIME",
3445
+ "windows_event_severity": "EVENT LOG SEVERITY"
3446
+ }
3447
+ }
3448
+ }
3449
+ ],
3450
+ "type": "table"
3451
+ },
3452
+ {
3453
+ "datasource": {
3454
+ "type": "elasticsearch",
3455
+ "uid": "wazuh_datasource_uid"
3456
+ },
3457
+ "fieldConfig": {
3458
+ "defaults": {
3459
+ "color": {
3460
+ "mode": "thresholds"
3461
+ },
3462
+ "custom": {
3463
+ "align": "auto",
3464
+ "displayMode": "auto"
3465
+ },
3466
+ "mappings": [],
3467
+ "thresholds": {
3468
+ "mode": "absolute",
3469
+ "steps": [
3470
+ {
3471
+ "color": "green"
3472
+ },
3473
+ {
3474
+ "color": "red",
3475
+ "value": 80
3476
+ }
3477
+ ]
3478
+ }
3479
+ },
3480
+ "overrides": [
3481
+ {
3482
+ "matcher": {
3483
+ "id": "byName",
3484
+ "options": "rule_level"
3485
+ },
3486
+ "properties": [
3487
+ {
3488
+ "id": "custom.width",
3489
+ "value": 93
3490
+ }
3491
+ ]
3492
+ },
3493
+ {
3494
+ "matcher": {
3495
+ "id": "byName",
3496
+ "options": "windows_event_id"
3497
+ },
3498
+ "properties": [
3499
+ {
3500
+ "id": "custom.width",
3501
+ "value": 186
3502
+ }
3503
+ ]
3504
+ },
3505
+ {
3506
+ "matcher": {
3507
+ "id": "byName",
3508
+ "options": "DATE/TIME"
3509
+ },
3510
+ "properties": [
3511
+ {
3512
+ "id": "custom.width",
3513
+ "value": 202
3514
+ }
3515
+ ]
3516
+ },
3517
+ {
3518
+ "matcher": {
3519
+ "id": "byName",
3520
+ "options": "AGENT"
3521
+ },
3522
+ "properties": [
3523
+ {
3524
+ "id": "custom.width",
3525
+ "value": 171
3526
+ }
3527
+ ]
3528
+ },
3529
+ {
3530
+ "matcher": {
3531
+ "id": "byName",
3532
+ "options": "SRC IP"
3533
+ },
3534
+ "properties": [
3535
+ {
3536
+ "id": "custom.width",
3537
+ "value": 167
3538
+ }
3539
+ ]
3540
+ },
3541
+ {
3542
+ "matcher": {
3543
+ "id": "byName",
3544
+ "options": "MESSAGE"
3545
+ },
3546
+ "properties": [
3547
+ {
3548
+ "id": "custom.width",
3549
+ "value": 1519
3550
+ }
3551
+ ]
3552
+ },
3553
+ {
3554
+ "matcher": {
3555
+ "id": "byName",
3556
+ "options": "rule_description"
3557
+ },
3558
+ "properties": [
3559
+ {
3560
+ "id": "custom.width",
3561
+ "value": 524
3562
+ }
3563
+ ]
3564
+ }
3565
+ ]
3566
+ },
3567
+ "gridPos": {
3568
+ "h": 8,
3569
+ "w": 12,
3570
+ "x": 0,
3571
+ "y": 44
3572
+ },
3573
+ "id": 137,
3574
+ "options": {
3575
+ "footer": {
3576
+ "fields": "",
3577
+ "reducer": ["sum"],
3578
+ "show": false
3579
+ },
3580
+ "showHeader": true,
3581
+ "sortBy": []
3582
+ },
3583
+ "pluginVersion": "8.3.3",
3584
+ "targets": [
3585
+ {
3586
+ "alias": "",
3587
+ "bucketAggs": [],
3588
+ "datasource": {
3589
+ "type": "elasticsearch",
3590
+ "uid": "wazuh_datasource_uid"
3591
+ },
3592
+ "metrics": [
3593
+ {
3594
+ "id": "1",
3595
+ "settings": {
3596
+ "size": "500"
3597
+ },
3598
+ "type": "raw_data"
3599
+ }
3600
+ ],
3601
+ "query": "agent_name:$agent_name AND data_inventory_module:bios",
3602
+ "queryType": "lucene",
3603
+ "refId": "A",
3604
+ "timeField": "timestamp"
3605
+ }
3606
+ ],
3607
+ "title": "BIOS INFO",
3608
+ "transformations": [
3609
+ {
3610
+ "id": "organize",
3611
+ "options": {
3612
+ "excludeByName": {
3613
+ "@metadata_beat": true,
3614
+ "@metadata_type": true,
3615
+ "@metadata_version": true,
3616
+ "_id": true,
3617
+ "_index": true,
3618
+ "_type": true,
3619
+ "agent_ephemeral_id": true,
3620
+ "agent_hostname": true,
3621
+ "agent_id": true,
3622
+ "agent_ip": false,
3623
+ "agent_ip_city_name": true,
3624
+ "agent_ip_country_code": true,
3625
+ "agent_ip_geolocation": true,
3626
+ "agent_labels_customer": true,
3627
+ "agent_name": false,
3628
+ "agent_type": true,
3629
+ "agent_version": true,
3630
+ "beats_type": true,
3631
+ "collector_node_id": true,
3632
+ "data_base_indicator_access_type": true,
3633
+ "data_base_indicator_id": false,
3634
+ "data_base_indicator_indicator_city_name": true,
3635
+ "data_base_indicator_indicator_country_code": true,
3636
+ "data_base_indicator_indicator_geolocation": true,
3637
+ "data_inventory_module": true,
3638
+ "data_type": true,
3639
+ "data_win_eventdata_domain": true,
3640
+ "data_win_eventdata_imagePath": true,
3641
+ "data_win_eventdata_sID": true,
3642
+ "data_win_eventdata_serviceName": true,
3643
+ "data_win_eventdata_serviceType": true,
3644
+ "data_win_eventdata_startType": true,
3645
+ "data_win_eventdata_timestamp": true,
3646
+ "data_win_eventdata_user": true,
3647
+ "data_win_system_channel": true,
3648
+ "data_win_system_computer": true,
3649
+ "data_win_system_eventID": true,
3650
+ "data_win_system_eventRecordID": true,
3651
+ "data_win_system_eventSourceName": true,
3652
+ "data_win_system_keywords": true,
3653
+ "data_win_system_level": true,
3654
+ "data_win_system_opcode": true,
3655
+ "data_win_system_processID": true,
3656
+ "data_win_system_providerGuid": true,
3657
+ "data_win_system_providerName": true,
3658
+ "data_win_system_severityValue": true,
3659
+ "data_win_system_systemTime": true,
3660
+ "data_win_system_task": true,
3661
+ "data_win_system_threadID": true,
3662
+ "data_win_system_version": true,
3663
+ "date": true,
3664
+ "decoder_name": true,
3665
+ "ecs_version": true,
3666
+ "gl2_accounted_message_size": true,
3667
+ "gl2_message_id": true,
3668
+ "gl2_processing_error": true,
3669
+ "gl2_remote_ip": true,
3670
+ "gl2_remote_port": true,
3671
+ "gl2_source_collector": true,
3672
+ "gl2_source_input": true,
3673
+ "gl2_source_node": true,
3674
+ "highlight": true,
3675
+ "host_name": true,
3676
+ "id": true,
3677
+ "location": true,
3678
+ "log_file_path": true,
3679
+ "log_offset": true,
3680
+ "manager_name": true,
3681
+ "message": true,
3682
+ "previous_output": true,
3683
+ "rule_description": true,
3684
+ "rule_firedtimes": true,
3685
+ "rule_frequency": true,
3686
+ "rule_gdpr": true,
3687
+ "rule_gpg13": true,
3688
+ "rule_group1": true,
3689
+ "rule_group2": true,
3690
+ "rule_groups": true,
3691
+ "rule_hipaa": true,
3692
+ "rule_id": true,
3693
+ "rule_level": true,
3694
+ "rule_mail": true,
3695
+ "rule_mitre_id": true,
3696
+ "rule_mitre_tactic": true,
3697
+ "rule_mitre_technique": true,
3698
+ "rule_nist_800_53": true,
3699
+ "rule_pci_dss": true,
3700
+ "rule_tsc": true,
3701
+ "sort": true,
3702
+ "source": true,
3703
+ "src_ip": true,
3704
+ "src_ip_city_name": true,
3705
+ "src_ip_country_code": true,
3706
+ "src_ip_geolocation": true,
3707
+ "streams": true,
3708
+ "syslog_tag": true,
3709
+ "syslog_type": true,
3710
+ "timestamp": true,
3711
+ "user_name": true,
3712
+ "win_system_eventID": true,
3713
+ "windows_event_id": true,
3714
+ "windows_event_severity": false
3715
+ },
3716
+ "indexByName": {
3717
+ "_id": 1,
3718
+ "_index": 2,
3719
+ "_type": 3,
3720
+ "agent_id": 4,
3721
+ "agent_ip": 5,
3722
+ "agent_labels_customer": 29,
3723
+ "agent_name": 0,
3724
+ "data_inventory_module": 30,
3725
+ "data_processor_cores": 33,
3726
+ "data_processor_logical_nbr": 34,
3727
+ "data_processor_name": 31,
3728
+ "data_processor_status": 32,
3729
+ "date": 35,
3730
+ "decoder_name": 6,
3731
+ "gl2_accounted_message_size": 7,
3732
+ "gl2_message_id": 8,
3733
+ "gl2_processing_error": 36,
3734
+ "gl2_remote_ip": 9,
3735
+ "gl2_remote_port": 10,
3736
+ "gl2_source_input": 11,
3737
+ "gl2_source_node": 12,
3738
+ "highlight": 13,
3739
+ "id": 14,
3740
+ "location": 15,
3741
+ "manager_name": 16,
3742
+ "message": 17,
3743
+ "rule_description": 18,
3744
+ "rule_firedtimes": 19,
3745
+ "rule_groups": 20,
3746
+ "rule_id": 21,
3747
+ "rule_level": 22,
3748
+ "rule_mail": 23,
3749
+ "sort": 24,
3750
+ "source": 25,
3751
+ "streams": 26,
3752
+ "syslog_type": 27,
3753
+ "timestamp": 28
3754
+ },
3755
+ "renameByName": {
3756
+ "agent_ip": "SRC IP",
3757
+ "agent_name": "AGENT",
3758
+ "data_base_indicator_access_type": "",
3759
+ "data_base_indicator_id": "OTX IoC ID",
3760
+ "data_base_indicator_indicator": "IoC",
3761
+ "data_base_indicator_indicator_country_code": "",
3762
+ "data_base_indicator_type": "IoC TYPE",
3763
+ "data_bios_sn": "BIOS S/N",
3764
+ "data_processor_cores": "CORES",
3765
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
3766
+ "data_processor_name": "PROCESSOR",
3767
+ "data_processor_status": "STATUS",
3768
+ "data_sections": "OTX SECTIONS",
3769
+ "data_type": "",
3770
+ "data_win_system_message": "MESSAGE",
3771
+ "data_win_system_providerGuid": "",
3772
+ "rule_level": "RULE LEVEL",
3773
+ "timestamp": "DATE/TIME",
3774
+ "windows_event_severity": "EVENT LOG SEVERITY"
3775
+ }
3776
+ }
3777
+ }
3778
+ ],
3779
+ "type": "table"
3780
+ },
3781
+ {
3782
+ "datasource": {
3783
+ "type": "elasticsearch",
3784
+ "uid": "wazuh_datasource_uid"
3785
+ },
3786
+ "fieldConfig": {
3787
+ "defaults": {
3788
+ "mappings": [
3789
+ {
3790
+ "options": {
3791
+ "match": "null",
3792
+ "result": {
3793
+ "text": "N/A"
3794
+ }
3795
+ },
3796
+ "type": "special"
3797
+ }
3798
+ ],
3799
+ "thresholds": {
3800
+ "mode": "absolute",
3801
+ "steps": [
3802
+ {
3803
+ "color": "orange"
3804
+ }
3805
+ ]
3806
+ },
3807
+ "unit": "short"
3808
+ },
3809
+ "overrides": []
3810
+ },
3811
+ "gridPos": {
3812
+ "h": 8,
3813
+ "w": 4,
3814
+ "x": 12,
3815
+ "y": 44
3816
+ },
3817
+ "id": 134,
3818
+ "links": [],
3819
+ "options": {
3820
+ "colorMode": "value",
3821
+ "graphMode": "area",
3822
+ "justifyMode": "auto",
3823
+ "orientation": "horizontal",
3824
+ "reduceOptions": {
3825
+ "calcs": ["sum"],
3826
+ "fields": "",
3827
+ "values": false
3828
+ },
3829
+ "text": {},
3830
+ "textMode": "auto"
3831
+ },
3832
+ "pluginVersion": "8.3.3",
3833
+ "targets": [
3834
+ {
3835
+ "bucketAggs": [
3836
+ {
3837
+ "$$hashKey": "object:50",
3838
+ "field": "timestamp",
3839
+ "id": "2",
3840
+ "settings": {
3841
+ "interval": "auto",
3842
+ "min_doc_count": 0,
3843
+ "trimEdges": 0
3844
+ },
3845
+ "type": "date_histogram"
3846
+ }
3847
+ ],
3848
+ "datasource": {
3849
+ "type": "elasticsearch",
3850
+ "uid": "wazuh_datasource_uid"
3851
+ },
3852
+ "metrics": [
3853
+ {
3854
+ "$$hashKey": "object:48",
3855
+ "field": "select field",
3856
+ "id": "1",
3857
+ "type": "count"
3858
+ }
3859
+ ],
3860
+ "query": "agent_name:$agent_name AND data_restart_pending:True",
3861
+ "refId": "A",
3862
+ "timeField": "timestamp"
3863
+ }
3864
+ ],
3865
+ "title": "PENDING RESTARTS",
3866
+ "type": "stat"
3867
+ },
3868
+ {
3869
+ "datasource": {
3870
+ "type": "elasticsearch",
3871
+ "uid": "wazuh_datasource_uid"
3872
+ },
3873
+ "fieldConfig": {
3874
+ "defaults": {
3875
+ "color": {
3876
+ "mode": "thresholds"
3877
+ },
3878
+ "custom": {
3879
+ "align": "auto",
3880
+ "displayMode": "auto"
3881
+ },
3882
+ "decimals": 0,
3883
+ "mappings": [],
3884
+ "thresholds": {
3885
+ "mode": "absolute",
3886
+ "steps": [
3887
+ {
3888
+ "color": "green"
3889
+ },
3890
+ {
3891
+ "color": "red",
3892
+ "value": 80
3893
+ }
3894
+ ]
3895
+ },
3896
+ "unit": "short"
3897
+ },
3898
+ "overrides": [
3899
+ {
3900
+ "matcher": {
3901
+ "id": "byName",
3902
+ "options": "1"
3903
+ },
3904
+ "properties": [
3905
+ {
3906
+ "id": "color",
3907
+ "value": {
3908
+ "fixedColor": "#FF9830",
3909
+ "mode": "fixed"
3910
+ }
3911
+ }
3912
+ ]
3913
+ },
3914
+ {
3915
+ "matcher": {
3916
+ "id": "byName",
3917
+ "options": "Alert"
3918
+ },
3919
+ "properties": [
3920
+ {
3921
+ "id": "color",
3922
+ "value": {
3923
+ "fixedColor": "#F2495C",
3924
+ "mode": "fixed"
3925
+ }
3926
+ }
3927
+ ]
3928
+ },
3929
+ {
3930
+ "matcher": {
3931
+ "id": "byName",
3932
+ "options": "Error"
3933
+ },
3934
+ "properties": [
3935
+ {
3936
+ "id": "color",
3937
+ "value": {
3938
+ "fixedColor": "#F2495C",
3939
+ "mode": "fixed"
3940
+ }
3941
+ }
3942
+ ]
3943
+ },
3944
+ {
3945
+ "matcher": {
3946
+ "id": "byName",
3947
+ "options": "Info"
3948
+ },
3949
+ "properties": [
3950
+ {
3951
+ "id": "color",
3952
+ "value": {
3953
+ "fixedColor": "#73BF69",
3954
+ "mode": "fixed"
3955
+ }
3956
+ }
3957
+ ]
3958
+ },
3959
+ {
3960
+ "matcher": {
3961
+ "id": "byName",
3962
+ "options": "NOTICE"
3963
+ },
3964
+ "properties": [
3965
+ {
3966
+ "id": "color",
3967
+ "value": {
3968
+ "fixedColor": "#5794F2",
3969
+ "mode": "fixed"
3970
+ }
3971
+ }
3972
+ ]
3973
+ },
3974
+ {
3975
+ "matcher": {
3976
+ "id": "byName",
3977
+ "options": "Notice"
3978
+ },
3979
+ "properties": [
3980
+ {
3981
+ "id": "color",
3982
+ "value": {
3983
+ "fixedColor": "#5794F2",
3984
+ "mode": "fixed"
3985
+ }
3986
+ }
3987
+ ]
3988
+ },
3989
+ {
3990
+ "matcher": {
3991
+ "id": "byName",
3992
+ "options": "Result"
3993
+ },
3994
+ "properties": [
3995
+ {
3996
+ "id": "color",
3997
+ "value": {
3998
+ "fixedColor": "#B877D9",
3999
+ "mode": "fixed"
4000
+ }
4001
+ }
4002
+ ]
4003
+ },
4004
+ {
4005
+ "matcher": {
4006
+ "id": "byName",
4007
+ "options": "Warning"
4008
+ },
4009
+ "properties": [
4010
+ {
4011
+ "id": "color",
4012
+ "value": {
4013
+ "fixedColor": "#FF9830",
4014
+ "mode": "fixed"
4015
+ }
4016
+ }
4017
+ ]
4018
+ },
4019
+ {
4020
+ "matcher": {
4021
+ "id": "byName",
4022
+ "options": "INFORMATION"
4023
+ },
4024
+ "properties": [
4025
+ {
4026
+ "id": "color",
4027
+ "value": {
4028
+ "fixedColor": "green",
4029
+ "mode": "fixed"
4030
+ }
4031
+ }
4032
+ ]
4033
+ },
4034
+ {
4035
+ "matcher": {
4036
+ "id": "byName",
4037
+ "options": "WARNING"
4038
+ },
4039
+ "properties": [
4040
+ {
4041
+ "id": "color",
4042
+ "value": {
4043
+ "fixedColor": "orange",
4044
+ "mode": "fixed"
4045
+ }
4046
+ }
4047
+ ]
4048
+ },
4049
+ {
4050
+ "matcher": {
4051
+ "id": "byName",
4052
+ "options": "ERROR"
4053
+ },
4054
+ "properties": [
4055
+ {
4056
+ "id": "color",
4057
+ "value": {
4058
+ "fixedColor": "red",
4059
+ "mode": "fixed"
4060
+ }
4061
+ }
4062
+ ]
4063
+ }
4064
+ ]
4065
+ },
4066
+ "gridPos": {
4067
+ "h": 8,
4068
+ "w": 8,
4069
+ "x": 16,
4070
+ "y": 44
4071
+ },
4072
+ "id": 135,
4073
+ "links": [],
4074
+ "maxDataPoints": 3,
4075
+ "options": {
4076
+ "footer": {
4077
+ "fields": "",
4078
+ "reducer": ["sum"],
4079
+ "show": false
4080
+ },
4081
+ "showHeader": true
4082
+ },
4083
+ "pluginVersion": "8.3.3",
4084
+ "targets": [
4085
+ {
4086
+ "bucketAggs": [
4087
+ {
4088
+ "$$hashKey": "object:73",
4089
+ "fake": true,
4090
+ "field": "agent_name",
4091
+ "id": "3",
4092
+ "settings": {
4093
+ "min_doc_count": 1,
4094
+ "order": "desc",
4095
+ "orderBy": "_count",
4096
+ "size": "0"
4097
+ },
4098
+ "type": "terms"
4099
+ }
4100
+ ],
4101
+ "datasource": {
4102
+ "type": "elasticsearch",
4103
+ "uid": "wazuh_datasource_uid"
4104
+ },
4105
+ "metrics": [
4106
+ {
4107
+ "$$hashKey": "object:71",
4108
+ "field": "select field",
4109
+ "id": "1",
4110
+ "type": "count"
4111
+ }
4112
+ ],
4113
+ "query": "agent_name:$agent_name AND data_restart_pending:True",
4114
+ "refId": "A",
4115
+ "timeField": "timestamp"
4116
+ }
4117
+ ],
4118
+ "title": "RESTARTS PENDING - AGENTS",
4119
+ "type": "table"
4120
+ },
4121
+ {
4122
+ "datasource": {
4123
+ "type": "elasticsearch",
4124
+ "uid": "wazuh_datasource_uid"
4125
+ },
4126
+ "fieldConfig": {
4127
+ "defaults": {
4128
+ "color": {
4129
+ "mode": "thresholds"
4130
+ },
4131
+ "custom": {
4132
+ "align": "auto",
4133
+ "displayMode": "auto"
4134
+ },
4135
+ "mappings": [],
4136
+ "thresholds": {
4137
+ "mode": "absolute",
4138
+ "steps": [
4139
+ {
4140
+ "color": "green"
4141
+ },
4142
+ {
4143
+ "color": "red",
4144
+ "value": 80
4145
+ }
4146
+ ]
4147
+ }
4148
+ },
4149
+ "overrides": [
4150
+ {
4151
+ "matcher": {
4152
+ "id": "byName",
4153
+ "options": "rule_level"
4154
+ },
4155
+ "properties": [
4156
+ {
4157
+ "id": "custom.width",
4158
+ "value": 93
4159
+ }
4160
+ ]
4161
+ },
4162
+ {
4163
+ "matcher": {
4164
+ "id": "byName",
4165
+ "options": "windows_event_id"
4166
+ },
4167
+ "properties": [
4168
+ {
4169
+ "id": "custom.width",
4170
+ "value": 186
4171
+ }
4172
+ ]
4173
+ },
4174
+ {
4175
+ "matcher": {
4176
+ "id": "byName",
4177
+ "options": "DATE/TIME"
4178
+ },
4179
+ "properties": [
4180
+ {
4181
+ "id": "custom.width",
4182
+ "value": 202
4183
+ }
4184
+ ]
4185
+ },
4186
+ {
4187
+ "matcher": {
4188
+ "id": "byName",
4189
+ "options": "AGENT"
4190
+ },
4191
+ "properties": [
4192
+ {
4193
+ "id": "custom.width",
4194
+ "value": 171
4195
+ }
4196
+ ]
4197
+ },
4198
+ {
4199
+ "matcher": {
4200
+ "id": "byName",
4201
+ "options": "SRC IP"
4202
+ },
4203
+ "properties": [
4204
+ {
4205
+ "id": "custom.width",
4206
+ "value": 167
4207
+ }
4208
+ ]
4209
+ },
4210
+ {
4211
+ "matcher": {
4212
+ "id": "byName",
4213
+ "options": "MESSAGE"
4214
+ },
4215
+ "properties": [
4216
+ {
4217
+ "id": "custom.width",
4218
+ "value": 1519
4219
+ }
4220
+ ]
4221
+ },
4222
+ {
4223
+ "matcher": {
4224
+ "id": "byName",
4225
+ "options": "rule_description"
4226
+ },
4227
+ "properties": [
4228
+ {
4229
+ "id": "custom.width",
4230
+ "value": 524
4231
+ }
4232
+ ]
4233
+ },
4234
+ {
4235
+ "matcher": {
4236
+ "id": "byName",
4237
+ "options": "PROCESSOR"
4238
+ },
4239
+ "properties": [
4240
+ {
4241
+ "id": "custom.width",
4242
+ "value": 418
4243
+ }
4244
+ ]
4245
+ },
4246
+ {
4247
+ "matcher": {
4248
+ "id": "byName",
4249
+ "options": "SIZE"
4250
+ },
4251
+ "properties": [
4252
+ {
4253
+ "id": "custom.width",
4254
+ "value": 114
4255
+ }
4256
+ ]
4257
+ },
4258
+ {
4259
+ "matcher": {
4260
+ "id": "byName",
4261
+ "options": "FREE SPACE"
4262
+ },
4263
+ "properties": [
4264
+ {
4265
+ "id": "custom.width",
4266
+ "value": 119
4267
+ }
4268
+ ]
4269
+ },
4270
+ {
4271
+ "matcher": {
4272
+ "id": "byName",
4273
+ "options": "UNIT"
4274
+ },
4275
+ "properties": [
4276
+ {
4277
+ "id": "custom.width",
4278
+ "value": 114
4279
+ }
4280
+ ]
4281
+ }
4282
+ ]
4283
+ },
4284
+ "gridPos": {
4285
+ "h": 8,
4286
+ "w": 24,
4287
+ "x": 0,
4288
+ "y": 52
4289
+ },
4290
+ "id": 144,
4291
+ "options": {
4292
+ "footer": {
4293
+ "fields": "",
4294
+ "reducer": ["sum"],
4295
+ "show": false
4296
+ },
4297
+ "showHeader": true,
4298
+ "sortBy": []
4299
+ },
4300
+ "pluginVersion": "8.3.3",
4301
+ "targets": [
4302
+ {
4303
+ "alias": "",
4304
+ "bucketAggs": [],
4305
+ "datasource": {
4306
+ "type": "elasticsearch",
4307
+ "uid": "wazuh_datasource_uid"
4308
+ },
4309
+ "metrics": [
4310
+ {
4311
+ "id": "1",
4312
+ "settings": {
4313
+ "size": "500"
4314
+ },
4315
+ "type": "raw_data"
4316
+ }
4317
+ ],
4318
+ "query": "agent_name:$agent_name AND data_inventory_module:drives",
4319
+ "queryType": "lucene",
4320
+ "refId": "A",
4321
+ "timeField": "timestamp"
4322
+ }
4323
+ ],
4324
+ "title": "SYSTEM DRIVES",
4325
+ "transformations": [
4326
+ {
4327
+ "id": "organize",
4328
+ "options": {
4329
+ "excludeByName": {
4330
+ "@metadata_beat": true,
4331
+ "@metadata_type": true,
4332
+ "@metadata_version": true,
4333
+ "_id": true,
4334
+ "_index": true,
4335
+ "_type": true,
4336
+ "agent_ephemeral_id": true,
4337
+ "agent_hostname": true,
4338
+ "agent_id": true,
4339
+ "agent_ip": false,
4340
+ "agent_ip_city_name": true,
4341
+ "agent_ip_country_code": true,
4342
+ "agent_ip_geolocation": true,
4343
+ "agent_labels_customer": true,
4344
+ "agent_name": false,
4345
+ "agent_type": true,
4346
+ "agent_version": true,
4347
+ "beats_type": true,
4348
+ "collector_node_id": true,
4349
+ "data_base_indicator_access_type": true,
4350
+ "data_base_indicator_id": false,
4351
+ "data_base_indicator_indicator_city_name": true,
4352
+ "data_base_indicator_indicator_country_code": true,
4353
+ "data_base_indicator_indicator_geolocation": true,
4354
+ "data_inventory_module": true,
4355
+ "data_type": true,
4356
+ "data_win_eventdata_domain": true,
4357
+ "data_win_eventdata_imagePath": true,
4358
+ "data_win_eventdata_sID": true,
4359
+ "data_win_eventdata_serviceName": true,
4360
+ "data_win_eventdata_serviceType": true,
4361
+ "data_win_eventdata_startType": true,
4362
+ "data_win_eventdata_timestamp": true,
4363
+ "data_win_eventdata_user": true,
4364
+ "data_win_system_channel": true,
4365
+ "data_win_system_computer": true,
4366
+ "data_win_system_eventID": true,
4367
+ "data_win_system_eventRecordID": true,
4368
+ "data_win_system_eventSourceName": true,
4369
+ "data_win_system_keywords": true,
4370
+ "data_win_system_level": true,
4371
+ "data_win_system_opcode": true,
4372
+ "data_win_system_processID": true,
4373
+ "data_win_system_providerGuid": true,
4374
+ "data_win_system_providerName": true,
4375
+ "data_win_system_severityValue": true,
4376
+ "data_win_system_systemTime": true,
4377
+ "data_win_system_task": true,
4378
+ "data_win_system_threadID": true,
4379
+ "data_win_system_version": true,
4380
+ "date": true,
4381
+ "decoder_name": true,
4382
+ "ecs_version": true,
4383
+ "gl2_accounted_message_size": true,
4384
+ "gl2_message_id": true,
4385
+ "gl2_processing_error": true,
4386
+ "gl2_remote_ip": true,
4387
+ "gl2_remote_port": true,
4388
+ "gl2_source_collector": true,
4389
+ "gl2_source_input": true,
4390
+ "gl2_source_node": true,
4391
+ "highlight": true,
4392
+ "host_name": true,
4393
+ "id": true,
4394
+ "location": true,
4395
+ "log_file_path": true,
4396
+ "log_offset": true,
4397
+ "manager_name": true,
4398
+ "message": true,
4399
+ "previous_output": true,
4400
+ "rule_description": true,
4401
+ "rule_firedtimes": true,
4402
+ "rule_frequency": true,
4403
+ "rule_gdpr": true,
4404
+ "rule_gpg13": true,
4405
+ "rule_group1": true,
4406
+ "rule_group2": true,
4407
+ "rule_groups": true,
4408
+ "rule_hipaa": true,
4409
+ "rule_id": true,
4410
+ "rule_level": true,
4411
+ "rule_mail": true,
4412
+ "rule_mitre_id": true,
4413
+ "rule_mitre_tactic": true,
4414
+ "rule_mitre_technique": true,
4415
+ "rule_nist_800_53": true,
4416
+ "rule_pci_dss": true,
4417
+ "rule_tsc": true,
4418
+ "sort": true,
4419
+ "source": true,
4420
+ "src_ip": true,
4421
+ "src_ip_city_name": true,
4422
+ "src_ip_country_code": true,
4423
+ "src_ip_geolocation": true,
4424
+ "streams": true,
4425
+ "syslog_level": true,
4426
+ "syslog_tag": true,
4427
+ "syslog_type": true,
4428
+ "timestamp": false,
4429
+ "true": true,
4430
+ "user_name": true,
4431
+ "win_system_eventID": true,
4432
+ "windows_event_id": true,
4433
+ "windows_event_severity": false
4434
+ },
4435
+ "indexByName": {
4436
+ "_id": 2,
4437
+ "_index": 3,
4438
+ "_type": 4,
4439
+ "agent_id": 5,
4440
+ "agent_ip": 6,
4441
+ "agent_labels_customer": 29,
4442
+ "agent_name": 1,
4443
+ "data_drive_caption": 33,
4444
+ "data_drive_description": 34,
4445
+ "data_drive_filesystem": 37,
4446
+ "data_drive_free_space": 38,
4447
+ "data_drive_size": 36,
4448
+ "data_drive_type": 35,
4449
+ "data_drive_volume_name": 39,
4450
+ "data_inventory_module": 30,
4451
+ "date": 31,
4452
+ "decoder_name": 7,
4453
+ "gl2_accounted_message_size": 8,
4454
+ "gl2_message_id": 9,
4455
+ "gl2_processing_error": 32,
4456
+ "gl2_remote_ip": 10,
4457
+ "gl2_remote_port": 11,
4458
+ "gl2_source_input": 12,
4459
+ "gl2_source_node": 13,
4460
+ "highlight": 14,
4461
+ "id": 15,
4462
+ "location": 16,
4463
+ "manager_name": 17,
4464
+ "message": 18,
4465
+ "rule_description": 19,
4466
+ "rule_firedtimes": 20,
4467
+ "rule_groups": 21,
4468
+ "rule_id": 22,
4469
+ "rule_level": 23,
4470
+ "rule_mail": 24,
4471
+ "sort": 25,
4472
+ "source": 26,
4473
+ "streams": 27,
4474
+ "syslog_type": 28,
4475
+ "timestamp": 0
4476
+ },
4477
+ "renameByName": {
4478
+ "agent_ip": "SRC IP",
4479
+ "agent_name": "AGENT",
4480
+ "data_base_indicator_access_type": "",
4481
+ "data_base_indicator_id": "OTX IoC ID",
4482
+ "data_base_indicator_indicator": "IoC",
4483
+ "data_base_indicator_indicator_country_code": "",
4484
+ "data_base_indicator_type": "IoC TYPE",
4485
+ "data_drive_caption": "UNIT",
4486
+ "data_drive_description": "DESCRIPTION",
4487
+ "data_drive_filesystem": "FILESYSTEM",
4488
+ "data_drive_free_space": "FREE SPACE",
4489
+ "data_drive_size": "SIZE",
4490
+ "data_drive_type": "TYPE",
4491
+ "data_drive_volume_name": "VOLUME NAME",
4492
+ "data_processor_cores": "CORES",
4493
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
4494
+ "data_processor_name": "PROCESSOR",
4495
+ "data_processor_status": "STATUS",
4496
+ "data_sections": "OTX SECTIONS",
4497
+ "data_type": "",
4498
+ "data_win_system_message": "MESSAGE",
4499
+ "data_win_system_providerGuid": "",
4500
+ "rule_level": "RULE LEVEL",
4501
+ "timestamp": "DATE/TIME",
4502
+ "windows_event_severity": "EVENT LOG SEVERITY"
4503
+ }
4504
+ }
4505
+ }
4506
+ ],
4507
+ "type": "table"
4508
+ },
4509
+ {
4510
+ "datasource": {
4511
+ "type": "elasticsearch",
4512
+ "uid": "wazuh_datasource_uid"
4513
+ },
4514
+ "fieldConfig": {
4515
+ "defaults": {
4516
+ "color": {
4517
+ "mode": "thresholds"
4518
+ },
4519
+ "custom": {
4520
+ "align": "auto",
4521
+ "displayMode": "auto"
4522
+ },
4523
+ "mappings": [
4524
+ {
4525
+ "options": {
4526
+ "Locked": {
4527
+ "color": "green",
4528
+ "index": 1
4529
+ },
4530
+ "Unlocked": {
4531
+ "color": "red",
4532
+ "index": 0
4533
+ }
4534
+ },
4535
+ "type": "value"
4536
+ }
4537
+ ],
4538
+ "thresholds": {
4539
+ "mode": "absolute",
4540
+ "steps": [
4541
+ {
4542
+ "color": "green"
4543
+ },
4544
+ {
4545
+ "color": "red",
4546
+ "value": 80
4547
+ }
4548
+ ]
4549
+ }
4550
+ },
4551
+ "overrides": [
4552
+ {
4553
+ "matcher": {
4554
+ "id": "byName",
4555
+ "options": "rule_level"
4556
+ },
4557
+ "properties": [
4558
+ {
4559
+ "id": "custom.width",
4560
+ "value": 93
4561
+ }
4562
+ ]
4563
+ },
4564
+ {
4565
+ "matcher": {
4566
+ "id": "byName",
4567
+ "options": "windows_event_id"
4568
+ },
4569
+ "properties": [
4570
+ {
4571
+ "id": "custom.width",
4572
+ "value": 186
4573
+ }
4574
+ ]
4575
+ },
4576
+ {
4577
+ "matcher": {
4578
+ "id": "byName",
4579
+ "options": "DATE/TIME"
4580
+ },
4581
+ "properties": [
4582
+ {
4583
+ "id": "custom.width",
4584
+ "value": 202
4585
+ }
4586
+ ]
4587
+ },
4588
+ {
4589
+ "matcher": {
4590
+ "id": "byName",
4591
+ "options": "AGENT"
4592
+ },
4593
+ "properties": [
4594
+ {
4595
+ "id": "custom.width",
4596
+ "value": 171
4597
+ }
4598
+ ]
4599
+ },
4600
+ {
4601
+ "matcher": {
4602
+ "id": "byName",
4603
+ "options": "SRC IP"
4604
+ },
4605
+ "properties": [
4606
+ {
4607
+ "id": "custom.width",
4608
+ "value": 167
4609
+ }
4610
+ ]
4611
+ },
4612
+ {
4613
+ "matcher": {
4614
+ "id": "byName",
4615
+ "options": "MESSAGE"
4616
+ },
4617
+ "properties": [
4618
+ {
4619
+ "id": "custom.width",
4620
+ "value": 1519
4621
+ }
4622
+ ]
4623
+ },
4624
+ {
4625
+ "matcher": {
4626
+ "id": "byName",
4627
+ "options": "PROCESSOR"
4628
+ },
4629
+ "properties": [
4630
+ {
4631
+ "id": "custom.width",
4632
+ "value": 418
4633
+ }
4634
+ ]
4635
+ },
4636
+ {
4637
+ "matcher": {
4638
+ "id": "byName",
4639
+ "options": "FREE SPACE"
4640
+ },
4641
+ "properties": [
4642
+ {
4643
+ "id": "custom.width",
4644
+ "value": 119
4645
+ }
4646
+ ]
4647
+ },
4648
+ {
4649
+ "matcher": {
4650
+ "id": "byName",
4651
+ "options": "UNIT"
4652
+ },
4653
+ "properties": [
4654
+ {
4655
+ "id": "custom.width",
4656
+ "value": 114
4657
+ }
4658
+ ]
4659
+ },
4660
+ {
4661
+ "matcher": {
4662
+ "id": "byName",
4663
+ "options": "LOCK STATUS"
4664
+ },
4665
+ "properties": [
4666
+ {
4667
+ "id": "custom.displayMode",
4668
+ "value": "color-text"
4669
+ }
4670
+ ]
4671
+ }
4672
+ ]
4673
+ },
4674
+ "gridPos": {
4675
+ "h": 8,
4676
+ "w": 24,
4677
+ "x": 0,
4678
+ "y": 60
4679
+ },
4680
+ "id": 146,
4681
+ "options": {
4682
+ "footer": {
4683
+ "fields": "",
4684
+ "reducer": ["sum"],
4685
+ "show": false
4686
+ },
4687
+ "showHeader": true,
4688
+ "sortBy": []
4689
+ },
4690
+ "pluginVersion": "8.3.3",
4691
+ "targets": [
4692
+ {
4693
+ "alias": "",
4694
+ "bucketAggs": [],
4695
+ "datasource": {
4696
+ "type": "elasticsearch",
4697
+ "uid": "wazuh_datasource_uid"
4698
+ },
4699
+ "metrics": [
4700
+ {
4701
+ "id": "1",
4702
+ "settings": {
4703
+ "size": "500"
4704
+ },
4705
+ "type": "raw_data"
4706
+ }
4707
+ ],
4708
+ "query": "agent_name:$agent_name AND data_inventory_module:bitlocker",
4709
+ "queryType": "lucene",
4710
+ "refId": "A",
4711
+ "timeField": "timestamp"
4712
+ }
4713
+ ],
4714
+ "title": "BITLOCKER",
4715
+ "transformations": [
4716
+ {
4717
+ "id": "organize",
4718
+ "options": {
4719
+ "excludeByName": {
4720
+ "@metadata_beat": true,
4721
+ "@metadata_type": true,
4722
+ "@metadata_version": true,
4723
+ "_id": true,
4724
+ "_index": true,
4725
+ "_type": true,
4726
+ "agent_ephemeral_id": true,
4727
+ "agent_hostname": true,
4728
+ "agent_id": true,
4729
+ "agent_ip": false,
4730
+ "agent_ip_city_name": true,
4731
+ "agent_ip_country_code": true,
4732
+ "agent_ip_geolocation": true,
4733
+ "agent_labels_customer": true,
4734
+ "agent_name": false,
4735
+ "agent_type": true,
4736
+ "agent_version": true,
4737
+ "beats_type": true,
4738
+ "collector_node_id": true,
4739
+ "data_base_indicator_access_type": true,
4740
+ "data_base_indicator_id": false,
4741
+ "data_base_indicator_indicator_city_name": true,
4742
+ "data_base_indicator_indicator_country_code": true,
4743
+ "data_base_indicator_indicator_geolocation": true,
4744
+ "data_inventory_module": true,
4745
+ "data_type": true,
4746
+ "data_win_eventdata_domain": true,
4747
+ "data_win_eventdata_imagePath": true,
4748
+ "data_win_eventdata_sID": true,
4749
+ "data_win_eventdata_serviceName": true,
4750
+ "data_win_eventdata_serviceType": true,
4751
+ "data_win_eventdata_startType": true,
4752
+ "data_win_eventdata_timestamp": true,
4753
+ "data_win_eventdata_user": true,
4754
+ "data_win_system_channel": true,
4755
+ "data_win_system_computer": true,
4756
+ "data_win_system_eventID": true,
4757
+ "data_win_system_eventRecordID": true,
4758
+ "data_win_system_eventSourceName": true,
4759
+ "data_win_system_keywords": true,
4760
+ "data_win_system_level": true,
4761
+ "data_win_system_opcode": true,
4762
+ "data_win_system_processID": true,
4763
+ "data_win_system_providerGuid": true,
4764
+ "data_win_system_providerName": true,
4765
+ "data_win_system_severityValue": true,
4766
+ "data_win_system_systemTime": true,
4767
+ "data_win_system_task": true,
4768
+ "data_win_system_threadID": true,
4769
+ "data_win_system_version": true,
4770
+ "date": true,
4771
+ "decoder_name": true,
4772
+ "ecs_version": true,
4773
+ "gl2_accounted_message_size": true,
4774
+ "gl2_message_id": true,
4775
+ "gl2_processing_error": true,
4776
+ "gl2_remote_ip": true,
4777
+ "gl2_remote_port": true,
4778
+ "gl2_source_collector": true,
4779
+ "gl2_source_input": true,
4780
+ "gl2_source_node": true,
4781
+ "highlight": true,
4782
+ "host_name": true,
4783
+ "id": true,
4784
+ "location": true,
4785
+ "log_file_path": true,
4786
+ "log_offset": true,
4787
+ "manager_name": true,
4788
+ "message": true,
4789
+ "previous_output": true,
4790
+ "rule_description": true,
4791
+ "rule_firedtimes": true,
4792
+ "rule_frequency": true,
4793
+ "rule_gdpr": true,
4794
+ "rule_gpg13": true,
4795
+ "rule_group1": true,
4796
+ "rule_group2": true,
4797
+ "rule_groups": true,
4798
+ "rule_hipaa": true,
4799
+ "rule_id": true,
4800
+ "rule_level": true,
4801
+ "rule_mail": true,
4802
+ "rule_mitre_id": true,
4803
+ "rule_mitre_tactic": true,
4804
+ "rule_mitre_technique": true,
4805
+ "rule_nist_800_53": true,
4806
+ "rule_pci_dss": true,
4807
+ "rule_tsc": true,
4808
+ "sort": true,
4809
+ "source": true,
4810
+ "src_ip": true,
4811
+ "src_ip_city_name": true,
4812
+ "src_ip_country_code": true,
4813
+ "src_ip_geolocation": true,
4814
+ "streams": true,
4815
+ "syslog_level": true,
4816
+ "syslog_tag": true,
4817
+ "syslog_type": true,
4818
+ "timestamp": false,
4819
+ "true": true,
4820
+ "user_name": true,
4821
+ "win_system_eventID": true,
4822
+ "windows_event_id": true,
4823
+ "windows_event_severity": false
4824
+ },
4825
+ "indexByName": {
4826
+ "_id": 2,
4827
+ "_index": 3,
4828
+ "_type": 4,
4829
+ "agent_id": 5,
4830
+ "agent_ip": 6,
4831
+ "agent_labels_customer": 34,
4832
+ "agent_name": 1,
4833
+ "data_encryption_method": 37,
4834
+ "data_encryption_percentage": 38,
4835
+ "data_inventory_module": 35,
4836
+ "data_lock_status": 9,
4837
+ "data_mount_point": 7,
4838
+ "data_protection_status": 11,
4839
+ "data_volume_status": 10,
4840
+ "data_volume_type": 8,
4841
+ "decoder_name": 12,
4842
+ "gl2_accounted_message_size": 13,
4843
+ "gl2_message_id": 14,
4844
+ "gl2_processing_error": 36,
4845
+ "gl2_remote_ip": 15,
4846
+ "gl2_remote_port": 16,
4847
+ "gl2_source_input": 17,
4848
+ "gl2_source_node": 18,
4849
+ "highlight": 19,
4850
+ "id": 20,
4851
+ "location": 21,
4852
+ "manager_name": 22,
4853
+ "message": 23,
4854
+ "rule_description": 24,
4855
+ "rule_firedtimes": 25,
4856
+ "rule_group1": 39,
4857
+ "rule_group2": 40,
4858
+ "rule_groups": 26,
4859
+ "rule_id": 27,
4860
+ "rule_level": 28,
4861
+ "rule_mail": 29,
4862
+ "sort": 30,
4863
+ "source": 31,
4864
+ "streams": 32,
4865
+ "syslog_type": 33,
4866
+ "timestamp": 0
4867
+ },
4868
+ "renameByName": {
4869
+ "agent_ip": "SRC IP",
4870
+ "agent_name": "AGENT",
4871
+ "data_base_indicator_access_type": "",
4872
+ "data_base_indicator_id": "OTX IoC ID",
4873
+ "data_base_indicator_indicator": "IoC",
4874
+ "data_base_indicator_indicator_country_code": "",
4875
+ "data_base_indicator_type": "IoC TYPE",
4876
+ "data_drive_caption": "UNIT",
4877
+ "data_drive_description": "DESCRIPTION",
4878
+ "data_drive_filesystem": "FILESYSTEM",
4879
+ "data_drive_free_space": "FREE SPACE",
4880
+ "data_drive_size": "SIZE",
4881
+ "data_drive_type": "TYPE",
4882
+ "data_drive_volume_name": "VOLUME NAME",
4883
+ "data_encryption_method": "ENCRYPTION METHOD",
4884
+ "data_encryption_percentage": "ENCRYPTION PERCENTAGE",
4885
+ "data_lock_status": "LOCK STATUS",
4886
+ "data_mount_point": "MOUNT POINT",
4887
+ "data_processor_cores": "CORES",
4888
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
4889
+ "data_processor_name": "PROCESSOR",
4890
+ "data_processor_status": "STATUS",
4891
+ "data_protection_status": "PROTECTION STATUS",
4892
+ "data_sections": "OTX SECTIONS",
4893
+ "data_type": "",
4894
+ "data_volume_status": "VOLUME STATUS",
4895
+ "data_volume_type": "VOLUME TYPE",
4896
+ "data_win_system_message": "MESSAGE",
4897
+ "data_win_system_providerGuid": "",
4898
+ "rule_level": "RULE LEVEL",
4899
+ "timestamp": "DATE/TIME",
4900
+ "windows_event_severity": "EVENT LOG SEVERITY"
4901
+ }
4902
+ }
4903
+ }
4904
+ ],
4905
+ "type": "table"
4906
+ },
4907
+ {
4908
+ "datasource": {
4909
+ "type": "elasticsearch",
4910
+ "uid": "wazuh_datasource_uid"
4911
+ },
4912
+ "fieldConfig": {
4913
+ "defaults": {
4914
+ "color": {
4915
+ "mode": "thresholds"
4916
+ },
4917
+ "custom": {
4918
+ "align": "auto",
4919
+ "displayMode": "auto"
4920
+ },
4921
+ "mappings": [],
4922
+ "thresholds": {
4923
+ "mode": "absolute",
4924
+ "steps": [
4925
+ {
4926
+ "color": "green"
4927
+ },
4928
+ {
4929
+ "color": "red",
4930
+ "value": 80
4931
+ }
4932
+ ]
4933
+ }
4934
+ },
4935
+ "overrides": [
4936
+ {
4937
+ "matcher": {
4938
+ "id": "byName",
4939
+ "options": "rule_level"
4940
+ },
4941
+ "properties": [
4942
+ {
4943
+ "id": "custom.width",
4944
+ "value": 93
4945
+ }
4946
+ ]
4947
+ },
4948
+ {
4949
+ "matcher": {
4950
+ "id": "byName",
4951
+ "options": "windows_event_id"
4952
+ },
4953
+ "properties": [
4954
+ {
4955
+ "id": "custom.width",
4956
+ "value": 186
4957
+ }
4958
+ ]
4959
+ },
4960
+ {
4961
+ "matcher": {
4962
+ "id": "byName",
4963
+ "options": "DATE/TIME"
4964
+ },
4965
+ "properties": [
4966
+ {
4967
+ "id": "custom.width",
4968
+ "value": 202
4969
+ }
4970
+ ]
4971
+ },
4972
+ {
4973
+ "matcher": {
4974
+ "id": "byName",
4975
+ "options": "AGENT"
4976
+ },
4977
+ "properties": [
4978
+ {
4979
+ "id": "custom.width",
4980
+ "value": 171
4981
+ }
4982
+ ]
4983
+ },
4984
+ {
4985
+ "matcher": {
4986
+ "id": "byName",
4987
+ "options": "SRC IP"
4988
+ },
4989
+ "properties": [
4990
+ {
4991
+ "id": "custom.width",
4992
+ "value": 167
4993
+ }
4994
+ ]
4995
+ },
4996
+ {
4997
+ "matcher": {
4998
+ "id": "byName",
4999
+ "options": "MESSAGE"
This file is too large to show in full.
backend/app/connectors/grafana/dashboards/Wazuh/edr_av_malware_ioc.json
new
+6992
@@ -0,0 +1,6992 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "collapsed": true,
44
+ "gridPos": {
45
+ "h": 1,
46
+ "w": 24,
47
+ "x": 0,
48
+ "y": 0
49
+ },
50
+ "id": 138,
51
+ "panels": [
52
+ {
53
+ "datasource": {
54
+ "type": "elasticsearch",
55
+ "uid": "wazuh_datasource_uid"
56
+ },
57
+ "fieldConfig": {
58
+ "defaults": {
59
+ "mappings": [
60
+ {
61
+ "options": {
62
+ "match": "null",
63
+ "result": {
64
+ "text": "N/A"
65
+ }
66
+ },
67
+ "type": "special"
68
+ }
69
+ ],
70
+ "thresholds": {
71
+ "mode": "absolute",
72
+ "steps": [
73
+ {
74
+ "color": "orange",
75
+ "value": null
76
+ }
77
+ ]
78
+ },
79
+ "unit": "short"
80
+ },
81
+ "overrides": []
82
+ },
83
+ "gridPos": {
84
+ "h": 7,
85
+ "w": 4,
86
+ "x": 0,
87
+ "y": 1
88
+ },
89
+ "id": 134,
90
+ "links": [],
91
+ "options": {
92
+ "colorMode": "value",
93
+ "graphMode": "area",
94
+ "justifyMode": "auto",
95
+ "orientation": "horizontal",
96
+ "reduceOptions": {
97
+ "calcs": ["sum"],
98
+ "fields": "",
99
+ "values": false
100
+ },
101
+ "text": {},
102
+ "textMode": "auto"
103
+ },
104
+ "pluginVersion": "10.0.2",
105
+ "targets": [
106
+ {
107
+ "bucketAggs": [
108
+ {
109
+ "$$hashKey": "object:50",
110
+ "field": "timestamp",
111
+ "id": "2",
112
+ "settings": {
113
+ "interval": "auto",
114
+ "min_doc_count": 0,
115
+ "trimEdges": 0
116
+ },
117
+ "type": "date_histogram"
118
+ }
119
+ ],
120
+ "datasource": {
121
+ "type": "elasticsearch",
122
+ "uid": "wazuh_datasource_uid"
123
+ },
124
+ "metrics": [
125
+ {
126
+ "$$hashKey": "object:48",
127
+ "field": "select field",
128
+ "id": "1",
129
+ "type": "count"
130
+ }
131
+ ],
132
+ "query": "_exists_:threat_intel_type",
133
+ "refId": "A",
134
+ "timeField": "timestamp"
135
+ }
136
+ ],
137
+ "title": "THREAT INTEL - ALERTS",
138
+ "type": "stat"
139
+ },
140
+ {
141
+ "datasource": {
142
+ "type": "elasticsearch",
143
+ "uid": "wazuh_datasource_uid"
144
+ },
145
+ "fieldConfig": {
146
+ "defaults": {
147
+ "custom": {
148
+ "align": "auto",
149
+ "cellOptions": {
150
+ "type": "auto"
151
+ },
152
+ "filterable": false,
153
+ "inspect": false
154
+ },
155
+ "mappings": [],
156
+ "thresholds": {
157
+ "mode": "absolute",
158
+ "steps": [
159
+ {
160
+ "color": "green",
161
+ "value": null
162
+ },
163
+ {
164
+ "color": "red",
165
+ "value": 80
166
+ }
167
+ ]
168
+ }
169
+ },
170
+ "overrides": [
171
+ {
172
+ "matcher": {
173
+ "id": "byName",
174
+ "options": "agent_name"
175
+ },
176
+ "properties": [
177
+ {
178
+ "id": "custom.width",
179
+ "value": 224
180
+ }
181
+ ]
182
+ }
183
+ ]
184
+ },
185
+ "gridPos": {
186
+ "h": 7,
187
+ "w": 5,
188
+ "x": 4,
189
+ "y": 1
190
+ },
191
+ "id": 130,
192
+ "links": [],
193
+ "maxDataPoints": 3,
194
+ "options": {
195
+ "cellHeight": "sm",
196
+ "footer": {
197
+ "countRows": false,
198
+ "fields": "",
199
+ "reducer": ["sum"],
200
+ "show": false
201
+ },
202
+ "showHeader": true,
203
+ "sortBy": []
204
+ },
205
+ "pluginVersion": "10.0.2",
206
+ "targets": [
207
+ {
208
+ "bucketAggs": [
209
+ {
210
+ "$$hashKey": "object:73",
211
+ "fake": true,
212
+ "field": "agent_name",
213
+ "id": "3",
214
+ "settings": {
215
+ "min_doc_count": 1,
216
+ "order": "desc",
217
+ "orderBy": "_count",
218
+ "size": "0"
219
+ },
220
+ "type": "terms"
221
+ }
222
+ ],
223
+ "datasource": {
224
+ "type": "elasticsearch",
225
+ "uid": "wazuh_datasource_uid"
226
+ },
227
+ "metrics": [
228
+ {
229
+ "$$hashKey": "object:71",
230
+ "field": "select field",
231
+ "id": "1",
232
+ "type": "count"
233
+ }
234
+ ],
235
+ "query": "_exists_:threat_intel_type",
236
+ "refId": "A",
237
+ "timeField": "timestamp"
238
+ }
239
+ ],
240
+ "title": "IoC - ALERTS BY AGENT",
241
+ "type": "table"
242
+ },
243
+ {
244
+ "datasource": {
245
+ "type": "elasticsearch",
246
+ "uid": "wazuh_datasource_uid"
247
+ },
248
+ "fieldConfig": {
249
+ "defaults": {
250
+ "custom": {
251
+ "align": "auto",
252
+ "cellOptions": {
253
+ "type": "auto"
254
+ },
255
+ "filterable": false,
256
+ "inspect": false
257
+ },
258
+ "mappings": [],
259
+ "thresholds": {
260
+ "mode": "absolute",
261
+ "steps": [
262
+ {
263
+ "color": "orange",
264
+ "value": null
265
+ }
266
+ ]
267
+ }
268
+ },
269
+ "overrides": [
270
+ {
271
+ "matcher": {
272
+ "id": "byName",
273
+ "options": "Count"
274
+ },
275
+ "properties": [
276
+ {
277
+ "id": "custom.cellOptions",
278
+ "value": {
279
+ "mode": "basic",
280
+ "type": "gauge"
281
+ }
282
+ }
283
+ ]
284
+ },
285
+ {
286
+ "matcher": {
287
+ "id": "byName",
288
+ "options": "rule_description"
289
+ },
290
+ "properties": [
291
+ {
292
+ "id": "custom.width",
293
+ "value": 703
294
+ }
295
+ ]
296
+ },
297
+ {
298
+ "matcher": {
299
+ "id": "byName",
300
+ "options": "rule_level"
301
+ },
302
+ "properties": [
303
+ {
304
+ "id": "custom.width",
305
+ "value": 212
306
+ },
307
+ {
308
+ "id": "mappings",
309
+ "value": [
310
+ {
311
+ "options": {
312
+ "from": 1,
313
+ "result": {
314
+ "color": "green",
315
+ "index": 0
316
+ },
317
+ "to": 3
318
+ },
319
+ "type": "range"
320
+ },
321
+ {
322
+ "options": {
323
+ "from": 4,
324
+ "result": {
325
+ "color": "dark-yellow",
326
+ "index": 1
327
+ },
328
+ "to": 6
329
+ },
330
+ "type": "range"
331
+ },
332
+ {
333
+ "options": {
334
+ "from": 7,
335
+ "result": {
336
+ "color": "orange",
337
+ "index": 2
338
+ },
339
+ "to": 9
340
+ },
341
+ "type": "range"
342
+ },
343
+ {
344
+ "options": {
345
+ "from": 10,
346
+ "result": {
347
+ "color": "semi-dark-red",
348
+ "index": 3
349
+ },
350
+ "to": 15
351
+ },
352
+ "type": "range"
353
+ }
354
+ ]
355
+ }
356
+ ]
357
+ }
358
+ ]
359
+ },
360
+ "gridPos": {
361
+ "h": 7,
362
+ "w": 10,
363
+ "x": 9,
364
+ "y": 1
365
+ },
366
+ "id": 131,
367
+ "links": [],
368
+ "maxDataPoints": 3,
369
+ "options": {
370
+ "cellHeight": "sm",
371
+ "footer": {
372
+ "countRows": false,
373
+ "fields": "",
374
+ "reducer": ["sum"],
375
+ "show": false
376
+ },
377
+ "showHeader": true,
378
+ "sortBy": []
379
+ },
380
+ "pluginVersion": "10.0.2",
381
+ "targets": [
382
+ {
383
+ "bucketAggs": [
384
+ {
385
+ "$$hashKey": "object:3082",
386
+ "fake": true,
387
+ "field": "threat_intel_type",
388
+ "id": "4",
389
+ "settings": {
390
+ "min_doc_count": "1",
391
+ "order": "desc",
392
+ "orderBy": "_count",
393
+ "size": "10"
394
+ },
395
+ "type": "terms"
396
+ }
397
+ ],
398
+ "datasource": {
399
+ "type": "elasticsearch",
400
+ "uid": "wazuh_datasource_uid"
401
+ },
402
+ "metrics": [
403
+ {
404
+ "$$hashKey": "object:71",
405
+ "field": "select field",
406
+ "id": "1",
407
+ "type": "count"
408
+ }
409
+ ],
410
+ "query": "_exists_:threat_intel_type",
411
+ "refId": "A",
412
+ "timeField": "timestamp"
413
+ }
414
+ ],
415
+ "title": "MISP IoC - EVENTS BY TYPE",
416
+ "transformations": [
417
+ {
418
+ "id": "organize",
419
+ "options": {
420
+ "excludeByName": {},
421
+ "indexByName": {},
422
+ "renameByName": {
423
+ "threat_intel_type": "IoC TYPE"
424
+ }
425
+ }
426
+ }
427
+ ],
428
+ "type": "table"
429
+ },
430
+ {
431
+ "datasource": {
432
+ "type": "elasticsearch",
433
+ "uid": "wazuh_datasource_uid"
434
+ },
435
+ "fieldConfig": {
436
+ "defaults": {
437
+ "color": {
438
+ "mode": "thresholds"
439
+ },
440
+ "custom": {
441
+ "align": "auto",
442
+ "cellOptions": {
443
+ "type": "auto"
444
+ },
445
+ "inspect": false
446
+ },
447
+ "mappings": [],
448
+ "thresholds": {
449
+ "mode": "absolute",
450
+ "steps": [
451
+ {
452
+ "color": "red",
453
+ "value": null
454
+ }
455
+ ]
456
+ }
457
+ },
458
+ "overrides": [
459
+ {
460
+ "matcher": {
461
+ "id": "byName",
462
+ "options": "rule_level"
463
+ },
464
+ "properties": [
465
+ {
466
+ "id": "custom.width",
467
+ "value": 93
468
+ }
469
+ ]
470
+ },
471
+ {
472
+ "matcher": {
473
+ "id": "byName",
474
+ "options": "DATE/TIME"
475
+ },
476
+ "properties": [
477
+ {
478
+ "id": "custom.width",
479
+ "value": 202
480
+ }
481
+ ]
482
+ },
483
+ {
484
+ "matcher": {
485
+ "id": "byName",
486
+ "options": "AGENT"
487
+ },
488
+ "properties": [
489
+ {
490
+ "id": "custom.width",
491
+ "value": 171
492
+ }
493
+ ]
494
+ },
495
+ {
496
+ "matcher": {
497
+ "id": "byName",
498
+ "options": "SRC IP"
499
+ },
500
+ "properties": [
501
+ {
502
+ "id": "custom.width",
503
+ "value": 150
504
+ }
505
+ ]
506
+ },
507
+ {
508
+ "matcher": {
509
+ "id": "byName",
510
+ "options": "rule_description"
511
+ },
512
+ "properties": [
513
+ {
514
+ "id": "custom.width",
515
+ "value": 524
516
+ }
517
+ ]
518
+ },
519
+ {
520
+ "matcher": {
521
+ "id": "byName",
522
+ "options": "RULE LEVEL"
523
+ },
524
+ "properties": [
525
+ {
526
+ "id": "custom.width",
527
+ "value": 96
528
+ }
529
+ ]
530
+ },
531
+ {
532
+ "matcher": {
533
+ "id": "byName",
534
+ "options": "IoC"
535
+ },
536
+ "properties": [
537
+ {
538
+ "id": "custom.cellOptions",
539
+ "value": {
540
+ "type": "color-text"
541
+ }
542
+ },
543
+ {
544
+ "id": "custom.width",
545
+ "value": 244
546
+ }
547
+ ]
548
+ },
549
+ {
550
+ "matcher": {
551
+ "id": "byName",
552
+ "options": "LABEL"
553
+ },
554
+ "properties": [
555
+ {
556
+ "id": "custom.width",
557
+ "value": 93
558
+ }
559
+ ]
560
+ },
561
+ {
562
+ "matcher": {
563
+ "id": "byName",
564
+ "options": "EVENT ID"
565
+ },
566
+ "properties": [
567
+ {
568
+ "id": "links",
569
+ "value": [
570
+ {
571
+ "targetBlank": true,
572
+ "title": "VIEW EVENT DETAILS",
573
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
574
+ }
575
+ ]
576
+ },
577
+ {
578
+ "id": "custom.width",
579
+ "value": 332
580
+ }
581
+ ]
582
+ },
583
+ {
584
+ "matcher": {
585
+ "id": "byName",
586
+ "options": "LEVEL"
587
+ },
588
+ "properties": [
589
+ {
590
+ "id": "custom.width",
591
+ "value": 145
592
+ }
593
+ ]
594
+ },
595
+ {
596
+ "matcher": {
597
+ "id": "byName",
598
+ "options": "COMMENT"
599
+ },
600
+ "properties": [
601
+ {
602
+ "id": "custom.width",
603
+ "value": 270
604
+ }
605
+ ]
606
+ },
607
+ {
608
+ "matcher": {
609
+ "id": "byName",
610
+ "options": "CAT"
611
+ },
612
+ "properties": [
613
+ {
614
+ "id": "custom.width",
615
+ "value": 197
616
+ }
617
+ ]
618
+ },
619
+ {
620
+ "matcher": {
621
+ "id": "byName",
622
+ "options": "IoC TYPE"
623
+ },
624
+ "properties": [
625
+ {
626
+ "id": "custom.width",
627
+ "value": 178
628
+ }
629
+ ]
630
+ }
631
+ ]
632
+ },
633
+ "gridPos": {
634
+ "h": 10,
635
+ "w": 24,
636
+ "x": 0,
637
+ "y": 8
638
+ },
639
+ "id": 143,
640
+ "options": {
641
+ "cellHeight": "sm",
642
+ "footer": {
643
+ "countRows": false,
644
+ "fields": "",
645
+ "reducer": ["sum"],
646
+ "show": false
647
+ },
648
+ "showHeader": true,
649
+ "sortBy": []
650
+ },
651
+ "pluginVersion": "10.0.2",
652
+ "targets": [
653
+ {
654
+ "alias": "",
655
+ "bucketAggs": [],
656
+ "datasource": {
657
+ "type": "elasticsearch",
658
+ "uid": "wazuh_datasource_uid"
659
+ },
660
+ "metrics": [
661
+ {
662
+ "id": "1",
663
+ "settings": {
664
+ "size": "500"
665
+ },
666
+ "type": "raw_data"
667
+ }
668
+ ],
669
+ "query": "_exists_:threat_intel_type",
670
+ "queryType": "lucene",
671
+ "refId": "A",
672
+ "timeField": "timestamp"
673
+ }
674
+ ],
675
+ "title": "IoC - ALERTS",
676
+ "transformations": [
677
+ {
678
+ "id": "organize",
679
+ "options": {
680
+ "excludeByName": {
681
+ "@metadata_beat": true,
682
+ "@metadata_type": true,
683
+ "@metadata_version": true,
684
+ "_id": false,
685
+ "_index": true,
686
+ "_type": true,
687
+ "agent_ephemeral_id": true,
688
+ "agent_hostname": true,
689
+ "agent_id": true,
690
+ "agent_ip": false,
691
+ "agent_ip_city_name": true,
692
+ "agent_ip_country_code": true,
693
+ "agent_ip_geolocation": true,
694
+ "agent_ip_reserved_ip": true,
695
+ "agent_labels_customer": true,
696
+ "agent_name": false,
697
+ "agent_type": true,
698
+ "agent_version": true,
699
+ "beats_type": true,
700
+ "cluster_name": true,
701
+ "cluster_node": true,
702
+ "collector_node_id": true,
703
+ "data_@metadata_beat": true,
704
+ "data_@metadata_type": true,
705
+ "data_@metadata_version": true,
706
+ "data_@timestamp": true,
707
+ "data_agent_ephemeral_id": true,
708
+ "data_agent_id": true,
709
+ "data_agent_name": true,
710
+ "data_agent_type": true,
711
+ "data_agent_version": true,
712
+ "data_base_indicator_access_type": true,
713
+ "data_base_indicator_id": false,
714
+ "data_base_indicator_indicator_city_name": true,
715
+ "data_base_indicator_indicator_country_code": true,
716
+ "data_base_indicator_indicator_geolocation": true,
717
+ "data_client_bytes": true,
718
+ "data_client_ip": true,
719
+ "data_client_ip_reserved_ip": true,
720
+ "data_client_port": true,
721
+ "data_destination_bytes": true,
722
+ "data_destination_ip": true,
723
+ "data_destination_ip_reserved_ip": true,
724
+ "data_destination_port": true,
725
+ "data_dns_additionals_count": true,
726
+ "data_dns_answers": true,
727
+ "data_dns_answers_count": true,
728
+ "data_dns_authorities_count": true,
729
+ "data_dns_flags_authentic_data": true,
730
+ "data_dns_flags_authoritative": true,
731
+ "data_dns_flags_checking_disabled": true,
732
+ "data_dns_flags_recursion_available": true,
733
+ "data_dns_flags_recursion_desired": true,
734
+ "data_dns_flags_truncated_response": true,
735
+ "data_dns_header_flags": true,
736
+ "data_dns_id": true,
737
+ "data_dns_op_code": true,
738
+ "data_dns_question_class": true,
739
+ "data_dns_question_etld_plus_one": true,
740
+ "data_dns_question_name": true,
741
+ "data_dns_question_registered_domain": true,
742
+ "data_dns_question_subdomain": true,
743
+ "data_dns_question_top_level_domain": true,
744
+ "data_dns_question_type": true,
745
+ "data_dns_resolved_ip": true,
746
+ "data_dns_resolved_ip_city_name": true,
747
+ "data_dns_resolved_ip_country_code": true,
748
+ "data_dns_resolved_ip_geolocation": true,
749
+ "data_dns_response_code": true,
750
+ "data_dns_type": true,
751
+ "data_ecs_version": true,
752
+ "data_event_category": true,
753
+ "data_event_dataset": true,
754
+ "data_event_duration": true,
755
+ "data_event_end": true,
756
+ "data_event_kind": true,
757
+ "data_event_start": true,
758
+ "data_event_type": true,
759
+ "data_host_architecture": true,
760
+ "data_host_containerized": true,
761
+ "data_host_hostname": true,
762
+ "data_host_id": true,
763
+ "data_host_ip": true,
764
+ "data_host_mac": true,
765
+ "data_host_name": true,
766
+ "data_host_os_codename": true,
767
+ "data_host_os_family": true,
768
+ "data_host_os_kernel": true,
769
+ "data_host_os_name": true,
770
+ "data_host_os_platform": true,
771
+ "data_host_os_type": true,
772
+ "data_host_os_version": true,
773
+ "data_integration": true,
774
+ "data_method": true,
775
+ "data_network_bytes": true,
776
+ "data_network_community_id": true,
777
+ "data_network_direction": true,
778
+ "data_network_protocol": true,
779
+ "data_network_transport": true,
780
+ "data_network_type": true,
781
+ "data_opencti_0_node_color": true,
782
+ "data_opencti_0_node_id": true,
783
+ "data_opencti_1_node_color": true,
784
+ "data_opencti_1_node_id": true,
785
+ "data_opencti_2_node_color": true,
786
+ "data_opencti_2_node_id": true,
787
+ "data_opencti_3_node_color": true,
788
+ "data_opencti_3_node_id": true,
789
+ "data_opencti_4_node_color": true,
790
+ "data_opencti_4_node_id": true,
791
+ "data_opencti_5_node_color": true,
792
+ "data_opencti_5_node_id": true,
793
+ "data_opencti_atime": true,
794
+ "data_opencti_createdBy": true,
795
+ "data_opencti_createdBy_contact_information": true,
796
+ "data_opencti_createdBy_created": true,
797
+ "data_opencti_createdBy_description": true,
798
+ "data_opencti_createdBy_entity_type": true,
799
+ "data_opencti_createdBy_id": true,
800
+ "data_opencti_createdBy_identity_class": true,
801
+ "data_opencti_createdBy_modified": true,
802
+ "data_opencti_createdBy_name": false,
803
+ "data_opencti_createdBy_parent_types": true,
804
+ "data_opencti_createdBy_roles": true,
805
+ "data_opencti_createdBy_spec_version": true,
806
+ "data_opencti_createdBy_standard_id": true,
807
+ "data_opencti_createdBy_x_opencti_aliases": true,
808
+ "data_opencti_createdBy_x_opencti_organization_type": true,
809
+ "data_opencti_createdBy_x_opencti_reliability": true,
810
+ "data_opencti_created_at": true,
811
+ "data_opencti_ctime": true,
812
+ "data_opencti_error": true,
813
+ "data_opencti_extensions": true,
814
+ "data_opencti_hashes": true,
815
+ "data_opencti_id": true,
816
+ "data_opencti_indicators_edges": true,
817
+ "data_opencti_mime_type": true,
818
+ "data_opencti_mtime": true,
819
+ "data_opencti_objectLabel_edges": true,
820
+ "data_opencti_objectMarking_edges": true,
821
+ "data_opencti_observable_value": true,
822
+ "data_opencti_observable_value_city_name": true,
823
+ "data_opencti_observable_value_country_code": true,
824
+ "data_opencti_observable_value_geolocation": true,
825
+ "data_opencti_parent_types": true,
826
+ "data_opencti_size": true,
827
+ "data_opencti_spec_version": true,
828
+ "data_opencti_standard_id": true,
829
+ "data_opencti_updated_at": true,
830
+ "data_opencti_value_city_name": true,
831
+ "data_opencti_value_country_code": true,
832
+ "data_opencti_value_geolocation": true,
833
+ "data_opencti_x_opencti_additional_names": true,
834
+ "data_opencti_x_opencti_description": true,
835
+ "data_query": true,
836
+ "data_related_ip": true,
837
+ "data_resource": true,
838
+ "data_server_bytes": true,
839
+ "data_server_ip": true,
840
+ "data_server_ip_reserved_ip": true,
841
+ "data_server_port": true,
842
+ "data_source_bytes": true,
843
+ "data_source_ip": true,
844
+ "data_source_ip_reserved_ip": true,
845
+ "data_source_port": true,
846
+ "data_status": true,
847
+ "data_type": true,
848
+ "data_win_eventdata_domain": true,
849
+ "data_win_eventdata_image": true,
850
+ "data_win_eventdata_imagePath": true,
851
+ "data_win_eventdata_processGuid": true,
852
+ "data_win_eventdata_processId": true,
853
+ "data_win_eventdata_queryName": true,
854
+ "data_win_eventdata_queryResults": true,
855
+ "data_win_eventdata_queryStatus": true,
856
+ "data_win_eventdata_sID": true,
857
+ "data_win_eventdata_serviceName": true,
858
+ "data_win_eventdata_serviceType": true,
859
+ "data_win_eventdata_startType": true,
860
+ "data_win_eventdata_timestamp": true,
861
+ "data_win_eventdata_user": true,
862
+ "data_win_eventdata_utcTime": true,
863
+ "data_win_system_channel": true,
864
+ "data_win_system_computer": true,
865
+ "data_win_system_eventID": true,
866
+ "data_win_system_eventRecordID": true,
867
+ "data_win_system_eventSourceName": true,
868
+ "data_win_system_keywords": true,
869
+ "data_win_system_level": true,
870
+ "data_win_system_message": true,
871
+ "data_win_system_opcode": true,
872
+ "data_win_system_processID": true,
873
+ "data_win_system_providerGuid": true,
874
+ "data_win_system_providerName": true,
875
+ "data_win_system_severityValue": true,
876
+ "data_win_system_systemTime": true,
877
+ "data_win_system_task": true,
878
+ "data_win_system_threadID": true,
879
+ "data_win_system_version": true,
880
+ "decoder_name": true,
881
+ "dns_answer": true,
882
+ "dns_answer_city_name": true,
883
+ "dns_answer_country_code": true,
884
+ "dns_answer_geolocation": true,
885
+ "dns_query": true,
886
+ "dns_response_code": true,
887
+ "dst_ip": true,
888
+ "dst_ip_reserved_ip": true,
889
+ "dst_port": true,
890
+ "ecs_version": true,
891
+ "gl2_accounted_message_size": true,
892
+ "gl2_message_id": true,
893
+ "gl2_processing_error": true,
894
+ "gl2_remote_ip": true,
895
+ "gl2_remote_port": true,
896
+ "gl2_source_collector": true,
897
+ "gl2_source_input": true,
898
+ "gl2_source_node": true,
899
+ "highlight": true,
900
+ "host_name": true,
901
+ "id": true,
902
+ "location": true,
903
+ "log_file_path": true,
904
+ "log_offset": true,
905
+ "manager_name": true,
906
+ "message": true,
907
+ "msg_timestamp": true,
908
+ "previous_output": true,
909
+ "process_id": true,
910
+ "process_image": true,
911
+ "protocol": true,
912
+ "rule_description": true,
913
+ "rule_firedtimes": true,
914
+ "rule_frequency": true,
915
+ "rule_gdpr": true,
916
+ "rule_gpg13": true,
917
+ "rule_group1": true,
918
+ "rule_group2": true,
919
+ "rule_group3": true,
920
+ "rule_groups": true,
921
+ "rule_hipaa": true,
922
+ "rule_id": true,
923
+ "rule_level": true,
924
+ "rule_mail": true,
925
+ "rule_mitre_id": true,
926
+ "rule_mitre_tactic": true,
927
+ "rule_mitre_technique": true,
928
+ "rule_nist_800_53": true,
929
+ "rule_pci_dss": true,
930
+ "rule_tsc": true,
931
+ "sort": true,
932
+ "source": true,
933
+ "source_reserved_ip": true,
934
+ "src_ip": true,
935
+ "src_ip_city_name": true,
936
+ "src_ip_country_code": true,
937
+ "src_ip_geolocation": true,
938
+ "src_ip_reserved_ip": true,
939
+ "src_port": true,
940
+ "streams": true,
941
+ "syslog_tag": true,
942
+ "syslog_type": true,
943
+ "threat_intel_ioc_source": true,
944
+ "threat_intel_source_description": true,
945
+ "threat_intel_timestamp": true,
946
+ "timestamp": false,
947
+ "timestamp_utc": true,
948
+ "traffic_direction": true,
949
+ "true": true,
950
+ "user_name": true,
951
+ "win_system_eventID": true,
952
+ "windows_event_id": true,
953
+ "windows_event_severity": false
954
+ },
955
+ "indexByName": {
956
+ "_id": 1,
957
+ "_index": 3,
958
+ "_type": 4,
959
+ "agent_id": 5,
960
+ "agent_ip": 6,
961
+ "agent_labels_customer": 33,
962
+ "agent_name": 2,
963
+ "data_integration": 34,
964
+ "data_opencti_0_node_color": 35,
965
+ "data_opencti_0_node_id": 36,
966
+ "data_opencti_0_node_value": 37,
967
+ "data_opencti_1_node_color": 38,
968
+ "data_opencti_1_node_id": 39,
969
+ "data_opencti_1_node_value": 40,
970
+ "data_opencti_atime": 69,
971
+ "data_opencti_createdBy": 70,
972
+ "data_opencti_createdBy_contact_information": 41,
973
+ "data_opencti_createdBy_created": 42,
974
+ "data_opencti_createdBy_description": 71,
975
+ "data_opencti_createdBy_entity_type": 43,
976
+ "data_opencti_createdBy_id": 44,
977
+ "data_opencti_createdBy_identity_class": 45,
978
+ "data_opencti_createdBy_modified": 46,
979
+ "data_opencti_createdBy_name": 9,
980
+ "data_opencti_createdBy_parent_types": 47,
981
+ "data_opencti_createdBy_roles": 48,
982
+ "data_opencti_createdBy_spec_version": 49,
983
+ "data_opencti_createdBy_standard_id": 50,
984
+ "data_opencti_createdBy_x_opencti_aliases": 10,
985
+ "data_opencti_createdBy_x_opencti_organization_type": 51,
986
+ "data_opencti_createdBy_x_opencti_reliability": 52,
987
+ "data_opencti_created_at": 53,
988
+ "data_opencti_ctime": 72,
989
+ "data_opencti_entity_type": 8,
990
+ "data_opencti_extensions": 73,
991
+ "data_opencti_hashes": 74,
992
+ "data_opencti_id": 54,
993
+ "data_opencti_indicators_edges": 55,
994
+ "data_opencti_mime_type": 75,
995
+ "data_opencti_mtime": 76,
996
+ "data_opencti_name": 77,
997
+ "data_opencti_objectLabel_edges": 56,
998
+ "data_opencti_objectMarking_edges": 57,
999
+ "data_opencti_observable_value": 58,
1000
+ "data_opencti_parent_types": 59,
1001
+ "data_opencti_size": 78,
1002
+ "data_opencti_spec_version": 60,
1003
+ "data_opencti_standard_id": 61,
1004
+ "data_opencti_updated_at": 62,
1005
+ "data_opencti_value": 7,
1006
+ "data_opencti_x_opencti_additional_names": 79,
1007
+ "data_opencti_x_opencti_description": 63,
1008
+ "data_opencti_x_opencti_score": 64,
1009
+ "decoder_name": 11,
1010
+ "gl2_accounted_message_size": 12,
1011
+ "gl2_message_id": 13,
1012
+ "gl2_processing_error": 65,
1013
+ "gl2_remote_ip": 14,
1014
+ "gl2_remote_port": 15,
1015
+ "gl2_source_input": 16,
1016
+ "gl2_source_node": 17,
1017
+ "highlight": 18,
1018
+ "id": 19,
1019
+ "location": 20,
1020
+ "manager_name": 21,
1021
+ "message": 22,
1022
+ "rule_description": 23,
1023
+ "rule_firedtimes": 24,
1024
+ "rule_group1": 66,
1025
+ "rule_group2": 67,
1026
+ "rule_group3": 68,
1027
+ "rule_groups": 25,
1028
+ "rule_id": 26,
1029
+ "rule_level": 27,
1030
+ "rule_mail": 28,
1031
+ "sort": 29,
1032
+ "source": 30,
1033
+ "streams": 31,
1034
+ "syslog_level": 80,
1035
+ "syslog_type": 32,
1036
+ "timestamp": 0,
1037
+ "true": 81
1038
+ },
1039
+ "renameByName": {
1040
+ "_id": "EVENT ID",
1041
+ "_type": "",
1042
+ "agent_ip": "SRC IP",
1043
+ "agent_name": "AGENT",
1044
+ "data_base_indicator_access_type": "",
1045
+ "data_base_indicator_id": "OTX IoC ID",
1046
+ "data_base_indicator_indicator": "IoC",
1047
+ "data_base_indicator_indicator_country_code": "",
1048
+ "data_base_indicator_type": "IoC TYPE",
1049
+ "data_opencti_0_node_value": "LABEL",
1050
+ "data_opencti_1_node_value": "LABEL",
1051
+ "data_opencti_2_node_value": "LABEL",
1052
+ "data_opencti_3_node_value": "LABEL",
1053
+ "data_opencti_4_node_value": "LABEL",
1054
+ "data_opencti_5_node_value": "LABEL",
1055
+ "data_opencti_createdBy_contact_information": "",
1056
+ "data_opencti_createdBy_name": "SECURITY FEED",
1057
+ "data_opencti_createdBy_x_opencti_aliases": "",
1058
+ "data_opencti_entity_type": "TYPE",
1059
+ "data_opencti_value": "IoC",
1060
+ "data_opencti_x_opencti_description": "",
1061
+ "data_opencti_x_opencti_score": "SCORE",
1062
+ "data_sections": "OTX SECTIONS",
1063
+ "data_type": "",
1064
+ "data_win_system_message": "MESSAGE",
1065
+ "data_win_system_providerGuid": "",
1066
+ "rule_level": "RULE LEVEL",
1067
+ "syslog_level": "LEVEL",
1068
+ "threat_intel_category": "CAT",
1069
+ "threat_intel_comment": "COMMENT",
1070
+ "threat_intel_ioc_source": "IoC SOURCE",
1071
+ "threat_intel_source_description": "IoC DESC",
1072
+ "threat_intel_type": "IoC TYPE",
1073
+ "threat_intel_value": "IoC",
1074
+ "threat_intel_virustotal_url": "VT URL",
1075
+ "timestamp": "DATE/TIME",
1076
+ "windows_event_severity": "EVENT LOG SEVERITY"
1077
+ }
1078
+ }
1079
+ }
1080
+ ],
1081
+ "transparent": true,
1082
+ "type": "table"
1083
+ }
1084
+ ],
1085
+ "title": "THREAT INTEL",
1086
+ "type": "row"
1087
+ },
1088
+ {
1089
+ "collapsed": true,
1090
+ "gridPos": {
1091
+ "h": 1,
1092
+ "w": 24,
1093
+ "x": 0,
1094
+ "y": 1
1095
+ },
1096
+ "id": 139,
1097
+ "panels": [
1098
+ {
1099
+ "datasource": {
1100
+ "type": "elasticsearch",
1101
+ "uid": "wazuh_datasource_uid"
1102
+ },
1103
+ "fieldConfig": {
1104
+ "defaults": {
1105
+ "mappings": [
1106
+ {
1107
+ "options": {
1108
+ "match": "null",
1109
+ "result": {
1110
+ "text": "N/A"
1111
+ }
1112
+ },
1113
+ "type": "special"
1114
+ }
1115
+ ],
1116
+ "thresholds": {
1117
+ "mode": "absolute",
1118
+ "steps": [
1119
+ {
1120
+ "color": "orange",
1121
+ "value": null
1122
+ }
1123
+ ]
1124
+ },
1125
+ "unit": "short"
1126
+ },
1127
+ "overrides": []
1128
+ },
1129
+ "gridPos": {
1130
+ "h": 7,
1131
+ "w": 4,
1132
+ "x": 0,
1133
+ "y": 2
1134
+ },
1135
+ "id": 140,
1136
+ "links": [],
1137
+ "options": {
1138
+ "colorMode": "value",
1139
+ "graphMode": "area",
1140
+ "justifyMode": "auto",
1141
+ "orientation": "horizontal",
1142
+ "reduceOptions": {
1143
+ "calcs": ["sum"],
1144
+ "fields": "",
1145
+ "values": false
1146
+ },
1147
+ "text": {},
1148
+ "textMode": "auto"
1149
+ },
1150
+ "pluginVersion": "10.0.2",
1151
+ "targets": [
1152
+ {
1153
+ "bucketAggs": [
1154
+ {
1155
+ "$$hashKey": "object:50",
1156
+ "field": "timestamp",
1157
+ "id": "2",
1158
+ "settings": {
1159
+ "interval": "auto",
1160
+ "min_doc_count": 0,
1161
+ "trimEdges": 0
1162
+ },
1163
+ "type": "date_histogram"
1164
+ }
1165
+ ],
1166
+ "datasource": {
1167
+ "type": "elasticsearch",
1168
+ "uid": "wazuh_datasource_uid"
1169
+ },
1170
+ "metrics": [
1171
+ {
1172
+ "$$hashKey": "object:48",
1173
+ "field": "select field",
1174
+ "id": "1",
1175
+ "type": "count"
1176
+ }
1177
+ ],
1178
+ "query": "rule_group3:sigma",
1179
+ "refId": "A",
1180
+ "timeField": "timestamp"
1181
+ }
1182
+ ],
1183
+ "title": "DETECTIONS",
1184
+ "type": "stat"
1185
+ },
1186
+ {
1187
+ "datasource": {
1188
+ "type": "elasticsearch",
1189
+ "uid": "wazuh_datasource_uid"
1190
+ },
1191
+ "fieldConfig": {
1192
+ "defaults": {
1193
+ "custom": {
1194
+ "align": "auto",
1195
+ "cellOptions": {
1196
+ "type": "auto"
1197
+ },
1198
+ "filterable": false,
1199
+ "inspect": false
1200
+ },
1201
+ "mappings": [],
1202
+ "thresholds": {
1203
+ "mode": "absolute",
1204
+ "steps": [
1205
+ {
1206
+ "color": "green",
1207
+ "value": null
1208
+ },
1209
+ {
1210
+ "color": "red",
1211
+ "value": 80
1212
+ }
1213
+ ]
1214
+ }
1215
+ },
1216
+ "overrides": [
1217
+ {
1218
+ "matcher": {
1219
+ "id": "byName",
1220
+ "options": "agent_name"
1221
+ },
1222
+ "properties": [
1223
+ {
1224
+ "id": "custom.width",
1225
+ "value": 224
1226
+ }
1227
+ ]
1228
+ }
1229
+ ]
1230
+ },
1231
+ "gridPos": {
1232
+ "h": 7,
1233
+ "w": 5,
1234
+ "x": 4,
1235
+ "y": 2
1236
+ },
1237
+ "id": 141,
1238
+ "links": [],
1239
+ "maxDataPoints": 3,
1240
+ "options": {
1241
+ "cellHeight": "sm",
1242
+ "footer": {
1243
+ "countRows": false,
1244
+ "fields": "",
1245
+ "reducer": ["sum"],
1246
+ "show": false
1247
+ },
1248
+ "showHeader": true,
1249
+ "sortBy": []
1250
+ },
1251
+ "pluginVersion": "10.0.2",
1252
+ "targets": [
1253
+ {
1254
+ "bucketAggs": [
1255
+ {
1256
+ "$$hashKey": "object:73",
1257
+ "fake": true,
1258
+ "field": "agent_name",
1259
+ "id": "3",
1260
+ "settings": {
1261
+ "min_doc_count": 1,
1262
+ "order": "desc",
1263
+ "orderBy": "_count",
1264
+ "size": "0"
1265
+ },
1266
+ "type": "terms"
1267
+ }
1268
+ ],
1269
+ "datasource": {
1270
+ "type": "elasticsearch",
1271
+ "uid": "wazuh_datasource_uid"
1272
+ },
1273
+ "metrics": [
1274
+ {
1275
+ "$$hashKey": "object:71",
1276
+ "field": "select field",
1277
+ "id": "1",
1278
+ "type": "count"
1279
+ }
1280
+ ],
1281
+ "query": "rule_group3:sigma",
1282
+ "refId": "A",
1283
+ "timeField": "timestamp"
1284
+ }
1285
+ ],
1286
+ "title": "DETECTIONS BY AGENT",
1287
+ "transformations": [
1288
+ {
1289
+ "id": "organize",
1290
+ "options": {
1291
+ "excludeByName": {},
1292
+ "indexByName": {},
1293
+ "renameByName": {
1294
+ "agent_name": "AGENT"
1295
+ }
1296
+ }
1297
+ }
1298
+ ],
1299
+ "type": "table"
1300
+ },
1301
+ {
1302
+ "datasource": {
1303
+ "type": "elasticsearch",
1304
+ "uid": "wazuh_datasource_uid"
1305
+ },
1306
+ "fieldConfig": {
1307
+ "defaults": {
1308
+ "custom": {
1309
+ "align": "auto",
1310
+ "cellOptions": {
1311
+ "type": "auto"
1312
+ },
1313
+ "filterable": false,
1314
+ "inspect": false
1315
+ },
1316
+ "mappings": [],
1317
+ "thresholds": {
1318
+ "mode": "absolute",
1319
+ "steps": [
1320
+ {
1321
+ "color": "orange",
1322
+ "value": null
1323
+ }
1324
+ ]
1325
+ }
1326
+ },
1327
+ "overrides": [
1328
+ {
1329
+ "matcher": {
1330
+ "id": "byName",
1331
+ "options": "Count"
1332
+ },
1333
+ "properties": [
1334
+ {
1335
+ "id": "custom.cellOptions",
1336
+ "value": {
1337
+ "mode": "basic",
1338
+ "type": "gauge"
1339
+ }
1340
+ }
1341
+ ]
1342
+ },
1343
+ {
1344
+ "matcher": {
1345
+ "id": "byName",
1346
+ "options": "rule_description"
1347
+ },
1348
+ "properties": [
1349
+ {
1350
+ "id": "custom.width",
1351
+ "value": 703
1352
+ }
1353
+ ]
1354
+ },
1355
+ {
1356
+ "matcher": {
1357
+ "id": "byName",
1358
+ "options": "rule_level"
1359
+ },
1360
+ "properties": [
1361
+ {
1362
+ "id": "custom.width",
1363
+ "value": 212
1364
+ },
1365
+ {
1366
+ "id": "mappings",
1367
+ "value": [
1368
+ {
1369
+ "options": {
1370
+ "from": 1,
1371
+ "result": {
1372
+ "color": "green",
1373
+ "index": 0
1374
+ },
1375
+ "to": 3
1376
+ },
1377
+ "type": "range"
1378
+ },
1379
+ {
1380
+ "options": {
1381
+ "from": 4,
1382
+ "result": {
1383
+ "color": "dark-yellow",
1384
+ "index": 1
1385
+ },
1386
+ "to": 6
1387
+ },
1388
+ "type": "range"
1389
+ },
1390
+ {
1391
+ "options": {
1392
+ "from": 7,
1393
+ "result": {
1394
+ "color": "orange",
1395
+ "index": 2
1396
+ },
1397
+ "to": 9
1398
+ },
1399
+ "type": "range"
1400
+ },
1401
+ {
1402
+ "options": {
1403
+ "from": 10,
1404
+ "result": {
1405
+ "color": "semi-dark-red",
1406
+ "index": 3
1407
+ },
1408
+ "to": 15
1409
+ },
1410
+ "type": "range"
1411
+ }
1412
+ ]
1413
+ }
1414
+ ]
1415
+ }
1416
+ ]
1417
+ },
1418
+ "gridPos": {
1419
+ "h": 7,
1420
+ "w": 15,
1421
+ "x": 9,
1422
+ "y": 2
1423
+ },
1424
+ "id": 142,
1425
+ "links": [],
1426
+ "maxDataPoints": 3,
1427
+ "options": {
1428
+ "cellHeight": "sm",
1429
+ "footer": {
1430
+ "countRows": false,
1431
+ "fields": "",
1432
+ "reducer": ["sum"],
1433
+ "show": false
1434
+ },
1435
+ "showHeader": true,
1436
+ "sortBy": []
1437
+ },
1438
+ "pluginVersion": "10.0.2",
1439
+ "targets": [
1440
+ {
1441
+ "bucketAggs": [
1442
+ {
1443
+ "$$hashKey": "object:3082",
1444
+ "fake": true,
1445
+ "field": "data_name",
1446
+ "id": "4",
1447
+ "settings": {
1448
+ "min_doc_count": "1",
1449
+ "order": "desc",
1450
+ "orderBy": "_count",
1451
+ "size": "10"
1452
+ },
1453
+ "type": "terms"
1454
+ }
1455
+ ],
1456
+ "datasource": {
1457
+ "type": "elasticsearch",
1458
+ "uid": "wazuh_datasource_uid"
1459
+ },
1460
+ "metrics": [
1461
+ {
1462
+ "$$hashKey": "object:71",
1463
+ "field": "select field",
1464
+ "id": "1",
1465
+ "type": "count"
1466
+ }
1467
+ ],
1468
+ "query": "rule_group3:sigma",
1469
+ "refId": "A",
1470
+ "timeField": "timestamp"
1471
+ }
1472
+ ],
1473
+ "title": "DETECTIONS BY TYPE",
1474
+ "transformations": [
1475
+ {
1476
+ "id": "organize",
1477
+ "options": {
1478
+ "excludeByName": {},
1479
+ "indexByName": {},
1480
+ "renameByName": {
1481
+ "data_name": "SIGMA DETECTION",
1482
+ "threat_intel_type": "IoC TYPE"
1483
+ }
1484
+ }
1485
+ }
1486
+ ],
1487
+ "type": "table"
1488
+ },
1489
+ {
1490
+ "datasource": {
1491
+ "type": "elasticsearch",
1492
+ "uid": "wazuh_datasource_uid"
1493
+ },
1494
+ "fieldConfig": {
1495
+ "defaults": {
1496
+ "color": {
1497
+ "mode": "thresholds"
1498
+ },
1499
+ "custom": {
1500
+ "align": "auto",
1501
+ "cellOptions": {
1502
+ "type": "auto"
1503
+ },
1504
+ "filterable": true,
1505
+ "inspect": false
1506
+ },
1507
+ "mappings": [],
1508
+ "thresholds": {
1509
+ "mode": "absolute",
1510
+ "steps": [
1511
+ {
1512
+ "color": "red",
1513
+ "value": null
1514
+ }
1515
+ ]
1516
+ }
1517
+ },
1518
+ "overrides": [
1519
+ {
1520
+ "matcher": {
1521
+ "id": "byName",
1522
+ "options": "rule_level"
1523
+ },
1524
+ "properties": [
1525
+ {
1526
+ "id": "custom.width",
1527
+ "value": 93
1528
+ }
1529
+ ]
1530
+ },
1531
+ {
1532
+ "matcher": {
1533
+ "id": "byName",
1534
+ "options": "DATE/TIME"
1535
+ },
1536
+ "properties": [
1537
+ {
1538
+ "id": "custom.width",
1539
+ "value": 202
1540
+ }
1541
+ ]
1542
+ },
1543
+ {
1544
+ "matcher": {
1545
+ "id": "byName",
1546
+ "options": "AGENT"
1547
+ },
1548
+ "properties": [
1549
+ {
1550
+ "id": "custom.width",
1551
+ "value": 171
1552
+ }
1553
+ ]
1554
+ },
1555
+ {
1556
+ "matcher": {
1557
+ "id": "byName",
1558
+ "options": "SRC IP"
1559
+ },
1560
+ "properties": [
1561
+ {
1562
+ "id": "custom.width",
1563
+ "value": 150
1564
+ }
1565
+ ]
1566
+ },
1567
+ {
1568
+ "matcher": {
1569
+ "id": "byName",
1570
+ "options": "rule_description"
1571
+ },
1572
+ "properties": [
1573
+ {
1574
+ "id": "custom.width",
1575
+ "value": 524
1576
+ }
1577
+ ]
1578
+ },
1579
+ {
1580
+ "matcher": {
1581
+ "id": "byName",
1582
+ "options": "RULE LEVEL"
1583
+ },
1584
+ "properties": [
1585
+ {
1586
+ "id": "custom.width",
1587
+ "value": 96
1588
+ }
1589
+ ]
1590
+ },
1591
+ {
1592
+ "matcher": {
1593
+ "id": "byName",
1594
+ "options": "IoC"
1595
+ },
1596
+ "properties": [
1597
+ {
1598
+ "id": "custom.cellOptions",
1599
+ "value": {
1600
+ "type": "color-text"
1601
+ }
1602
+ },
1603
+ {
1604
+ "id": "custom.width",
1605
+ "value": 244
1606
+ }
1607
+ ]
1608
+ },
1609
+ {
1610
+ "matcher": {
1611
+ "id": "byName",
1612
+ "options": "LABEL"
1613
+ },
1614
+ "properties": [
1615
+ {
1616
+ "id": "custom.width",
1617
+ "value": 93
1618
+ }
1619
+ ]
1620
+ },
1621
+ {
1622
+ "matcher": {
1623
+ "id": "byName",
1624
+ "options": "EVENT ID"
1625
+ },
1626
+ "properties": [
1627
+ {
1628
+ "id": "links",
1629
+ "value": [
1630
+ {
1631
+ "targetBlank": true,
1632
+ "title": "VIEW EVENT DETAILS",
1633
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1634
+ }
1635
+ ]
1636
+ },
1637
+ {
1638
+ "id": "custom.width",
1639
+ "value": 332
1640
+ }
1641
+ ]
1642
+ },
1643
+ {
1644
+ "matcher": {
1645
+ "id": "byName",
1646
+ "options": "LEVEL"
1647
+ },
1648
+ "properties": [
1649
+ {
1650
+ "id": "custom.width",
1651
+ "value": 145
1652
+ }
1653
+ ]
1654
+ },
1655
+ {
1656
+ "matcher": {
1657
+ "id": "byName",
1658
+ "options": "COMMENT"
1659
+ },
1660
+ "properties": [
1661
+ {
1662
+ "id": "custom.width",
1663
+ "value": 270
1664
+ }
1665
+ ]
1666
+ },
1667
+ {
1668
+ "matcher": {
1669
+ "id": "byName",
1670
+ "options": "CAT"
1671
+ },
1672
+ "properties": [
1673
+ {
1674
+ "id": "custom.width",
1675
+ "value": 197
1676
+ }
1677
+ ]
1678
+ },
1679
+ {
1680
+ "matcher": {
1681
+ "id": "byName",
1682
+ "options": "IoC TYPE"
1683
+ },
1684
+ "properties": [
1685
+ {
1686
+ "id": "custom.width",
1687
+ "value": 178
1688
+ }
1689
+ ]
1690
+ }
1691
+ ]
1692
+ },
1693
+ "gridPos": {
1694
+ "h": 13,
1695
+ "w": 24,
1696
+ "x": 0,
1697
+ "y": 9
1698
+ },
1699
+ "id": 132,
1700
+ "options": {
1701
+ "cellHeight": "sm",
1702
+ "footer": {
1703
+ "countRows": false,
1704
+ "enablePagination": true,
1705
+ "fields": "",
1706
+ "reducer": ["sum"],
1707
+ "show": false
1708
+ },
1709
+ "showHeader": true,
1710
+ "sortBy": []
1711
+ },
1712
+ "pluginVersion": "10.0.2",
1713
+ "targets": [
1714
+ {
1715
+ "alias": "",
1716
+ "bucketAggs": [],
1717
+ "datasource": {
1718
+ "type": "elasticsearch",
1719
+ "uid": "wazuh_datasource_uid"
1720
+ },
1721
+ "metrics": [
1722
+ {
1723
+ "id": "1",
1724
+ "settings": {
1725
+ "size": "500"
1726
+ },
1727
+ "type": "raw_data"
1728
+ }
1729
+ ],
1730
+ "query": "rule_group3:sigma AND !data_message:\"Failed to update Sigma rules.\"",
1731
+ "queryType": "lucene",
1732
+ "refId": "A",
1733
+ "timeField": "timestamp"
1734
+ }
1735
+ ],
1736
+ "title": "DETECTIONS",
1737
+ "transformations": [
1738
+ {
1739
+ "id": "organize",
1740
+ "options": {
1741
+ "excludeByName": {
1742
+ "@metadata_beat": true,
1743
+ "@metadata_type": true,
1744
+ "@metadata_version": true,
1745
+ "_id": false,
1746
+ "_index": true,
1747
+ "_type": true,
1748
+ "agent_ephemeral_id": true,
1749
+ "agent_hostname": true,
1750
+ "agent_id": true,
1751
+ "agent_ip": false,
1752
+ "agent_ip_city_name": true,
1753
+ "agent_ip_country_code": true,
1754
+ "agent_ip_geolocation": true,
1755
+ "agent_ip_reserved_ip": true,
1756
+ "agent_labels_customer": true,
1757
+ "agent_name": false,
1758
+ "agent_type": true,
1759
+ "agent_version": true,
1760
+ "ask_socfortress_message": true,
1761
+ "beats_type": true,
1762
+ "cluster_name": true,
1763
+ "cluster_node": true,
1764
+ "collector_node_id": true,
1765
+ "data_@metadata_beat": true,
1766
+ "data_@metadata_type": true,
1767
+ "data_@metadata_version": true,
1768
+ "data_@timestamp": true,
1769
+ "data_agent_ephemeral_id": true,
1770
+ "data_agent_id": true,
1771
+ "data_agent_name": true,
1772
+ "data_agent_type": true,
1773
+ "data_agent_version": true,
1774
+ "data_authors": true,
1775
+ "data_base_indicator_access_type": true,
1776
+ "data_base_indicator_id": false,
1777
+ "data_base_indicator_indicator_city_name": true,
1778
+ "data_base_indicator_indicator_country_code": true,
1779
+ "data_base_indicator_indicator_geolocation": true,
1780
+ "data_client_bytes": true,
1781
+ "data_client_ip": true,
1782
+ "data_client_ip_reserved_ip": true,
1783
+ "data_client_port": true,
1784
+ "data_destination_bytes": true,
1785
+ "data_destination_ip": true,
1786
+ "data_destination_ip_reserved_ip": true,
1787
+ "data_destination_port": true,
1788
+ "data_dns_additionals_count": true,
1789
+ "data_dns_answers": true,
1790
+ "data_dns_answers_count": true,
1791
+ "data_dns_authorities_count": true,
1792
+ "data_dns_flags_authentic_data": true,
1793
+ "data_dns_flags_authoritative": true,
1794
+ "data_dns_flags_checking_disabled": true,
1795
+ "data_dns_flags_recursion_available": true,
1796
+ "data_dns_flags_recursion_desired": true,
1797
+ "data_dns_flags_truncated_response": true,
1798
+ "data_dns_header_flags": true,
1799
+ "data_dns_id": true,
1800
+ "data_dns_op_code": true,
1801
+ "data_dns_question_class": true,
1802
+ "data_dns_question_etld_plus_one": true,
1803
+ "data_dns_question_name": true,
1804
+ "data_dns_question_registered_domain": true,
1805
+ "data_dns_question_subdomain": true,
1806
+ "data_dns_question_top_level_domain": true,
1807
+ "data_dns_question_type": true,
1808
+ "data_dns_resolved_ip": true,
1809
+ "data_dns_resolved_ip_city_name": true,
1810
+ "data_dns_resolved_ip_country_code": true,
1811
+ "data_dns_resolved_ip_geolocation": true,
1812
+ "data_dns_response_code": true,
1813
+ "data_dns_type": true,
1814
+ "data_document": true,
1815
+ "data_ecs_version": true,
1816
+ "data_event_AuthenticationPackageName": true,
1817
+ "data_event_CallTrace": true,
1818
+ "data_event_CommandLine": true,
1819
+ "data_event_Company": true,
1820
+ "data_event_CurrentDirectory": true,
1821
+ "data_event_Description": true,
1822
+ "data_event_ElevatedToken": true,
1823
+ "data_event_Endpoint": true,
1824
+ "data_event_Environment": true,
1825
+ "data_event_Error": true,
1826
+ "data_event_EventsDropped": true,
1827
+ "data_event_EventsUploaded": true,
1828
+ "data_event_FailedConnections": true,
1829
+ "data_event_FileVersion": true,
1830
+ "data_event_GrantedAccess": true,
1831
+ "data_event_Hashes": true,
1832
+ "data_event_Image": true,
1833
+ "data_event_ImpersonationLevel": true,
1834
+ "data_event_IntegrityLevel": true,
1835
+ "data_event_IpAddress": true,
1836
+ "data_event_IpAddress_reserved_ip": true,
1837
+ "data_event_IpPort": true,
1838
+ "data_event_KeyLength": true,
1839
+ "data_event_LastEventlogWrittenTime": true,
1840
+ "data_event_LastHttpError": true,
1841
+ "data_event_LmPackageName": true,
1842
+ "data_event_LogonGuid": true,
1843
+ "data_event_LogonId": true,
1844
+ "data_event_LogonProcessName": true,
1845
+ "data_event_LogonType": true,
1846
+ "data_event_MessageNumber": true,
1847
+ "data_event_MessageTotal": true,
1848
+ "data_event_OriginalFileName": true,
1849
+ "data_event_ParentCommandLine": true,
1850
+ "data_event_ParentImage": true,
1851
+ "data_event_ParentProcessGuid": true,
1852
+ "data_event_ParentProcessId": true,
1853
+ "data_event_ParentUser": true,
1854
+ "data_event_Path": true,
1855
+ "data_event_ProcessGuid": true,
1856
+ "data_event_ProcessId": true,
1857
+ "data_event_ProcessName": true,
1858
+ "data_event_Product": true,
1859
+ "data_event_QueuedTileCleanups": true,
1860
+ "data_event_QueuedTileCloses": true,
1861
+ "data_event_RestrictedAdminMode": true,
1862
+ "data_event_RuleName": true,
1863
+ "data_event_ScriptBlockId": true,
1864
+ "data_event_ScriptBlockText": true,
1865
+ "data_event_SessionId": true,
1866
+ "data_event_SourceImage": true,
1867
+ "data_event_SourceProcessGUID": true,
1868
+ "data_event_SourceProcessId": true,
1869
+ "data_event_SourceThreadId": true,
1870
+ "data_event_SourceUser": true,
1871
+ "data_event_SubjectDomainName": true,
1872
+ "data_event_SubjectLogonId": true,
1873
+ "data_event_SubjectUserName": true,
1874
+ "data_event_SubjectUserSid": true,
1875
+ "data_event_SuccessfulConnections": true,
1876
+ "data_event_TargetDomainName": true,
1877
+ "data_event_TargetImage": true,
1878
+ "data_event_TargetLinkedLogonId": true,
1879
+ "data_event_TargetLogonId": true,
1880
+ "data_event_TargetOutboundDomainName": true,
1881
+ "data_event_TargetOutboundUserName": true,
1882
+ "data_event_TargetProcessGUID": true,
1883
+ "data_event_TargetProcessId": true,
1884
+ "data_event_TargetUser": true,
1885
+ "data_event_TargetUserName": true,
1886
+ "data_event_TargetUserSid": true,
1887
+ "data_event_TerminalSessionId": true,
1888
+ "data_event_TransmittedServices": true,
1889
+ "data_event_User": true,
1890
+ "data_event_UtcTime": true,
1891
+ "data_event_VirtualAccount": true,
1892
+ "data_event_WorkstationName": true,
1893
+ "data_event_category": true,
1894
+ "data_event_dataset": true,
1895
+ "data_event_duration": true,
1896
+ "data_event_end": true,
1897
+ "data_event_kind": true,
1898
+ "data_event_start": true,
1899
+ "data_event_type": true,
1900
+ "data_falsepositives": false,
1901
+ "data_group": true,
1902
+ "data_host_architecture": true,
1903
+ "data_host_containerized": true,
1904
+ "data_host_hostname": true,
1905
+ "data_host_id": true,
1906
+ "data_host_ip": true,
1907
+ "data_host_mac": true,
1908
+ "data_host_name": true,
1909
+ "data_host_os_codename": true,
1910
+ "data_host_os_family": true,
1911
+ "data_host_os_kernel": true,
1912
+ "data_host_os_name": true,
1913
+ "data_host_os_platform": true,
1914
+ "data_host_os_type": true,
1915
+ "data_host_os_version": true,
1916
+ "data_id": true,
1917
+ "data_integration": true,
1918
+ "data_kind": true,
1919
+ "data_level": true,
1920
+ "data_logsource_category": true,
1921
+ "data_logsource_definition": true,
1922
+ "data_logsource_product": true,
1923
+ "data_logsource_service": true,
1924
+ "data_message": true,
1925
+ "data_method": true,
1926
+ "data_network_bytes": true,
1927
+ "data_network_community_id": true,
1928
+ "data_network_direction": true,
1929
+ "data_network_protocol": true,
1930
+ "data_network_transport": true,
1931
+ "data_network_type": true,
1932
+ "data_opencti_0_node_color": true,
1933
+ "data_opencti_0_node_id": true,
1934
+ "data_opencti_1_node_color": true,
1935
+ "data_opencti_1_node_id": true,
1936
+ "data_opencti_2_node_color": true,
1937
+ "data_opencti_2_node_id": true,
1938
+ "data_opencti_3_node_color": true,
1939
+ "data_opencti_3_node_id": true,
1940
+ "data_opencti_4_node_color": true,
1941
+ "data_opencti_4_node_id": true,
1942
+ "data_opencti_5_node_color": true,
1943
+ "data_opencti_5_node_id": true,
1944
+ "data_opencti_atime": true,
1945
+ "data_opencti_createdBy": true,
1946
+ "data_opencti_createdBy_contact_information": true,
1947
+ "data_opencti_createdBy_created": true,
1948
+ "data_opencti_createdBy_description": true,
1949
+ "data_opencti_createdBy_entity_type": true,
1950
+ "data_opencti_createdBy_id": true,
1951
+ "data_opencti_createdBy_identity_class": true,
1952
+ "data_opencti_createdBy_modified": true,
1953
+ "data_opencti_createdBy_name": false,
1954
+ "data_opencti_createdBy_parent_types": true,
1955
+ "data_opencti_createdBy_roles": true,
1956
+ "data_opencti_createdBy_spec_version": true,
1957
+ "data_opencti_createdBy_standard_id": true,
1958
+ "data_opencti_createdBy_x_opencti_aliases": true,
1959
+ "data_opencti_createdBy_x_opencti_organization_type": true,
1960
+ "data_opencti_createdBy_x_opencti_reliability": true,
1961
+ "data_opencti_created_at": true,
1962
+ "data_opencti_ctime": true,
1963
+ "data_opencti_error": true,
1964
+ "data_opencti_extensions": true,
1965
+ "data_opencti_hashes": true,
1966
+ "data_opencti_id": true,
1967
+ "data_opencti_indicators_edges": true,
1968
+ "data_opencti_mime_type": true,
1969
+ "data_opencti_mtime": true,
1970
+ "data_opencti_objectLabel_edges": true,
1971
+ "data_opencti_objectMarking_edges": true,
1972
+ "data_opencti_observable_value": true,
1973
+ "data_opencti_observable_value_city_name": true,
1974
+ "data_opencti_observable_value_country_code": true,
1975
+ "data_opencti_observable_value_geolocation": true,
1976
+ "data_opencti_parent_types": true,
1977
+ "data_opencti_size": true,
1978
+ "data_opencti_spec_version": true,
1979
+ "data_opencti_standard_id": true,
1980
+ "data_opencti_updated_at": true,
1981
+ "data_opencti_value_city_name": true,
1982
+ "data_opencti_value_country_code": true,
1983
+ "data_opencti_value_geolocation": true,
1984
+ "data_opencti_x_opencti_additional_names": true,
1985
+ "data_opencti_x_opencti_description": true,
1986
+ "data_path": true,
1987
+ "data_query": true,
1988
+ "data_references": true,
1989
+ "data_related_ip": true,
1990
+ "data_resource": true,
1991
+ "data_server_bytes": true,
1992
+ "data_server_ip": true,
1993
+ "data_server_ip_reserved_ip": true,
1994
+ "data_server_port": true,
1995
+ "data_source": true,
1996
+ "data_source_bytes": true,
1997
+ "data_source_ip": true,
1998
+ "data_source_ip_reserved_ip": true,
1999
+ "data_source_port": true,
2000
+ "data_status": true,
2001
+ "data_system_Channel": true,
2002
+ "data_system_Computer": true,
2003
+ "data_system_Correlation": true,
2004
+ "data_system_Correlation_attributes_ActivityID": true,
2005
+ "data_system_EventID": true,
2006
+ "data_system_EventRecordID": true,
2007
+ "data_system_Execution_attributes_ProcessID": true,
2008
+ "data_system_Execution_attributes_ThreadID": true,
2009
+ "data_system_Keywords": true,
2010
+ "data_system_Level": true,
2011
+ "data_system_Opcode": true,
2012
+ "data_system_Provider_attributes_Guid": true,
2013
+ "data_system_Provider_attributes_Name": true,
2014
+ "data_system_Security": true,
2015
+ "data_system_Security_attributes_UserID": true,
2016
+ "data_system_Task": true,
2017
+ "data_system_TimeCreated_attributes_SystemTime": true,
2018
+ "data_system_Version": true,
2019
+ "data_tags": true,
2020
+ "data_timestamp": true,
2021
+ "data_type": true,
2022
+ "data_win_eventdata_domain": true,
2023
+ "data_win_eventdata_image": true,
2024
+ "data_win_eventdata_imagePath": true,
2025
+ "data_win_eventdata_processGuid": true,
2026
+ "data_win_eventdata_processId": true,
2027
+ "data_win_eventdata_queryName": true,
2028
+ "data_win_eventdata_queryResults": true,
2029
+ "data_win_eventdata_queryStatus": true,
2030
+ "data_win_eventdata_sID": true,
2031
+ "data_win_eventdata_serviceName": true,
2032
+ "data_win_eventdata_serviceType": true,
2033
+ "data_win_eventdata_startType": true,
2034
+ "data_win_eventdata_timestamp": true,
2035
+ "data_win_eventdata_user": true,
2036
+ "data_win_eventdata_utcTime": true,
2037
+ "data_win_system_channel": true,
2038
+ "data_win_system_computer": true,
2039
+ "data_win_system_eventID": true,
2040
+ "data_win_system_eventRecordID": true,
2041
+ "data_win_system_eventSourceName": true,
2042
+ "data_win_system_keywords": true,
2043
+ "data_win_system_level": true,
2044
+ "data_win_system_message": true,
2045
+ "data_win_system_opcode": true,
2046
+ "data_win_system_processID": true,
2047
+ "data_win_system_providerGuid": true,
2048
+ "data_win_system_providerName": true,
2049
+ "data_win_system_severityValue": true,
2050
+ "data_win_system_systemTime": true,
2051
+ "data_win_system_task": true,
2052
+ "data_win_system_threadID": true,
2053
+ "data_win_system_version": true,
2054
+ "decoder_name": true,
2055
+ "dns_answer": true,
2056
+ "dns_answer_city_name": true,
2057
+ "dns_answer_country_code": true,
2058
+ "dns_answer_geolocation": true,
2059
+ "dns_query": true,
2060
+ "dns_response_code": true,
2061
+ "dst_ip": true,
2062
+ "dst_ip_reserved_ip": true,
2063
+ "dst_port": true,
2064
+ "ecs_version": true,
2065
+ "gl2_accounted_message_size": true,
2066
+ "gl2_message_id": true,
2067
+ "gl2_processing_error": true,
2068
+ "gl2_remote_ip": true,
2069
+ "gl2_remote_port": true,
2070
+ "gl2_source_collector": true,
2071
+ "gl2_source_input": true,
2072
+ "gl2_source_node": true,
2073
+ "highlight": true,
2074
+ "host_name": true,
2075
+ "id": true,
2076
+ "location": true,
2077
+ "log_file_path": true,
2078
+ "log_offset": true,
2079
+ "manager_name": true,
2080
+ "message": true,
2081
+ "msg_timestamp": true,
2082
+ "previous_output": true,
2083
+ "process_id": true,
2084
+ "process_image": true,
2085
+ "protocol": true,
2086
+ "rule_description": true,
2087
+ "rule_firedtimes": true,
2088
+ "rule_frequency": true,
2089
+ "rule_gdpr": true,
2090
+ "rule_gpg13": true,
2091
+ "rule_group1": true,
2092
+ "rule_group2": true,
2093
+ "rule_group3": true,
2094
+ "rule_groups": true,
2095
+ "rule_hipaa": true,
2096
+ "rule_id": true,
2097
+ "rule_level": true,
2098
+ "rule_mail": true,
2099
+ "rule_mitre_id": true,
2100
+ "rule_mitre_tactic": true,
2101
+ "rule_mitre_technique": true,
2102
+ "rule_nist_800_53": true,
2103
+ "rule_pci_dss": true,
2104
+ "rule_tsc": true,
2105
+ "sigma_name_encoded": true,
2106
+ "sort": true,
2107
+ "source": true,
2108
+ "source_reserved_ip": true,
2109
+ "src_ip": true,
2110
+ "src_ip_city_name": true,
2111
+ "src_ip_country_code": true,
2112
+ "src_ip_geolocation": true,
2113
+ "src_ip_reserved_ip": true,
2114
+ "src_port": true,
2115
+ "streams": true,
2116
+ "syslog_tag": true,
2117
+ "syslog_type": true,
2118
+ "threat_intel_ioc_source": true,
2119
+ "threat_intel_source_description": true,
2120
+ "threat_intel_timestamp": true,
2121
+ "timestamp": false,
2122
+ "timestamp_utc": true,
2123
+ "traffic_direction": true,
2124
+ "true": true,
2125
+ "user_name": true,
2126
+ "win_system_eventID": true,
2127
+ "windows_event_id": true,
2128
+ "windows_event_severity": false
2129
+ },
2130
+ "indexByName": {
2131
+ "_id": 1,
2132
+ "_index": 3,
2133
+ "_type": 4,
2134
+ "agent_id": 5,
2135
+ "agent_ip": 6,
2136
+ "agent_ip_reserved_ip": 36,
2137
+ "agent_labels_customer": 29,
2138
+ "agent_name": 2,
2139
+ "ask_socfortress_message": 37,
2140
+ "cluster_name": 38,
2141
+ "cluster_node": 39,
2142
+ "data_authors": 40,
2143
+ "data_document": 41,
2144
+ "data_event_AuthenticationPackageName": 42,
2145
+ "data_event_CallTrace": 43,
2146
+ "data_event_CommandLine": 44,
2147
+ "data_event_Company": 45,
2148
+ "data_event_CurrentDirectory": 46,
2149
+ "data_event_Description": 47,
2150
+ "data_event_ElevatedToken": 48,
2151
+ "data_event_Endpoint": 49,
2152
+ "data_event_Environment": 50,
2153
+ "data_event_Error": 51,
2154
+ "data_event_EventsDropped": 52,
2155
+ "data_event_EventsUploaded": 53,
2156
+ "data_event_FailedConnections": 54,
2157
+ "data_event_FileVersion": 55,
2158
+ "data_event_GrantedAccess": 56,
2159
+ "data_event_Hashes": 57,
2160
+ "data_event_Image": 58,
2161
+ "data_event_ImpersonationLevel": 59,
2162
+ "data_event_IntegrityLevel": 60,
2163
+ "data_event_IpAddress": 61,
2164
+ "data_event_IpAddress_reserved_ip": 62,
2165
+ "data_event_IpPort": 63,
2166
+ "data_event_KeyLength": 64,
2167
+ "data_event_LastEventlogWrittenTime": 65,
2168
+ "data_event_LastHttpError": 66,
2169
+ "data_event_LmPackageName": 67,
2170
+ "data_event_LogonGuid": 68,
2171
+ "data_event_LogonId": 69,
2172
+ "data_event_LogonProcessName": 70,
2173
+ "data_event_LogonType": 71,
2174
+ "data_event_MessageNumber": 72,
2175
+ "data_event_MessageTotal": 73,
2176
+ "data_event_OriginalFileName": 74,
2177
+ "data_event_ParentCommandLine": 75,
2178
+ "data_event_ParentImage": 76,
2179
+ "data_event_ParentProcessGuid": 77,
2180
+ "data_event_ParentProcessId": 78,
2181
+ "data_event_ParentUser": 79,
2182
+ "data_event_Path": 80,
2183
+ "data_event_ProcessGuid": 81,
2184
+ "data_event_ProcessId": 82,
2185
+ "data_event_ProcessName": 83,
2186
+ "data_event_Product": 84,
2187
+ "data_event_QueuedTileCleanups": 85,
2188
+ "data_event_QueuedTileCloses": 86,
2189
+ "data_event_RestrictedAdminMode": 87,
2190
+ "data_event_RuleName": 88,
2191
+ "data_event_ScriptBlockId": 89,
2192
+ "data_event_ScriptBlockText": 90,
2193
+ "data_event_SessionId": 91,
2194
+ "data_event_SourceImage": 92,
2195
+ "data_event_SourceProcessGUID": 93,
2196
+ "data_event_SourceProcessId": 94,
2197
+ "data_event_SourceThreadId": 95,
2198
+ "data_event_SourceUser": 96,
2199
+ "data_event_SubjectDomainName": 97,
2200
+ "data_event_SubjectLogonId": 98,
2201
+ "data_event_SubjectUserName": 99,
2202
+ "data_event_SubjectUserSid": 100,
2203
+ "data_event_SuccessfulConnections": 101,
2204
+ "data_event_TargetDomainName": 102,
2205
+ "data_event_TargetImage": 103,
2206
+ "data_event_TargetLinkedLogonId": 104,
2207
+ "data_event_TargetLogonId": 105,
2208
+ "data_event_TargetOutboundDomainName": 106,
2209
+ "data_event_TargetOutboundUserName": 107,
2210
+ "data_event_TargetProcessGUID": 108,
2211
+ "data_event_TargetProcessId": 109,
2212
+ "data_event_TargetUser": 110,
2213
+ "data_event_TargetUserName": 111,
2214
+ "data_event_TargetUserSid": 112,
2215
+ "data_event_TerminalSessionId": 113,
2216
+ "data_event_TransmittedServices": 114,
2217
+ "data_event_User": 115,
2218
+ "data_event_UtcTime": 116,
2219
+ "data_event_VirtualAccount": 117,
2220
+ "data_event_WorkstationName": 118,
2221
+ "data_falsepositives": 120,
2222
+ "data_group": 121,
2223
+ "data_id": 122,
2224
+ "data_kind": 123,
2225
+ "data_level": 124,
2226
+ "data_logsource_category": 125,
2227
+ "data_logsource_definition": 126,
2228
+ "data_logsource_product": 127,
2229
+ "data_logsource_service": 128,
2230
+ "data_message": 129,
2231
+ "data_name": 119,
2232
+ "data_path": 130,
2233
+ "data_references": 131,
2234
+ "data_source": 132,
2235
+ "data_status": 133,
2236
+ "data_system_Channel": 134,
2237
+ "data_system_Computer": 135,
2238
+ "data_system_Correlation": 136,
2239
+ "data_system_Correlation_attributes_ActivityID": 137,
2240
+ "data_system_EventID": 138,
2241
+ "data_system_EventRecordID": 139,
2242
+ "data_system_Execution_attributes_ProcessID": 140,
2243
+ "data_system_Execution_attributes_ThreadID": 141,
2244
+ "data_system_Keywords": 142,
2245
+ "data_system_Level": 143,
2246
+ "data_system_Opcode": 144,
2247
+ "data_system_Provider_attributes_Guid": 145,
2248
+ "data_system_Provider_attributes_Name": 146,
2249
+ "data_system_Security": 147,
2250
+ "data_system_Security_attributes_UserID": 148,
2251
+ "data_system_Task": 149,
2252
+ "data_system_TimeCreated_attributes_SystemTime": 150,
2253
+ "data_system_Version": 151,
2254
+ "data_tags": 152,
2255
+ "data_timestamp": 153,
2256
+ "decoder_name": 7,
2257
+ "gl2_accounted_message_size": 8,
2258
+ "gl2_message_id": 9,
2259
+ "gl2_processing_error": 30,
2260
+ "gl2_remote_ip": 10,
2261
+ "gl2_remote_port": 11,
2262
+ "gl2_source_input": 12,
2263
+ "gl2_source_node": 13,
2264
+ "highlight": 14,
2265
+ "id": 15,
2266
+ "location": 16,
2267
+ "manager_name": 17,
2268
+ "message": 18,
2269
+ "process_id": 154,
2270
+ "rule_description": 19,
2271
+ "rule_firedtimes": 20,
2272
+ "rule_group1": 31,
2273
+ "rule_group2": 32,
2274
+ "rule_group3": 33,
2275
+ "rule_groups": 21,
2276
+ "rule_id": 22,
2277
+ "rule_level": 23,
2278
+ "rule_mail": 24,
2279
+ "sigma_name_encoded": 155,
2280
+ "sort": 25,
2281
+ "source": 26,
2282
+ "source_reserved_ip": 156,
2283
+ "streams": 27,
2284
+ "syslog_level": 34,
2285
+ "syslog_type": 28,
2286
+ "timestamp": 0,
2287
+ "timestamp_utc": 157,
2288
+ "true": 35
2289
+ },
2290
+ "renameByName": {
2291
+ "_id": "EVENT ID",
2292
+ "_type": "",
2293
+ "agent_ip": "SRC IP",
2294
+ "agent_name": "AGENT",
2295
+ "data_base_indicator_access_type": "",
2296
+ "data_base_indicator_id": "OTX IoC ID",
2297
+ "data_base_indicator_indicator": "IoC",
2298
+ "data_base_indicator_indicator_country_code": "",
2299
+ "data_base_indicator_type": "IoC TYPE",
2300
+ "data_falsepositives": "FALSE POSITIVES",
2301
+ "data_name": "DETECTION",
2302
+ "data_opencti_0_node_value": "LABEL",
2303
+ "data_opencti_1_node_value": "LABEL",
2304
+ "data_opencti_2_node_value": "LABEL",
2305
+ "data_opencti_3_node_value": "LABEL",
2306
+ "data_opencti_4_node_value": "LABEL",
2307
+ "data_opencti_5_node_value": "LABEL",
2308
+ "data_opencti_createdBy_contact_information": "",
2309
+ "data_opencti_createdBy_name": "SECURITY FEED",
2310
+ "data_opencti_createdBy_x_opencti_aliases": "",
2311
+ "data_opencti_entity_type": "TYPE",
2312
+ "data_opencti_value": "IoC",
2313
+ "data_opencti_x_opencti_description": "",
2314
+ "data_opencti_x_opencti_score": "SCORE",
2315
+ "data_sections": "OTX SECTIONS",
2316
+ "data_type": "",
2317
+ "data_win_system_message": "MESSAGE",
2318
+ "data_win_system_providerGuid": "",
2319
+ "rule_level": "RULE LEVEL",
2320
+ "syslog_level": "LEVEL",
2321
+ "threat_intel_category": "CAT",
2322
+ "threat_intel_comment": "COMMENT",
2323
+ "threat_intel_ioc_source": "IoC SOURCE",
2324
+ "threat_intel_source_description": "IoC DESC",
2325
+ "threat_intel_type": "IoC TYPE",
2326
+ "threat_intel_value": "IoC",
2327
+ "threat_intel_virustotal_url": "VT URL",
2328
+ "timestamp": "DATE/TIME",
2329
+ "windows_event_severity": "EVENT LOG SEVERITY"
2330
+ }
2331
+ }
2332
+ }
2333
+ ],
2334
+ "transparent": true,
2335
+ "type": "table"
2336
+ }
2337
+ ],
2338
+ "title": "SIGMA RULES DETECTIONS",
2339
+ "type": "row"
2340
+ },
2341
+ {
2342
+ "collapsed": true,
2343
+ "datasource": {
2344
+ "type": "elasticsearch",
2345
+ "uid": "wazuh_datasource_uid"
2346
+ },
2347
+ "gridPos": {
2348
+ "h": 1,
2349
+ "w": 24,
2350
+ "x": 0,
2351
+ "y": 2
2352
+ },
2353
+ "id": 72,
2354
+ "panels": [
2355
+ {
2356
+ "datasource": {
2357
+ "type": "elasticsearch",
2358
+ "uid": "wazuh_datasource_uid"
2359
+ },
2360
+ "fieldConfig": {
2361
+ "defaults": {
2362
+ "mappings": [
2363
+ {
2364
+ "options": {
2365
+ "match": "null",
2366
+ "result": {
2367
+ "text": "N/A"
2368
+ }
2369
+ },
2370
+ "type": "special"
2371
+ }
2372
+ ],
2373
+ "thresholds": {
2374
+ "mode": "absolute",
2375
+ "steps": [
2376
+ {
2377
+ "color": "blue",
2378
+ "value": null
2379
+ }
2380
+ ]
2381
+ },
2382
+ "unit": "short"
2383
+ },
2384
+ "overrides": []
2385
+ },
2386
+ "gridPos": {
2387
+ "h": 8,
2388
+ "w": 4,
2389
+ "x": 0,
2390
+ "y": 23
2391
+ },
2392
+ "id": 113,
2393
+ "links": [],
2394
+ "options": {
2395
+ "colorMode": "value",
2396
+ "graphMode": "area",
2397
+ "justifyMode": "auto",
2398
+ "orientation": "horizontal",
2399
+ "reduceOptions": {
2400
+ "calcs": ["sum"],
2401
+ "fields": "",
2402
+ "values": false
2403
+ },
2404
+ "text": {},
2405
+ "textMode": "auto"
2406
+ },
2407
+ "pluginVersion": "10.0.2",
2408
+ "targets": [
2409
+ {
2410
+ "bucketAggs": [
2411
+ {
2412
+ "$$hashKey": "object:50",
2413
+ "field": "timestamp",
2414
+ "id": "2",
2415
+ "settings": {
2416
+ "interval": "auto",
2417
+ "min_doc_count": 0,
2418
+ "trimEdges": 0
2419
+ },
2420
+ "type": "date_histogram"
2421
+ }
2422
+ ],
2423
+ "datasource": {
2424
+ "type": "elasticsearch",
2425
+ "uid": "wazuh_datasource_uid"
2426
+ },
2427
+ "metrics": [
2428
+ {
2429
+ "$$hashKey": "object:48",
2430
+ "field": "select field",
2431
+ "id": "1",
2432
+ "type": "count"
2433
+ }
2434
+ ],
2435
+ "query": "rule_group2:windows_defender AND agent_name:$agent_name",
2436
+ "refId": "A",
2437
+ "timeField": "timestamp"
2438
+ }
2439
+ ],
2440
+ "title": "WINDOWS DEFENDER - EVENTS",
2441
+ "type": "stat"
2442
+ },
2443
+ {
2444
+ "datasource": {
2445
+ "type": "elasticsearch",
2446
+ "uid": "wazuh_datasource_uid"
2447
+ },
2448
+ "fieldConfig": {
2449
+ "defaults": {
2450
+ "color": {
2451
+ "mode": "palette-classic"
2452
+ },
2453
+ "custom": {
2454
+ "hideFrom": {
2455
+ "legend": false,
2456
+ "tooltip": false,
2457
+ "viz": false
2458
+ }
2459
+ },
2460
+ "decimals": 0,
2461
+ "mappings": [],
2462
+ "unit": "short"
2463
+ },
2464
+ "overrides": [
2465
+ {
2466
+ "matcher": {
2467
+ "id": "byName",
2468
+ "options": "1"
2469
+ },
2470
+ "properties": [
2471
+ {
2472
+ "id": "color",
2473
+ "value": {
2474
+ "fixedColor": "#FF9830",
2475
+ "mode": "fixed"
2476
+ }
2477
+ }
2478
+ ]
2479
+ },
2480
+ {
2481
+ "matcher": {
2482
+ "id": "byName",
2483
+ "options": "Alert"
2484
+ },
2485
+ "properties": [
2486
+ {
2487
+ "id": "color",
2488
+ "value": {
2489
+ "fixedColor": "#F2495C",
2490
+ "mode": "fixed"
2491
+ }
2492
+ }
2493
+ ]
2494
+ },
2495
+ {
2496
+ "matcher": {
2497
+ "id": "byName",
2498
+ "options": "Error"
2499
+ },
2500
+ "properties": [
2501
+ {
2502
+ "id": "color",
2503
+ "value": {
2504
+ "fixedColor": "#F2495C",
2505
+ "mode": "fixed"
2506
+ }
2507
+ }
2508
+ ]
2509
+ },
2510
+ {
2511
+ "matcher": {
2512
+ "id": "byName",
2513
+ "options": "Info"
2514
+ },
2515
+ "properties": [
2516
+ {
2517
+ "id": "color",
2518
+ "value": {
2519
+ "fixedColor": "#73BF69",
2520
+ "mode": "fixed"
2521
+ }
2522
+ }
2523
+ ]
2524
+ },
2525
+ {
2526
+ "matcher": {
2527
+ "id": "byName",
2528
+ "options": "NOTICE"
2529
+ },
2530
+ "properties": [
2531
+ {
2532
+ "id": "color",
2533
+ "value": {
2534
+ "fixedColor": "#5794F2",
2535
+ "mode": "fixed"
2536
+ }
2537
+ }
2538
+ ]
2539
+ },
2540
+ {
2541
+ "matcher": {
2542
+ "id": "byName",
2543
+ "options": "Notice"
2544
+ },
2545
+ "properties": [
2546
+ {
2547
+ "id": "color",
2548
+ "value": {
2549
+ "fixedColor": "#5794F2",
2550
+ "mode": "fixed"
2551
+ }
2552
+ }
2553
+ ]
2554
+ },
2555
+ {
2556
+ "matcher": {
2557
+ "id": "byName",
2558
+ "options": "Result"
2559
+ },
2560
+ "properties": [
2561
+ {
2562
+ "id": "color",
2563
+ "value": {
2564
+ "fixedColor": "#B877D9",
2565
+ "mode": "fixed"
2566
+ }
2567
+ }
2568
+ ]
2569
+ },
2570
+ {
2571
+ "matcher": {
2572
+ "id": "byName",
2573
+ "options": "Warning"
2574
+ },
2575
+ "properties": [
2576
+ {
2577
+ "id": "color",
2578
+ "value": {
2579
+ "fixedColor": "#FF9830",
2580
+ "mode": "fixed"
2581
+ }
2582
+ }
2583
+ ]
2584
+ },
2585
+ {
2586
+ "matcher": {
2587
+ "id": "byName",
2588
+ "options": "INFORMATION"
2589
+ },
2590
+ "properties": [
2591
+ {
2592
+ "id": "color",
2593
+ "value": {
2594
+ "fixedColor": "green",
2595
+ "mode": "fixed"
2596
+ }
2597
+ }
2598
+ ]
2599
+ },
2600
+ {
2601
+ "matcher": {
2602
+ "id": "byName",
2603
+ "options": "WARNING"
2604
+ },
2605
+ "properties": [
2606
+ {
2607
+ "id": "color",
2608
+ "value": {
2609
+ "fixedColor": "orange",
2610
+ "mode": "fixed"
2611
+ }
2612
+ }
2613
+ ]
2614
+ },
2615
+ {
2616
+ "matcher": {
2617
+ "id": "byName",
2618
+ "options": "ERROR"
2619
+ },
2620
+ "properties": [
2621
+ {
2622
+ "id": "color",
2623
+ "value": {
2624
+ "fixedColor": "red",
2625
+ "mode": "fixed"
2626
+ }
2627
+ }
2628
+ ]
2629
+ }
2630
+ ]
2631
+ },
2632
+ "gridPos": {
2633
+ "h": 8,
2634
+ "w": 5,
2635
+ "x": 4,
2636
+ "y": 23
2637
+ },
2638
+ "id": 68,
2639
+ "links": [],
2640
+ "maxDataPoints": 3,
2641
+ "options": {
2642
+ "displayLabels": [],
2643
+ "legend": {
2644
+ "calcs": [],
2645
+ "displayMode": "table",
2646
+ "placement": "right",
2647
+ "showLegend": true,
2648
+ "values": ["value"]
2649
+ },
2650
+ "pieType": "donut",
2651
+ "reduceOptions": {
2652
+ "calcs": ["sum"],
2653
+ "fields": "",
2654
+ "values": false
2655
+ },
2656
+ "text": {},
2657
+ "tooltip": {
2658
+ "mode": "single",
2659
+ "sort": "none"
2660
+ }
2661
+ },
2662
+ "targets": [
2663
+ {
2664
+ "bucketAggs": [
2665
+ {
2666
+ "$$hashKey": "object:73",
2667
+ "fake": true,
2668
+ "field": "data_win_system_severityValue",
2669
+ "id": "3",
2670
+ "settings": {
2671
+ "min_doc_count": 1,
2672
+ "order": "desc",
2673
+ "orderBy": "_count",
2674
+ "size": "0"
2675
+ },
2676
+ "type": "terms"
2677
+ },
2678
+ {
2679
+ "$$hashKey": "object:74",
2680
+ "field": "timestamp",
2681
+ "id": "2",
2682
+ "settings": {
2683
+ "interval": "auto",
2684
+ "min_doc_count": 0,
2685
+ "trimEdges": 0
2686
+ },
2687
+ "type": "date_histogram"
2688
+ }
2689
+ ],
2690
+ "datasource": {
2691
+ "type": "elasticsearch",
2692
+ "uid": "wazuh_datasource_uid"
2693
+ },
2694
+ "metrics": [
2695
+ {
2696
+ "$$hashKey": "object:71",
2697
+ "field": "select field",
2698
+ "id": "1",
2699
+ "type": "count"
2700
+ }
2701
+ ],
2702
+ "query": "rule_group2:windows_defender AND agent_name:$agent_name",
2703
+ "refId": "A",
2704
+ "timeField": "timestamp"
2705
+ }
2706
+ ],
2707
+ "title": "WINDOWS DEFENDER - SEVERITY LEVELS",
2708
+ "type": "piechart"
2709
+ },
2710
+ {
2711
+ "datasource": {
2712
+ "type": "elasticsearch",
2713
+ "uid": "wazuh_datasource_uid"
2714
+ },
2715
+ "fieldConfig": {
2716
+ "defaults": {
2717
+ "custom": {
2718
+ "align": "auto",
2719
+ "cellOptions": {
2720
+ "type": "auto"
2721
+ },
2722
+ "filterable": false,
2723
+ "inspect": false
2724
+ },
2725
+ "mappings": [],
2726
+ "thresholds": {
2727
+ "mode": "absolute",
2728
+ "steps": [
2729
+ {
2730
+ "color": "blue",
2731
+ "value": null
2732
+ },
2733
+ {
2734
+ "color": "red",
2735
+ "value": 50
2736
+ }
2737
+ ]
2738
+ }
2739
+ },
2740
+ "overrides": [
2741
+ {
2742
+ "matcher": {
2743
+ "id": "byName",
2744
+ "options": "Count"
2745
+ },
2746
+ "properties": [
2747
+ {
2748
+ "id": "custom.cellOptions",
2749
+ "value": {
2750
+ "mode": "basic",
2751
+ "type": "gauge"
2752
+ }
2753
+ }
2754
+ ]
2755
+ },
2756
+ {
2757
+ "matcher": {
2758
+ "id": "byName",
2759
+ "options": "rule_description"
2760
+ },
2761
+ "properties": [
2762
+ {
2763
+ "id": "custom.width",
2764
+ "value": 703
2765
+ }
2766
+ ]
2767
+ },
2768
+ {
2769
+ "matcher": {
2770
+ "id": "byName",
2771
+ "options": "rule_level"
2772
+ },
2773
+ "properties": [
2774
+ {
2775
+ "id": "custom.width",
2776
+ "value": 212
2777
+ },
2778
+ {
2779
+ "id": "mappings",
2780
+ "value": [
2781
+ {
2782
+ "options": {
2783
+ "from": 1,
2784
+ "result": {
2785
+ "color": "green",
2786
+ "index": 0
2787
+ },
2788
+ "to": 3
2789
+ },
2790
+ "type": "range"
2791
+ },
2792
+ {
2793
+ "options": {
2794
+ "from": 4,
2795
+ "result": {
2796
+ "color": "dark-yellow",
2797
+ "index": 1
2798
+ },
2799
+ "to": 6
2800
+ },
2801
+ "type": "range"
2802
+ },
2803
+ {
2804
+ "options": {
2805
+ "from": 7,
2806
+ "result": {
2807
+ "color": "orange",
2808
+ "index": 2
2809
+ },
2810
+ "to": 9
2811
+ },
2812
+ "type": "range"
2813
+ },
2814
+ {
2815
+ "options": {
2816
+ "from": 10,
2817
+ "result": {
2818
+ "color": "semi-dark-red",
2819
+ "index": 3
2820
+ },
2821
+ "to": 15
2822
+ },
2823
+ "type": "range"
2824
+ }
2825
+ ]
2826
+ }
2827
+ ]
2828
+ }
2829
+ ]
2830
+ },
2831
+ "gridPos": {
2832
+ "h": 8,
2833
+ "w": 15,
2834
+ "x": 9,
2835
+ "y": 23
2836
+ },
2837
+ "id": 115,
2838
+ "links": [],
2839
+ "maxDataPoints": 3,
2840
+ "options": {
2841
+ "cellHeight": "sm",
2842
+ "footer": {
2843
+ "countRows": false,
2844
+ "fields": "",
2845
+ "reducer": ["sum"],
2846
+ "show": false
2847
+ },
2848
+ "showHeader": true,
2849
+ "sortBy": []
2850
+ },
2851
+ "pluginVersion": "10.0.2",
2852
+ "targets": [
2853
+ {
2854
+ "bucketAggs": [
2855
+ {
2856
+ "$$hashKey": "object:3082",
2857
+ "fake": true,
2858
+ "field": "rule_description",
2859
+ "id": "4",
2860
+ "settings": {
2861
+ "min_doc_count": 0,
2862
+ "order": "desc",
2863
+ "orderBy": "_count",
2864
+ "size": "10"
2865
+ },
2866
+ "type": "terms"
2867
+ },
2868
+ {
2869
+ "$$hashKey": "object:73",
2870
+ "fake": true,
2871
+ "field": "rule_level",
2872
+ "id": "3",
2873
+ "settings": {
2874
+ "min_doc_count": 1,
2875
+ "order": "desc",
2876
+ "orderBy": "_count",
2877
+ "size": "0"
2878
+ },
2879
+ "type": "terms"
2880
+ }
2881
+ ],
2882
+ "datasource": {
2883
+ "type": "elasticsearch",
2884
+ "uid": "wazuh_datasource_uid"
2885
+ },
2886
+ "metrics": [
2887
+ {
2888
+ "$$hashKey": "object:71",
2889
+ "field": "select field",
2890
+ "id": "1",
2891
+ "type": "count"
2892
+ }
2893
+ ],
2894
+ "query": "rule_group2:windows_defender AND agent_name:$agent_name",
2895
+ "refId": "A",
2896
+ "timeField": "timestamp"
2897
+ }
2898
+ ],
2899
+ "title": "WINDOWS DEFENDER - EVENTS BY TYPE",
2900
+ "type": "table"
2901
+ },
2902
+ {
2903
+ "datasource": {
2904
+ "type": "elasticsearch",
2905
+ "uid": "wazuh_datasource_uid"
2906
+ },
2907
+ "fieldConfig": {
2908
+ "defaults": {
2909
+ "custom": {
2910
+ "align": "auto",
2911
+ "cellOptions": {
2912
+ "type": "auto"
2913
+ },
2914
+ "filterable": false,
2915
+ "inspect": false
2916
+ },
2917
+ "mappings": [],
2918
+ "thresholds": {
2919
+ "mode": "absolute",
2920
+ "steps": [
2921
+ {
2922
+ "color": "green",
2923
+ "value": null
2924
+ },
2925
+ {
2926
+ "color": "red",
2927
+ "value": 80
2928
+ }
2929
+ ]
2930
+ }
2931
+ },
2932
+ "overrides": [
2933
+ {
2934
+ "matcher": {
2935
+ "id": "byName",
2936
+ "options": "agent_name"
2937
+ },
2938
+ "properties": [
2939
+ {
2940
+ "id": "custom.width",
2941
+ "value": 492
2942
+ }
2943
+ ]
2944
+ }
2945
+ ]
2946
+ },
2947
+ "gridPos": {
2948
+ "h": 7,
2949
+ "w": 9,
2950
+ "x": 0,
2951
+ "y": 31
2952
+ },
2953
+ "id": 70,
2954
+ "links": [],
2955
+ "maxDataPoints": 3,
2956
+ "options": {
2957
+ "cellHeight": "sm",
2958
+ "footer": {
2959
+ "countRows": false,
2960
+ "fields": "",
2961
+ "reducer": ["sum"],
2962
+ "show": false
2963
+ },
2964
+ "showHeader": true,
2965
+ "sortBy": []
2966
+ },
2967
+ "pluginVersion": "10.0.2",
2968
+ "targets": [
2969
+ {
2970
+ "bucketAggs": [
2971
+ {
2972
+ "$$hashKey": "object:73",
2973
+ "fake": true,
2974
+ "field": "agent_name",
2975
+ "id": "3",
2976
+ "settings": {
2977
+ "min_doc_count": 1,
2978
+ "order": "desc",
2979
+ "orderBy": "_count",
2980
+ "size": "0"
2981
+ },
2982
+ "type": "terms"
2983
+ }
2984
+ ],
2985
+ "datasource": {
2986
+ "type": "elasticsearch",
2987
+ "uid": "wazuh_datasource_uid"
2988
+ },
2989
+ "metrics": [
2990
+ {
2991
+ "$$hashKey": "object:71",
2992
+ "field": "select field",
2993
+ "id": "1",
2994
+ "type": "count"
2995
+ }
2996
+ ],
2997
+ "query": "rule_group2:windows_defender AND agent_name:$agent_name",
2998
+ "refId": "A",
2999
+ "timeField": "timestamp"
3000
+ }
3001
+ ],
3002
+ "title": "WINDOWS DEFENDER - EVENTS BY AGENT",
3003
+ "type": "table"
3004
+ },
3005
+ {
3006
+ "aliasColors": {},
3007
+ "bars": true,
3008
+ "dashLength": 10,
3009
+ "dashes": false,
3010
+ "datasource": {
3011
+ "type": "elasticsearch",
3012
+ "uid": "wazuh_datasource_uid"
3013
+ },
3014
+ "fill": 1,
3015
+ "fillGradient": 0,
3016
+ "gridPos": {
3017
+ "h": 7,
3018
+ "w": 15,
3019
+ "x": 9,
3020
+ "y": 31
3021
+ },
3022
+ "hiddenSeries": false,
3023
+ "id": 83,
3024
+ "legend": {
3025
+ "alignAsTable": true,
3026
+ "avg": false,
3027
+ "current": false,
3028
+ "max": false,
3029
+ "min": false,
3030
+ "rightSide": true,
3031
+ "show": true,
3032
+ "total": false,
3033
+ "values": false
3034
+ },
3035
+ "lines": false,
3036
+ "linewidth": 1,
3037
+ "links": [],
3038
+ "maxDataPoints": 3,
3039
+ "nullPointMode": "null",
3040
+ "options": {
3041
+ "alertThreshold": true
3042
+ },
3043
+ "percentage": false,
3044
+ "pluginVersion": "10.0.2",
3045
+ "pointradius": 2,
3046
+ "points": false,
3047
+ "renderer": "flot",
3048
+ "seriesOverrides": [],
3049
+ "spaceLength": 10,
3050
+ "stack": true,
3051
+ "steppedLine": false,
3052
+ "targets": [
3053
+ {
3054
+ "alias": "",
3055
+ "bucketAggs": [
3056
+ {
3057
+ "field": "agent_name",
3058
+ "id": "4",
3059
+ "settings": {
3060
+ "min_doc_count": "1",
3061
+ "order": "desc",
3062
+ "orderBy": "_count",
3063
+ "size": "10"
3064
+ },
3065
+ "type": "terms"
3066
+ },
3067
+ {
3068
+ "field": "timestamp",
3069
+ "id": "5",
3070
+ "settings": {
3071
+ "interval": "auto",
3072
+ "min_doc_count": "0",
3073
+ "trimEdges": "0"
3074
+ },
3075
+ "type": "date_histogram"
3076
+ }
3077
+ ],
3078
+ "datasource": {
3079
+ "type": "elasticsearch",
3080
+ "uid": "wazuh_datasource_uid"
3081
+ },
3082
+ "metrics": [
3083
+ {
3084
+ "$$hashKey": "object:71",
3085
+ "field": "select field",
3086
+ "id": "1",
3087
+ "type": "count"
3088
+ }
3089
+ ],
3090
+ "query": "rule_group2:windows_defender AND agent_name:$agent_name",
3091
+ "refId": "A",
3092
+ "timeField": "timestamp"
3093
+ }
3094
+ ],
3095
+ "thresholds": [],
3096
+ "timeRegions": [],
3097
+ "title": "WINDOWS DEFENDER - EVENTS BY AGENT (HISTOGRAM)",
3098
+ "tooltip": {
3099
+ "shared": true,
3100
+ "sort": 0,
3101
+ "value_type": "individual"
3102
+ },
3103
+ "type": "graph",
3104
+ "xaxis": {
3105
+ "mode": "time",
3106
+ "show": true,
3107
+ "values": []
3108
+ },
3109
+ "yaxes": [
3110
+ {
3111
+ "format": "short",
3112
+ "logBase": 1,
3113
+ "show": true
3114
+ },
3115
+ {
3116
+ "format": "short",
3117
+ "logBase": 1,
3118
+ "show": true
3119
+ }
3120
+ ],
3121
+ "yaxis": {
3122
+ "align": false
3123
+ }
3124
+ },
3125
+ {
3126
+ "datasource": {
3127
+ "type": "elasticsearch",
3128
+ "uid": "wazuh_datasource_uid"
3129
+ },
3130
+ "fieldConfig": {
3131
+ "defaults": {
3132
+ "color": {
3133
+ "mode": "thresholds"
3134
+ },
3135
+ "custom": {
3136
+ "align": "auto",
3137
+ "cellOptions": {
3138
+ "type": "auto"
3139
+ },
3140
+ "inspect": false
3141
+ },
3142
+ "mappings": [],
3143
+ "thresholds": {
3144
+ "mode": "absolute",
3145
+ "steps": [
3146
+ {
3147
+ "color": "green",
3148
+ "value": null
3149
+ },
3150
+ {
3151
+ "color": "red",
3152
+ "value": 80
3153
+ }
3154
+ ]
3155
+ }
3156
+ },
3157
+ "overrides": [
3158
+ {
3159
+ "matcher": {
3160
+ "id": "byName",
3161
+ "options": "rule_level"
3162
+ },
3163
+ "properties": [
3164
+ {
3165
+ "id": "custom.width",
3166
+ "value": 93
3167
+ }
3168
+ ]
3169
+ },
3170
+ {
3171
+ "matcher": {
3172
+ "id": "byName",
3173
+ "options": "windows_event_id"
3174
+ },
3175
+ "properties": [
3176
+ {
3177
+ "id": "custom.width",
3178
+ "value": 186
3179
+ }
3180
+ ]
3181
+ },
3182
+ {
3183
+ "matcher": {
3184
+ "id": "byName",
3185
+ "options": "DATE/TIME"
3186
+ },
3187
+ "properties": [
3188
+ {
3189
+ "id": "custom.width",
3190
+ "value": 202
3191
+ }
3192
+ ]
3193
+ },
3194
+ {
3195
+ "matcher": {
3196
+ "id": "byName",
3197
+ "options": "AGENT"
3198
+ },
3199
+ "properties": [
3200
+ {
3201
+ "id": "custom.width",
3202
+ "value": 171
3203
+ }
3204
+ ]
3205
+ },
3206
+ {
3207
+ "matcher": {
3208
+ "id": "byName",
3209
+ "options": "SRC IP"
3210
+ },
3211
+ "properties": [
3212
+ {
3213
+ "id": "custom.width",
3214
+ "value": 167
3215
+ }
3216
+ ]
3217
+ },
3218
+ {
3219
+ "matcher": {
3220
+ "id": "byName",
3221
+ "options": "MESSAGE"
3222
+ },
3223
+ "properties": [
3224
+ {
3225
+ "id": "custom.width",
3226
+ "value": 1519
3227
+ }
3228
+ ]
3229
+ },
3230
+ {
3231
+ "matcher": {
3232
+ "id": "byName",
3233
+ "options": "rule_description"
3234
+ },
3235
+ "properties": [
3236
+ {
3237
+ "id": "custom.width",
3238
+ "value": 524
3239
+ }
3240
+ ]
3241
+ },
3242
+ {
3243
+ "matcher": {
3244
+ "id": "byName",
3245
+ "options": "EVENT ID"
3246
+ },
3247
+ "properties": [
3248
+ {
3249
+ "id": "links",
3250
+ "value": [
3251
+ {
3252
+ "targetBlank": true,
3253
+ "title": "VIEW EVENT DETAILS",
3254
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
3255
+ }
3256
+ ]
3257
+ }
3258
+ ]
3259
+ }
3260
+ ]
3261
+ },
3262
+ "gridPos": {
3263
+ "h": 10,
3264
+ "w": 24,
3265
+ "x": 0,
3266
+ "y": 38
3267
+ },
3268
+ "id": 85,
3269
+ "options": {
3270
+ "cellHeight": "sm",
3271
+ "footer": {
3272
+ "countRows": false,
3273
+ "fields": "",
3274
+ "reducer": ["sum"],
3275
+ "show": false
3276
+ },
3277
+ "showHeader": true,
3278
+ "sortBy": []
3279
+ },
3280
+ "pluginVersion": "10.0.2",
3281
+ "targets": [
3282
+ {
3283
+ "alias": "",
3284
+ "bucketAggs": [],
3285
+ "datasource": {
3286
+ "type": "elasticsearch",
3287
+ "uid": "wazuh_datasource_uid"
3288
+ },
3289
+ "metrics": [
3290
+ {
3291
+ "id": "1",
3292
+ "settings": {
3293
+ "size": "500"
3294
+ },
3295
+ "type": "raw_data"
3296
+ }
3297
+ ],
3298
+ "query": "rule_groups:*windows_defender AND agent_name:$agent_name",
3299
+ "queryType": "lucene",
3300
+ "refId": "A",
3301
+ "timeField": "timestamp"
3302
+ }
3303
+ ],
3304
+ "title": "WINDOWS DEFENDER - EVENTS",
3305
+ "transformations": [
3306
+ {
3307
+ "id": "organize",
3308
+ "options": {
3309
+ "excludeByName": {
3310
+ "@metadata_beat": true,
3311
+ "@metadata_type": true,
3312
+ "@metadata_version": true,
3313
+ "_id": false,
3314
+ "_index": true,
3315
+ "_type": true,
3316
+ "agent_ephemeral_id": true,
3317
+ "agent_hostname": true,
3318
+ "agent_id": true,
3319
+ "agent_ip": false,
3320
+ "agent_ip_city_name": true,
3321
+ "agent_ip_country_code": true,
3322
+ "agent_ip_geolocation": true,
3323
+ "agent_labels_customer": true,
3324
+ "agent_name": false,
3325
+ "agent_type": true,
3326
+ "agent_version": true,
3327
+ "beats_type": true,
3328
+ "collector_node_id": true,
3329
+ "data_win_eventdata_domain": true,
3330
+ "data_win_eventdata_imagePath": true,
3331
+ "data_win_eventdata_sID": true,
3332
+ "data_win_eventdata_serviceName": true,
3333
+ "data_win_eventdata_serviceType": true,
3334
+ "data_win_eventdata_startType": true,
3335
+ "data_win_eventdata_timestamp": true,
3336
+ "data_win_eventdata_user": true,
3337
+ "data_win_system_channel": true,
3338
+ "data_win_system_computer": true,
3339
+ "data_win_system_eventID": true,
3340
+ "data_win_system_eventRecordID": true,
3341
+ "data_win_system_eventSourceName": true,
3342
+ "data_win_system_keywords": true,
3343
+ "data_win_system_level": true,
3344
+ "data_win_system_opcode": true,
3345
+ "data_win_system_processID": true,
3346
+ "data_win_system_providerGuid": true,
3347
+ "data_win_system_providerName": true,
3348
+ "data_win_system_severityValue": true,
3349
+ "data_win_system_systemTime": true,
3350
+ "data_win_system_task": true,
3351
+ "data_win_system_threadID": true,
3352
+ "data_win_system_version": true,
3353
+ "decoder_name": true,
3354
+ "ecs_version": true,
3355
+ "gl2_accounted_message_size": true,
3356
+ "gl2_message_id": true,
3357
+ "gl2_processing_error": true,
3358
+ "gl2_remote_ip": true,
3359
+ "gl2_remote_port": true,
3360
+ "gl2_source_collector": true,
3361
+ "gl2_source_input": true,
3362
+ "gl2_source_node": true,
3363
+ "highlight": true,
3364
+ "host_name": true,
3365
+ "id": true,
3366
+ "location": true,
3367
+ "log_file_path": true,
3368
+ "log_offset": true,
3369
+ "manager_name": true,
3370
+ "message": true,
3371
+ "previous_output": true,
3372
+ "rule_description": true,
3373
+ "rule_firedtimes": true,
3374
+ "rule_frequency": true,
3375
+ "rule_gdpr": true,
3376
+ "rule_gpg13": true,
3377
+ "rule_group1": true,
3378
+ "rule_group2": true,
3379
+ "rule_groups": true,
3380
+ "rule_hipaa": true,
3381
+ "rule_id": true,
3382
+ "rule_mail": true,
3383
+ "rule_mitre_id": true,
3384
+ "rule_mitre_tactic": true,
3385
+ "rule_mitre_technique": true,
3386
+ "rule_nist_800_53": true,
3387
+ "rule_pci_dss": true,
3388
+ "rule_tsc": true,
3389
+ "sort": true,
3390
+ "source": true,
3391
+ "src_ip": true,
3392
+ "src_ip_city_name": true,
3393
+ "src_ip_country_code": true,
3394
+ "src_ip_geolocation": true,
3395
+ "streams": true,
3396
+ "syslog_tag": true,
3397
+ "syslog_type": true,
3398
+ "timestamp": false,
3399
+ "user_name": true,
3400
+ "win_system_eventID": true,
3401
+ "windows_event_id": true,
3402
+ "windows_event_severity": false
3403
+ },
3404
+ "indexByName": {
3405
+ "_id": 1,
3406
+ "_index": 3,
3407
+ "_type": 4,
3408
+ "agent_id": 5,
3409
+ "agent_ip": 6,
3410
+ "agent_ip_city_name": 7,
3411
+ "agent_ip_country_code": 8,
3412
+ "agent_ip_geolocation": 9,
3413
+ "agent_labels_customer": 57,
3414
+ "agent_name": 2,
3415
+ "data_win_eventdata_domain": 10,
3416
+ "data_win_eventdata_sID": 11,
3417
+ "data_win_eventdata_timestamp": 58,
3418
+ "data_win_eventdata_user": 12,
3419
+ "data_win_system_channel": 13,
3420
+ "data_win_system_computer": 14,
3421
+ "data_win_system_eventID": 15,
3422
+ "data_win_system_eventRecordID": 16,
3423
+ "data_win_system_keywords": 17,
3424
+ "data_win_system_level": 18,
3425
+ "data_win_system_message": 19,
3426
+ "data_win_system_opcode": 20,
3427
+ "data_win_system_processID": 21,
3428
+ "data_win_system_providerGuid": 22,
3429
+ "data_win_system_providerName": 23,
3430
+ "data_win_system_severityValue": 24,
3431
+ "data_win_system_systemTime": 25,
3432
+ "data_win_system_task": 26,
3433
+ "data_win_system_threadID": 27,
3434
+ "data_win_system_version": 28,
3435
+ "decoder_name": 29,
3436
+ "gl2_accounted_message_size": 30,
3437
+ "gl2_message_id": 31,
3438
+ "gl2_processing_error": 59,
3439
+ "gl2_remote_ip": 32,
3440
+ "gl2_remote_port": 33,
3441
+ "gl2_source_input": 34,
3442
+ "gl2_source_node": 35,
3443
+ "highlight": 36,
3444
+ "id": 37,
3445
+ "location": 38,
3446
+ "manager_name": 39,
3447
+ "message": 40,
3448
+ "rule_description": 41,
3449
+ "rule_firedtimes": 42,
3450
+ "rule_gdpr": 43,
3451
+ "rule_gpg13": 44,
3452
+ "rule_group1": 60,
3453
+ "rule_group2": 61,
3454
+ "rule_groups": 45,
3455
+ "rule_hipaa": 46,
3456
+ "rule_id": 47,
3457
+ "rule_level": 48,
3458
+ "rule_mail": 49,
3459
+ "rule_nist_800_53": 50,
3460
+ "rule_pci_dss": 51,
3461
+ "rule_tsc": 52,
3462
+ "sort": 53,
3463
+ "source": 54,
3464
+ "streams": 55,
3465
+ "syslog_level": 62,
3466
+ "syslog_type": 56,
3467
+ "timestamp": 0,
3468
+ "true": 63
3469
+ },
3470
+ "renameByName": {
3471
+ "_id": "EVENT ID",
3472
+ "agent_ip": "SRC IP",
3473
+ "agent_name": "AGENT",
3474
+ "data_win_system_message": "MESSAGE",
3475
+ "data_win_system_providerGuid": "",
3476
+ "rule_level": "RULE LEVEL",
3477
+ "timestamp": "DATE/TIME",
3478
+ "windows_event_severity": "EVENT LOG SEVERITY"
3479
+ }
3480
+ }
3481
+ }
3482
+ ],
3483
+ "type": "table"
3484
+ }
3485
+ ],
3486
+ "title": "WINDOWS DEFENDER AV",
3487
+ "type": "row"
3488
+ },
3489
+ {
3490
+ "collapsed": true,
3491
+ "datasource": {
3492
+ "type": "elasticsearch",
3493
+ "uid": "wazuh_datasource_uid"
3494
+ },
3495
+ "gridPos": {
3496
+ "h": 1,
3497
+ "w": 24,
3498
+ "x": 0,
3499
+ "y": 3
3500
+ },
3501
+ "id": 99,
3502
+ "panels": [
3503
+ {
3504
+ "datasource": {
3505
+ "type": "elasticsearch",
3506
+ "uid": "wazuh_datasource_uid"
3507
+ },
3508
+ "fieldConfig": {
3509
+ "defaults": {
3510
+ "mappings": [
3511
+ {
3512
+ "options": {
3513
+ "match": "null",
3514
+ "result": {
3515
+ "text": "N/A"
3516
+ }
3517
+ },
3518
+ "type": "special"
3519
+ }
3520
+ ],
3521
+ "thresholds": {
3522
+ "mode": "absolute",
3523
+ "steps": [
3524
+ {
3525
+ "color": "orange",
3526
+ "value": null
3527
+ }
3528
+ ]
3529
+ },
3530
+ "unit": "short"
3531
+ },
3532
+ "overrides": []
3533
+ },
3534
+ "gridPos": {
3535
+ "h": 7,
3536
+ "w": 4,
3537
+ "x": 0,
3538
+ "y": 24
3539
+ },
3540
+ "id": 100,
3541
+ "links": [],
3542
+ "options": {
3543
+ "colorMode": "value",
3544
+ "graphMode": "area",
3545
+ "justifyMode": "auto",
3546
+ "orientation": "horizontal",
3547
+ "reduceOptions": {
3548
+ "calcs": ["sum"],
3549
+ "fields": "",
3550
+ "values": false
3551
+ },
3552
+ "text": {},
3553
+ "textMode": "auto"
3554
+ },
3555
+ "pluginVersion": "10.0.2",
3556
+ "targets": [
3557
+ {
3558
+ "bucketAggs": [
3559
+ {
3560
+ "$$hashKey": "object:50",
3561
+ "field": "timestamp",
3562
+ "id": "2",
3563
+ "settings": {
3564
+ "interval": "auto",
3565
+ "min_doc_count": 0,
3566
+ "trimEdges": 0
3567
+ },
3568
+ "type": "date_histogram"
3569
+ }
3570
+ ],
3571
+ "datasource": {
3572
+ "type": "elasticsearch",
3573
+ "uid": "wazuh_datasource_uid"
3574
+ },
3575
+ "metrics": [
3576
+ {
3577
+ "$$hashKey": "object:48",
3578
+ "field": "select field",
3579
+ "id": "1",
3580
+ "type": "count"
3581
+ }
3582
+ ],
3583
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
3584
+ "refId": "A",
3585
+ "timeField": "timestamp"
3586
+ }
3587
+ ],
3588
+ "title": "WINDOWS SIGCHECK - EVENTS",
3589
+ "type": "stat"
3590
+ },
3591
+ {
3592
+ "datasource": {
3593
+ "type": "elasticsearch",
3594
+ "uid": "wazuh_datasource_uid"
3595
+ },
3596
+ "fieldConfig": {
3597
+ "defaults": {
3598
+ "color": {
3599
+ "mode": "palette-classic"
3600
+ },
3601
+ "custom": {
3602
+ "hideFrom": {
3603
+ "legend": false,
3604
+ "tooltip": false,
3605
+ "viz": false
3606
+ }
3607
+ },
3608
+ "decimals": 0,
3609
+ "mappings": [],
3610
+ "unit": "short"
3611
+ },
3612
+ "overrides": [
3613
+ {
3614
+ "matcher": {
3615
+ "id": "byName",
3616
+ "options": "1"
3617
+ },
3618
+ "properties": [
3619
+ {
3620
+ "id": "color",
3621
+ "value": {
3622
+ "fixedColor": "#FF9830",
3623
+ "mode": "fixed"
3624
+ }
3625
+ }
3626
+ ]
3627
+ },
3628
+ {
3629
+ "matcher": {
3630
+ "id": "byName",
3631
+ "options": "Alert"
3632
+ },
3633
+ "properties": [
3634
+ {
3635
+ "id": "color",
3636
+ "value": {
3637
+ "fixedColor": "#F2495C",
3638
+ "mode": "fixed"
3639
+ }
3640
+ }
3641
+ ]
3642
+ },
3643
+ {
3644
+ "matcher": {
3645
+ "id": "byName",
3646
+ "options": "Error"
3647
+ },
3648
+ "properties": [
3649
+ {
3650
+ "id": "color",
3651
+ "value": {
3652
+ "fixedColor": "#F2495C",
3653
+ "mode": "fixed"
3654
+ }
3655
+ }
3656
+ ]
3657
+ },
3658
+ {
3659
+ "matcher": {
3660
+ "id": "byName",
3661
+ "options": "Info"
3662
+ },
3663
+ "properties": [
3664
+ {
3665
+ "id": "color",
3666
+ "value": {
3667
+ "fixedColor": "#73BF69",
3668
+ "mode": "fixed"
3669
+ }
3670
+ }
3671
+ ]
3672
+ },
3673
+ {
3674
+ "matcher": {
3675
+ "id": "byName",
3676
+ "options": "NOTICE"
3677
+ },
3678
+ "properties": [
3679
+ {
3680
+ "id": "color",
3681
+ "value": {
3682
+ "fixedColor": "#5794F2",
3683
+ "mode": "fixed"
3684
+ }
3685
+ }
3686
+ ]
3687
+ },
3688
+ {
3689
+ "matcher": {
3690
+ "id": "byName",
3691
+ "options": "Notice"
3692
+ },
3693
+ "properties": [
3694
+ {
3695
+ "id": "color",
3696
+ "value": {
3697
+ "fixedColor": "#5794F2",
3698
+ "mode": "fixed"
3699
+ }
3700
+ }
3701
+ ]
3702
+ },
3703
+ {
3704
+ "matcher": {
3705
+ "id": "byName",
3706
+ "options": "Result"
3707
+ },
3708
+ "properties": [
3709
+ {
3710
+ "id": "color",
3711
+ "value": {
3712
+ "fixedColor": "#B877D9",
3713
+ "mode": "fixed"
3714
+ }
3715
+ }
3716
+ ]
3717
+ },
3718
+ {
3719
+ "matcher": {
3720
+ "id": "byName",
3721
+ "options": "Warning"
3722
+ },
3723
+ "properties": [
3724
+ {
3725
+ "id": "color",
3726
+ "value": {
3727
+ "fixedColor": "#FF9830",
3728
+ "mode": "fixed"
3729
+ }
3730
+ }
3731
+ ]
3732
+ }
3733
+ ]
3734
+ },
3735
+ "gridPos": {
3736
+ "h": 7,
3737
+ "w": 5,
3738
+ "x": 4,
3739
+ "y": 24
3740
+ },
3741
+ "id": 101,
3742
+ "links": [],
3743
+ "maxDataPoints": 3,
3744
+ "options": {
3745
+ "displayLabels": [],
3746
+ "legend": {
3747
+ "calcs": [],
3748
+ "displayMode": "list",
3749
+ "placement": "bottom",
3750
+ "showLegend": false,
3751
+ "values": ["value"]
3752
+ },
3753
+ "pieType": "donut",
3754
+ "reduceOptions": {
3755
+ "calcs": ["sum"],
3756
+ "fields": "",
3757
+ "values": false
3758
+ },
3759
+ "text": {},
3760
+ "tooltip": {
3761
+ "mode": "single",
3762
+ "sort": "none"
3763
+ }
3764
+ },
3765
+ "targets": [
3766
+ {
3767
+ "bucketAggs": [
3768
+ {
3769
+ "$$hashKey": "object:73",
3770
+ "fake": true,
3771
+ "field": "data_VTdetection",
3772
+ "id": "3",
3773
+ "settings": {
3774
+ "min_doc_count": 1,
3775
+ "order": "desc",
3776
+ "orderBy": "_count",
3777
+ "size": "0"
3778
+ },
3779
+ "type": "terms"
3780
+ },
3781
+ {
3782
+ "$$hashKey": "object:74",
3783
+ "field": "timestamp",
3784
+ "id": "2",
3785
+ "settings": {
3786
+ "interval": "auto",
3787
+ "min_doc_count": 0,
3788
+ "trimEdges": 0
3789
+ },
3790
+ "type": "date_histogram"
3791
+ }
3792
+ ],
3793
+ "datasource": {
3794
+ "type": "elasticsearch",
3795
+ "uid": "wazuh_datasource_uid"
3796
+ },
3797
+ "metrics": [
3798
+ {
3799
+ "$$hashKey": "object:71",
3800
+ "field": "select field",
3801
+ "id": "1",
3802
+ "type": "count"
3803
+ }
3804
+ ],
3805
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
3806
+ "refId": "A",
3807
+ "timeField": "timestamp"
3808
+ }
3809
+ ],
3810
+ "title": "WINDOWS SIGCHECK - VIRUS TOTAL HITS",
3811
+ "type": "piechart"
3812
+ },
3813
+ {
3814
+ "datasource": {
3815
+ "type": "elasticsearch",
3816
+ "uid": "wazuh_datasource_uid"
3817
+ },
3818
+ "fieldConfig": {
3819
+ "defaults": {
3820
+ "custom": {
3821
+ "align": "auto",
3822
+ "cellOptions": {
3823
+ "type": "auto"
3824
+ },
3825
+ "filterable": false,
3826
+ "inspect": false
3827
+ },
3828
+ "mappings": [],
3829
+ "thresholds": {
3830
+ "mode": "absolute",
3831
+ "steps": [
3832
+ {
3833
+ "color": "orange",
3834
+ "value": null
3835
+ },
3836
+ {
3837
+ "color": "red",
3838
+ "value": 50
3839
+ }
3840
+ ]
3841
+ }
3842
+ },
3843
+ "overrides": [
3844
+ {
3845
+ "matcher": {
3846
+ "id": "byName",
3847
+ "options": "Count"
3848
+ },
3849
+ "properties": [
3850
+ {
3851
+ "id": "custom.cellOptions",
3852
+ "value": {
3853
+ "mode": "basic",
3854
+ "type": "gauge"
3855
+ }
3856
+ }
3857
+ ]
3858
+ },
3859
+ {
3860
+ "matcher": {
3861
+ "id": "byName",
3862
+ "options": "data_VTdetection"
3863
+ },
3864
+ "properties": [
3865
+ {
3866
+ "id": "displayName",
3867
+ "value": "VT DETECTION"
3868
+ }
3869
+ ]
3870
+ },
3871
+ {
3872
+ "matcher": {
3873
+ "id": "byName",
3874
+ "options": "rule_level"
3875
+ },
3876
+ "properties": [
3877
+ {
3878
+ "id": "displayName",
3879
+ "value": "RULE LEVEL"
3880
+ }
3881
+ ]
3882
+ }
3883
+ ]
3884
+ },
3885
+ "gridPos": {
3886
+ "h": 7,
3887
+ "w": 15,
3888
+ "x": 9,
3889
+ "y": 24
3890
+ },
3891
+ "id": 102,
3892
+ "links": [],
3893
+ "maxDataPoints": 3,
3894
+ "options": {
3895
+ "cellHeight": "sm",
3896
+ "footer": {
3897
+ "countRows": false,
3898
+ "fields": "",
3899
+ "reducer": ["sum"],
3900
+ "show": false
3901
+ },
3902
+ "showHeader": true
3903
+ },
3904
+ "pluginVersion": "10.0.2",
3905
+ "targets": [
3906
+ {
3907
+ "bucketAggs": [
3908
+ {
3909
+ "$$hashKey": "object:3082",
3910
+ "fake": true,
3911
+ "field": "data_VTdetection",
3912
+ "id": "4",
3913
+ "settings": {
3914
+ "min_doc_count": 0,
3915
+ "order": "desc",
3916
+ "orderBy": "_count",
3917
+ "size": "10"
3918
+ },
3919
+ "type": "terms"
3920
+ },
3921
+ {
3922
+ "$$hashKey": "object:73",
3923
+ "fake": true,
3924
+ "field": "rule_level",
3925
+ "id": "3",
3926
+ "settings": {
3927
+ "min_doc_count": 1,
3928
+ "order": "desc",
3929
+ "orderBy": "_count",
3930
+ "size": "0"
3931
+ },
3932
+ "type": "terms"
3933
+ }
3934
+ ],
3935
+ "datasource": {
3936
+ "type": "elasticsearch",
3937
+ "uid": "wazuh_datasource_uid"
3938
+ },
3939
+ "metrics": [
3940
+ {
3941
+ "$$hashKey": "object:71",
3942
+ "field": "select field",
3943
+ "id": "1",
3944
+ "type": "count"
3945
+ }
3946
+ ],
3947
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
3948
+ "refId": "A",
3949
+ "timeField": "timestamp"
3950
+ }
3951
+ ],
3952
+ "title": "WINDOWS SIGCHECK - VIRUS TOTAL HITS (Hits|Sources)",
3953
+ "type": "table"
3954
+ },
3955
+ {
3956
+ "datasource": {
3957
+ "type": "elasticsearch",
3958
+ "uid": "wazuh_datasource_uid"
3959
+ },
3960
+ "fieldConfig": {
3961
+ "defaults": {
3962
+ "custom": {
3963
+ "align": "auto",
3964
+ "cellOptions": {
3965
+ "type": "auto"
3966
+ },
3967
+ "filterable": false,
3968
+ "inspect": false
3969
+ },
3970
+ "mappings": [],
3971
+ "thresholds": {
3972
+ "mode": "absolute",
3973
+ "steps": [
3974
+ {
3975
+ "color": "orange",
3976
+ "value": null
3977
+ },
3978
+ {
3979
+ "color": "red",
3980
+ "value": 80
3981
+ }
3982
+ ]
3983
+ }
3984
+ },
3985
+ "overrides": [
3986
+ {
3987
+ "matcher": {
3988
+ "id": "byName",
3989
+ "options": "agent_name"
3990
+ },
3991
+ "properties": [
3992
+ {
3993
+ "id": "displayName",
3994
+ "value": "AGENT"
3995
+ }
3996
+ ]
3997
+ }
3998
+ ]
3999
+ },
4000
+ "gridPos": {
4001
+ "h": 7,
4002
+ "w": 9,
4003
+ "x": 0,
4004
+ "y": 31
4005
+ },
4006
+ "id": 106,
4007
+ "links": [],
4008
+ "maxDataPoints": 3,
4009
+ "options": {
4010
+ "cellHeight": "sm",
4011
+ "footer": {
4012
+ "countRows": false,
4013
+ "fields": "",
4014
+ "reducer": ["sum"],
4015
+ "show": false
4016
+ },
4017
+ "showHeader": true
4018
+ },
4019
+ "pluginVersion": "10.0.2",
4020
+ "targets": [
4021
+ {
4022
+ "bucketAggs": [
4023
+ {
4024
+ "$$hashKey": "object:2063",
4025
+ "fake": true,
4026
+ "field": "agent_name",
4027
+ "id": "4",
4028
+ "settings": {
4029
+ "min_doc_count": "1",
4030
+ "order": "desc",
4031
+ "orderBy": "_count",
4032
+ "size": "10"
4033
+ },
4034
+ "type": "terms"
4035
+ }
4036
+ ],
4037
+ "datasource": {
4038
+ "type": "elasticsearch",
4039
+ "uid": "wazuh_datasource_uid"
4040
+ },
4041
+ "metrics": [
4042
+ {
4043
+ "$$hashKey": "object:71",
4044
+ "field": "select field",
4045
+ "id": "1",
4046
+ "type": "count"
4047
+ }
4048
+ ],
4049
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
4050
+ "refId": "A",
4051
+ "timeField": "timestamp"
4052
+ }
4053
+ ],
4054
+ "title": "WINDOWS SIGCHECK - EVENTS BY AGENT",
4055
+ "type": "table"
4056
+ },
4057
+ {
4058
+ "aliasColors": {},
4059
+ "bars": true,
4060
+ "dashLength": 10,
4061
+ "dashes": false,
4062
+ "datasource": {
4063
+ "type": "elasticsearch",
4064
+ "uid": "wazuh_datasource_uid"
4065
+ },
4066
+ "fill": 1,
4067
+ "fillGradient": 0,
4068
+ "gridPos": {
4069
+ "h": 7,
4070
+ "w": 15,
4071
+ "x": 9,
4072
+ "y": 31
4073
+ },
4074
+ "hiddenSeries": false,
4075
+ "id": 107,
4076
+ "legend": {
4077
+ "alignAsTable": true,
4078
+ "avg": false,
4079
+ "current": false,
4080
+ "max": false,
4081
+ "min": false,
4082
+ "rightSide": true,
4083
+ "show": true,
4084
+ "total": false,
4085
+ "values": false
4086
+ },
4087
+ "lines": false,
4088
+ "linewidth": 1,
4089
+ "links": [],
4090
+ "maxDataPoints": 3,
4091
+ "nullPointMode": "null",
4092
+ "options": {
4093
+ "alertThreshold": true
4094
+ },
4095
+ "percentage": false,
4096
+ "pluginVersion": "10.0.2",
4097
+ "pointradius": 2,
4098
+ "points": false,
4099
+ "renderer": "flot",
4100
+ "seriesOverrides": [],
4101
+ "spaceLength": 10,
4102
+ "stack": true,
4103
+ "steppedLine": false,
4104
+ "targets": [
4105
+ {
4106
+ "alias": "",
4107
+ "bucketAggs": [
4108
+ {
4109
+ "field": "agent_name",
4110
+ "id": "4",
4111
+ "settings": {
4112
+ "min_doc_count": "1",
4113
+ "order": "desc",
4114
+ "orderBy": "_count",
4115
+ "size": "10"
4116
+ },
4117
+ "type": "terms"
4118
+ },
4119
+ {
4120
+ "field": "timestamp",
4121
+ "id": "5",
4122
+ "settings": {
4123
+ "interval": "auto",
4124
+ "min_doc_count": "0",
4125
+ "trimEdges": "0"
4126
+ },
4127
+ "type": "date_histogram"
4128
+ }
4129
+ ],
4130
+ "datasource": {
4131
+ "type": "elasticsearch",
4132
+ "uid": "wazuh_datasource_uid"
4133
+ },
4134
+ "metrics": [
4135
+ {
4136
+ "$$hashKey": "object:71",
4137
+ "field": "select field",
4138
+ "id": "1",
4139
+ "type": "count"
4140
+ }
4141
+ ],
4142
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
4143
+ "refId": "A",
4144
+ "timeField": "timestamp"
4145
+ }
4146
+ ],
4147
+ "thresholds": [],
4148
+ "timeRegions": [],
4149
+ "title": "WINDOWS SIGCHECK - EVENTS BY AGENT (HISTOGRAM)",
4150
+ "tooltip": {
4151
+ "shared": true,
4152
+ "sort": 0,
4153
+ "value_type": "individual"
4154
+ },
4155
+ "type": "graph",
4156
+ "xaxis": {
4157
+ "mode": "time",
4158
+ "show": true,
4159
+ "values": []
4160
+ },
4161
+ "yaxes": [
4162
+ {
4163
+ "format": "short",
4164
+ "logBase": 1,
4165
+ "show": true
4166
+ },
4167
+ {
4168
+ "format": "short",
4169
+ "logBase": 1,
4170
+ "show": true
4171
+ }
4172
+ ],
4173
+ "yaxis": {
4174
+ "align": false
4175
+ }
4176
+ },
4177
+ {
4178
+ "datasource": {
4179
+ "type": "elasticsearch",
4180
+ "uid": "wazuh_datasource_uid"
4181
+ },
4182
+ "fieldConfig": {
4183
+ "defaults": {
4184
+ "color": {
4185
+ "mode": "palette-classic"
4186
+ },
4187
+ "custom": {
4188
+ "hideFrom": {
4189
+ "legend": false,
4190
+ "tooltip": false,
4191
+ "viz": false
4192
+ }
4193
+ },
4194
+ "decimals": 0,
4195
+ "mappings": [],
4196
+ "unit": "short"
4197
+ },
4198
+ "overrides": [
4199
+ {
4200
+ "matcher": {
4201
+ "id": "byName",
4202
+ "options": "1"
4203
+ },
4204
+ "properties": [
4205
+ {
4206
+ "id": "color",
4207
+ "value": {
4208
+ "fixedColor": "#FF9830",
4209
+ "mode": "fixed"
4210
+ }
4211
+ }
4212
+ ]
4213
+ },
4214
+ {
4215
+ "matcher": {
4216
+ "id": "byName",
4217
+ "options": "Alert"
4218
+ },
4219
+ "properties": [
4220
+ {
4221
+ "id": "color",
4222
+ "value": {
4223
+ "fixedColor": "#F2495C",
4224
+ "mode": "fixed"
4225
+ }
4226
+ }
4227
+ ]
4228
+ },
4229
+ {
4230
+ "matcher": {
4231
+ "id": "byName",
4232
+ "options": "Error"
4233
+ },
4234
+ "properties": [
4235
+ {
4236
+ "id": "color",
4237
+ "value": {
4238
+ "fixedColor": "#F2495C",
4239
+ "mode": "fixed"
4240
+ }
4241
+ }
4242
+ ]
4243
+ },
4244
+ {
4245
+ "matcher": {
4246
+ "id": "byName",
4247
+ "options": "Info"
4248
+ },
4249
+ "properties": [
4250
+ {
4251
+ "id": "color",
4252
+ "value": {
4253
+ "fixedColor": "#73BF69",
4254
+ "mode": "fixed"
4255
+ }
4256
+ }
4257
+ ]
4258
+ },
4259
+ {
4260
+ "matcher": {
4261
+ "id": "byName",
4262
+ "options": "NOTICE"
4263
+ },
4264
+ "properties": [
4265
+ {
4266
+ "id": "color",
4267
+ "value": {
4268
+ "fixedColor": "#5794F2",
4269
+ "mode": "fixed"
4270
+ }
4271
+ }
4272
+ ]
4273
+ },
4274
+ {
4275
+ "matcher": {
4276
+ "id": "byName",
4277
+ "options": "Notice"
4278
+ },
4279
+ "properties": [
4280
+ {
4281
+ "id": "color",
4282
+ "value": {
4283
+ "fixedColor": "#5794F2",
4284
+ "mode": "fixed"
4285
+ }
4286
+ }
4287
+ ]
4288
+ },
4289
+ {
4290
+ "matcher": {
4291
+ "id": "byName",
4292
+ "options": "Result"
4293
+ },
4294
+ "properties": [
4295
+ {
4296
+ "id": "color",
4297
+ "value": {
4298
+ "fixedColor": "#B877D9",
4299
+ "mode": "fixed"
4300
+ }
4301
+ }
4302
+ ]
4303
+ },
4304
+ {
4305
+ "matcher": {
4306
+ "id": "byName",
4307
+ "options": "Warning"
4308
+ },
4309
+ "properties": [
4310
+ {
4311
+ "id": "color",
4312
+ "value": {
4313
+ "fixedColor": "#FF9830",
4314
+ "mode": "fixed"
4315
+ }
4316
+ }
4317
+ ]
4318
+ }
4319
+ ]
4320
+ },
4321
+ "gridPos": {
4322
+ "h": 9,
4323
+ "w": 5,
4324
+ "x": 0,
4325
+ "y": 38
4326
+ },
4327
+ "id": 110,
4328
+ "links": [],
4329
+ "maxDataPoints": 3,
4330
+ "options": {
4331
+ "displayLabels": [],
4332
+ "legend": {
4333
+ "calcs": [],
4334
+ "displayMode": "table",
4335
+ "placement": "right",
4336
+ "showLegend": true,
4337
+ "values": ["value"]
4338
+ },
4339
+ "pieType": "donut",
4340
+ "reduceOptions": {
4341
+ "calcs": ["sum"],
4342
+ "fields": "",
4343
+ "values": false
4344
+ },
4345
+ "text": {},
4346
+ "tooltip": {
4347
+ "mode": "single",
4348
+ "sort": "none"
4349
+ }
4350
+ },
4351
+ "targets": [
4352
+ {
4353
+ "bucketAggs": [
4354
+ {
4355
+ "$$hashKey": "object:73",
4356
+ "fake": true,
4357
+ "field": "data_Verified",
4358
+ "id": "3",
4359
+ "settings": {
4360
+ "min_doc_count": 1,
4361
+ "order": "desc",
4362
+ "orderBy": "_count",
4363
+ "size": "0"
4364
+ },
4365
+ "type": "terms"
4366
+ },
4367
+ {
4368
+ "$$hashKey": "object:74",
4369
+ "field": "timestamp",
4370
+ "id": "2",
4371
+ "settings": {
4372
+ "interval": "auto",
4373
+ "min_doc_count": 0,
4374
+ "trimEdges": 0
4375
+ },
4376
+ "type": "date_histogram"
4377
+ }
4378
+ ],
4379
+ "datasource": {
4380
+ "type": "elasticsearch",
4381
+ "uid": "wazuh_datasource_uid"
4382
+ },
4383
+ "metrics": [
4384
+ {
4385
+ "$$hashKey": "object:71",
4386
+ "field": "select field",
4387
+ "id": "1",
4388
+ "type": "count"
4389
+ }
4390
+ ],
4391
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
4392
+ "refId": "A",
4393
+ "timeField": "timestamp"
4394
+ }
4395
+ ],
4396
+ "title": "WINDOWS SIGCHECK - SIGNATURE STATUS",
4397
+ "type": "piechart"
4398
+ },
4399
+ {
4400
+ "datasource": {
4401
+ "type": "elasticsearch",
4402
+ "uid": "wazuh_datasource_uid"
4403
+ },
4404
+ "fieldConfig": {
4405
+ "defaults": {
4406
+ "custom": {
4407
+ "align": "auto",
4408
+ "cellOptions": {
4409
+ "type": "auto"
4410
+ },
4411
+ "filterable": false,
4412
+ "inspect": false
4413
+ },
4414
+ "links": [
4415
+ {
4416
+ "targetBlank": true,
4417
+ "title": "Virus Total Detection",
4418
+ "url": "${__data.fields.data_VTlink}"
4419
+ }
4420
+ ],
4421
+ "mappings": [],
4422
+ "thresholds": {
4423
+ "mode": "absolute",
4424
+ "steps": [
4425
+ {
4426
+ "color": "orange",
4427
+ "value": null
4428
+ },
4429
+ {
4430
+ "color": "red",
4431
+ "value": 50
4432
+ }
4433
+ ]
4434
+ }
4435
+ },
4436
+ "overrides": [
4437
+ {
4438
+ "matcher": {
4439
+ "id": "byName",
4440
+ "options": "data_VTlink"
4441
+ },
4442
+ "properties": [
4443
+ {
4444
+ "id": "custom.width",
4445
+ "value": 977
4446
+ },
4447
+ {
4448
+ "id": "displayName",
4449
+ "value": "VT DETECTION URL"
4450
+ }
4451
+ ]
4452
+ }
4453
+ ]
4454
+ },
4455
+ "gridPos": {
4456
+ "h": 9,
4457
+ "w": 19,
4458
+ "x": 5,
4459
+ "y": 38
4460
+ },
4461
+ "id": 103,
4462
+ "links": [],
4463
+ "maxDataPoints": 3,
4464
+ "options": {
4465
+ "cellHeight": "sm",
4466
+ "footer": {
4467
+ "countRows": false,
4468
+ "fields": "",
4469
+ "reducer": ["sum"],
4470
+ "show": false
4471
+ },
4472
+ "showHeader": true,
4473
+ "sortBy": []
4474
+ },
4475
+ "pluginVersion": "10.0.2",
4476
+ "targets": [
4477
+ {
4478
+ "bucketAggs": [
4479
+ {
4480
+ "$$hashKey": "object:3082",
4481
+ "fake": true,
4482
+ "field": "data_VTlink",
4483
+ "id": "4",
4484
+ "settings": {
4485
+ "min_doc_count": "1",
4486
+ "order": "desc",
4487
+ "orderBy": "_count",
4488
+ "size": "10"
4489
+ },
4490
+ "type": "terms"
4491
+ }
4492
+ ],
4493
+ "datasource": {
4494
+ "type": "elasticsearch",
4495
+ "uid": "wazuh_datasource_uid"
4496
+ },
4497
+ "metrics": [
4498
+ {
4499
+ "$$hashKey": "object:71",
4500
+ "field": "select field",
4501
+ "id": "1",
4502
+ "type": "count"
4503
+ }
4504
+ ],
4505
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
4506
+ "refId": "A",
4507
+ "timeField": "timestamp"
4508
+ }
4509
+ ],
4510
+ "title": "WINDOWS SIGCHECK - VIRUS TOTAL DETECTION",
4511
+ "type": "table"
4512
+ },
4513
+ {
4514
+ "datasource": {
4515
+ "type": "elasticsearch",
4516
+ "uid": "wazuh_datasource_uid"
4517
+ },
4518
+ "fieldConfig": {
4519
+ "defaults": {
4520
+ "color": {
4521
+ "mode": "thresholds"
4522
+ },
4523
+ "custom": {
4524
+ "align": "auto",
4525
+ "cellOptions": {
4526
+ "type": "auto"
4527
+ },
4528
+ "inspect": false
4529
+ },
4530
+ "mappings": [],
4531
+ "thresholds": {
4532
+ "mode": "absolute",
4533
+ "steps": [
4534
+ {
4535
+ "color": "green",
4536
+ "value": null
4537
+ },
4538
+ {
4539
+ "color": "red",
4540
+ "value": 80
4541
+ }
4542
+ ]
4543
+ }
4544
+ },
4545
+ "overrides": [
4546
+ {
4547
+ "matcher": {
4548
+ "id": "byName",
4549
+ "options": "rule_level"
4550
+ },
4551
+ "properties": [
4552
+ {
4553
+ "id": "custom.width",
4554
+ "value": 93
4555
+ }
4556
+ ]
4557
+ },
4558
+ {
4559
+ "matcher": {
4560
+ "id": "byName",
4561
+ "options": "windows_event_id"
4562
+ },
4563
+ "properties": [
4564
+ {
4565
+ "id": "custom.width",
4566
+ "value": 186
4567
+ }
4568
+ ]
4569
+ },
4570
+ {
4571
+ "matcher": {
4572
+ "id": "byName",
4573
+ "options": "DATE/TIME"
4574
+ },
4575
+ "properties": [
4576
+ {
4577
+ "id": "custom.width",
4578
+ "value": 202
4579
+ }
4580
+ ]
4581
+ },
4582
+ {
4583
+ "matcher": {
4584
+ "id": "byName",
4585
+ "options": "AGENT"
4586
+ },
4587
+ "properties": [
4588
+ {
4589
+ "id": "custom.width",
4590
+ "value": 171
4591
+ }
4592
+ ]
4593
+ },
4594
+ {
4595
+ "matcher": {
4596
+ "id": "byName",
4597
+ "options": "SRC IP"
4598
+ },
4599
+ "properties": [
4600
+ {
4601
+ "id": "custom.width",
4602
+ "value": 167
4603
+ }
4604
+ ]
4605
+ },
4606
+ {
4607
+ "matcher": {
4608
+ "id": "byName",
4609
+ "options": "MESSAGE"
4610
+ },
4611
+ "properties": [
4612
+ {
4613
+ "id": "custom.width",
4614
+ "value": 1519
4615
+ }
4616
+ ]
4617
+ },
4618
+ {
4619
+ "matcher": {
4620
+ "id": "byName",
4621
+ "options": "rule_description"
4622
+ },
4623
+ "properties": [
4624
+ {
4625
+ "id": "custom.width",
4626
+ "value": 524
4627
+ }
4628
+ ]
4629
+ },
4630
+ {
4631
+ "matcher": {
4632
+ "id": "byName",
4633
+ "options": "VT HITS"
4634
+ },
4635
+ "properties": [
4636
+ {
4637
+ "id": "custom.width",
4638
+ "value": 102
4639
+ }
4640
+ ]
4641
+ },
4642
+ {
4643
+ "matcher": {
4644
+ "id": "byName",
4645
+ "options": "RULE LEVEL"
4646
+ },
4647
+ "properties": [
4648
+ {
4649
+ "id": "custom.width",
4650
+ "value": 115
4651
+ }
4652
+ ]
4653
+ },
4654
+ {
4655
+ "matcher": {
4656
+ "id": "byName",
4657
+ "options": "CATEGORY"
4658
+ },
4659
+ "properties": [
4660
+ {
4661
+ "id": "custom.width",
4662
+ "value": 159
4663
+ }
4664
+ ]
4665
+ },
4666
+ {
4667
+ "matcher": {
4668
+ "id": "byName",
4669
+ "options": "VENDOR"
4670
+ },
4671
+ "properties": [
4672
+ {
4673
+ "id": "custom.width",
4674
+ "value": 154
4675
+ }
4676
+ ]
4677
+ },
4678
+ {
4679
+ "matcher": {
4680
+ "id": "byName",
4681
+ "options": "STATUS"
4682
+ },
4683
+ "properties": [
4684
+ {
4685
+ "id": "custom.width",
4686
+ "value": 116
4687
+ }
4688
+ ]
4689
+ },
4690
+ {
4691
+ "matcher": {
4692
+ "id": "byName",
4693
+ "options": "FILE PATH"
4694
+ },
4695
+ "properties": [
4696
+ {
4697
+ "id": "custom.width",
4698
+ "value": 751
4699
+ }
4700
+ ]
4701
+ },
4702
+ {
4703
+ "matcher": {
4704
+ "id": "byName",
4705
+ "options": "EVENT ID"
4706
+ },
4707
+ "properties": [
4708
+ {
4709
+ "id": "links",
4710
+ "value": [
4711
+ {
4712
+ "targetBlank": true,
4713
+ "title": "VIEW EVENT DETAILS",
4714
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
4715
+ }
4716
+ ]
4717
+ }
4718
+ ]
4719
+ }
4720
+ ]
4721
+ },
4722
+ "gridPos": {
4723
+ "h": 10,
4724
+ "w": 24,
4725
+ "x": 0,
4726
+ "y": 47
4727
+ },
4728
+ "id": 93,
4729
+ "options": {
4730
+ "cellHeight": "sm",
4731
+ "footer": {
4732
+ "countRows": false,
4733
+ "fields": "",
4734
+ "reducer": ["sum"],
4735
+ "show": false
4736
+ },
4737
+ "showHeader": true,
4738
+ "sortBy": []
4739
+ },
4740
+ "pluginVersion": "10.0.2",
4741
+ "targets": [
4742
+ {
4743
+ "alias": "",
4744
+ "bucketAggs": [],
4745
+ "datasource": {
4746
+ "type": "elasticsearch",
4747
+ "uid": "wazuh_datasource_uid"
4748
+ },
4749
+ "metrics": [
4750
+ {
4751
+ "id": "1",
4752
+ "settings": {
4753
+ "size": "500"
4754
+ },
4755
+ "type": "raw_data"
4756
+ }
4757
+ ],
4758
+ "query": "rule_group2:windows_sigcheck AND agent_name:$agent_name",
4759
+ "queryType": "lucene",
4760
+ "refId": "A",
4761
+ "timeField": "timestamp"
4762
+ }
4763
+ ],
4764
+ "title": "WINDOWS SIGCHECK - EVENTS",
4765
+ "transformations": [
4766
+ {
4767
+ "id": "organize",
4768
+ "options": {
4769
+ "excludeByName": {
4770
+ "@metadata_beat": true,
4771
+ "@metadata_type": true,
4772
+ "@metadata_version": true,
4773
+ "_id": false,
4774
+ "_index": true,
4775
+ "_type": true,
4776
+ "agent_ephemeral_id": true,
4777
+ "agent_hostname": true,
4778
+ "agent_id": true,
4779
+ "agent_ip": false,
4780
+ "agent_ip_city_name": true,
4781
+ "agent_ip_country_code": true,
4782
+ "agent_ip_geolocation": true,
4783
+ "agent_ip_reserved_ip": true,
4784
+ "agent_labels_customer": true,
4785
+ "agent_name": false,
4786
+ "agent_type": true,
4787
+ "agent_version": true,
4788
+ "beats_type": true,
4789
+ "cluster_name": true,
4790
+ "cluster_node": true,
4791
+ "collector_node_id": true,
4792
+ "data_Company": false,
4793
+ "data_Date": true,
4794
+ "data_Description": true,
4795
+ "data_EntryLocation": true,
4796
+ "data_FileVersion": true,
4797
+ "data_FileVersion_city_name": true,
4798
+ "data_FileVersion_country_code": true,
4799
+ "data_FileVersion_geolocation": true,
4800
+ "data_IMP": true,
4801
+ "data_ImagePath": true,
4802
+ "data_LaunchString": true,
4803
+ "data_MD5": true,
4804
+ "data_MachineType": true,
4805
+ "data_PESHA-1": true,
4806
+ "data_PESHA-256": true,
4807
+ "data_Product": true,
4808
+ "data_ProductVersion": true,
4809
+ "data_ProductVersion_city_name": true,
4810
+ "data_ProductVersion_country_code": true,
4811
+ "data_ProductVersion_geolocation": true,
4812
+ "data_Profile": true,
4813
+ "data_Publisher": true,
4814
+ "data_SHA-1": true,
4815
+ "data_Signer": true,
4816
+ "data_Time": true,
4817
+ "data_VTlink": true,
4818
+ "data_VTpermalink": true,
4819
+ "data_Verified": false,
4820
+ "data_Version": true,
4821
+ "data_Version_city_name": true,
4822
+ "data_Version_country_code": true,
4823
+ "data_Version_geolocation": true,
4824
+ "data_win_eventXML_binaryData": true,
4825
+ "data_win_eventXML_binaryDataSize": true,
4826
+ "data_win_eventXML_param1": true,
4827
+ "data_win_eventdata_accessMask": true,
4828
+ "data_win_eventdata_authenticationPackageName": true,
4829
+ "data_win_eventdata_binary": true,
4830
+ "data_win_eventdata_data": true,
4831
+ "data_win_eventdata_domain": true,
4832
+ "data_win_eventdata_elevatedToken": true,
4833
+ "data_win_eventdata_failureReason": true,
4834
+ "data_win_eventdata_handleId": true,
4835
+ "data_win_eventdata_imagePath": true,
4836
+ "data_win_eventdata_impersonationLevel": true,
4837
+ "data_win_eventdata_ipAddress": true,
4838
+ "data_win_eventdata_ipPort": true,
4839
+ "data_win_eventdata_keyLength": true,
4840
+ "data_win_eventdata_lmPackageName": true,
4841
+ "data_win_eventdata_logonGuid": true,
4842
+ "data_win_eventdata_logonProcessName": true,
4843
+ "data_win_eventdata_logonType": true,
4844
+ "data_win_eventdata_objectServer": true,
4845
+ "data_win_eventdata_packageName": true,
4846
+ "data_win_eventdata_passwordLastSet": true,
4847
+ "data_win_eventdata_privilegeList": true,
4848
+ "data_win_eventdata_processId": true,
4849
+ "data_win_eventdata_processName": true,
4850
+ "data_win_eventdata_restrictedAdminMode": true,
4851
+ "data_win_eventdata_sID": true,
4852
+ "data_win_eventdata_serviceName": true,
4853
+ "data_win_eventdata_serviceType": true,
4854
+ "data_win_eventdata_startType": true,
4855
+ "data_win_eventdata_status": true,
4856
+ "data_win_eventdata_subStatus": true,
4857
+ "data_win_eventdata_subjectDomainName": true,
4858
+ "data_win_eventdata_subjectLogonId": true,
4859
+ "data_win_eventdata_subjectUserName": true,
4860
+ "data_win_eventdata_subjectUserSid": true,
4861
+ "data_win_eventdata_targetDomainName": true,
4862
+ "data_win_eventdata_targetLinkedLogonId": true,
4863
+ "data_win_eventdata_targetLogonId": true,
4864
+ "data_win_eventdata_targetSid": true,
4865
+ "data_win_eventdata_targetUserName": true,
4866
+ "data_win_eventdata_targetUserSid": true,
4867
+ "data_win_eventdata_user": true,
4868
+ "data_win_eventdata_virtualAccount": true,
4869
+ "data_win_eventdata_workstation": true,
4870
+ "data_win_eventdata_workstationName": true,
4871
+ "data_win_system_channel": true,
4872
+ "data_win_system_computer": true,
4873
+ "data_win_system_eventID": true,
4874
+ "data_win_system_eventRecordID": true,
4875
+ "data_win_system_eventSourceName": true,
4876
+ "data_win_system_keywords": true,
4877
+ "data_win_system_level": true,
4878
+ "data_win_system_opcode": true,
4879
+ "data_win_system_processID": true,
4880
+ "data_win_system_providerGuid": true,
4881
+ "data_win_system_providerName": true,
4882
+ "data_win_system_severityValue": true,
4883
+ "data_win_system_systemTime": true,
4884
+ "data_win_system_task": true,
4885
+ "data_win_system_threadID": true,
4886
+ "data_win_system_version": true,
4887
+ "decoder_name": true,
4888
+ "ecs_version": true,
4889
+ "gl2_accounted_message_size": true,
4890
+ "gl2_message_id": true,
4891
+ "gl2_processing_error": true,
4892
+ "gl2_remote_ip": true,
4893
+ "gl2_remote_port": true,
4894
+ "gl2_source_collector": true,
4895
+ "gl2_source_input": true,
4896
+ "gl2_source_node": true,
4897
+ "highlight": true,
4898
+ "host_name": true,
4899
+ "id": true,
4900
+ "location": true,
4901
+ "log_file_path": true,
4902
+ "log_offset": true,
4903
+ "manager_name": true,
4904
+ "message": true,
4905
+ "previous_output": true,
4906
+ "process_id": true,
4907
+ "rule_description": true,
4908
+ "rule_firedtimes": true,
4909
+ "rule_frequency": true,
4910
+ "rule_gdpr": true,
4911
+ "rule_gpg13": true,
4912
+ "rule_group1": true,
4913
+ "rule_group2": true,
4914
+ "rule_groups": true,
4915
+ "rule_hipaa": true,
4916
+ "rule_id": true,
4917
+ "rule_mail": true,
4918
+ "rule_mitre_id": true,
4919
+ "rule_mitre_tactic": true,
4920
+ "rule_mitre_technique": true,
4921
+ "rule_nist_800_53": true,
4922
+ "rule_pci_dss": true,
4923
+ "rule_tsc": true,
4924
+ "sort": true,
4925
+ "source": true,
4926
+ "source_reserved_ip": true,
4927
+ "src_ip": true,
4928
+ "src_ip_city_name": true,
4929
+ "src_ip_country_code": true,
4930
+ "src_ip_geolocation": true,
4931
+ "streams": true,
4932
+ "syslog_tag": true,
4933
+ "syslog_type": true,
4934
+ "timestamp": false,
4935
+ "timestamp_utc": true,
4936
+ "true": true,
4937
+ "user_name": true,
4938
+ "win_system_eventID": true,
4939
+ "windows_auth_package": true,
4940
+ "windows_domain": true,
4941
+ "windows_event_id": true,
4942
+ "windows_event_severity": false,
4943
+ "windows_logon_type": true
4944
+ },
4945
+ "indexByName": {
4946
+ "_id": 1,
4947
+ "_index": 3,
4948
+ "_type": 4,
4949
+ "agent_id": 5,
4950
+ "agent_ip": 6,
4951
+ "agent_ip_city_name": 7,
4952
+ "agent_ip_country_code": 9,
4953
+ "agent_ip_geolocation": 10,
4954
+ "agent_labels_customer": 35,
4955
+ "agent_name": 2,
4956
+ "data_Company": 33,
4957
+ "data_Date": 36,
4958
+ "data_Description": 34,
4959
+ "data_FileVersion": 37,
4960
+ "data_FileVersion_city_name": 38,
4961
+ "data_FileVersion_country_code": 39,
4962
+ "data_FileVersion_geolocation": 40,
4963
+ "data_MachineType": 41,
4964
+ "data_Path": 42,
4965
+ "data_Product": 43,
4966
+ "data_ProductVersion": 44,
4967
+ "data_ProductVersion_city_name": 45,
4968
+ "data_ProductVersion_country_code": 46,
4969
+ "data_ProductVersion_geolocation": 47,
4970
+ "data_Publisher": 48,
4971
+ "data_VTdetection": 8,
4972
+ "data_VTlink": 49,
4973
+ "data_Verified": 50,
4974
+ "decoder_name": 11,
4975
+ "gl2_accounted_message_size": 12,
4976
+ "gl2_message_id": 13,
4977
+ "gl2_processing_error": 51,
4978
+ "gl2_remote_ip": 14,
4979
+ "gl2_remote_port": 15,
4980
+ "gl2_source_input": 16,
4981
+ "gl2_source_node": 17,
4982
+ "highlight": 18,
4983
+ "id": 19,
4984
+ "location": 20,
4985
+ "manager_name": 21,
4986
+ "message": 22,
4987
+ "rule_description": 23,
4988
+ "rule_firedtimes": 24,
4989
+ "rule_group1": 52,
4990
+ "rule_group2": 53,
4991
+ "rule_groups": 25,
4992
+ "rule_id": 26,
4993
+ "rule_level": 27,
4994
+ "rule_mail": 28,
4995
+ "rule_mitre_id": 54,
4996
+ "rule_mitre_tactic": 55,
4997
+ "rule_mitre_technique": 56,
4998
+ "sort": 29,
4999
+ "source": 30,
This file is too large to show in full.
backend/app/connectors/grafana/dashboards/Wazuh/edr_compliance.json
new
+3772
@@ -0,0 +1,3772 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "gridPos": {
44
+ "h": 1,
45
+ "w": 24,
46
+ "x": 0,
47
+ "y": 0
48
+ },
49
+ "id": 92,
50
+ "title": "Controlled Unclassified Information (CUI)",
51
+ "type": "row"
52
+ },
53
+ {
54
+ "datasource": {
55
+ "type": "elasticsearch",
56
+ "uid": "wazuh_datasource_uid"
57
+ },
58
+ "fieldConfig": {
59
+ "defaults": {
60
+ "mappings": [
61
+ {
62
+ "options": {
63
+ "match": "null",
64
+ "result": {
65
+ "text": "N/A"
66
+ }
67
+ },
68
+ "type": "special"
69
+ }
70
+ ],
71
+ "thresholds": {
72
+ "mode": "absolute",
73
+ "steps": [
74
+ {
75
+ "color": "blue",
76
+ "value": null
77
+ }
78
+ ]
79
+ },
80
+ "unit": "short"
81
+ },
82
+ "overrides": []
83
+ },
84
+ "gridPos": {
85
+ "h": 7,
86
+ "w": 4,
87
+ "x": 0,
88
+ "y": 1
89
+ },
90
+ "id": 93,
91
+ "links": [],
92
+ "options": {
93
+ "colorMode": "value",
94
+ "graphMode": "area",
95
+ "justifyMode": "auto",
96
+ "orientation": "horizontal",
97
+ "reduceOptions": {
98
+ "calcs": ["sum"],
99
+ "fields": "",
100
+ "values": false
101
+ },
102
+ "text": {},
103
+ "textMode": "auto"
104
+ },
105
+ "pluginVersion": "10.0.2",
106
+ "targets": [
107
+ {
108
+ "bucketAggs": [
109
+ {
110
+ "$$hashKey": "object:50",
111
+ "field": "timestamp",
112
+ "id": "2",
113
+ "settings": {
114
+ "interval": "auto",
115
+ "min_doc_count": 0,
116
+ "trimEdges": 0
117
+ },
118
+ "type": "date_histogram"
119
+ }
120
+ ],
121
+ "datasource": {
122
+ "type": "elasticsearch",
123
+ "uid": "wazuh_datasource_uid"
124
+ },
125
+ "metrics": [
126
+ {
127
+ "$$hashKey": "object:48",
128
+ "field": "select field",
129
+ "id": "1",
130
+ "type": "count"
131
+ }
132
+ ],
133
+ "query": "agent_name:$agent_name AND _exists_:cui_value",
134
+ "refId": "A",
135
+ "timeField": "timestamp"
136
+ }
137
+ ],
138
+ "title": "CUI - EVENTS",
139
+ "type": "stat"
140
+ },
141
+ {
142
+ "datasource": {
143
+ "type": "elasticsearch",
144
+ "uid": "wazuh_datasource_uid"
145
+ },
146
+ "fieldConfig": {
147
+ "defaults": {
148
+ "color": {
149
+ "mode": "palette-classic"
150
+ },
151
+ "custom": {
152
+ "hideFrom": {
153
+ "legend": false,
154
+ "tooltip": false,
155
+ "viz": false
156
+ }
157
+ },
158
+ "decimals": 0,
159
+ "mappings": [],
160
+ "unit": "short"
161
+ },
162
+ "overrides": [
163
+ {
164
+ "matcher": {
165
+ "id": "byName",
166
+ "options": "1"
167
+ },
168
+ "properties": [
169
+ {
170
+ "id": "color",
171
+ "value": {
172
+ "fixedColor": "#FF9830",
173
+ "mode": "fixed"
174
+ }
175
+ }
176
+ ]
177
+ },
178
+ {
179
+ "matcher": {
180
+ "id": "byName",
181
+ "options": "Alert"
182
+ },
183
+ "properties": [
184
+ {
185
+ "id": "color",
186
+ "value": {
187
+ "fixedColor": "#F2495C",
188
+ "mode": "fixed"
189
+ }
190
+ }
191
+ ]
192
+ },
193
+ {
194
+ "matcher": {
195
+ "id": "byName",
196
+ "options": "Error"
197
+ },
198
+ "properties": [
199
+ {
200
+ "id": "color",
201
+ "value": {
202
+ "fixedColor": "#F2495C",
203
+ "mode": "fixed"
204
+ }
205
+ }
206
+ ]
207
+ },
208
+ {
209
+ "matcher": {
210
+ "id": "byName",
211
+ "options": "Info"
212
+ },
213
+ "properties": [
214
+ {
215
+ "id": "color",
216
+ "value": {
217
+ "fixedColor": "#73BF69",
218
+ "mode": "fixed"
219
+ }
220
+ }
221
+ ]
222
+ },
223
+ {
224
+ "matcher": {
225
+ "id": "byName",
226
+ "options": "NOTICE"
227
+ },
228
+ "properties": [
229
+ {
230
+ "id": "color",
231
+ "value": {
232
+ "fixedColor": "#5794F2",
233
+ "mode": "fixed"
234
+ }
235
+ }
236
+ ]
237
+ },
238
+ {
239
+ "matcher": {
240
+ "id": "byName",
241
+ "options": "Notice"
242
+ },
243
+ "properties": [
244
+ {
245
+ "id": "color",
246
+ "value": {
247
+ "fixedColor": "#5794F2",
248
+ "mode": "fixed"
249
+ }
250
+ }
251
+ ]
252
+ },
253
+ {
254
+ "matcher": {
255
+ "id": "byName",
256
+ "options": "Result"
257
+ },
258
+ "properties": [
259
+ {
260
+ "id": "color",
261
+ "value": {
262
+ "fixedColor": "#B877D9",
263
+ "mode": "fixed"
264
+ }
265
+ }
266
+ ]
267
+ },
268
+ {
269
+ "matcher": {
270
+ "id": "byName",
271
+ "options": "Warning"
272
+ },
273
+ "properties": [
274
+ {
275
+ "id": "color",
276
+ "value": {
277
+ "fixedColor": "#FF9830",
278
+ "mode": "fixed"
279
+ }
280
+ }
281
+ ]
282
+ },
283
+ {
284
+ "matcher": {
285
+ "id": "byName",
286
+ "options": "INFORMATION"
287
+ },
288
+ "properties": [
289
+ {
290
+ "id": "color",
291
+ "value": {
292
+ "fixedColor": "green",
293
+ "mode": "fixed"
294
+ }
295
+ }
296
+ ]
297
+ },
298
+ {
299
+ "matcher": {
300
+ "id": "byName",
301
+ "options": "WARNING"
302
+ },
303
+ "properties": [
304
+ {
305
+ "id": "color",
306
+ "value": {
307
+ "fixedColor": "orange",
308
+ "mode": "fixed"
309
+ }
310
+ }
311
+ ]
312
+ },
313
+ {
314
+ "matcher": {
315
+ "id": "byName",
316
+ "options": "ERROR"
317
+ },
318
+ "properties": [
319
+ {
320
+ "id": "color",
321
+ "value": {
322
+ "fixedColor": "red",
323
+ "mode": "fixed"
324
+ }
325
+ }
326
+ ]
327
+ }
328
+ ]
329
+ },
330
+ "gridPos": {
331
+ "h": 7,
332
+ "w": 5,
333
+ "x": 4,
334
+ "y": 1
335
+ },
336
+ "id": 94,
337
+ "links": [],
338
+ "maxDataPoints": 3,
339
+ "options": {
340
+ "displayLabels": [],
341
+ "legend": {
342
+ "calcs": [],
343
+ "displayMode": "table",
344
+ "placement": "right",
345
+ "showLegend": true,
346
+ "values": ["value"]
347
+ },
348
+ "pieType": "donut",
349
+ "reduceOptions": {
350
+ "calcs": ["sum"],
351
+ "fields": "",
352
+ "values": false
353
+ },
354
+ "text": {},
355
+ "tooltip": {
356
+ "mode": "single",
357
+ "sort": "none"
358
+ }
359
+ },
360
+ "targets": [
361
+ {
362
+ "bucketAggs": [
363
+ {
364
+ "$$hashKey": "object:73",
365
+ "fake": true,
366
+ "field": "cui_value",
367
+ "id": "3",
368
+ "settings": {
369
+ "min_doc_count": 1,
370
+ "order": "desc",
371
+ "orderBy": "_count",
372
+ "size": "0"
373
+ },
374
+ "type": "terms"
375
+ },
376
+ {
377
+ "$$hashKey": "object:74",
378
+ "field": "timestamp",
379
+ "id": "2",
380
+ "settings": {
381
+ "interval": "auto",
382
+ "min_doc_count": 0,
383
+ "trimEdges": 0
384
+ },
385
+ "type": "date_histogram"
386
+ }
387
+ ],
388
+ "datasource": {
389
+ "type": "elasticsearch",
390
+ "uid": "wazuh_datasource_uid"
391
+ },
392
+ "metrics": [
393
+ {
394
+ "$$hashKey": "object:71",
395
+ "field": "select field",
396
+ "id": "1",
397
+ "type": "count"
398
+ }
399
+ ],
400
+ "query": "agent_name:$agent_name AND _exists_:cui_value",
401
+ "refId": "A",
402
+ "timeField": "timestamp"
403
+ }
404
+ ],
405
+ "title": "CUI - SECURITY CONTROLS",
406
+ "type": "piechart"
407
+ },
408
+ {
409
+ "datasource": {
410
+ "type": "elasticsearch",
411
+ "uid": "wazuh_datasource_uid"
412
+ },
413
+ "fieldConfig": {
414
+ "defaults": {
415
+ "custom": {
416
+ "align": "auto",
417
+ "cellOptions": {
418
+ "type": "auto"
419
+ },
420
+ "filterable": false,
421
+ "inspect": false
422
+ },
423
+ "mappings": [],
424
+ "thresholds": {
425
+ "mode": "absolute",
426
+ "steps": [
427
+ {
428
+ "color": "orange",
429
+ "value": null
430
+ },
431
+ {
432
+ "color": "red",
433
+ "value": 50
434
+ }
435
+ ]
436
+ }
437
+ },
438
+ "overrides": [
439
+ {
440
+ "matcher": {
441
+ "id": "byName",
442
+ "options": "Count"
443
+ },
444
+ "properties": [
445
+ {
446
+ "id": "custom.cellOptions",
447
+ "value": {
448
+ "mode": "basic",
449
+ "type": "gauge"
450
+ }
451
+ }
452
+ ]
453
+ },
454
+ {
455
+ "matcher": {
456
+ "id": "byName",
457
+ "options": "rule_description"
458
+ },
459
+ "properties": [
460
+ {
461
+ "id": "custom.width",
462
+ "value": 703
463
+ }
464
+ ]
465
+ },
466
+ {
467
+ "matcher": {
468
+ "id": "byName",
469
+ "options": "rule_level"
470
+ },
471
+ "properties": [
472
+ {
473
+ "id": "custom.width",
474
+ "value": 212
475
+ },
476
+ {
477
+ "id": "mappings",
478
+ "value": [
479
+ {
480
+ "options": {
481
+ "from": 1,
482
+ "result": {
483
+ "color": "green",
484
+ "index": 0
485
+ },
486
+ "to": 3
487
+ },
488
+ "type": "range"
489
+ },
490
+ {
491
+ "options": {
492
+ "from": 4,
493
+ "result": {
494
+ "color": "dark-yellow",
495
+ "index": 1
496
+ },
497
+ "to": 6
498
+ },
499
+ "type": "range"
500
+ },
501
+ {
502
+ "options": {
503
+ "from": 7,
504
+ "result": {
505
+ "color": "orange",
506
+ "index": 2
507
+ },
508
+ "to": 9
509
+ },
510
+ "type": "range"
511
+ },
512
+ {
513
+ "options": {
514
+ "from": 10,
515
+ "result": {
516
+ "color": "semi-dark-red",
517
+ "index": 3
518
+ },
519
+ "to": 15
520
+ },
521
+ "type": "range"
522
+ }
523
+ ]
524
+ }
525
+ ]
526
+ }
527
+ ]
528
+ },
529
+ "gridPos": {
530
+ "h": 7,
531
+ "w": 15,
532
+ "x": 9,
533
+ "y": 1
534
+ },
535
+ "id": 69,
536
+ "links": [],
537
+ "maxDataPoints": 3,
538
+ "options": {
539
+ "cellHeight": "sm",
540
+ "footer": {
541
+ "countRows": false,
542
+ "fields": "",
543
+ "reducer": ["sum"],
544
+ "show": false
545
+ },
546
+ "showHeader": true,
547
+ "sortBy": []
548
+ },
549
+ "pluginVersion": "10.0.2",
550
+ "targets": [
551
+ {
552
+ "bucketAggs": [
553
+ {
554
+ "$$hashKey": "object:3082",
555
+ "fake": true,
556
+ "field": "rule_description",
557
+ "id": "4",
558
+ "settings": {
559
+ "min_doc_count": 0,
560
+ "order": "desc",
561
+ "orderBy": "_count",
562
+ "size": "10"
563
+ },
564
+ "type": "terms"
565
+ },
566
+ {
567
+ "$$hashKey": "object:73",
568
+ "fake": true,
569
+ "field": "rule_level",
570
+ "id": "3",
571
+ "settings": {
572
+ "min_doc_count": 1,
573
+ "order": "desc",
574
+ "orderBy": "_count",
575
+ "size": "0"
576
+ },
577
+ "type": "terms"
578
+ }
579
+ ],
580
+ "datasource": {
581
+ "type": "elasticsearch",
582
+ "uid": "wazuh_datasource_uid"
583
+ },
584
+ "metrics": [
585
+ {
586
+ "$$hashKey": "object:71",
587
+ "field": "select field",
588
+ "id": "1",
589
+ "type": "count"
590
+ }
591
+ ],
592
+ "query": "agent_name:$agent_name AND _exists_:cui_value",
593
+ "refId": "A",
594
+ "timeField": "timestamp"
595
+ }
596
+ ],
597
+ "title": "CUI - EVENTS BY TYPE",
598
+ "type": "table"
599
+ },
600
+ {
601
+ "datasource": {
602
+ "type": "elasticsearch",
603
+ "uid": "wazuh_datasource_uid"
604
+ },
605
+ "fieldConfig": {
606
+ "defaults": {
607
+ "custom": {
608
+ "align": "auto",
609
+ "cellOptions": {
610
+ "type": "auto"
611
+ },
612
+ "filterable": false,
613
+ "inspect": false
614
+ },
615
+ "mappings": [],
616
+ "thresholds": {
617
+ "mode": "absolute",
618
+ "steps": [
619
+ {
620
+ "color": "green",
621
+ "value": null
622
+ },
623
+ {
624
+ "color": "red",
625
+ "value": 80
626
+ }
627
+ ]
628
+ }
629
+ },
630
+ "overrides": [
631
+ {
632
+ "matcher": {
633
+ "id": "byName",
634
+ "options": "agent_name"
635
+ },
636
+ "properties": [
637
+ {
638
+ "id": "custom.width",
639
+ "value": 492
640
+ }
641
+ ]
642
+ }
643
+ ]
644
+ },
645
+ "gridPos": {
646
+ "h": 7,
647
+ "w": 9,
648
+ "x": 0,
649
+ "y": 8
650
+ },
651
+ "id": 96,
652
+ "links": [],
653
+ "maxDataPoints": 3,
654
+ "options": {
655
+ "cellHeight": "sm",
656
+ "footer": {
657
+ "countRows": false,
658
+ "fields": "",
659
+ "reducer": ["sum"],
660
+ "show": false
661
+ },
662
+ "showHeader": true,
663
+ "sortBy": []
664
+ },
665
+ "pluginVersion": "10.0.2",
666
+ "targets": [
667
+ {
668
+ "bucketAggs": [
669
+ {
670
+ "$$hashKey": "object:73",
671
+ "fake": true,
672
+ "field": "agent_name",
673
+ "id": "3",
674
+ "settings": {
675
+ "min_doc_count": 1,
676
+ "order": "desc",
677
+ "orderBy": "_count",
678
+ "size": "0"
679
+ },
680
+ "type": "terms"
681
+ }
682
+ ],
683
+ "datasource": {
684
+ "type": "elasticsearch",
685
+ "uid": "wazuh_datasource_uid"
686
+ },
687
+ "metrics": [
688
+ {
689
+ "$$hashKey": "object:71",
690
+ "field": "select field",
691
+ "id": "1",
692
+ "type": "count"
693
+ }
694
+ ],
695
+ "query": "agent_name:$agent_name AND _exists_:cui_value",
696
+ "refId": "A",
697
+ "timeField": "timestamp"
698
+ }
699
+ ],
700
+ "title": "CUI - EVENTS BY AGENT",
701
+ "type": "table"
702
+ },
703
+ {
704
+ "aliasColors": {},
705
+ "bars": true,
706
+ "dashLength": 10,
707
+ "dashes": false,
708
+ "datasource": {
709
+ "type": "elasticsearch",
710
+ "uid": "wazuh_datasource_uid"
711
+ },
712
+ "fill": 1,
713
+ "fillGradient": 0,
714
+ "gridPos": {
715
+ "h": 7,
716
+ "w": 15,
717
+ "x": 9,
718
+ "y": 8
719
+ },
720
+ "hiddenSeries": false,
721
+ "id": 97,
722
+ "legend": {
723
+ "alignAsTable": true,
724
+ "avg": false,
725
+ "current": false,
726
+ "max": false,
727
+ "min": false,
728
+ "rightSide": true,
729
+ "show": true,
730
+ "total": false,
731
+ "values": false
732
+ },
733
+ "lines": false,
734
+ "linewidth": 1,
735
+ "links": [],
736
+ "maxDataPoints": 3,
737
+ "nullPointMode": "null",
738
+ "options": {
739
+ "alertThreshold": true
740
+ },
741
+ "percentage": false,
742
+ "pluginVersion": "10.0.2",
743
+ "pointradius": 2,
744
+ "points": false,
745
+ "renderer": "flot",
746
+ "seriesOverrides": [],
747
+ "spaceLength": 10,
748
+ "stack": true,
749
+ "steppedLine": false,
750
+ "targets": [
751
+ {
752
+ "alias": "",
753
+ "bucketAggs": [
754
+ {
755
+ "field": "agent_name",
756
+ "id": "4",
757
+ "settings": {
758
+ "min_doc_count": "1",
759
+ "order": "desc",
760
+ "orderBy": "_count",
761
+ "size": "10"
762
+ },
763
+ "type": "terms"
764
+ },
765
+ {
766
+ "field": "timestamp",
767
+ "id": "5",
768
+ "settings": {
769
+ "interval": "auto",
770
+ "min_doc_count": "0",
771
+ "trimEdges": "0"
772
+ },
773
+ "type": "date_histogram"
774
+ }
775
+ ],
776
+ "datasource": {
777
+ "type": "elasticsearch",
778
+ "uid": "wazuh_datasource_uid"
779
+ },
780
+ "metrics": [
781
+ {
782
+ "$$hashKey": "object:71",
783
+ "field": "select field",
784
+ "id": "1",
785
+ "type": "count"
786
+ }
787
+ ],
788
+ "query": "agent_name:$agent_name AND _exists_:cui_value",
789
+ "refId": "A",
790
+ "timeField": "timestamp"
791
+ }
792
+ ],
793
+ "thresholds": [],
794
+ "timeRegions": [],
795
+ "title": "CUI - EVENTS BY AGENT (HISTOGRAM)",
796
+ "tooltip": {
797
+ "shared": true,
798
+ "sort": 0,
799
+ "value_type": "individual"
800
+ },
801
+ "type": "graph",
802
+ "xaxis": {
803
+ "mode": "time",
804
+ "show": true,
805
+ "values": []
806
+ },
807
+ "yaxes": [
808
+ {
809
+ "format": "short",
810
+ "logBase": 1,
811
+ "show": true
812
+ },
813
+ {
814
+ "format": "short",
815
+ "logBase": 1,
816
+ "show": true
817
+ }
818
+ ],
819
+ "yaxis": {
820
+ "align": false
821
+ }
822
+ },
823
+ {
824
+ "datasource": {
825
+ "type": "elasticsearch",
826
+ "uid": "wazuh_datasource_uid"
827
+ },
828
+ "fieldConfig": {
829
+ "defaults": {
830
+ "color": {
831
+ "mode": "thresholds"
832
+ },
833
+ "custom": {
834
+ "align": "auto",
835
+ "cellOptions": {
836
+ "type": "auto"
837
+ },
838
+ "inspect": false
839
+ },
840
+ "mappings": [],
841
+ "thresholds": {
842
+ "mode": "absolute",
843
+ "steps": [
844
+ {
845
+ "color": "green",
846
+ "value": null
847
+ },
848
+ {
849
+ "color": "red",
850
+ "value": 80
851
+ }
852
+ ]
853
+ }
854
+ },
855
+ "overrides": [
856
+ {
857
+ "matcher": {
858
+ "id": "byName",
859
+ "options": "rule_level"
860
+ },
861
+ "properties": [
862
+ {
863
+ "id": "custom.width",
864
+ "value": 93
865
+ }
866
+ ]
867
+ },
868
+ {
869
+ "matcher": {
870
+ "id": "byName",
871
+ "options": "windows_event_id"
872
+ },
873
+ "properties": [
874
+ {
875
+ "id": "custom.width",
876
+ "value": 186
877
+ }
878
+ ]
879
+ },
880
+ {
881
+ "matcher": {
882
+ "id": "byName",
883
+ "options": "DATE/TIME"
884
+ },
885
+ "properties": [
886
+ {
887
+ "id": "custom.width",
888
+ "value": 202
889
+ }
890
+ ]
891
+ },
892
+ {
893
+ "matcher": {
894
+ "id": "byName",
895
+ "options": "AGENT"
896
+ },
897
+ "properties": [
898
+ {
899
+ "id": "custom.width",
900
+ "value": 171
901
+ }
902
+ ]
903
+ },
904
+ {
905
+ "matcher": {
906
+ "id": "byName",
907
+ "options": "SRC IP"
908
+ },
909
+ "properties": [
910
+ {
911
+ "id": "custom.width",
912
+ "value": 167
913
+ }
914
+ ]
915
+ },
916
+ {
917
+ "matcher": {
918
+ "id": "byName",
919
+ "options": "MESSAGE"
920
+ },
921
+ "properties": [
922
+ {
923
+ "id": "custom.width",
924
+ "value": 1519
925
+ }
926
+ ]
927
+ },
928
+ {
929
+ "matcher": {
930
+ "id": "byName",
931
+ "options": "rule_description"
932
+ },
933
+ "properties": [
934
+ {
935
+ "id": "custom.width",
936
+ "value": 524
937
+ }
938
+ ]
939
+ },
940
+ {
941
+ "matcher": {
942
+ "id": "byName",
943
+ "options": "RULE LEVEL"
944
+ },
945
+ "properties": [
946
+ {
947
+ "id": "custom.width",
948
+ "value": 196
949
+ }
950
+ ]
951
+ }
952
+ ]
953
+ },
954
+ "gridPos": {
955
+ "h": 10,
956
+ "w": 24,
957
+ "x": 0,
958
+ "y": 15
959
+ },
960
+ "id": 98,
961
+ "options": {
962
+ "cellHeight": "sm",
963
+ "footer": {
964
+ "countRows": false,
965
+ "fields": "",
966
+ "reducer": ["sum"],
967
+ "show": false
968
+ },
969
+ "showHeader": true,
970
+ "sortBy": []
971
+ },
972
+ "pluginVersion": "10.0.2",
973
+ "targets": [
974
+ {
975
+ "alias": "",
976
+ "bucketAggs": [
977
+ {
978
+ "field": "agent_name",
979
+ "id": "2",
980
+ "settings": {
981
+ "min_doc_count": "1",
982
+ "order": "desc",
983
+ "orderBy": "_term",
984
+ "size": "10"
985
+ },
986
+ "type": "terms"
987
+ },
988
+ {
989
+ "field": "rule_description",
990
+ "id": "3",
991
+ "settings": {
992
+ "min_doc_count": "1",
993
+ "order": "desc",
994
+ "orderBy": "_count",
995
+ "size": "10"
996
+ },
997
+ "type": "terms"
998
+ },
999
+ {
1000
+ "field": "cui_value",
1001
+ "id": "4",
1002
+ "settings": {
1003
+ "min_doc_count": "1",
1004
+ "order": "desc",
1005
+ "orderBy": "_term",
1006
+ "size": "10"
1007
+ },
1008
+ "type": "terms"
1009
+ }
1010
+ ],
1011
+ "datasource": {
1012
+ "type": "elasticsearch",
1013
+ "uid": "wazuh_datasource_uid"
1014
+ },
1015
+ "metrics": [
1016
+ {
1017
+ "id": "1",
1018
+ "type": "count"
1019
+ }
1020
+ ],
1021
+ "query": "agent_name:$agent_name AND _exists_:cui_value",
1022
+ "queryType": "lucene",
1023
+ "refId": "A",
1024
+ "timeField": "timestamp"
1025
+ }
1026
+ ],
1027
+ "title": "CUI - EVENTS",
1028
+ "transformations": [
1029
+ {
1030
+ "id": "organize",
1031
+ "options": {
1032
+ "excludeByName": {
1033
+ "@metadata_beat": true,
1034
+ "@metadata_type": true,
1035
+ "@metadata_version": true,
1036
+ "_id": true,
1037
+ "_index": true,
1038
+ "_type": true,
1039
+ "agent_ephemeral_id": true,
1040
+ "agent_hostname": true,
1041
+ "agent_id": true,
1042
+ "agent_ip": false,
1043
+ "agent_ip_city_name": true,
1044
+ "agent_ip_country_code": true,
1045
+ "agent_ip_geolocation": true,
1046
+ "agent_labels_customer": true,
1047
+ "agent_name": false,
1048
+ "agent_type": true,
1049
+ "agent_version": true,
1050
+ "beats_type": true,
1051
+ "collector_node_id": true,
1052
+ "data_extra_data": true,
1053
+ "data_win_eventdata_authenticationPackageName": true,
1054
+ "data_win_eventdata_domain": true,
1055
+ "data_win_eventdata_elevatedToken": true,
1056
+ "data_win_eventdata_imagePath": true,
1057
+ "data_win_eventdata_impersonationLevel": true,
1058
+ "data_win_eventdata_ipAddress": true,
1059
+ "data_win_eventdata_ipPort": true,
1060
+ "data_win_eventdata_keyLength": true,
1061
+ "data_win_eventdata_logonGuid": true,
1062
+ "data_win_eventdata_logonProcessName": true,
1063
+ "data_win_eventdata_logonType": true,
1064
+ "data_win_eventdata_param1": true,
1065
+ "data_win_eventdata_param2": true,
1066
+ "data_win_eventdata_param3": true,
1067
+ "data_win_eventdata_param4": true,
1068
+ "data_win_eventdata_processId": true,
1069
+ "data_win_eventdata_processName": true,
1070
+ "data_win_eventdata_sID": true,
1071
+ "data_win_eventdata_serviceName": true,
1072
+ "data_win_eventdata_serviceSid": true,
1073
+ "data_win_eventdata_serviceType": true,
1074
+ "data_win_eventdata_startType": true,
1075
+ "data_win_eventdata_status": true,
1076
+ "data_win_eventdata_subjectDomainName": true,
1077
+ "data_win_eventdata_subjectLogonId": true,
1078
+ "data_win_eventdata_subjectUserName": true,
1079
+ "data_win_eventdata_subjectUserSid": true,
1080
+ "data_win_eventdata_targetDomainName": true,
1081
+ "data_win_eventdata_targetLinkedLogonId": true,
1082
+ "data_win_eventdata_targetLogonId": true,
1083
+ "data_win_eventdata_targetUserName": true,
1084
+ "data_win_eventdata_targetUserSid": true,
1085
+ "data_win_eventdata_ticketEncryptionType": true,
1086
+ "data_win_eventdata_ticketOptions": true,
1087
+ "data_win_eventdata_user": true,
1088
+ "data_win_eventdata_virtualAccount": true,
1089
+ "data_win_system_channel": true,
1090
+ "data_win_system_computer": true,
1091
+ "data_win_system_eventID": true,
1092
+ "data_win_system_eventRecordID": true,
1093
+ "data_win_system_eventSourceName": true,
1094
+ "data_win_system_keywords": true,
1095
+ "data_win_system_level": true,
1096
+ "data_win_system_message": true,
1097
+ "data_win_system_opcode": true,
1098
+ "data_win_system_processID": true,
1099
+ "data_win_system_providerGuid": true,
1100
+ "data_win_system_providerName": true,
1101
+ "data_win_system_severityValue": true,
1102
+ "data_win_system_systemTime": true,
1103
+ "data_win_system_task": true,
1104
+ "data_win_system_threadID": true,
1105
+ "data_win_system_version": true,
1106
+ "decoder_name": true,
1107
+ "decoder_parent": true,
1108
+ "ecs_version": true,
1109
+ "full_log": true,
1110
+ "gl2_accounted_message_size": true,
1111
+ "gl2_message_id": true,
1112
+ "gl2_processing_error": true,
1113
+ "gl2_remote_ip": true,
1114
+ "gl2_remote_port": true,
1115
+ "gl2_source_collector": true,
1116
+ "gl2_source_input": true,
1117
+ "gl2_source_node": true,
1118
+ "highlight": true,
1119
+ "host_name": true,
1120
+ "id": true,
1121
+ "location": true,
1122
+ "log_file_path": true,
1123
+ "log_offset": true,
1124
+ "manager_name": true,
1125
+ "message": true,
1126
+ "previous_log": true,
1127
+ "previous_output": true,
1128
+ "rule_description": false,
1129
+ "rule_firedtimes": true,
1130
+ "rule_frequency": true,
1131
+ "rule_gdpr": true,
1132
+ "rule_gpg13": true,
1133
+ "rule_group1": true,
1134
+ "rule_group2": true,
1135
+ "rule_group3": true,
1136
+ "rule_groups": true,
1137
+ "rule_hipaa": true,
1138
+ "rule_id": true,
1139
+ "rule_info": true,
1140
+ "rule_mail": true,
1141
+ "rule_mitre_id": false,
1142
+ "rule_mitre_tactic": true,
1143
+ "rule_mitre_technique": true,
1144
+ "rule_nist_800_53": false,
1145
+ "rule_pci_dss": true,
1146
+ "rule_tsc": true,
1147
+ "sort": true,
1148
+ "source": true,
1149
+ "src_ip": true,
1150
+ "src_ip_city_name": true,
1151
+ "src_ip_country_code": true,
1152
+ "src_ip_geolocation": true,
1153
+ "streams": true,
1154
+ "syslog_tag": true,
1155
+ "syslog_type": true,
1156
+ "timestamp": true,
1157
+ "user_name": true,
1158
+ "win_system_eventID": true,
1159
+ "windows_event_id": true,
1160
+ "windows_event_severity": true
1161
+ },
1162
+ "indexByName": {
1163
+ "@metadata_beat": 2,
1164
+ "@metadata_type": 3,
1165
+ "@metadata_version": 4,
1166
+ "_id": 5,
1167
+ "_index": 6,
1168
+ "_type": 7,
1169
+ "agent_ephemeral_id": 8,
1170
+ "agent_hostname": 9,
1171
+ "agent_id": 10,
1172
+ "agent_ip": 11,
1173
+ "agent_ip_city_name": 12,
1174
+ "agent_ip_country_code": 13,
1175
+ "agent_ip_geolocation": 14,
1176
+ "agent_name": 1,
1177
+ "agent_type": 16,
1178
+ "agent_version": 17,
1179
+ "beats_type": 18,
1180
+ "collector_node_id": 19,
1181
+ "data_win_eventdata_domain": 20,
1182
+ "data_win_eventdata_sID": 21,
1183
+ "data_win_eventdata_user": 22,
1184
+ "data_win_system_channel": 23,
1185
+ "data_win_system_computer": 24,
1186
+ "data_win_system_eventID": 25,
1187
+ "data_win_system_eventRecordID": 26,
1188
+ "data_win_system_keywords": 27,
1189
+ "data_win_system_level": 28,
1190
+ "data_win_system_message": 29,
1191
+ "data_win_system_opcode": 30,
1192
+ "data_win_system_processID": 31,
1193
+ "data_win_system_providerGuid": 32,
1194
+ "data_win_system_providerName": 33,
1195
+ "data_win_system_severityValue": 34,
1196
+ "data_win_system_systemTime": 35,
1197
+ "data_win_system_task": 36,
1198
+ "data_win_system_threadID": 37,
1199
+ "data_win_system_version": 38,
1200
+ "decoder_name": 39,
1201
+ "ecs_version": 40,
1202
+ "gl2_accounted_message_size": 41,
1203
+ "gl2_message_id": 42,
1204
+ "gl2_remote_ip": 43,
1205
+ "gl2_remote_port": 44,
1206
+ "gl2_source_collector": 45,
1207
+ "gl2_source_input": 46,
1208
+ "gl2_source_node": 47,
1209
+ "highlight": 48,
1210
+ "host_name": 49,
1211
+ "id": 50,
1212
+ "location": 51,
1213
+ "log_file_path": 52,
1214
+ "log_offset": 53,
1215
+ "manager_name": 54,
1216
+ "message": 55,
1217
+ "previous_output": 56,
1218
+ "rule_description": 57,
1219
+ "rule_firedtimes": 58,
1220
+ "rule_frequency": 59,
1221
+ "rule_gdpr": 60,
1222
+ "rule_gpg13": 61,
1223
+ "rule_groups": 62,
1224
+ "rule_hipaa": 63,
1225
+ "rule_id": 64,
1226
+ "rule_level": 65,
1227
+ "rule_mail": 66,
1228
+ "rule_nist_800_53": 67,
1229
+ "rule_pci_dss": 68,
1230
+ "rule_tsc": 69,
1231
+ "sort": 70,
1232
+ "source": 71,
1233
+ "src_ip": 72,
1234
+ "src_ip_city_name": 73,
1235
+ "src_ip_country_code": 74,
1236
+ "src_ip_geolocation": 75,
1237
+ "streams": 76,
1238
+ "syslog_tag": 77,
1239
+ "syslog_type": 78,
1240
+ "timestamp": 79,
1241
+ "user_name": 80,
1242
+ "win_system_eventID": 81,
1243
+ "windows_event_id": 82,
1244
+ "windows_event_severity": 83
1245
+ },
1246
+ "renameByName": {
1247
+ "Count": "COUNT",
1248
+ "agent_ip": "SRC IP",
1249
+ "agent_name": "AGENT",
1250
+ "cui_value": "CUI",
1251
+ "data_win_system_message": "MESSAGE",
1252
+ "data_win_system_providerGuid": "",
1253
+ "rule_description": "EVENT",
1254
+ "rule_level": "RULE LEVEL",
1255
+ "rule_mitre_id": "MITRE ID",
1256
+ "rule_nist_800_53": "NIST 800-53",
1257
+ "timestamp": "DATE/TIME",
1258
+ "windows_event_severity": "EVENT LOG SEVERITY"
1259
+ }
1260
+ }
1261
+ }
1262
+ ],
1263
+ "type": "table"
1264
+ },
1265
+ {
1266
+ "collapsed": true,
1267
+ "datasource": {
1268
+ "type": "elasticsearch",
1269
+ "uid": "wazuh_datasource_uid"
1270
+ },
1271
+ "gridPos": {
1272
+ "h": 1,
1273
+ "w": 24,
1274
+ "x": 0,
1275
+ "y": 25
1276
+ },
1277
+ "id": 72,
1278
+ "panels": [
1279
+ {
1280
+ "datasource": {
1281
+ "type": "elasticsearch",
1282
+ "uid": "wazuh_datasource_uid"
1283
+ },
1284
+ "fieldConfig": {
1285
+ "defaults": {
1286
+ "mappings": [
1287
+ {
1288
+ "options": {
1289
+ "match": "null",
1290
+ "result": {
1291
+ "text": "N/A"
1292
+ }
1293
+ },
1294
+ "type": "special"
1295
+ }
1296
+ ],
1297
+ "thresholds": {
1298
+ "mode": "absolute",
1299
+ "steps": [
1300
+ {
1301
+ "color": "blue",
1302
+ "value": null
1303
+ }
1304
+ ]
1305
+ },
1306
+ "unit": "short"
1307
+ },
1308
+ "overrides": []
1309
+ },
1310
+ "gridPos": {
1311
+ "h": 7,
1312
+ "w": 4,
1313
+ "x": 0,
1314
+ "y": 26
1315
+ },
1316
+ "id": 67,
1317
+ "links": [],
1318
+ "options": {
1319
+ "colorMode": "value",
1320
+ "graphMode": "area",
1321
+ "justifyMode": "auto",
1322
+ "orientation": "horizontal",
1323
+ "reduceOptions": {
1324
+ "calcs": ["sum"],
1325
+ "fields": "",
1326
+ "values": false
1327
+ },
1328
+ "text": {},
1329
+ "textMode": "auto"
1330
+ },
1331
+ "pluginVersion": "10.0.2",
1332
+ "targets": [
1333
+ {
1334
+ "bucketAggs": [
1335
+ {
1336
+ "$$hashKey": "object:50",
1337
+ "field": "timestamp",
1338
+ "id": "2",
1339
+ "settings": {
1340
+ "interval": "auto",
1341
+ "min_doc_count": 0,
1342
+ "trimEdges": 0
1343
+ },
1344
+ "type": "date_histogram"
1345
+ }
1346
+ ],
1347
+ "datasource": {
1348
+ "type": "elasticsearch",
1349
+ "uid": "wazuh_datasource_uid"
1350
+ },
1351
+ "metrics": [
1352
+ {
1353
+ "$$hashKey": "object:48",
1354
+ "field": "select field",
1355
+ "id": "1",
1356
+ "type": "count"
1357
+ }
1358
+ ],
1359
+ "query": "agent_name:$agent_name AND _exists_:rule_nist_800_53",
1360
+ "refId": "A",
1361
+ "timeField": "timestamp"
1362
+ }
1363
+ ],
1364
+ "title": "NIST 800-53 - EVENTS",
1365
+ "type": "stat"
1366
+ },
1367
+ {
1368
+ "datasource": {
1369
+ "type": "elasticsearch",
1370
+ "uid": "wazuh_datasource_uid"
1371
+ },
1372
+ "fieldConfig": {
1373
+ "defaults": {
1374
+ "color": {
1375
+ "mode": "palette-classic"
1376
+ },
1377
+ "custom": {
1378
+ "hideFrom": {
1379
+ "legend": false,
1380
+ "tooltip": false,
1381
+ "viz": false
1382
+ }
1383
+ },
1384
+ "decimals": 0,
1385
+ "mappings": [],
1386
+ "unit": "short"
1387
+ },
1388
+ "overrides": [
1389
+ {
1390
+ "matcher": {
1391
+ "id": "byName",
1392
+ "options": "1"
1393
+ },
1394
+ "properties": [
1395
+ {
1396
+ "id": "color",
1397
+ "value": {
1398
+ "fixedColor": "#FF9830",
1399
+ "mode": "fixed"
1400
+ }
1401
+ }
1402
+ ]
1403
+ },
1404
+ {
1405
+ "matcher": {
1406
+ "id": "byName",
1407
+ "options": "Alert"
1408
+ },
1409
+ "properties": [
1410
+ {
1411
+ "id": "color",
1412
+ "value": {
1413
+ "fixedColor": "#F2495C",
1414
+ "mode": "fixed"
1415
+ }
1416
+ }
1417
+ ]
1418
+ },
1419
+ {
1420
+ "matcher": {
1421
+ "id": "byName",
1422
+ "options": "Error"
1423
+ },
1424
+ "properties": [
1425
+ {
1426
+ "id": "color",
1427
+ "value": {
1428
+ "fixedColor": "#F2495C",
1429
+ "mode": "fixed"
1430
+ }
1431
+ }
1432
+ ]
1433
+ },
1434
+ {
1435
+ "matcher": {
1436
+ "id": "byName",
1437
+ "options": "Info"
1438
+ },
1439
+ "properties": [
1440
+ {
1441
+ "id": "color",
1442
+ "value": {
1443
+ "fixedColor": "#73BF69",
1444
+ "mode": "fixed"
1445
+ }
1446
+ }
1447
+ ]
1448
+ },
1449
+ {
1450
+ "matcher": {
1451
+ "id": "byName",
1452
+ "options": "NOTICE"
1453
+ },
1454
+ "properties": [
1455
+ {
1456
+ "id": "color",
1457
+ "value": {
1458
+ "fixedColor": "#5794F2",
1459
+ "mode": "fixed"
1460
+ }
1461
+ }
1462
+ ]
1463
+ },
1464
+ {
1465
+ "matcher": {
1466
+ "id": "byName",
1467
+ "options": "Notice"
1468
+ },
1469
+ "properties": [
1470
+ {
1471
+ "id": "color",
1472
+ "value": {
1473
+ "fixedColor": "#5794F2",
1474
+ "mode": "fixed"
1475
+ }
1476
+ }
1477
+ ]
1478
+ },
1479
+ {
1480
+ "matcher": {
1481
+ "id": "byName",
1482
+ "options": "Result"
1483
+ },
1484
+ "properties": [
1485
+ {
1486
+ "id": "color",
1487
+ "value": {
1488
+ "fixedColor": "#B877D9",
1489
+ "mode": "fixed"
1490
+ }
1491
+ }
1492
+ ]
1493
+ },
1494
+ {
1495
+ "matcher": {
1496
+ "id": "byName",
1497
+ "options": "Warning"
1498
+ },
1499
+ "properties": [
1500
+ {
1501
+ "id": "color",
1502
+ "value": {
1503
+ "fixedColor": "#FF9830",
1504
+ "mode": "fixed"
1505
+ }
1506
+ }
1507
+ ]
1508
+ },
1509
+ {
1510
+ "matcher": {
1511
+ "id": "byName",
1512
+ "options": "INFORMATION"
1513
+ },
1514
+ "properties": [
1515
+ {
1516
+ "id": "color",
1517
+ "value": {
1518
+ "fixedColor": "green",
1519
+ "mode": "fixed"
1520
+ }
1521
+ }
1522
+ ]
1523
+ },
1524
+ {
1525
+ "matcher": {
1526
+ "id": "byName",
1527
+ "options": "WARNING"
1528
+ },
1529
+ "properties": [
1530
+ {
1531
+ "id": "color",
1532
+ "value": {
1533
+ "fixedColor": "orange",
1534
+ "mode": "fixed"
1535
+ }
1536
+ }
1537
+ ]
1538
+ },
1539
+ {
1540
+ "matcher": {
1541
+ "id": "byName",
1542
+ "options": "ERROR"
1543
+ },
1544
+ "properties": [
1545
+ {
1546
+ "id": "color",
1547
+ "value": {
1548
+ "fixedColor": "red",
1549
+ "mode": "fixed"
1550
+ }
1551
+ }
1552
+ ]
1553
+ }
1554
+ ]
1555
+ },
1556
+ "gridPos": {
1557
+ "h": 7,
1558
+ "w": 5,
1559
+ "x": 4,
1560
+ "y": 26
1561
+ },
1562
+ "id": 68,
1563
+ "links": [],
1564
+ "maxDataPoints": 3,
1565
+ "options": {
1566
+ "displayLabels": [],
1567
+ "legend": {
1568
+ "calcs": [],
1569
+ "displayMode": "table",
1570
+ "placement": "right",
1571
+ "showLegend": true,
1572
+ "values": ["value"]
1573
+ },
1574
+ "pieType": "donut",
1575
+ "reduceOptions": {
1576
+ "calcs": ["sum"],
1577
+ "fields": "",
1578
+ "values": false
1579
+ },
1580
+ "text": {},
1581
+ "tooltip": {
1582
+ "mode": "single",
1583
+ "sort": "none"
1584
+ }
1585
+ },
1586
+ "targets": [
1587
+ {
1588
+ "bucketAggs": [
1589
+ {
1590
+ "$$hashKey": "object:73",
1591
+ "fake": true,
1592
+ "field": "rule_nist_800_53",
1593
+ "id": "3",
1594
+ "settings": {
1595
+ "min_doc_count": 1,
1596
+ "order": "desc",
1597
+ "orderBy": "_count",
1598
+ "size": "0"
1599
+ },
1600
+ "type": "terms"
1601
+ },
1602
+ {
1603
+ "$$hashKey": "object:74",
1604
+ "field": "timestamp",
1605
+ "id": "2",
1606
+ "settings": {
1607
+ "interval": "auto",
1608
+ "min_doc_count": 0,
1609
+ "trimEdges": 0
1610
+ },
1611
+ "type": "date_histogram"
1612
+ }
1613
+ ],
1614
+ "datasource": {
1615
+ "type": "elasticsearch",
1616
+ "uid": "wazuh_datasource_uid"
1617
+ },
1618
+ "metrics": [
1619
+ {
1620
+ "$$hashKey": "object:71",
1621
+ "field": "select field",
1622
+ "id": "1",
1623
+ "type": "count"
1624
+ }
1625
+ ],
1626
+ "query": "agent_name:$agent_name AND _exists_:rule_nist_800_53",
1627
+ "refId": "A",
1628
+ "timeField": "timestamp"
1629
+ }
1630
+ ],
1631
+ "title": "NIST 800-53 - SECURITY CONTROLS",
1632
+ "type": "piechart"
1633
+ },
1634
+ {
1635
+ "datasource": {
1636
+ "type": "elasticsearch",
1637
+ "uid": "wazuh_datasource_uid"
1638
+ },
1639
+ "fieldConfig": {
1640
+ "defaults": {
1641
+ "custom": {
1642
+ "align": "auto",
1643
+ "cellOptions": {
1644
+ "type": "auto"
1645
+ },
1646
+ "filterable": false,
1647
+ "inspect": false
1648
+ },
1649
+ "mappings": [],
1650
+ "thresholds": {
1651
+ "mode": "absolute",
1652
+ "steps": [
1653
+ {
1654
+ "color": "orange",
1655
+ "value": null
1656
+ },
1657
+ {
1658
+ "color": "red",
1659
+ "value": 50
1660
+ }
1661
+ ]
1662
+ }
1663
+ },
1664
+ "overrides": [
1665
+ {
1666
+ "matcher": {
1667
+ "id": "byName",
1668
+ "options": "Count"
1669
+ },
1670
+ "properties": [
1671
+ {
1672
+ "id": "custom.cellOptions",
1673
+ "value": {
1674
+ "mode": "basic",
1675
+ "type": "gauge"
1676
+ }
1677
+ }
1678
+ ]
1679
+ },
1680
+ {
1681
+ "matcher": {
1682
+ "id": "byName",
1683
+ "options": "rule_description"
1684
+ },
1685
+ "properties": [
1686
+ {
1687
+ "id": "custom.width",
1688
+ "value": 703
1689
+ }
1690
+ ]
1691
+ },
1692
+ {
1693
+ "matcher": {
1694
+ "id": "byName",
1695
+ "options": "rule_level"
1696
+ },
1697
+ "properties": [
1698
+ {
1699
+ "id": "custom.width",
1700
+ "value": 212
1701
+ },
1702
+ {
1703
+ "id": "mappings",
1704
+ "value": [
1705
+ {
1706
+ "options": {
1707
+ "from": 1,
1708
+ "result": {
1709
+ "color": "green",
1710
+ "index": 0
1711
+ },
1712
+ "to": 3
1713
+ },
1714
+ "type": "range"
1715
+ },
1716
+ {
1717
+ "options": {
1718
+ "from": 4,
1719
+ "result": {
1720
+ "color": "dark-yellow",
1721
+ "index": 1
1722
+ },
1723
+ "to": 6
1724
+ },
1725
+ "type": "range"
1726
+ },
1727
+ {
1728
+ "options": {
1729
+ "from": 7,
1730
+ "result": {
1731
+ "color": "orange",
1732
+ "index": 2
1733
+ },
1734
+ "to": 9
1735
+ },
1736
+ "type": "range"
1737
+ },
1738
+ {
1739
+ "options": {
1740
+ "from": 10,
1741
+ "result": {
1742
+ "color": "semi-dark-red",
1743
+ "index": 3
1744
+ },
1745
+ "to": 15
1746
+ },
1747
+ "type": "range"
1748
+ }
1749
+ ]
1750
+ }
1751
+ ]
1752
+ }
1753
+ ]
1754
+ },
1755
+ "gridPos": {
1756
+ "h": 7,
1757
+ "w": 15,
1758
+ "x": 9,
1759
+ "y": 26
1760
+ },
1761
+ "id": 95,
1762
+ "links": [],
1763
+ "maxDataPoints": 3,
1764
+ "options": {
1765
+ "cellHeight": "sm",
1766
+ "footer": {
1767
+ "countRows": false,
1768
+ "fields": "",
1769
+ "reducer": ["sum"],
1770
+ "show": false
1771
+ },
1772
+ "showHeader": true,
1773
+ "sortBy": []
1774
+ },
1775
+ "pluginVersion": "10.0.2",
1776
+ "targets": [
1777
+ {
1778
+ "bucketAggs": [
1779
+ {
1780
+ "$$hashKey": "object:3082",
1781
+ "fake": true,
1782
+ "field": "rule_description",
1783
+ "id": "4",
1784
+ "settings": {
1785
+ "min_doc_count": 0,
1786
+ "order": "desc",
1787
+ "orderBy": "_count",
1788
+ "size": "10"
1789
+ },
1790
+ "type": "terms"
1791
+ },
1792
+ {
1793
+ "$$hashKey": "object:73",
1794
+ "fake": true,
1795
+ "field": "rule_level",
1796
+ "id": "3",
1797
+ "settings": {
1798
+ "min_doc_count": 1,
1799
+ "order": "desc",
1800
+ "orderBy": "_count",
1801
+ "size": "0"
1802
+ },
1803
+ "type": "terms"
1804
+ }
1805
+ ],
1806
+ "datasource": {
1807
+ "type": "elasticsearch",
1808
+ "uid": "wazuh_datasource_uid"
1809
+ },
1810
+ "metrics": [
1811
+ {
1812
+ "$$hashKey": "object:71",
1813
+ "field": "select field",
1814
+ "id": "1",
1815
+ "type": "count"
1816
+ }
1817
+ ],
1818
+ "query": "agent_name:$agent_name AND _exists_:rule_nist_800_53",
1819
+ "refId": "A",
1820
+ "timeField": "timestamp"
1821
+ }
1822
+ ],
1823
+ "title": "NIST 800-53 - EVENTS BY TYPE",
1824
+ "type": "table"
1825
+ },
1826
+ {
1827
+ "datasource": {
1828
+ "type": "elasticsearch",
1829
+ "uid": "wazuh_datasource_uid"
1830
+ },
1831
+ "fieldConfig": {
1832
+ "defaults": {
1833
+ "custom": {
1834
+ "align": "auto",
1835
+ "cellOptions": {
1836
+ "type": "auto"
1837
+ },
1838
+ "filterable": false,
1839
+ "inspect": false
1840
+ },
1841
+ "mappings": [],
1842
+ "thresholds": {
1843
+ "mode": "absolute",
1844
+ "steps": [
1845
+ {
1846
+ "color": "green",
1847
+ "value": null
1848
+ },
1849
+ {
1850
+ "color": "red",
1851
+ "value": 80
1852
+ }
1853
+ ]
1854
+ }
1855
+ },
1856
+ "overrides": [
1857
+ {
1858
+ "matcher": {
1859
+ "id": "byName",
1860
+ "options": "agent_name"
1861
+ },
1862
+ "properties": [
1863
+ {
1864
+ "id": "custom.width",
1865
+ "value": 492
1866
+ }
1867
+ ]
1868
+ }
1869
+ ]
1870
+ },
1871
+ "gridPos": {
1872
+ "h": 7,
1873
+ "w": 9,
1874
+ "x": 0,
1875
+ "y": 33
1876
+ },
1877
+ "id": 70,
1878
+ "links": [],
1879
+ "maxDataPoints": 3,
1880
+ "options": {
1881
+ "cellHeight": "sm",
1882
+ "footer": {
1883
+ "countRows": false,
1884
+ "fields": "",
1885
+ "reducer": ["sum"],
1886
+ "show": false
1887
+ },
1888
+ "showHeader": true,
1889
+ "sortBy": []
1890
+ },
1891
+ "pluginVersion": "10.0.2",
1892
+ "targets": [
1893
+ {
1894
+ "bucketAggs": [
1895
+ {
1896
+ "$$hashKey": "object:73",
1897
+ "fake": true,
1898
+ "field": "agent_name",
1899
+ "id": "3",
1900
+ "settings": {
1901
+ "min_doc_count": 1,
1902
+ "order": "desc",
1903
+ "orderBy": "_count",
1904
+ "size": "0"
1905
+ },
1906
+ "type": "terms"
1907
+ }
1908
+ ],
1909
+ "datasource": {
1910
+ "type": "elasticsearch",
1911
+ "uid": "wazuh_datasource_uid"
1912
+ },
1913
+ "metrics": [
1914
+ {
1915
+ "$$hashKey": "object:71",
1916
+ "field": "select field",
1917
+ "id": "1",
1918
+ "type": "count"
1919
+ }
1920
+ ],
1921
+ "query": "agent_name:$agent_name AND _exists_:rule_nist_800_53",
1922
+ "refId": "A",
1923
+ "timeField": "timestamp"
1924
+ }
1925
+ ],
1926
+ "title": "NIST 800-53 - EVENTS BY AGENT",
1927
+ "type": "table"
1928
+ },
1929
+ {
1930
+ "aliasColors": {},
1931
+ "bars": true,
1932
+ "dashLength": 10,
1933
+ "dashes": false,
1934
+ "datasource": {
1935
+ "type": "elasticsearch",
1936
+ "uid": "wazuh_datasource_uid"
1937
+ },
1938
+ "fill": 1,
1939
+ "fillGradient": 0,
1940
+ "gridPos": {
1941
+ "h": 7,
1942
+ "w": 15,
1943
+ "x": 9,
1944
+ "y": 33
1945
+ },
1946
+ "hiddenSeries": false,
1947
+ "id": 83,
1948
+ "legend": {
1949
+ "alignAsTable": true,
1950
+ "avg": false,
1951
+ "current": false,
1952
+ "max": false,
1953
+ "min": false,
1954
+ "rightSide": true,
1955
+ "show": true,
1956
+ "total": false,
1957
+ "values": false
1958
+ },
1959
+ "lines": false,
1960
+ "linewidth": 1,
1961
+ "links": [],
1962
+ "maxDataPoints": 3,
1963
+ "nullPointMode": "null",
1964
+ "options": {
1965
+ "alertThreshold": true
1966
+ },
1967
+ "percentage": false,
1968
+ "pluginVersion": "10.0.2",
1969
+ "pointradius": 2,
1970
+ "points": false,
1971
+ "renderer": "flot",
1972
+ "seriesOverrides": [],
1973
+ "spaceLength": 10,
1974
+ "stack": true,
1975
+ "steppedLine": false,
1976
+ "targets": [
1977
+ {
1978
+ "alias": "",
1979
+ "bucketAggs": [
1980
+ {
1981
+ "field": "agent_name",
1982
+ "id": "4",
1983
+ "settings": {
1984
+ "min_doc_count": "1",
1985
+ "order": "desc",
1986
+ "orderBy": "_count",
1987
+ "size": "10"
1988
+ },
1989
+ "type": "terms"
1990
+ },
1991
+ {
1992
+ "field": "timestamp",
1993
+ "id": "5",
1994
+ "settings": {
1995
+ "interval": "auto",
1996
+ "min_doc_count": "0",
1997
+ "trimEdges": "0"
1998
+ },
1999
+ "type": "date_histogram"
2000
+ }
2001
+ ],
2002
+ "datasource": {
2003
+ "type": "elasticsearch",
2004
+ "uid": "wazuh_datasource_uid"
2005
+ },
2006
+ "metrics": [
2007
+ {
2008
+ "$$hashKey": "object:71",
2009
+ "field": "select field",
2010
+ "id": "1",
2011
+ "type": "count"
2012
+ }
2013
+ ],
2014
+ "query": "agent_name:$agent_name AND _exists_:rule_nist_800_53",
2015
+ "refId": "A",
2016
+ "timeField": "timestamp"
2017
+ }
2018
+ ],
2019
+ "thresholds": [],
2020
+ "timeRegions": [],
2021
+ "title": "NIST 800-53 - EVENTS BY AGENT (HISTOGRAM)",
2022
+ "tooltip": {
2023
+ "shared": true,
2024
+ "sort": 0,
2025
+ "value_type": "individual"
2026
+ },
2027
+ "type": "graph",
2028
+ "xaxis": {
2029
+ "mode": "time",
2030
+ "show": true,
2031
+ "values": []
2032
+ },
2033
+ "yaxes": [
2034
+ {
2035
+ "format": "short",
2036
+ "logBase": 1,
2037
+ "show": true
2038
+ },
2039
+ {
2040
+ "format": "short",
2041
+ "logBase": 1,
2042
+ "show": true
2043
+ }
2044
+ ],
2045
+ "yaxis": {
2046
+ "align": false
2047
+ }
2048
+ },
2049
+ {
2050
+ "datasource": {
2051
+ "type": "elasticsearch",
2052
+ "uid": "wazuh_datasource_uid"
2053
+ },
2054
+ "fieldConfig": {
2055
+ "defaults": {
2056
+ "color": {
2057
+ "mode": "thresholds"
2058
+ },
2059
+ "custom": {
2060
+ "align": "auto",
2061
+ "cellOptions": {
2062
+ "type": "auto"
2063
+ },
2064
+ "inspect": false
2065
+ },
2066
+ "mappings": [],
2067
+ "thresholds": {
2068
+ "mode": "absolute",
2069
+ "steps": [
2070
+ {
2071
+ "color": "green",
2072
+ "value": null
2073
+ },
2074
+ {
2075
+ "color": "red",
2076
+ "value": 80
2077
+ }
2078
+ ]
2079
+ }
2080
+ },
2081
+ "overrides": [
2082
+ {
2083
+ "matcher": {
2084
+ "id": "byName",
2085
+ "options": "rule_level"
2086
+ },
2087
+ "properties": [
2088
+ {
2089
+ "id": "custom.width",
2090
+ "value": 93
2091
+ }
2092
+ ]
2093
+ },
2094
+ {
2095
+ "matcher": {
2096
+ "id": "byName",
2097
+ "options": "windows_event_id"
2098
+ },
2099
+ "properties": [
2100
+ {
2101
+ "id": "custom.width",
2102
+ "value": 186
2103
+ }
2104
+ ]
2105
+ },
2106
+ {
2107
+ "matcher": {
2108
+ "id": "byName",
2109
+ "options": "DATE/TIME"
2110
+ },
2111
+ "properties": [
2112
+ {
2113
+ "id": "custom.width",
2114
+ "value": 202
2115
+ }
2116
+ ]
2117
+ },
2118
+ {
2119
+ "matcher": {
2120
+ "id": "byName",
2121
+ "options": "AGENT"
2122
+ },
2123
+ "properties": [
2124
+ {
2125
+ "id": "custom.width",
2126
+ "value": 171
2127
+ }
2128
+ ]
2129
+ },
2130
+ {
2131
+ "matcher": {
2132
+ "id": "byName",
2133
+ "options": "SRC IP"
2134
+ },
2135
+ "properties": [
2136
+ {
2137
+ "id": "custom.width",
2138
+ "value": 167
2139
+ }
2140
+ ]
2141
+ },
2142
+ {
2143
+ "matcher": {
2144
+ "id": "byName",
2145
+ "options": "MESSAGE"
2146
+ },
2147
+ "properties": [
2148
+ {
2149
+ "id": "custom.width",
2150
+ "value": 1519
2151
+ }
2152
+ ]
2153
+ },
2154
+ {
2155
+ "matcher": {
2156
+ "id": "byName",
2157
+ "options": "rule_description"
2158
+ },
2159
+ "properties": [
2160
+ {
2161
+ "id": "custom.width",
2162
+ "value": 524
2163
+ }
2164
+ ]
2165
+ },
2166
+ {
2167
+ "matcher": {
2168
+ "id": "byName",
2169
+ "options": "RULE LEVEL"
2170
+ },
2171
+ "properties": [
2172
+ {
2173
+ "id": "custom.width",
2174
+ "value": 196
2175
+ }
2176
+ ]
2177
+ }
2178
+ ]
2179
+ },
2180
+ "gridPos": {
2181
+ "h": 10,
2182
+ "w": 24,
2183
+ "x": 0,
2184
+ "y": 40
2185
+ },
2186
+ "id": 85,
2187
+ "options": {
2188
+ "cellHeight": "sm",
2189
+ "footer": {
2190
+ "countRows": false,
2191
+ "fields": "",
2192
+ "reducer": ["sum"],
2193
+ "show": false
2194
+ },
2195
+ "showHeader": true,
2196
+ "sortBy": []
2197
+ },
2198
+ "pluginVersion": "10.0.2",
2199
+ "targets": [
2200
+ {
2201
+ "alias": "",
2202
+ "bucketAggs": [
2203
+ {
2204
+ "field": "agent_name",
2205
+ "id": "2",
2206
+ "settings": {
2207
+ "min_doc_count": "1",
2208
+ "order": "desc",
2209
+ "orderBy": "_term",
2210
+ "size": "10"
2211
+ },
2212
+ "type": "terms"
2213
+ },
2214
+ {
2215
+ "field": "rule_description",
2216
+ "id": "3",
2217
+ "settings": {
2218
+ "min_doc_count": "1",
2219
+ "order": "desc",
2220
+ "orderBy": "_count",
2221
+ "size": "10"
2222
+ },
2223
+ "type": "terms"
2224
+ },
2225
+ {
2226
+ "field": "rule_nist_800_53",
2227
+ "id": "4",
2228
+ "settings": {
2229
+ "min_doc_count": "1",
2230
+ "order": "desc",
2231
+ "orderBy": "_term",
2232
+ "size": "10"
2233
+ },
2234
+ "type": "terms"
2235
+ }
2236
+ ],
2237
+ "datasource": {
2238
+ "type": "elasticsearch",
2239
+ "uid": "wazuh_datasource_uid"
2240
+ },
2241
+ "metrics": [
2242
+ {
2243
+ "id": "1",
2244
+ "type": "count"
2245
+ }
2246
+ ],
2247
+ "query": "agent_name:$agent_name AND _exists_:rule_nist_800_53",
2248
+ "queryType": "lucene",
2249
+ "refId": "A",
2250
+ "timeField": "timestamp"
2251
+ }
2252
+ ],
2253
+ "title": "NIST 800-53 - EVENTS",
2254
+ "transformations": [
2255
+ {
2256
+ "id": "organize",
2257
+ "options": {
2258
+ "excludeByName": {
2259
+ "@metadata_beat": true,
2260
+ "@metadata_type": true,
2261
+ "@metadata_version": true,
2262
+ "_id": true,
2263
+ "_index": true,
2264
+ "_type": true,
2265
+ "agent_ephemeral_id": true,
2266
+ "agent_hostname": true,
2267
+ "agent_id": true,
2268
+ "agent_ip": false,
2269
+ "agent_ip_city_name": true,
2270
+ "agent_ip_country_code": true,
2271
+ "agent_ip_geolocation": true,
2272
+ "agent_labels_customer": true,
2273
+ "agent_name": false,
2274
+ "agent_type": true,
2275
+ "agent_version": true,
2276
+ "beats_type": true,
2277
+ "collector_node_id": true,
2278
+ "data_extra_data": true,
2279
+ "data_win_eventdata_authenticationPackageName": true,
2280
+ "data_win_eventdata_domain": true,
2281
+ "data_win_eventdata_elevatedToken": true,
2282
+ "data_win_eventdata_imagePath": true,
2283
+ "data_win_eventdata_impersonationLevel": true,
2284
+ "data_win_eventdata_ipAddress": true,
2285
+ "data_win_eventdata_ipPort": true,
2286
+ "data_win_eventdata_keyLength": true,
2287
+ "data_win_eventdata_logonGuid": true,
2288
+ "data_win_eventdata_logonProcessName": true,
2289
+ "data_win_eventdata_logonType": true,
2290
+ "data_win_eventdata_param1": true,
2291
+ "data_win_eventdata_param2": true,
2292
+ "data_win_eventdata_param3": true,
2293
+ "data_win_eventdata_param4": true,
2294
+ "data_win_eventdata_processId": true,
2295
+ "data_win_eventdata_processName": true,
2296
+ "data_win_eventdata_sID": true,
2297
+ "data_win_eventdata_serviceName": true,
2298
+ "data_win_eventdata_serviceSid": true,
2299
+ "data_win_eventdata_serviceType": true,
2300
+ "data_win_eventdata_startType": true,
2301
+ "data_win_eventdata_status": true,
2302
+ "data_win_eventdata_subjectDomainName": true,
2303
+ "data_win_eventdata_subjectLogonId": true,
2304
+ "data_win_eventdata_subjectUserName": true,
2305
+ "data_win_eventdata_subjectUserSid": true,
2306
+ "data_win_eventdata_targetDomainName": true,
2307
+ "data_win_eventdata_targetLinkedLogonId": true,
2308
+ "data_win_eventdata_targetLogonId": true,
2309
+ "data_win_eventdata_targetUserName": true,
2310
+ "data_win_eventdata_targetUserSid": true,
2311
+ "data_win_eventdata_ticketEncryptionType": true,
2312
+ "data_win_eventdata_ticketOptions": true,
2313
+ "data_win_eventdata_user": true,
2314
+ "data_win_eventdata_virtualAccount": true,
2315
+ "data_win_system_channel": true,
2316
+ "data_win_system_computer": true,
2317
+ "data_win_system_eventID": true,
2318
+ "data_win_system_eventRecordID": true,
2319
+ "data_win_system_eventSourceName": true,
2320
+ "data_win_system_keywords": true,
2321
+ "data_win_system_level": true,
2322
+ "data_win_system_message": true,
2323
+ "data_win_system_opcode": true,
2324
+ "data_win_system_processID": true,
2325
+ "data_win_system_providerGuid": true,
2326
+ "data_win_system_providerName": true,
2327
+ "data_win_system_severityValue": true,
2328
+ "data_win_system_systemTime": true,
2329
+ "data_win_system_task": true,
2330
+ "data_win_system_threadID": true,
2331
+ "data_win_system_version": true,
2332
+ "decoder_name": true,
2333
+ "decoder_parent": true,
2334
+ "ecs_version": true,
2335
+ "full_log": true,
2336
+ "gl2_accounted_message_size": true,
2337
+ "gl2_message_id": true,
2338
+ "gl2_processing_error": true,
2339
+ "gl2_remote_ip": true,
2340
+ "gl2_remote_port": true,
2341
+ "gl2_source_collector": true,
2342
+ "gl2_source_input": true,
2343
+ "gl2_source_node": true,
2344
+ "highlight": true,
2345
+ "host_name": true,
2346
+ "id": true,
2347
+ "location": true,
2348
+ "log_file_path": true,
2349
+ "log_offset": true,
2350
+ "manager_name": true,
2351
+ "message": true,
2352
+ "previous_log": true,
2353
+ "previous_output": true,
2354
+ "rule_description": false,
2355
+ "rule_firedtimes": true,
2356
+ "rule_frequency": true,
2357
+ "rule_gdpr": true,
2358
+ "rule_gpg13": true,
2359
+ "rule_group1": true,
2360
+ "rule_group2": true,
2361
+ "rule_group3": true,
2362
+ "rule_groups": true,
2363
+ "rule_hipaa": true,
2364
+ "rule_id": true,
2365
+ "rule_info": true,
2366
+ "rule_mail": true,
2367
+ "rule_mitre_id": false,
2368
+ "rule_mitre_tactic": true,
2369
+ "rule_mitre_technique": true,
2370
+ "rule_nist_800_53": false,
2371
+ "rule_pci_dss": true,
2372
+ "rule_tsc": true,
2373
+ "sort": true,
2374
+ "source": true,
2375
+ "src_ip": true,
2376
+ "src_ip_city_name": true,
2377
+ "src_ip_country_code": true,
2378
+ "src_ip_geolocation": true,
2379
+ "streams": true,
2380
+ "syslog_tag": true,
2381
+ "syslog_type": true,
2382
+ "timestamp": true,
2383
+ "user_name": true,
2384
+ "win_system_eventID": true,
2385
+ "windows_event_id": true,
2386
+ "windows_event_severity": true
2387
+ },
2388
+ "indexByName": {
2389
+ "@metadata_beat": 2,
2390
+ "@metadata_type": 3,
2391
+ "@metadata_version": 4,
2392
+ "_id": 5,
2393
+ "_index": 6,
2394
+ "_type": 7,
2395
+ "agent_ephemeral_id": 8,
2396
+ "agent_hostname": 9,
2397
+ "agent_id": 10,
2398
+ "agent_ip": 11,
2399
+ "agent_ip_city_name": 12,
2400
+ "agent_ip_country_code": 13,
2401
+ "agent_ip_geolocation": 14,
2402
+ "agent_name": 1,
2403
+ "agent_type": 16,
2404
+ "agent_version": 17,
2405
+ "beats_type": 18,
2406
+ "collector_node_id": 19,
2407
+ "data_win_eventdata_domain": 20,
2408
+ "data_win_eventdata_sID": 21,
2409
+ "data_win_eventdata_user": 22,
2410
+ "data_win_system_channel": 23,
2411
+ "data_win_system_computer": 24,
2412
+ "data_win_system_eventID": 25,
2413
+ "data_win_system_eventRecordID": 26,
2414
+ "data_win_system_keywords": 27,
2415
+ "data_win_system_level": 28,
2416
+ "data_win_system_message": 29,
2417
+ "data_win_system_opcode": 30,
2418
+ "data_win_system_processID": 31,
2419
+ "data_win_system_providerGuid": 32,
2420
+ "data_win_system_providerName": 33,
2421
+ "data_win_system_severityValue": 34,
2422
+ "data_win_system_systemTime": 35,
2423
+ "data_win_system_task": 36,
2424
+ "data_win_system_threadID": 37,
2425
+ "data_win_system_version": 38,
2426
+ "decoder_name": 39,
2427
+ "ecs_version": 40,
2428
+ "gl2_accounted_message_size": 41,
2429
+ "gl2_message_id": 42,
2430
+ "gl2_remote_ip": 43,
2431
+ "gl2_remote_port": 44,
2432
+ "gl2_source_collector": 45,
2433
+ "gl2_source_input": 46,
2434
+ "gl2_source_node": 47,
2435
+ "highlight": 48,
2436
+ "host_name": 49,
2437
+ "id": 50,
2438
+ "location": 51,
2439
+ "log_file_path": 52,
2440
+ "log_offset": 53,
2441
+ "manager_name": 54,
2442
+ "message": 55,
2443
+ "previous_output": 56,
2444
+ "rule_description": 57,
2445
+ "rule_firedtimes": 58,
2446
+ "rule_frequency": 59,
2447
+ "rule_gdpr": 60,
2448
+ "rule_gpg13": 61,
2449
+ "rule_groups": 62,
2450
+ "rule_hipaa": 63,
2451
+ "rule_id": 64,
2452
+ "rule_level": 65,
2453
+ "rule_mail": 66,
2454
+ "rule_nist_800_53": 67,
2455
+ "rule_pci_dss": 68,
2456
+ "rule_tsc": 69,
2457
+ "sort": 70,
2458
+ "source": 71,
2459
+ "src_ip": 72,
2460
+ "src_ip_city_name": 73,
2461
+ "src_ip_country_code": 74,
2462
+ "src_ip_geolocation": 75,
2463
+ "streams": 76,
2464
+ "syslog_tag": 77,
2465
+ "syslog_type": 78,
2466
+ "timestamp": 79,
2467
+ "user_name": 80,
2468
+ "win_system_eventID": 81,
2469
+ "windows_event_id": 82,
2470
+ "windows_event_severity": 83
2471
+ },
2472
+ "renameByName": {
2473
+ "Count": "COUNT",
2474
+ "agent_ip": "SRC IP",
2475
+ "agent_name": "AGENT",
2476
+ "data_win_system_message": "MESSAGE",
2477
+ "data_win_system_providerGuid": "",
2478
+ "rule_description": "EVENT",
2479
+ "rule_level": "RULE LEVEL",
2480
+ "rule_mitre_id": "MITRE ID",
2481
+ "rule_nist_800_53": "NIST 800-53",
2482
+ "timestamp": "DATE/TIME",
2483
+ "windows_event_severity": "EVENT LOG SEVERITY"
2484
+ }
2485
+ }
2486
+ }
2487
+ ],
2488
+ "type": "table"
2489
+ }
2490
+ ],
2491
+ "title": "NIST 800-53",
2492
+ "type": "row"
2493
+ },
2494
+ {
2495
+ "collapsed": true,
2496
+ "datasource": {
2497
+ "type": "elasticsearch",
2498
+ "uid": "wazuh_datasource_uid"
2499
+ },
2500
+ "gridPos": {
2501
+ "h": 1,
2502
+ "w": 24,
2503
+ "x": 0,
2504
+ "y": 26
2505
+ },
2506
+ "id": 76,
2507
+ "panels": [
2508
+ {
2509
+ "datasource": {
2510
+ "type": "elasticsearch",
2511
+ "uid": "wazuh_datasource_uid"
2512
+ },
2513
+ "fieldConfig": {
2514
+ "defaults": {
2515
+ "mappings": [
2516
+ {
2517
+ "options": {
2518
+ "match": "null",
2519
+ "result": {
2520
+ "text": "N/A"
2521
+ }
2522
+ },
2523
+ "type": "special"
2524
+ }
2525
+ ],
2526
+ "thresholds": {
2527
+ "mode": "absolute",
2528
+ "steps": [
2529
+ {
2530
+ "color": "blue"
2531
+ }
2532
+ ]
2533
+ },
2534
+ "unit": "short"
2535
+ },
2536
+ "overrides": []
2537
+ },
2538
+ "gridPos": {
2539
+ "h": 7,
2540
+ "w": 4,
2541
+ "x": 0,
2542
+ "y": 26
2543
+ },
2544
+ "id": 86,
2545
+ "links": [],
2546
+ "options": {
2547
+ "colorMode": "value",
2548
+ "graphMode": "area",
2549
+ "justifyMode": "auto",
2550
+ "orientation": "horizontal",
2551
+ "reduceOptions": {
2552
+ "calcs": ["sum"],
2553
+ "fields": "",
2554
+ "values": false
2555
+ },
2556
+ "text": {},
2557
+ "textMode": "auto"
2558
+ },
2559
+ "pluginVersion": "8.3.3",
2560
+ "targets": [
2561
+ {
2562
+ "bucketAggs": [
2563
+ {
2564
+ "$$hashKey": "object:50",
2565
+ "field": "timestamp",
2566
+ "id": "2",
2567
+ "settings": {
2568
+ "interval": "auto",
2569
+ "min_doc_count": 0,
2570
+ "trimEdges": 0
2571
+ },
2572
+ "type": "date_histogram"
2573
+ }
2574
+ ],
2575
+ "datasource": {
2576
+ "type": "elasticsearch",
2577
+ "uid": "wazuh_datasource_uid"
2578
+ },
2579
+ "metrics": [
2580
+ {
2581
+ "$$hashKey": "object:48",
2582
+ "field": "select field",
2583
+ "id": "1",
2584
+ "type": "count"
2585
+ }
2586
+ ],
2587
+ "query": "agent_name:$agent_name AND _exists_:rule_gdpr",
2588
+ "refId": "A",
2589
+ "timeField": "timestamp"
2590
+ }
2591
+ ],
2592
+ "title": "GDPR - EVENTS",
2593
+ "type": "stat"
2594
+ },
2595
+ {
2596
+ "datasource": {
2597
+ "type": "elasticsearch",
2598
+ "uid": "wazuh_datasource_uid"
2599
+ },
2600
+ "fieldConfig": {
2601
+ "defaults": {
2602
+ "color": {
2603
+ "mode": "palette-classic"
2604
+ },
2605
+ "custom": {
2606
+ "hideFrom": {
2607
+ "legend": false,
2608
+ "tooltip": false,
2609
+ "viz": false
2610
+ }
2611
+ },
2612
+ "decimals": 0,
2613
+ "mappings": [],
2614
+ "unit": "short"
2615
+ },
2616
+ "overrides": [
2617
+ {
2618
+ "matcher": {
2619
+ "id": "byName",
2620
+ "options": "1"
2621
+ },
2622
+ "properties": [
2623
+ {
2624
+ "id": "color",
2625
+ "value": {
2626
+ "fixedColor": "#FF9830",
2627
+ "mode": "fixed"
2628
+ }
2629
+ }
2630
+ ]
2631
+ },
2632
+ {
2633
+ "matcher": {
2634
+ "id": "byName",
2635
+ "options": "Alert"
2636
+ },
2637
+ "properties": [
2638
+ {
2639
+ "id": "color",
2640
+ "value": {
2641
+ "fixedColor": "#F2495C",
2642
+ "mode": "fixed"
2643
+ }
2644
+ }
2645
+ ]
2646
+ },
2647
+ {
2648
+ "matcher": {
2649
+ "id": "byName",
2650
+ "options": "Error"
2651
+ },
2652
+ "properties": [
2653
+ {
2654
+ "id": "color",
2655
+ "value": {
2656
+ "fixedColor": "#F2495C",
2657
+ "mode": "fixed"
2658
+ }
2659
+ }
2660
+ ]
2661
+ },
2662
+ {
2663
+ "matcher": {
2664
+ "id": "byName",
2665
+ "options": "Info"
2666
+ },
2667
+ "properties": [
2668
+ {
2669
+ "id": "color",
2670
+ "value": {
2671
+ "fixedColor": "#73BF69",
2672
+ "mode": "fixed"
2673
+ }
2674
+ }
2675
+ ]
2676
+ },
2677
+ {
2678
+ "matcher": {
2679
+ "id": "byName",
2680
+ "options": "NOTICE"
2681
+ },
2682
+ "properties": [
2683
+ {
2684
+ "id": "color",
2685
+ "value": {
2686
+ "fixedColor": "#5794F2",
2687
+ "mode": "fixed"
2688
+ }
2689
+ }
2690
+ ]
2691
+ },
2692
+ {
2693
+ "matcher": {
2694
+ "id": "byName",
2695
+ "options": "Notice"
2696
+ },
2697
+ "properties": [
2698
+ {
2699
+ "id": "color",
2700
+ "value": {
2701
+ "fixedColor": "#5794F2",
2702
+ "mode": "fixed"
2703
+ }
2704
+ }
2705
+ ]
2706
+ },
2707
+ {
2708
+ "matcher": {
2709
+ "id": "byName",
2710
+ "options": "Result"
2711
+ },
2712
+ "properties": [
2713
+ {
2714
+ "id": "color",
2715
+ "value": {
2716
+ "fixedColor": "#B877D9",
2717
+ "mode": "fixed"
2718
+ }
2719
+ }
2720
+ ]
2721
+ },
2722
+ {
2723
+ "matcher": {
2724
+ "id": "byName",
2725
+ "options": "Warning"
2726
+ },
2727
+ "properties": [
2728
+ {
2729
+ "id": "color",
2730
+ "value": {
2731
+ "fixedColor": "#FF9830",
2732
+ "mode": "fixed"
2733
+ }
2734
+ }
2735
+ ]
2736
+ },
2737
+ {
2738
+ "matcher": {
2739
+ "id": "byName",
2740
+ "options": "INFORMATION"
2741
+ },
2742
+ "properties": [
2743
+ {
2744
+ "id": "color",
2745
+ "value": {
2746
+ "fixedColor": "green",
2747
+ "mode": "fixed"
2748
+ }
2749
+ }
2750
+ ]
2751
+ },
2752
+ {
2753
+ "matcher": {
2754
+ "id": "byName",
2755
+ "options": "WARNING"
2756
+ },
2757
+ "properties": [
2758
+ {
2759
+ "id": "color",
2760
+ "value": {
2761
+ "fixedColor": "orange",
2762
+ "mode": "fixed"
2763
+ }
2764
+ }
2765
+ ]
2766
+ },
2767
+ {
2768
+ "matcher": {
2769
+ "id": "byName",
2770
+ "options": "ERROR"
2771
+ },
2772
+ "properties": [
2773
+ {
2774
+ "id": "color",
2775
+ "value": {
2776
+ "fixedColor": "red",
2777
+ "mode": "fixed"
2778
+ }
2779
+ }
2780
+ ]
2781
+ }
2782
+ ]
2783
+ },
2784
+ "gridPos": {
2785
+ "h": 7,
2786
+ "w": 5,
2787
+ "x": 4,
2788
+ "y": 26
2789
+ },
2790
+ "id": 87,
2791
+ "links": [],
2792
+ "maxDataPoints": 3,
2793
+ "options": {
2794
+ "displayLabels": [],
2795
+ "legend": {
2796
+ "calcs": [],
2797
+ "displayMode": "table",
2798
+ "placement": "right",
2799
+ "showLegend": true,
2800
+ "values": ["value"]
2801
+ },
2802
+ "pieType": "donut",
2803
+ "reduceOptions": {
2804
+ "calcs": ["sum"],
2805
+ "fields": "",
2806
+ "values": false
2807
+ },
2808
+ "text": {},
2809
+ "tooltip": {
2810
+ "mode": "single"
2811
+ }
2812
+ },
2813
+ "targets": [
2814
+ {
2815
+ "bucketAggs": [
2816
+ {
2817
+ "$$hashKey": "object:73",
2818
+ "fake": true,
2819
+ "field": "rule_gdpr",
2820
+ "id": "3",
2821
+ "settings": {
2822
+ "min_doc_count": 1,
2823
+ "order": "desc",
2824
+ "orderBy": "_count",
2825
+ "size": "0"
2826
+ },
2827
+ "type": "terms"
2828
+ },
2829
+ {
2830
+ "$$hashKey": "object:74",
2831
+ "field": "timestamp",
2832
+ "id": "2",
2833
+ "settings": {
2834
+ "interval": "auto",
2835
+ "min_doc_count": 0,
2836
+ "trimEdges": 0
2837
+ },
2838
+ "type": "date_histogram"
2839
+ }
2840
+ ],
2841
+ "datasource": {
2842
+ "type": "elasticsearch",
2843
+ "uid": "wazuh_datasource_uid"
2844
+ },
2845
+ "metrics": [
2846
+ {
2847
+ "$$hashKey": "object:71",
2848
+ "field": "select field",
2849
+ "id": "1",
2850
+ "type": "count"
2851
+ }
2852
+ ],
2853
+ "query": "agent_name:$agent_name AND _exists_:rule_gdpr",
2854
+ "refId": "A",
2855
+ "timeField": "timestamp"
2856
+ }
2857
+ ],
2858
+ "title": "GDPR - SECURITY CONTROLS",
2859
+ "type": "piechart"
2860
+ },
2861
+ {
2862
+ "datasource": {
2863
+ "type": "elasticsearch",
2864
+ "uid": "wazuh_datasource_uid"
2865
+ },
2866
+ "fieldConfig": {
2867
+ "defaults": {
2868
+ "custom": {
2869
+ "align": "auto",
2870
+ "cellOptions": {
2871
+ "type": "auto"
2872
+ },
2873
+ "filterable": false
2874
+ },
2875
+ "mappings": [],
2876
+ "thresholds": {
2877
+ "mode": "absolute",
2878
+ "steps": [
2879
+ {
2880
+ "color": "orange"
2881
+ },
2882
+ {
2883
+ "color": "red",
2884
+ "value": 50
2885
+ }
2886
+ ]
2887
+ }
2888
+ },
2889
+ "overrides": [
2890
+ {
2891
+ "matcher": {
2892
+ "id": "byName",
2893
+ "options": "Count"
2894
+ },
2895
+ "properties": [
2896
+ {
2897
+ "id": "custom.cellOptions",
2898
+ "value": {
2899
+ "mode": "basic",
2900
+ "type": "gauge"
2901
+ }
2902
+ }
2903
+ ]
2904
+ },
2905
+ {
2906
+ "matcher": {
2907
+ "id": "byName",
2908
+ "options": "rule_description"
2909
+ },
2910
+ "properties": [
2911
+ {
2912
+ "id": "custom.width",
2913
+ "value": 703
2914
+ }
2915
+ ]
2916
+ },
2917
+ {
2918
+ "matcher": {
2919
+ "id": "byName",
2920
+ "options": "rule_level"
2921
+ },
2922
+ "properties": [
2923
+ {
2924
+ "id": "custom.width",
2925
+ "value": 212
2926
+ },
2927
+ {
2928
+ "id": "mappings",
2929
+ "value": [
2930
+ {
2931
+ "options": {
2932
+ "from": 1,
2933
+ "result": {
2934
+ "color": "green",
2935
+ "index": 0
2936
+ },
2937
+ "to": 3
2938
+ },
2939
+ "type": "range"
2940
+ },
2941
+ {
2942
+ "options": {
2943
+ "from": 4,
2944
+ "result": {
2945
+ "color": "dark-yellow",
2946
+ "index": 1
2947
+ },
2948
+ "to": 6
2949
+ },
2950
+ "type": "range"
2951
+ },
2952
+ {
2953
+ "options": {
2954
+ "from": 7,
2955
+ "result": {
2956
+ "color": "orange",
2957
+ "index": 2
2958
+ },
2959
+ "to": 9
2960
+ },
2961
+ "type": "range"
2962
+ },
2963
+ {
2964
+ "options": {
2965
+ "from": 10,
2966
+ "result": {
2967
+ "color": "semi-dark-red",
2968
+ "index": 3
2969
+ },
2970
+ "to": 15
2971
+ },
2972
+ "type": "range"
2973
+ }
2974
+ ]
2975
+ }
2976
+ ]
2977
+ }
2978
+ ]
2979
+ },
2980
+ "gridPos": {
2981
+ "h": 7,
2982
+ "w": 15,
2983
+ "x": 9,
2984
+ "y": 26
2985
+ },
2986
+ "id": 88,
2987
+ "links": [],
2988
+ "maxDataPoints": 3,
2989
+ "options": {
2990
+ "footer": {
2991
+ "fields": "",
2992
+ "reducer": ["sum"],
2993
+ "show": false
2994
+ },
2995
+ "showHeader": true,
2996
+ "sortBy": []
2997
+ },
2998
+ "pluginVersion": "8.3.3",
2999
+ "targets": [
3000
+ {
3001
+ "bucketAggs": [
3002
+ {
3003
+ "$$hashKey": "object:3082",
3004
+ "fake": true,
3005
+ "field": "rule_description",
3006
+ "id": "4",
3007
+ "settings": {
3008
+ "min_doc_count": 0,
3009
+ "order": "desc",
3010
+ "orderBy": "_count",
3011
+ "size": "10"
3012
+ },
3013
+ "type": "terms"
3014
+ },
3015
+ {
3016
+ "$$hashKey": "object:73",
3017
+ "fake": true,
3018
+ "field": "rule_level",
3019
+ "id": "3",
3020
+ "settings": {
3021
+ "min_doc_count": 1,
3022
+ "order": "desc",
3023
+ "orderBy": "_count",
3024
+ "size": "0"
3025
+ },
3026
+ "type": "terms"
3027
+ }
3028
+ ],
3029
+ "datasource": {
3030
+ "type": "elasticsearch",
3031
+ "uid": "wazuh_datasource_uid"
3032
+ },
3033
+ "metrics": [
3034
+ {
3035
+ "$$hashKey": "object:71",
3036
+ "field": "select field",
3037
+ "id": "1",
3038
+ "type": "count"
3039
+ }
3040
+ ],
3041
+ "query": "agent_name:$agent_name AND _exists_:rule_gdpr",
3042
+ "refId": "A",
3043
+ "timeField": "timestamp"
3044
+ }
3045
+ ],
3046
+ "title": "GDPR - EVENTS BY TYPE",
3047
+ "type": "table"
3048
+ },
3049
+ {
3050
+ "datasource": {
3051
+ "type": "elasticsearch",
3052
+ "uid": "wazuh_datasource_uid"
3053
+ },
3054
+ "fieldConfig": {
3055
+ "defaults": {
3056
+ "custom": {
3057
+ "align": "auto",
3058
+ "cellOptions": {
3059
+ "type": "auto"
3060
+ },
3061
+ "filterable": false
3062
+ },
3063
+ "mappings": [],
3064
+ "thresholds": {
3065
+ "mode": "absolute",
3066
+ "steps": [
3067
+ {
3068
+ "color": "green"
3069
+ },
3070
+ {
3071
+ "color": "red",
3072
+ "value": 80
3073
+ }
3074
+ ]
3075
+ }
3076
+ },
3077
+ "overrides": [
3078
+ {
3079
+ "matcher": {
3080
+ "id": "byName",
3081
+ "options": "agent_name"
3082
+ },
3083
+ "properties": [
3084
+ {
3085
+ "id": "custom.width",
3086
+ "value": 492
3087
+ }
3088
+ ]
3089
+ }
3090
+ ]
3091
+ },
3092
+ "gridPos": {
3093
+ "h": 7,
3094
+ "w": 9,
3095
+ "x": 0,
3096
+ "y": 33
3097
+ },
3098
+ "id": 90,
3099
+ "links": [],
3100
+ "maxDataPoints": 3,
3101
+ "options": {
3102
+ "footer": {
3103
+ "fields": "",
3104
+ "reducer": ["sum"],
3105
+ "show": false
3106
+ },
3107
+ "showHeader": true,
3108
+ "sortBy": []
3109
+ },
3110
+ "pluginVersion": "8.3.3",
3111
+ "targets": [
3112
+ {
3113
+ "bucketAggs": [
3114
+ {
3115
+ "$$hashKey": "object:73",
3116
+ "fake": true,
3117
+ "field": "agent_name",
3118
+ "id": "3",
3119
+ "settings": {
3120
+ "min_doc_count": 1,
3121
+ "order": "desc",
3122
+ "orderBy": "_count",
3123
+ "size": "0"
3124
+ },
3125
+ "type": "terms"
3126
+ }
3127
+ ],
3128
+ "datasource": {
3129
+ "type": "elasticsearch",
3130
+ "uid": "wazuh_datasource_uid"
3131
+ },
3132
+ "metrics": [
3133
+ {
3134
+ "$$hashKey": "object:71",
3135
+ "field": "select field",
3136
+ "id": "1",
3137
+ "type": "count"
3138
+ }
3139
+ ],
3140
+ "query": "agent_name:$agent_name AND _exists_:rule_gdpr",
3141
+ "refId": "A",
3142
+ "timeField": "timestamp"
3143
+ }
3144
+ ],
3145
+ "title": "GDPR - EVENTS BY AGENT",
3146
+ "type": "table"
3147
+ },
3148
+ {
3149
+ "aliasColors": {},
3150
+ "bars": true,
3151
+ "dashLength": 10,
3152
+ "dashes": false,
3153
+ "datasource": {
3154
+ "type": "elasticsearch",
3155
+ "uid": "wazuh_datasource_uid"
3156
+ },
3157
+ "fill": 1,
3158
+ "fillGradient": 0,
3159
+ "gridPos": {
3160
+ "h": 7,
3161
+ "w": 15,
3162
+ "x": 9,
3163
+ "y": 33
3164
+ },
3165
+ "hiddenSeries": false,
3166
+ "id": 91,
3167
+ "legend": {
3168
+ "alignAsTable": true,
3169
+ "avg": false,
3170
+ "current": false,
3171
+ "max": false,
3172
+ "min": false,
3173
+ "rightSide": true,
3174
+ "show": true,
3175
+ "total": false,
3176
+ "values": false
3177
+ },
3178
+ "lines": false,
3179
+ "linewidth": 1,
3180
+ "links": [],
3181
+ "maxDataPoints": 3,
3182
+ "nullPointMode": "null",
3183
+ "options": {
3184
+ "alertThreshold": true
3185
+ },
3186
+ "percentage": false,
3187
+ "pluginVersion": "8.3.3",
3188
+ "pointradius": 2,
3189
+ "points": false,
3190
+ "renderer": "flot",
3191
+ "seriesOverrides": [],
3192
+ "spaceLength": 10,
3193
+ "stack": true,
3194
+ "steppedLine": false,
3195
+ "targets": [
3196
+ {
3197
+ "alias": "",
3198
+ "bucketAggs": [
3199
+ {
3200
+ "field": "agent_name",
3201
+ "id": "4",
3202
+ "settings": {
3203
+ "min_doc_count": "1",
3204
+ "order": "desc",
3205
+ "orderBy": "_count",
3206
+ "size": "10"
3207
+ },
3208
+ "type": "terms"
3209
+ },
3210
+ {
3211
+ "field": "timestamp",
3212
+ "id": "5",
3213
+ "settings": {
3214
+ "interval": "auto",
3215
+ "min_doc_count": "0",
3216
+ "trimEdges": "0"
3217
+ },
3218
+ "type": "date_histogram"
3219
+ }
3220
+ ],
3221
+ "datasource": {
3222
+ "type": "elasticsearch",
3223
+ "uid": "wazuh_datasource_uid"
3224
+ },
3225
+ "metrics": [
3226
+ {
3227
+ "$$hashKey": "object:71",
3228
+ "field": "select field",
3229
+ "id": "1",
3230
+ "type": "count"
3231
+ }
3232
+ ],
3233
+ "query": "agent_name:$agent_name AND _exists_:rule_gdpr",
3234
+ "refId": "A",
3235
+ "timeField": "timestamp"
3236
+ }
3237
+ ],
3238
+ "thresholds": [],
3239
+ "timeRegions": [],
3240
+ "title": "GDPR - EVENTS BY AGENT (HISTOGRAM)",
3241
+ "tooltip": {
3242
+ "shared": true,
3243
+ "sort": 0,
3244
+ "value_type": "individual"
3245
+ },
3246
+ "type": "graph",
3247
+ "xaxis": {
3248
+ "mode": "time",
3249
+ "show": true,
3250
+ "values": []
3251
+ },
3252
+ "yaxes": [
3253
+ {
3254
+ "format": "short",
3255
+ "logBase": 1,
3256
+ "show": true
3257
+ },
3258
+ {
3259
+ "format": "short",
3260
+ "logBase": 1,
3261
+ "show": true
3262
+ }
3263
+ ],
3264
+ "yaxis": {
3265
+ "align": false
3266
+ }
3267
+ },
3268
+ {
3269
+ "datasource": {
3270
+ "type": "elasticsearch",
3271
+ "uid": "wazuh_datasource_uid"
3272
+ },
3273
+ "fieldConfig": {
3274
+ "defaults": {
3275
+ "color": {
3276
+ "mode": "thresholds"
3277
+ },
3278
+ "custom": {
3279
+ "align": "auto",
3280
+ "cellOptions": {
3281
+ "type": "auto"
3282
+ }
3283
+ },
3284
+ "mappings": [],
3285
+ "thresholds": {
3286
+ "mode": "absolute",
3287
+ "steps": [
3288
+ {
3289
+ "color": "green"
3290
+ },
3291
+ {
3292
+ "color": "red",
3293
+ "value": 80
3294
+ }
3295
+ ]
3296
+ }
3297
+ },
3298
+ "overrides": [
3299
+ {
3300
+ "matcher": {
3301
+ "id": "byName",
3302
+ "options": "rule_level"
3303
+ },
3304
+ "properties": [
3305
+ {
3306
+ "id": "custom.width",
3307
+ "value": 93
3308
+ }
3309
+ ]
3310
+ },
3311
+ {
3312
+ "matcher": {
3313
+ "id": "byName",
3314
+ "options": "windows_event_id"
3315
+ },
3316
+ "properties": [
3317
+ {
3318
+ "id": "custom.width",
3319
+ "value": 186
3320
+ }
3321
+ ]
3322
+ },
3323
+ {
3324
+ "matcher": {
3325
+ "id": "byName",
3326
+ "options": "DATE/TIME"
3327
+ },
3328
+ "properties": [
3329
+ {
3330
+ "id": "custom.width",
3331
+ "value": 202
3332
+ }
3333
+ ]
3334
+ },
3335
+ {
3336
+ "matcher": {
3337
+ "id": "byName",
3338
+ "options": "AGENT"
3339
+ },
3340
+ "properties": [
3341
+ {
3342
+ "id": "custom.width",
3343
+ "value": 171
3344
+ }
3345
+ ]
3346
+ },
3347
+ {
3348
+ "matcher": {
3349
+ "id": "byName",
3350
+ "options": "SRC IP"
3351
+ },
3352
+ "properties": [
3353
+ {
3354
+ "id": "custom.width",
3355
+ "value": 167
3356
+ }
3357
+ ]
3358
+ },
3359
+ {
3360
+ "matcher": {
3361
+ "id": "byName",
3362
+ "options": "MESSAGE"
3363
+ },
3364
+ "properties": [
3365
+ {
3366
+ "id": "custom.width",
3367
+ "value": 1519
3368
+ }
3369
+ ]
3370
+ },
3371
+ {
3372
+ "matcher": {
3373
+ "id": "byName",
3374
+ "options": "rule_description"
3375
+ },
3376
+ "properties": [
3377
+ {
3378
+ "id": "custom.width",
3379
+ "value": 524
3380
+ }
3381
+ ]
3382
+ },
3383
+ {
3384
+ "matcher": {
3385
+ "id": "byName",
3386
+ "options": "RULE LEVEL"
3387
+ },
3388
+ "properties": [
3389
+ {
3390
+ "id": "custom.width",
3391
+ "value": 188
3392
+ }
3393
+ ]
3394
+ }
3395
+ ]
3396
+ },
3397
+ "gridPos": {
3398
+ "h": 10,
3399
+ "w": 24,
3400
+ "x": 0,
3401
+ "y": 40
3402
+ },
3403
+ "id": 89,
3404
+ "options": {
3405
+ "footer": {
3406
+ "fields": "",
3407
+ "reducer": ["sum"],
3408
+ "show": false
3409
+ },
3410
+ "showHeader": true,
3411
+ "sortBy": []
3412
+ },
3413
+ "pluginVersion": "8.3.3",
3414
+ "targets": [
3415
+ {
3416
+ "alias": "",
3417
+ "bucketAggs": [
3418
+ {
3419
+ "field": "agent_name",
3420
+ "id": "2",
3421
+ "settings": {
3422
+ "min_doc_count": "1",
3423
+ "order": "desc",
3424
+ "orderBy": "_term",
3425
+ "size": "10"
3426
+ },
3427
+ "type": "terms"
3428
+ },
3429
+ {
3430
+ "field": "rule_description",
3431
+ "id": "3",
3432
+ "settings": {
3433
+ "min_doc_count": "1",
3434
+ "order": "desc",
3435
+ "orderBy": "_count",
3436
+ "size": "10"
3437
+ },
3438
+ "type": "terms"
3439
+ },
3440
+ {
3441
+ "field": "rule_gdpr",
3442
+ "id": "4",
3443
+ "settings": {
3444
+ "min_doc_count": "1",
3445
+ "order": "desc",
3446
+ "orderBy": "_term",
3447
+ "size": "10"
3448
+ },
3449
+ "type": "terms"
3450
+ }
3451
+ ],
3452
+ "datasource": {
3453
+ "type": "elasticsearch",
3454
+ "uid": "wazuh_datasource_uid"
3455
+ },
3456
+ "metrics": [
3457
+ {
3458
+ "id": "1",
3459
+ "type": "count"
3460
+ }
3461
+ ],
3462
+ "query": "agent_name:$agent_name AND _exists_:rule_gdpr",
3463
+ "queryType": "lucene",
3464
+ "refId": "A",
3465
+ "timeField": "timestamp"
3466
+ }
3467
+ ],
3468
+ "title": "GDPR - EVENTS",
3469
+ "transformations": [
3470
+ {
3471
+ "id": "organize",
3472
+ "options": {
3473
+ "excludeByName": {
3474
+ "@metadata_beat": true,
3475
+ "@metadata_type": true,
3476
+ "@metadata_version": true,
3477
+ "_id": true,
3478
+ "_index": true,
3479
+ "_type": true,
3480
+ "agent_ephemeral_id": true,
3481
+ "agent_hostname": true,
3482
+ "agent_id": true,
3483
+ "agent_ip": false,
3484
+ "agent_ip_city_name": true,
3485
+ "agent_ip_country_code": true,
3486
+ "agent_ip_geolocation": true,
3487
+ "agent_labels_customer": true,
3488
+ "agent_name": false,
3489
+ "agent_type": true,
3490
+ "agent_version": true,
3491
+ "beats_type": true,
3492
+ "collector_node_id": true,
3493
+ "data_extra_data": true,
3494
+ "data_win_eventXML_binaryData": true,
3495
+ "data_win_eventXML_binaryDataSize": true,
3496
+ "data_win_eventXML_param1": true,
3497
+ "data_win_eventdata_authenticationPackageName": true,
3498
+ "data_win_eventdata_binary": true,
3499
+ "data_win_eventdata_data": true,
3500
+ "data_win_eventdata_domain": true,
3501
+ "data_win_eventdata_elevatedToken": true,
3502
+ "data_win_eventdata_imagePath": true,
3503
+ "data_win_eventdata_impersonationLevel": true,
3504
+ "data_win_eventdata_ipAddress": true,
3505
+ "data_win_eventdata_ipPort": true,
3506
+ "data_win_eventdata_keyLength": true,
3507
+ "data_win_eventdata_logonGuid": true,
3508
+ "data_win_eventdata_logonProcessName": true,
3509
+ "data_win_eventdata_logonType": true,
3510
+ "data_win_eventdata_param1": true,
3511
+ "data_win_eventdata_param2": true,
3512
+ "data_win_eventdata_param3": true,
3513
+ "data_win_eventdata_param4": true,
3514
+ "data_win_eventdata_processId": true,
3515
+ "data_win_eventdata_processName": true,
3516
+ "data_win_eventdata_sID": true,
3517
+ "data_win_eventdata_serviceName": true,
3518
+ "data_win_eventdata_serviceSid": true,
3519
+ "data_win_eventdata_serviceType": true,
3520
+ "data_win_eventdata_startType": true,
3521
+ "data_win_eventdata_status": true,
3522
+ "data_win_eventdata_subjectDomainName": true,
3523
+ "data_win_eventdata_subjectLogonId": true,
3524
+ "data_win_eventdata_subjectUserName": true,
3525
+ "data_win_eventdata_subjectUserSid": true,
3526
+ "data_win_eventdata_targetDomainName": true,
3527
+ "data_win_eventdata_targetLinkedLogonId": true,
3528
+ "data_win_eventdata_targetLogonId": true,
3529
+ "data_win_eventdata_targetUserName": true,
3530
+ "data_win_eventdata_targetUserSid": true,
3531
+ "data_win_eventdata_ticketEncryptionType": true,
3532
+ "data_win_eventdata_ticketOptions": true,
3533
+ "data_win_eventdata_user": true,
3534
+ "data_win_eventdata_virtualAccount": true,
3535
+ "data_win_system_channel": true,
3536
+ "data_win_system_computer": true,
3537
+ "data_win_system_eventID": true,
3538
+ "data_win_system_eventRecordID": true,
3539
+ "data_win_system_eventSourceName": true,
3540
+ "data_win_system_keywords": true,
3541
+ "data_win_system_level": true,
3542
+ "data_win_system_message": true,
3543
+ "data_win_system_opcode": true,
3544
+ "data_win_system_processID": true,
3545
+ "data_win_system_providerGuid": true,
3546
+ "data_win_system_providerName": true,
3547
+ "data_win_system_severityValue": true,
3548
+ "data_win_system_systemTime": true,
3549
+ "data_win_system_task": true,
3550
+ "data_win_system_threadID": true,
3551
+ "data_win_system_version": true,
3552
+ "decoder_name": true,
3553
+ "decoder_parent": true,
3554
+ "ecs_version": true,
3555
+ "full_log": true,
3556
+ "gl2_accounted_message_size": true,
3557
+ "gl2_message_id": true,
3558
+ "gl2_processing_error": true,
3559
+ "gl2_remote_ip": true,
3560
+ "gl2_remote_port": true,
3561
+ "gl2_source_collector": true,
3562
+ "gl2_source_input": true,
3563
+ "gl2_source_node": true,
3564
+ "highlight": true,
3565
+ "host_name": true,
3566
+ "id": true,
3567
+ "location": true,
3568
+ "log_file_path": true,
3569
+ "log_offset": true,
3570
+ "manager_name": true,
3571
+ "message": true,
3572
+ "previous_log": true,
3573
+ "previous_output": true,
3574
+ "rule_description": false,
3575
+ "rule_firedtimes": true,
3576
+ "rule_frequency": true,
3577
+ "rule_gdpr": false,
3578
+ "rule_gpg13": true,
3579
+ "rule_group1": true,
3580
+ "rule_group2": true,
3581
+ "rule_group3": true,
3582
+ "rule_groups": true,
3583
+ "rule_hipaa": true,
3584
+ "rule_id": true,
3585
+ "rule_info": true,
3586
+ "rule_mail": true,
3587
+ "rule_mitre_id": true,
3588
+ "rule_mitre_tactic": true,
3589
+ "rule_mitre_technique": true,
3590
+ "rule_nist_800_53": true,
3591
+ "rule_pci_dss": true,
3592
+ "rule_tsc": true,
3593
+ "sort": true,
3594
+ "source": true,
3595
+ "src_ip": true,
3596
+ "src_ip_city_name": true,
3597
+ "src_ip_country_code": true,
3598
+ "src_ip_geolocation": true,
3599
+ "streams": true,
3600
+ "syslog_tag": true,
3601
+ "syslog_type": true,
3602
+ "timestamp": true,
3603
+ "user_name": true,
3604
+ "win_system_eventID": true,
3605
+ "windows_event_id": true,
3606
+ "windows_event_severity": false
3607
+ },
3608
+ "indexByName": {
3609
+ "@metadata_beat": 2,
3610
+ "@metadata_type": 3,
3611
+ "@metadata_version": 4,
3612
+ "_id": 5,
3613
+ "_index": 6,
3614
+ "_type": 7,
3615
+ "agent_ephemeral_id": 8,
3616
+ "agent_hostname": 9,
3617
+ "agent_id": 10,
3618
+ "agent_ip": 11,
3619
+ "agent_ip_city_name": 12,
3620
+ "agent_ip_country_code": 13,
3621
+ "agent_ip_geolocation": 14,
3622
+ "agent_name": 1,
3623
+ "agent_type": 16,
3624
+ "agent_version": 17,
3625
+ "beats_type": 18,
3626
+ "collector_node_id": 19,
3627
+ "data_win_eventdata_domain": 20,
3628
+ "data_win_eventdata_sID": 21,
3629
+ "data_win_eventdata_user": 22,
3630
+ "data_win_system_channel": 23,
3631
+ "data_win_system_computer": 24,
3632
+ "data_win_system_eventID": 25,
3633
+ "data_win_system_eventRecordID": 26,
3634
+ "data_win_system_keywords": 27,
3635
+ "data_win_system_level": 28,
3636
+ "data_win_system_message": 29,
3637
+ "data_win_system_opcode": 30,
3638
+ "data_win_system_processID": 31,
3639
+ "data_win_system_providerGuid": 32,
3640
+ "data_win_system_providerName": 33,
3641
+ "data_win_system_severityValue": 34,
3642
+ "data_win_system_systemTime": 35,
3643
+ "data_win_system_task": 36,
3644
+ "data_win_system_threadID": 37,
3645
+ "data_win_system_version": 38,
3646
+ "decoder_name": 39,
3647
+ "ecs_version": 40,
3648
+ "gl2_accounted_message_size": 41,
3649
+ "gl2_message_id": 42,
3650
+ "gl2_remote_ip": 43,
3651
+ "gl2_remote_port": 44,
3652
+ "gl2_source_collector": 45,
3653
+ "gl2_source_input": 46,
3654
+ "gl2_source_node": 47,
3655
+ "highlight": 48,
3656
+ "host_name": 49,
3657
+ "id": 50,
3658
+ "location": 51,
3659
+ "log_file_path": 52,
3660
+ "log_offset": 53,
3661
+ "manager_name": 54,
3662
+ "message": 55,
3663
+ "previous_output": 56,
3664
+ "rule_description": 57,
3665
+ "rule_firedtimes": 58,
3666
+ "rule_frequency": 59,
3667
+ "rule_gdpr": 60,
3668
+ "rule_gpg13": 61,
3669
+ "rule_groups": 62,
3670
+ "rule_hipaa": 63,
3671
+ "rule_id": 64,
3672
+ "rule_level": 65,
3673
+ "rule_mail": 66,
3674
+ "rule_nist_800_53": 67,
3675
+ "rule_pci_dss": 68,
3676
+ "rule_tsc": 69,
3677
+ "sort": 70,
3678
+ "source": 71,
3679
+ "src_ip": 72,
3680
+ "src_ip_city_name": 73,
3681
+ "src_ip_country_code": 74,
3682
+ "src_ip_geolocation": 75,
3683
+ "streams": 76,
3684
+ "syslog_tag": 77,
3685
+ "syslog_type": 78,
3686
+ "timestamp": 79,
3687
+ "user_name": 80,
3688
+ "win_system_eventID": 81,
3689
+ "windows_event_id": 82,
3690
+ "windows_event_severity": 83
3691
+ },
3692
+ "renameByName": {
3693
+ "Count": "COUNT",
3694
+ "agent_ip": "SRC IP",
3695
+ "agent_name": "AGENT",
3696
+ "data_win_system_message": "MESSAGE",
3697
+ "data_win_system_providerGuid": "",
3698
+ "rule_description": "EVENT",
3699
+ "rule_gdpr": "GDPR",
3700
+ "rule_level": "RULE LEVEL",
3701
+ "timestamp": "DATE/TIME",
3702
+ "windows_event_severity": "EVENT LOG SEVERITY"
3703
+ }
3704
+ }
3705
+ }
3706
+ ],
3707
+ "type": "table"
3708
+ }
3709
+ ],
3710
+ "title": "GDPR",
3711
+ "type": "row"
3712
+ }
3713
+ ],
3714
+ "refresh": "",
3715
+ "schemaVersion": 38,
3716
+ "style": "dark",
3717
+ "tags": ["EDR"],
3718
+ "templating": {
3719
+ "list": [
3720
+ {
3721
+ "datasource": {
3722
+ "type": "elasticsearch",
3723
+ "uid": "wazuh_datasource_uid"
3724
+ },
3725
+ "filters": [],
3726
+ "hide": 0,
3727
+ "label": "",
3728
+ "name": "Filters",
3729
+ "skipUrlSync": false,
3730
+ "type": "adhoc"
3731
+ },
3732
+ {
3733
+ "current": {
3734
+ "selected": false,
3735
+ "text": "All",
3736
+ "value": "$__all"
3737
+ },
3738
+ "datasource": {
3739
+ "type": "elasticsearch",
3740
+ "uid": "wazuh_datasource_uid"
3741
+ },
3742
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"*\"}",
3743
+ "hide": 0,
3744
+ "includeAll": true,
3745
+ "label": "Agent",
3746
+ "multi": false,
3747
+ "name": "agent_name",
3748
+ "options": [],
3749
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"*\"}",
3750
+ "refresh": 2,
3751
+ "regex": "",
3752
+ "skipUrlSync": false,
3753
+ "sort": 2,
3754
+ "tagValuesQuery": "",
3755
+ "tagsQuery": "",
3756
+ "type": "query",
3757
+ "useTags": false
3758
+ }
3759
+ ]
3760
+ },
3761
+ "time": {
3762
+ "from": "now-6h",
3763
+ "to": "now"
3764
+ },
3765
+ "timepicker": {
3766
+ "refresh_intervals": ["10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
3767
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
3768
+ },
3769
+ "timezone": "",
3770
+ "title": "EDR - COMPLIANCE",
3771
+ "weekStart": ""
3772
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_dll_side_loading.json
new
+2078
@@ -0,0 +1,2078 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194196381,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "datasource": {
45
+ "type": "elasticsearch",
46
+ "uid": "wazuh_datasource_uid"
47
+ },
48
+ "fieldConfig": {
49
+ "defaults": {
50
+ "mappings": [
51
+ {
52
+ "options": {
53
+ "match": "null",
54
+ "result": {
55
+ "text": "N/A"
56
+ }
57
+ },
58
+ "type": "special"
59
+ }
60
+ ],
61
+ "thresholds": {
62
+ "mode": "absolute",
63
+ "steps": [
64
+ {
65
+ "color": "orange",
66
+ "value": null
67
+ }
68
+ ]
69
+ },
70
+ "unit": "short"
71
+ },
72
+ "overrides": []
73
+ },
74
+ "gridPos": {
75
+ "h": 7,
76
+ "w": 4,
77
+ "x": 0,
78
+ "y": 0
79
+ },
80
+ "id": 63,
81
+ "links": [],
82
+ "options": {
83
+ "colorMode": "value",
84
+ "graphMode": "area",
85
+ "justifyMode": "auto",
86
+ "orientation": "horizontal",
87
+ "reduceOptions": {
88
+ "calcs": ["sum"],
89
+ "fields": "",
90
+ "values": false
91
+ },
92
+ "text": {},
93
+ "textMode": "auto"
94
+ },
95
+ "pluginVersion": "9.0.0",
96
+ "targets": [
97
+ {
98
+ "bucketAggs": [
99
+ {
100
+ "$$hashKey": "object:118",
101
+ "field": "timestamp",
102
+ "id": "2",
103
+ "settings": {
104
+ "interval": "auto",
105
+ "min_doc_count": 0,
106
+ "trimEdges": 0
107
+ },
108
+ "type": "date_histogram"
109
+ }
110
+ ],
111
+ "metrics": [
112
+ {
113
+ "$$hashKey": "object:116",
114
+ "field": "select field",
115
+ "id": "1",
116
+ "type": "count"
117
+ }
118
+ ],
119
+ "query": "rule_group3:sysmon_event7 AND data_win_eventdata_signed:false AND agent_name:$agent_name",
120
+ "refId": "A",
121
+ "timeField": "timestamp"
122
+ }
123
+ ],
124
+ "title": "IMAGE LOAD EVENTS - UNSIGNED DLLs",
125
+ "type": "stat"
126
+ },
127
+ {
128
+ "datasource": {
129
+ "type": "elasticsearch",
130
+ "uid": "wazuh_datasource_uid"
131
+ },
132
+ "fieldConfig": {
133
+ "defaults": {
134
+ "custom": {
135
+ "align": "auto",
136
+ "displayMode": "auto",
137
+ "filterable": false,
138
+ "inspect": false
139
+ },
140
+ "mappings": [],
141
+ "thresholds": {
142
+ "mode": "absolute",
143
+ "steps": [
144
+ {
145
+ "color": "orange",
146
+ "value": null
147
+ },
148
+ {
149
+ "color": "red",
150
+ "value": 80
151
+ }
152
+ ]
153
+ }
154
+ },
155
+ "overrides": [
156
+ {
157
+ "matcher": {
158
+ "id": "byName",
159
+ "options": "Count"
160
+ },
161
+ "properties": [
162
+ {
163
+ "id": "custom.displayMode",
164
+ "value": "color-text"
165
+ }
166
+ ]
167
+ },
168
+ {
169
+ "matcher": {
170
+ "id": "byName",
171
+ "options": "software_vendor"
172
+ },
173
+ "properties": [
174
+ {
175
+ "id": "custom.displayMode",
176
+ "value": "color-text"
177
+ }
178
+ ]
179
+ }
180
+ ]
181
+ },
182
+ "gridPos": {
183
+ "h": 7,
184
+ "w": 6,
185
+ "x": 4,
186
+ "y": 0
187
+ },
188
+ "id": 64,
189
+ "links": [],
190
+ "options": {
191
+ "footer": {
192
+ "fields": "",
193
+ "reducer": ["sum"],
194
+ "show": false
195
+ },
196
+ "showHeader": true
197
+ },
198
+ "pluginVersion": "9.0.0",
199
+ "targets": [
200
+ {
201
+ "bucketAggs": [
202
+ {
203
+ "$$hashKey": "object:42",
204
+ "fake": true,
205
+ "field": "software_vendor",
206
+ "id": "3",
207
+ "settings": {
208
+ "min_doc_count": "1",
209
+ "missing": "Unknown",
210
+ "order": "desc",
211
+ "orderBy": "_count",
212
+ "size": "10"
213
+ },
214
+ "type": "terms"
215
+ }
216
+ ],
217
+ "datasource": {
218
+ "type": "elasticsearch",
219
+ "uid": "wazuh_datasource_uid"
220
+ },
221
+ "metrics": [
222
+ {
223
+ "$$hashKey": "object:40",
224
+ "field": "select field",
225
+ "id": "1",
226
+ "type": "count"
227
+ }
228
+ ],
229
+ "query": "rule_group3:sysmon_event7 AND data_win_eventdata_signed:false AND agent_name:$agent_name",
230
+ "queryType": "lucene",
231
+ "refId": "A",
232
+ "timeField": "timestamp"
233
+ }
234
+ ],
235
+ "title": "UNSIGNED IMAGES / SOFTWARE VENDOR",
236
+ "type": "table"
237
+ },
238
+ {
239
+ "datasource": {
240
+ "type": "elasticsearch",
241
+ "uid": "wazuh_datasource_uid"
242
+ },
243
+ "fieldConfig": {
244
+ "defaults": {
245
+ "custom": {
246
+ "align": "auto",
247
+ "displayMode": "auto",
248
+ "filterable": false,
249
+ "inspect": false
250
+ },
251
+ "mappings": [],
252
+ "thresholds": {
253
+ "mode": "absolute",
254
+ "steps": [
255
+ {
256
+ "color": "orange",
257
+ "value": null
258
+ },
259
+ {
260
+ "color": "red",
261
+ "value": 80
262
+ }
263
+ ]
264
+ }
265
+ },
266
+ "overrides": [
267
+ {
268
+ "matcher": {
269
+ "id": "byName",
270
+ "options": "Count"
271
+ },
272
+ "properties": [
273
+ {
274
+ "id": "custom.displayMode",
275
+ "value": "color-text"
276
+ }
277
+ ]
278
+ },
279
+ {
280
+ "matcher": {
281
+ "id": "byName",
282
+ "options": "software_vendor"
283
+ },
284
+ "properties": [
285
+ {
286
+ "id": "custom.displayMode",
287
+ "value": "color-text"
288
+ }
289
+ ]
290
+ },
291
+ {
292
+ "matcher": {
293
+ "id": "byName",
294
+ "options": "data_win_eventdata_originalFileName"
295
+ },
296
+ "properties": [
297
+ {
298
+ "id": "custom.width",
299
+ "value": 568
300
+ },
301
+ {
302
+ "id": "custom.displayMode",
303
+ "value": "color-text"
304
+ }
305
+ ]
306
+ },
307
+ {
308
+ "matcher": {
309
+ "id": "byName",
310
+ "options": "agent_name"
311
+ },
312
+ "properties": [
313
+ {
314
+ "id": "custom.displayMode",
315
+ "value": "color-text"
316
+ }
317
+ ]
318
+ },
319
+ {
320
+ "matcher": {
321
+ "id": "byName",
322
+ "options": "data_win_eventdata_imageLoaded"
323
+ },
324
+ "properties": [
325
+ {
326
+ "id": "custom.displayMode",
327
+ "value": "color-text"
328
+ }
329
+ ]
330
+ },
331
+ {
332
+ "matcher": {
333
+ "id": "byName",
334
+ "options": "DLL NAME"
335
+ },
336
+ "properties": [
337
+ {
338
+ "id": "custom.width",
339
+ "value": 287
340
+ }
341
+ ]
342
+ },
343
+ {
344
+ "matcher": {
345
+ "id": "byName",
346
+ "options": "IMAGE FILE"
347
+ },
348
+ "properties": [
349
+ {
350
+ "id": "custom.width",
351
+ "value": 290
352
+ }
353
+ ]
354
+ }
355
+ ]
356
+ },
357
+ "gridPos": {
358
+ "h": 7,
359
+ "w": 14,
360
+ "x": 10,
361
+ "y": 0
362
+ },
363
+ "id": 65,
364
+ "links": [],
365
+ "options": {
366
+ "footer": {
367
+ "fields": "",
368
+ "reducer": ["sum"],
369
+ "show": false
370
+ },
371
+ "showHeader": true,
372
+ "sortBy": []
373
+ },
374
+ "pluginVersion": "9.0.0",
375
+ "targets": [
376
+ {
377
+ "bucketAggs": [
378
+ {
379
+ "$$hashKey": "object:250",
380
+ "fake": true,
381
+ "field": "agent_name",
382
+ "id": "4",
383
+ "settings": {
384
+ "min_doc_count": "1",
385
+ "order": "desc",
386
+ "orderBy": "_count",
387
+ "size": "10"
388
+ },
389
+ "type": "terms"
390
+ },
391
+ {
392
+ "$$hashKey": "object:265",
393
+ "fake": true,
394
+ "field": "data_win_eventdata_originalFileName",
395
+ "id": "5",
396
+ "settings": {
397
+ "min_doc_count": "1",
398
+ "missing": "Unknown",
399
+ "order": "desc",
400
+ "orderBy": "_count",
401
+ "size": "10"
402
+ },
403
+ "type": "terms"
404
+ },
405
+ {
406
+ "$$hashKey": "object:42",
407
+ "fake": true,
408
+ "field": "software_vendor",
409
+ "id": "3",
410
+ "settings": {
411
+ "min_doc_count": "1",
412
+ "missing": "Unknown",
413
+ "order": "desc",
414
+ "orderBy": "_count",
415
+ "size": "10"
416
+ },
417
+ "type": "terms"
418
+ },
419
+ {
420
+ "field": "data_win_eventdata_imageLoaded",
421
+ "id": "6",
422
+ "settings": {
423
+ "min_doc_count": "1",
424
+ "order": "desc",
425
+ "orderBy": "_term",
426
+ "size": "10"
427
+ },
428
+ "type": "terms"
429
+ }
430
+ ],
431
+ "datasource": {
432
+ "type": "elasticsearch",
433
+ "uid": "wazuh_datasource_uid"
434
+ },
435
+ "metrics": [
436
+ {
437
+ "$$hashKey": "object:40",
438
+ "field": "select field",
439
+ "id": "1",
440
+ "type": "count"
441
+ }
442
+ ],
443
+ "query": "rule_group3:sysmon_event7 AND data_win_eventdata_signed:false AND agent_name:$agent_name",
444
+ "queryType": "lucene",
445
+ "refId": "A",
446
+ "timeField": "timestamp"
447
+ }
448
+ ],
449
+ "title": "UNSIGNED IMAGES / EVENTS",
450
+ "transformations": [
451
+ {
452
+ "id": "organize",
453
+ "options": {
454
+ "excludeByName": {},
455
+ "indexByName": {
456
+ "Count": 4,
457
+ "agent_name": 0,
458
+ "data_win_eventdata_imageLoaded": 2,
459
+ "data_win_eventdata_originalFileName": 1,
460
+ "software_vendor": 3
461
+ },
462
+ "renameByName": {
463
+ "Count": "COUNT",
464
+ "agent_name": "AGENT",
465
+ "data_win_eventdata_imageLoaded": "IMAGE FILE",
466
+ "data_win_eventdata_originalFileName": "DLL NAME",
467
+ "software_vendor": "VENDOR"
468
+ }
469
+ }
470
+ }
471
+ ],
472
+ "type": "table"
473
+ },
474
+ {
475
+ "datasource": {
476
+ "type": "elasticsearch",
477
+ "uid": "wazuh_datasource_uid"
478
+ },
479
+ "fieldConfig": {
480
+ "defaults": {
481
+ "mappings": [
482
+ {
483
+ "options": {
484
+ "match": "null",
485
+ "result": {
486
+ "text": "N/A"
487
+ }
488
+ },
489
+ "type": "special"
490
+ }
491
+ ],
492
+ "thresholds": {
493
+ "mode": "absolute",
494
+ "steps": [
495
+ {
496
+ "color": "blue",
497
+ "value": null
498
+ }
499
+ ]
500
+ },
501
+ "unit": "short"
502
+ },
503
+ "overrides": []
504
+ },
505
+ "gridPos": {
506
+ "h": 7,
507
+ "w": 4,
508
+ "x": 0,
509
+ "y": 7
510
+ },
511
+ "id": 43,
512
+ "links": [],
513
+ "options": {
514
+ "colorMode": "value",
515
+ "graphMode": "area",
516
+ "justifyMode": "auto",
517
+ "orientation": "horizontal",
518
+ "reduceOptions": {
519
+ "calcs": ["sum"],
520
+ "fields": "",
521
+ "values": false
522
+ },
523
+ "text": {},
524
+ "textMode": "auto"
525
+ },
526
+ "pluginVersion": "9.0.0",
527
+ "targets": [
528
+ {
529
+ "bucketAggs": [
530
+ {
531
+ "$$hashKey": "object:118",
532
+ "field": "timestamp",
533
+ "id": "2",
534
+ "settings": {
535
+ "interval": "auto",
536
+ "min_doc_count": 0,
537
+ "trimEdges": 0
538
+ },
539
+ "type": "date_histogram"
540
+ }
541
+ ],
542
+ "metrics": [
543
+ {
544
+ "$$hashKey": "object:116",
545
+ "field": "select field",
546
+ "id": "1",
547
+ "type": "count"
548
+ }
549
+ ],
550
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
551
+ "refId": "A",
552
+ "timeField": "timestamp"
553
+ }
554
+ ],
555
+ "title": "DLL LOAD EVENTS",
556
+ "type": "stat"
557
+ },
558
+ {
559
+ "datasource": {
560
+ "type": "elasticsearch",
561
+ "uid": "wazuh_datasource_uid"
562
+ },
563
+ "fieldConfig": {
564
+ "defaults": {
565
+ "custom": {
566
+ "align": "auto",
567
+ "displayMode": "auto",
568
+ "filterable": false,
569
+ "inspect": false
570
+ },
571
+ "mappings": [],
572
+ "thresholds": {
573
+ "mode": "absolute",
574
+ "steps": [
575
+ {
576
+ "color": "blue",
577
+ "value": null
578
+ }
579
+ ]
580
+ }
581
+ },
582
+ "overrides": [
583
+ {
584
+ "matcher": {
585
+ "id": "byName",
586
+ "options": "Count"
587
+ },
588
+ "properties": [
589
+ {
590
+ "id": "custom.displayMode",
591
+ "value": "color-text"
592
+ }
593
+ ]
594
+ },
595
+ {
596
+ "matcher": {
597
+ "id": "byName",
598
+ "options": "software_vendor"
599
+ },
600
+ "properties": [
601
+ {
602
+ "id": "custom.displayMode",
603
+ "value": "color-text"
604
+ }
605
+ ]
606
+ }
607
+ ]
608
+ },
609
+ "gridPos": {
610
+ "h": 7,
611
+ "w": 8,
612
+ "x": 4,
613
+ "y": 7
614
+ },
615
+ "id": 72,
616
+ "links": [],
617
+ "options": {
618
+ "footer": {
619
+ "fields": "",
620
+ "reducer": ["sum"],
621
+ "show": false
622
+ },
623
+ "showHeader": true
624
+ },
625
+ "pluginVersion": "9.0.0",
626
+ "targets": [
627
+ {
628
+ "bucketAggs": [
629
+ {
630
+ "$$hashKey": "object:42",
631
+ "fake": true,
632
+ "field": "data_win_eventdata_description",
633
+ "id": "3",
634
+ "settings": {
635
+ "min_doc_count": "1",
636
+ "missing": "Unknown",
637
+ "order": "desc",
638
+ "orderBy": "_count",
639
+ "size": "0"
640
+ },
641
+ "type": "terms"
642
+ }
643
+ ],
644
+ "datasource": {
645
+ "type": "elasticsearch",
646
+ "uid": "wazuh_datasource_uid"
647
+ },
648
+ "metrics": [
649
+ {
650
+ "$$hashKey": "object:40",
651
+ "field": "select field",
652
+ "id": "1",
653
+ "type": "count"
654
+ }
655
+ ],
656
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
657
+ "queryType": "lucene",
658
+ "refId": "A",
659
+ "timeField": "timestamp"
660
+ }
661
+ ],
662
+ "title": "DLL IMAGES / DESCRIPTION",
663
+ "type": "table"
664
+ },
665
+ {
666
+ "datasource": {
667
+ "type": "elasticsearch",
668
+ "uid": "wazuh_datasource_uid"
669
+ },
670
+ "fieldConfig": {
671
+ "defaults": {
672
+ "color": {
673
+ "mode": "palette-classic"
674
+ },
675
+ "custom": {
676
+ "hideFrom": {
677
+ "legend": false,
678
+ "tooltip": false,
679
+ "viz": false
680
+ }
681
+ },
682
+ "decimals": 0,
683
+ "mappings": [],
684
+ "unit": "short"
685
+ },
686
+ "overrides": []
687
+ },
688
+ "gridPos": {
689
+ "h": 7,
690
+ "w": 4,
691
+ "x": 12,
692
+ "y": 7
693
+ },
694
+ "id": 66,
695
+ "links": [],
696
+ "options": {
697
+ "displayLabels": [],
698
+ "legend": {
699
+ "calcs": [],
700
+ "displayMode": "hidden",
701
+ "placement": "bottom",
702
+ "values": ["value"]
703
+ },
704
+ "pieType": "donut",
705
+ "reduceOptions": {
706
+ "calcs": ["sum"],
707
+ "fields": "",
708
+ "values": false
709
+ },
710
+ "text": {},
711
+ "tooltip": {
712
+ "mode": "single",
713
+ "sort": "none"
714
+ }
715
+ },
716
+ "pluginVersion": "7.3.4",
717
+ "targets": [
718
+ {
719
+ "bucketAggs": [
720
+ {
721
+ "$$hashKey": "object:73",
722
+ "fake": true,
723
+ "field": "software_vendor",
724
+ "id": "3",
725
+ "settings": {
726
+ "min_doc_count": "1",
727
+ "missing": "Unknown",
728
+ "order": "desc",
729
+ "orderBy": "_count",
730
+ "size": "10"
731
+ },
732
+ "type": "terms"
733
+ },
734
+ {
735
+ "$$hashKey": "object:74",
736
+ "field": "timestamp",
737
+ "id": "2",
738
+ "settings": {
739
+ "interval": "auto",
740
+ "min_doc_count": 0,
741
+ "trimEdges": 0
742
+ },
743
+ "type": "date_histogram"
744
+ }
745
+ ],
746
+ "datasource": {
747
+ "type": "elasticsearch",
748
+ "uid": "wazuh_datasource_uid"
749
+ },
750
+ "metrics": [
751
+ {
752
+ "$$hashKey": "object:71",
753
+ "field": "select field",
754
+ "id": "1",
755
+ "type": "count"
756
+ }
757
+ ],
758
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
759
+ "queryType": "lucene",
760
+ "refId": "A",
761
+ "timeField": "timestamp"
762
+ }
763
+ ],
764
+ "title": "IMAGE LOAD EVENTS / SOFTWARE VENDOR",
765
+ "type": "piechart"
766
+ },
767
+ {
768
+ "datasource": {
769
+ "type": "elasticsearch",
770
+ "uid": "wazuh_datasource_uid"
771
+ },
772
+ "fieldConfig": {
773
+ "defaults": {
774
+ "custom": {
775
+ "align": "auto",
776
+ "displayMode": "auto",
777
+ "filterable": false,
778
+ "inspect": false
779
+ },
780
+ "mappings": [],
781
+ "thresholds": {
782
+ "mode": "absolute",
783
+ "steps": [
784
+ {
785
+ "color": "green",
786
+ "value": null
787
+ },
788
+ {
789
+ "color": "red",
790
+ "value": 80
791
+ }
792
+ ]
793
+ }
794
+ },
795
+ "overrides": []
796
+ },
797
+ "gridPos": {
798
+ "h": 7,
799
+ "w": 8,
800
+ "x": 16,
801
+ "y": 7
802
+ },
803
+ "id": 61,
804
+ "links": [],
805
+ "options": {
806
+ "footer": {
807
+ "fields": "",
808
+ "reducer": ["sum"],
809
+ "show": false
810
+ },
811
+ "showHeader": true
812
+ },
813
+ "pluginVersion": "9.0.0",
814
+ "targets": [
815
+ {
816
+ "bucketAggs": [
817
+ {
818
+ "$$hashKey": "object:42",
819
+ "fake": true,
820
+ "field": "software_vendor",
821
+ "id": "3",
822
+ "settings": {
823
+ "min_doc_count": "1",
824
+ "missing": "Unknown",
825
+ "order": "desc",
826
+ "orderBy": "_count",
827
+ "size": "0"
828
+ },
829
+ "type": "terms"
830
+ }
831
+ ],
832
+ "datasource": {
833
+ "type": "elasticsearch",
834
+ "uid": "wazuh_datasource_uid"
835
+ },
836
+ "metrics": [
837
+ {
838
+ "$$hashKey": "object:40",
839
+ "field": "select field",
840
+ "id": "1",
841
+ "type": "count"
842
+ }
843
+ ],
844
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
845
+ "queryType": "lucene",
846
+ "refId": "A",
847
+ "timeField": "timestamp"
848
+ }
849
+ ],
850
+ "title": "IMAGE LOAD EVENTS / SOFTWARE VENDOR",
851
+ "type": "table"
852
+ },
853
+ {
854
+ "datasource": {
855
+ "type": "elasticsearch",
856
+ "uid": "wazuh_datasource_uid"
857
+ },
858
+ "fieldConfig": {
859
+ "defaults": {
860
+ "mappings": [],
861
+ "thresholds": {
862
+ "mode": "absolute",
863
+ "steps": [
864
+ {
865
+ "color": "green",
866
+ "value": null
867
+ },
868
+ {
869
+ "color": "red",
870
+ "value": 80
871
+ }
872
+ ]
873
+ }
874
+ },
875
+ "overrides": []
876
+ },
877
+ "gridPos": {
878
+ "h": 13,
879
+ "w": 24,
880
+ "x": 0,
881
+ "y": 14
882
+ },
883
+ "id": 74,
884
+ "options": {
885
+ "color": "blue",
886
+ "iteration": 20,
887
+ "monochrome": false,
888
+ "nodeColor": "grey",
889
+ "nodePadding": 30,
890
+ "nodeWidth": 30
891
+ },
892
+ "targets": [
893
+ {
894
+ "alias": "",
895
+ "bucketAggs": [
896
+ {
897
+ "field": "process_image",
898
+ "id": "3",
899
+ "settings": {
900
+ "min_doc_count": "1",
901
+ "missing": "Unknown",
902
+ "order": "desc",
903
+ "orderBy": "_term",
904
+ "size": "5"
905
+ },
906
+ "type": "terms"
907
+ },
908
+ {
909
+ "field": "dll_name",
910
+ "id": "4",
911
+ "settings": {
912
+ "min_doc_count": "1",
913
+ "missing": "Unknown",
914
+ "order": "desc",
915
+ "orderBy": "_term",
916
+ "size": "5"
917
+ },
918
+ "type": "terms"
919
+ },
920
+ {
921
+ "field": "dll_signature",
922
+ "id": "5",
923
+ "settings": {
924
+ "min_doc_count": "1",
925
+ "missing": "Unknown",
926
+ "order": "desc",
927
+ "orderBy": "_term",
928
+ "size": "10"
929
+ },
930
+ "type": "terms"
931
+ },
932
+ {
933
+ "field": "data_win_eventdata_imageLoaded",
934
+ "id": "6",
935
+ "settings": {
936
+ "min_doc_count": "1",
937
+ "order": "desc",
938
+ "orderBy": "_term",
939
+ "size": "10"
940
+ },
941
+ "type": "terms"
942
+ }
943
+ ],
944
+ "datasource": {
945
+ "type": "elasticsearch",
946
+ "uid": "wazuh_datasource_uid"
947
+ },
948
+ "metrics": [
949
+ {
950
+ "id": "1",
951
+ "type": "count"
952
+ }
953
+ ],
954
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
955
+ "refId": "A",
956
+ "timeField": "timestamp"
957
+ }
958
+ ],
959
+ "title": "DLL SIDE LOADING - MAP",
960
+ "type": "netsage-sankey-panel"
961
+ },
962
+ {
963
+ "datasource": {
964
+ "type": "elasticsearch",
965
+ "uid": "wazuh_datasource_uid"
966
+ },
967
+ "fieldConfig": {
968
+ "defaults": {
969
+ "color": {
970
+ "mode": "thresholds"
971
+ },
972
+ "custom": {
973
+ "align": "auto",
974
+ "displayMode": "auto",
975
+ "inspect": false
976
+ },
977
+ "mappings": [],
978
+ "thresholds": {
979
+ "mode": "absolute",
980
+ "steps": [
981
+ {
982
+ "color": "green"
983
+ },
984
+ {
985
+ "color": "red",
986
+ "value": 80
987
+ }
988
+ ]
989
+ }
990
+ },
991
+ "overrides": []
992
+ },
993
+ "gridPos": {
994
+ "h": 10,
995
+ "w": 6,
996
+ "x": 0,
997
+ "y": 27
998
+ },
999
+ "id": 59,
1000
+ "links": [],
1001
+ "options": {
1002
+ "footer": {
1003
+ "fields": "",
1004
+ "reducer": ["sum"],
1005
+ "show": false
1006
+ },
1007
+ "showHeader": true
1008
+ },
1009
+ "pluginVersion": "9.0.0",
1010
+ "targets": [
1011
+ {
1012
+ "bucketAggs": [
1013
+ {
1014
+ "$$hashKey": "object:73",
1015
+ "fake": true,
1016
+ "field": "agent_name",
1017
+ "id": "3",
1018
+ "settings": {
1019
+ "min_doc_count": "1",
1020
+ "order": "desc",
1021
+ "orderBy": "_count",
1022
+ "size": "10"
1023
+ },
1024
+ "type": "terms"
1025
+ }
1026
+ ],
1027
+ "metrics": [
1028
+ {
1029
+ "$$hashKey": "object:71",
1030
+ "field": "select field",
1031
+ "id": "1",
1032
+ "type": "count"
1033
+ }
1034
+ ],
1035
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
1036
+ "queryType": "lucene",
1037
+ "refId": "A",
1038
+ "timeField": "timestamp"
1039
+ }
1040
+ ],
1041
+ "title": "IMAGE LOAD EVENTS / AGENT",
1042
+ "type": "table"
1043
+ },
1044
+ {
1045
+ "datasource": {
1046
+ "type": "elasticsearch",
1047
+ "uid": "wazuh_datasource_uid"
1048
+ },
1049
+ "fieldConfig": {
1050
+ "defaults": {
1051
+ "color": {
1052
+ "mode": "palette-classic"
1053
+ },
1054
+ "custom": {
1055
+ "axisLabel": "",
1056
+ "axisPlacement": "auto",
1057
+ "barAlignment": 0,
1058
+ "drawStyle": "bars",
1059
+ "fillOpacity": 0,
1060
+ "gradientMode": "none",
1061
+ "hideFrom": {
1062
+ "legend": false,
1063
+ "tooltip": false,
1064
+ "viz": false
1065
+ },
1066
+ "lineInterpolation": "linear",
1067
+ "lineWidth": 1,
1068
+ "pointSize": 5,
1069
+ "scaleDistribution": {
1070
+ "type": "linear"
1071
+ },
1072
+ "showPoints": "auto",
1073
+ "spanNulls": false,
1074
+ "stacking": {
1075
+ "group": "A",
1076
+ "mode": "normal"
1077
+ },
1078
+ "thresholdsStyle": {
1079
+ "mode": "off"
1080
+ }
1081
+ },
1082
+ "mappings": [],
1083
+ "thresholds": {
1084
+ "mode": "absolute",
1085
+ "steps": [
1086
+ {
1087
+ "color": "green"
1088
+ },
1089
+ {
1090
+ "color": "red",
1091
+ "value": 80
1092
+ }
1093
+ ]
1094
+ }
1095
+ },
1096
+ "overrides": []
1097
+ },
1098
+ "gridPos": {
1099
+ "h": 10,
1100
+ "w": 18,
1101
+ "x": 6,
1102
+ "y": 27
1103
+ },
1104
+ "id": 76,
1105
+ "options": {
1106
+ "legend": {
1107
+ "calcs": [],
1108
+ "displayMode": "table",
1109
+ "placement": "right"
1110
+ },
1111
+ "tooltip": {
1112
+ "mode": "single",
1113
+ "sort": "none"
1114
+ }
1115
+ },
1116
+ "targets": [
1117
+ {
1118
+ "alias": "",
1119
+ "bucketAggs": [
1120
+ {
1121
+ "field": "agent_name",
1122
+ "id": "3",
1123
+ "settings": {
1124
+ "min_doc_count": "1",
1125
+ "order": "desc",
1126
+ "orderBy": "_term",
1127
+ "size": "10"
1128
+ },
1129
+ "type": "terms"
1130
+ },
1131
+ {
1132
+ "field": "timestamp",
1133
+ "id": "2",
1134
+ "settings": {
1135
+ "interval": "auto"
1136
+ },
1137
+ "type": "date_histogram"
1138
+ }
1139
+ ],
1140
+ "datasource": {
1141
+ "type": "elasticsearch",
1142
+ "uid": "wazuh_datasource_uid"
1143
+ },
1144
+ "metrics": [
1145
+ {
1146
+ "id": "1",
1147
+ "type": "count"
1148
+ }
1149
+ ],
1150
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
1151
+ "refId": "A",
1152
+ "timeField": "timestamp"
1153
+ }
1154
+ ],
1155
+ "title": "TOP 10 AGENTS - HISTOGRAM",
1156
+ "transparent": true,
1157
+ "type": "timeseries"
1158
+ },
1159
+ {
1160
+ "datasource": {
1161
+ "type": "elasticsearch",
1162
+ "uid": "wazuh_datasource_uid"
1163
+ },
1164
+ "fieldConfig": {
1165
+ "defaults": {
1166
+ "mappings": [],
1167
+ "thresholds": {
1168
+ "mode": "absolute",
1169
+ "steps": [
1170
+ {
1171
+ "color": "green"
1172
+ },
1173
+ {
1174
+ "color": "red",
1175
+ "value": 80
1176
+ }
1177
+ ]
1178
+ }
1179
+ },
1180
+ "overrides": []
1181
+ },
1182
+ "gridPos": {
1183
+ "h": 8,
1184
+ "w": 12,
1185
+ "x": 0,
1186
+ "y": 37
1187
+ },
1188
+ "id": 67,
1189
+ "links": [],
1190
+ "options": {
1191
+ "displayMode": "gradient",
1192
+ "minVizHeight": 10,
1193
+ "minVizWidth": 0,
1194
+ "orientation": "horizontal",
1195
+ "reduceOptions": {
1196
+ "calcs": ["sum"],
1197
+ "fields": "",
1198
+ "values": false
1199
+ },
1200
+ "showUnfilled": true,
1201
+ "text": {}
1202
+ },
1203
+ "pluginVersion": "9.0.0",
1204
+ "targets": [
1205
+ {
1206
+ "bucketAggs": [
1207
+ {
1208
+ "$$hashKey": "object:73",
1209
+ "fake": true,
1210
+ "field": "process_image",
1211
+ "id": "3",
1212
+ "settings": {
1213
+ "min_doc_count": "1",
1214
+ "order": "desc",
1215
+ "orderBy": "_count",
1216
+ "size": "10"
1217
+ },
1218
+ "type": "terms"
1219
+ },
1220
+ {
1221
+ "$$hashKey": "object:74",
1222
+ "field": "timestamp",
1223
+ "id": "2",
1224
+ "settings": {
1225
+ "interval": "auto",
1226
+ "min_doc_count": 0,
1227
+ "trimEdges": 0
1228
+ },
1229
+ "type": "date_histogram"
1230
+ }
1231
+ ],
1232
+ "metrics": [
1233
+ {
1234
+ "$$hashKey": "object:71",
1235
+ "field": "select field",
1236
+ "id": "1",
1237
+ "type": "count"
1238
+ }
1239
+ ],
1240
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
1241
+ "queryType": "lucene",
1242
+ "refId": "A",
1243
+ "timeField": "timestamp"
1244
+ }
1245
+ ],
1246
+ "title": "IMAGE LOAD EVENTS / TOP 10 PROCESS",
1247
+ "type": "bargauge"
1248
+ },
1249
+ {
1250
+ "datasource": {
1251
+ "type": "elasticsearch",
1252
+ "uid": "wazuh_datasource_uid"
1253
+ },
1254
+ "fieldConfig": {
1255
+ "defaults": {
1256
+ "custom": {
1257
+ "align": "auto",
1258
+ "displayMode": "auto",
1259
+ "filterable": false,
1260
+ "inspect": false
1261
+ },
1262
+ "mappings": [],
1263
+ "thresholds": {
1264
+ "mode": "absolute",
1265
+ "steps": [
1266
+ {
1267
+ "color": "green"
1268
+ },
1269
+ {
1270
+ "color": "red",
1271
+ "value": 80
1272
+ }
1273
+ ]
1274
+ }
1275
+ },
1276
+ "overrides": [
1277
+ {
1278
+ "matcher": {
1279
+ "id": "byName",
1280
+ "options": "process_image"
1281
+ },
1282
+ "properties": [
1283
+ {
1284
+ "id": "custom.width",
1285
+ "value": 699
1286
+ }
1287
+ ]
1288
+ }
1289
+ ]
1290
+ },
1291
+ "gridPos": {
1292
+ "h": 16,
1293
+ "w": 12,
1294
+ "x": 12,
1295
+ "y": 37
1296
+ },
1297
+ "id": 69,
1298
+ "links": [],
1299
+ "options": {
1300
+ "footer": {
1301
+ "fields": "",
1302
+ "reducer": ["sum"],
1303
+ "show": false
1304
+ },
1305
+ "showHeader": true,
1306
+ "sortBy": [
1307
+ {
1308
+ "desc": true,
1309
+ "displayName": "Count"
1310
+ }
1311
+ ]
1312
+ },
1313
+ "pluginVersion": "9.0.0",
1314
+ "targets": [
1315
+ {
1316
+ "bucketAggs": [
1317
+ {
1318
+ "$$hashKey": "object:42",
1319
+ "fake": true,
1320
+ "field": "process_image",
1321
+ "id": "3",
1322
+ "settings": {
1323
+ "min_doc_count": "1",
1324
+ "order": "desc",
1325
+ "orderBy": "_count",
1326
+ "size": "0"
1327
+ },
1328
+ "type": "terms"
1329
+ }
1330
+ ],
1331
+ "metrics": [
1332
+ {
1333
+ "$$hashKey": "object:40",
1334
+ "field": "select field",
1335
+ "id": "1",
1336
+ "type": "count"
1337
+ }
1338
+ ],
1339
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
1340
+ "queryType": "lucene",
1341
+ "refId": "A",
1342
+ "timeField": "timestamp"
1343
+ }
1344
+ ],
1345
+ "title": "IMAGE LOAD EVENTS / PROCESS",
1346
+ "type": "table"
1347
+ },
1348
+ {
1349
+ "datasource": {
1350
+ "type": "elasticsearch",
1351
+ "uid": "wazuh_datasource_uid"
1352
+ },
1353
+ "fieldConfig": {
1354
+ "defaults": {
1355
+ "mappings": [],
1356
+ "thresholds": {
1357
+ "mode": "absolute",
1358
+ "steps": [
1359
+ {
1360
+ "color": "green"
1361
+ },
1362
+ {
1363
+ "color": "red",
1364
+ "value": 80
1365
+ }
1366
+ ]
1367
+ }
1368
+ },
1369
+ "overrides": []
1370
+ },
1371
+ "gridPos": {
1372
+ "h": 8,
1373
+ "w": 12,
1374
+ "x": 0,
1375
+ "y": 45
1376
+ },
1377
+ "id": 68,
1378
+ "links": [],
1379
+ "options": {
1380
+ "displayMode": "gradient",
1381
+ "minVizHeight": 10,
1382
+ "minVizWidth": 0,
1383
+ "orientation": "horizontal",
1384
+ "reduceOptions": {
1385
+ "calcs": ["sum"],
1386
+ "fields": "",
1387
+ "values": false
1388
+ },
1389
+ "showUnfilled": true,
1390
+ "text": {}
1391
+ },
1392
+ "pluginVersion": "9.0.0",
1393
+ "targets": [
1394
+ {
1395
+ "bucketAggs": [
1396
+ {
1397
+ "$$hashKey": "object:73",
1398
+ "fake": true,
1399
+ "field": "process_image",
1400
+ "id": "3",
1401
+ "settings": {
1402
+ "min_doc_count": "1",
1403
+ "order": "asc",
1404
+ "orderBy": "_count",
1405
+ "size": "10"
1406
+ },
1407
+ "type": "terms"
1408
+ },
1409
+ {
1410
+ "$$hashKey": "object:74",
1411
+ "field": "timestamp",
1412
+ "id": "2",
1413
+ "settings": {
1414
+ "interval": "auto",
1415
+ "min_doc_count": 0,
1416
+ "trimEdges": 0
1417
+ },
1418
+ "type": "date_histogram"
1419
+ }
1420
+ ],
1421
+ "metrics": [
1422
+ {
1423
+ "$$hashKey": "object:71",
1424
+ "field": "select field",
1425
+ "id": "1",
1426
+ "type": "count"
1427
+ }
1428
+ ],
1429
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
1430
+ "queryType": "lucene",
1431
+ "refId": "A",
1432
+ "timeField": "timestamp"
1433
+ }
1434
+ ],
1435
+ "title": "IMAGE LOAD EVENTS / LEAST SEEN PROCESS",
1436
+ "type": "bargauge"
1437
+ },
1438
+ {
1439
+ "datasource": {
1440
+ "type": "elasticsearch",
1441
+ "uid": "wazuh_datasource_uid"
1442
+ },
1443
+ "fieldConfig": {
1444
+ "defaults": {
1445
+ "custom": {
1446
+ "align": "auto",
1447
+ "displayMode": "auto",
1448
+ "filterable": false,
1449
+ "inspect": false
1450
+ },
1451
+ "mappings": [],
1452
+ "thresholds": {
1453
+ "mode": "absolute",
1454
+ "steps": [
1455
+ {
1456
+ "color": "green"
1457
+ },
1458
+ {
1459
+ "color": "red",
1460
+ "value": 80
1461
+ }
1462
+ ]
1463
+ }
1464
+ },
1465
+ "overrides": [
1466
+ {
1467
+ "matcher": {
1468
+ "id": "byName",
1469
+ "options": "DATE/TIME"
1470
+ },
1471
+ "properties": [
1472
+ {
1473
+ "id": "custom.width",
1474
+ "value": 255
1475
+ }
1476
+ ]
1477
+ },
1478
+ {
1479
+ "matcher": {
1480
+ "id": "byName",
1481
+ "options": "AGENT"
1482
+ },
1483
+ "properties": [
1484
+ {
1485
+ "id": "custom.width",
1486
+ "value": 229
1487
+ }
1488
+ ]
1489
+ },
1490
+ {
1491
+ "matcher": {
1492
+ "id": "byName",
1493
+ "options": "CERT STATUS"
1494
+ },
1495
+ "properties": [
1496
+ {
1497
+ "id": "custom.width",
1498
+ "value": 234
1499
+ }
1500
+ ]
1501
+ },
1502
+ {
1503
+ "matcher": {
1504
+ "id": "byName",
1505
+ "options": "DLL LOCATION"
1506
+ },
1507
+ "properties": [
1508
+ {
1509
+ "id": "custom.width",
1510
+ "value": 622
1511
+ }
1512
+ ]
1513
+ },
1514
+ {
1515
+ "matcher": {
1516
+ "id": "byName",
1517
+ "options": "PROCESS FILE"
1518
+ },
1519
+ "properties": [
1520
+ {
1521
+ "id": "custom.width",
1522
+ "value": 345
1523
+ }
1524
+ ]
1525
+ },
1526
+ {
1527
+ "matcher": {
1528
+ "id": "byName",
1529
+ "options": "EVENT ID"
1530
+ },
1531
+ "properties": [
1532
+ {
1533
+ "id": "links",
1534
+ "value": [
1535
+ {
1536
+ "targetBlank": true,
1537
+ "title": "VIEW EVENT DETAILS",
1538
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1539
+ }
1540
+ ]
1541
+ }
1542
+ ]
1543
+ }
1544
+ ]
1545
+ },
1546
+ "gridPos": {
1547
+ "h": 10,
1548
+ "w": 24,
1549
+ "x": 0,
1550
+ "y": 53
1551
+ },
1552
+ "id": 71,
1553
+ "options": {
1554
+ "footer": {
1555
+ "fields": "",
1556
+ "reducer": ["sum"],
1557
+ "show": false
1558
+ },
1559
+ "showHeader": true,
1560
+ "sortBy": []
1561
+ },
1562
+ "pluginVersion": "9.0.0",
1563
+ "targets": [
1564
+ {
1565
+ "bucketAggs": [],
1566
+ "datasource": {
1567
+ "type": "elasticsearch",
1568
+ "uid": "wazuh_datasource_uid"
1569
+ },
1570
+ "metrics": [
1571
+ {
1572
+ "$$hashKey": "object:823",
1573
+ "field": "select field",
1574
+ "id": "1",
1575
+ "meta": {},
1576
+ "settings": {
1577
+ "size": "250"
1578
+ },
1579
+ "type": "raw_data"
1580
+ }
1581
+ ],
1582
+ "query": "rule_group3:sysmon_event7 AND agent_name:$agent_name",
1583
+ "queryType": "lucene",
1584
+ "refId": "A",
1585
+ "timeField": "timestamp"
1586
+ }
1587
+ ],
1588
+ "title": "DLL SIDE LOADING - EVENTS",
1589
+ "transformations": [
1590
+ {
1591
+ "id": "organize",
1592
+ "options": {
1593
+ "excludeByName": {
1594
+ "@metadata_beat": true,
1595
+ "@metadata_type": true,
1596
+ "@metadata_version": true,
1597
+ "IMPHASH": true,
1598
+ "MD5": true,
1599
+ "SHA1": true,
1600
+ "_id": false,
1601
+ "_index": true,
1602
+ "_type": true,
1603
+ "agent_ephemeral_id": true,
1604
+ "agent_hostname": true,
1605
+ "agent_id": true,
1606
+ "agent_ip": false,
1607
+ "agent_ip_city_name": true,
1608
+ "agent_ip_country_code": true,
1609
+ "agent_ip_geolocation": true,
1610
+ "agent_labels_customer": true,
1611
+ "agent_name": false,
1612
+ "agent_type": true,
1613
+ "agent_version": true,
1614
+ "beats_type": true,
1615
+ "collector_node_id": true,
1616
+ "data_win_eventdata_description": true,
1617
+ "data_win_eventdata_fileVersion": true,
1618
+ "data_win_eventdata_fileVersion_city_name": true,
1619
+ "data_win_eventdata_fileVersion_country_code": true,
1620
+ "data_win_eventdata_fileVersion_geolocation": true,
1621
+ "data_win_eventdata_hashes": true,
1622
+ "data_win_eventdata_image": false,
1623
+ "data_win_eventdata_originalFileName": true,
1624
+ "data_win_eventdata_processGuid": true,
1625
+ "data_win_eventdata_processId": true,
1626
+ "data_win_eventdata_product": true,
1627
+ "data_win_eventdata_ruleName": true,
1628
+ "data_win_eventdata_signature": true,
1629
+ "data_win_eventdata_user": true,
1630
+ "data_win_eventdata_utcTime": true,
1631
+ "data_win_system_channel": true,
1632
+ "data_win_system_computer": true,
1633
+ "data_win_system_eventID": true,
1634
+ "data_win_system_eventRecordID": true,
1635
+ "data_win_system_keywords": true,
1636
+ "data_win_system_level": true,
1637
+ "data_win_system_message": true,
1638
+ "data_win_system_opcode": true,
1639
+ "data_win_system_processID": true,
1640
+ "data_win_system_providerGuid": true,
1641
+ "data_win_system_providerName": true,
1642
+ "data_win_system_severityValue": true,
1643
+ "data_win_system_systemTime": true,
1644
+ "data_win_system_task": true,
1645
+ "data_win_system_threadID": true,
1646
+ "data_win_system_version": true,
1647
+ "date": true,
1648
+ "decoder_name": true,
1649
+ "dll_hashes": true,
1650
+ "dll_name": true,
1651
+ "dll_signature": true,
1652
+ "dll_signature_status": true,
1653
+ "dll_signed": true,
1654
+ "ecs_version": true,
1655
+ "firewall_rule_name": true,
1656
+ "gl2_accounted_message_size": true,
1657
+ "gl2_message_id": true,
1658
+ "gl2_processing_error": true,
1659
+ "gl2_remote_ip": true,
1660
+ "gl2_remote_port": true,
1661
+ "gl2_source_collector": true,
1662
+ "gl2_source_input": true,
1663
+ "gl2_source_node": true,
1664
+ "hash_md5": true,
1665
+ "hash_sha1": true,
1666
+ "hash_sha256": true,
1667
+ "highlight": true,
1668
+ "host_name": true,
1669
+ "id": true,
1670
+ "image_loaded": true,
1671
+ "location": true,
1672
+ "log_file_path": true,
1673
+ "log_offset": true,
1674
+ "manager_name": true,
1675
+ "message": true,
1676
+ "process_id": true,
1677
+ "process_image": true,
1678
+ "rule_description": true,
1679
+ "rule_firedtimes": true,
1680
+ "rule_group1": true,
1681
+ "rule_group2": true,
1682
+ "rule_group3": true,
1683
+ "rule_groups": true,
1684
+ "rule_id": true,
1685
+ "rule_level": true,
1686
+ "rule_mail": true,
1687
+ "rule_mitre_id": true,
1688
+ "rule_mitre_tactic": true,
1689
+ "rule_mitre_technique": true,
1690
+ "software_package": false,
1691
+ "sort": true,
1692
+ "source": true,
1693
+ "src_ip": true,
1694
+ "src_ip_city_name": true,
1695
+ "src_ip_country_code": true,
1696
+ "src_ip_geolocation": true,
1697
+ "streams": true,
1698
+ "syslog_tag": true,
1699
+ "syslog_type": true,
1700
+ "sysmon_event_description": true,
1701
+ "timestamp": false,
1702
+ "true": true,
1703
+ "win_system_eventID": true,
1704
+ "windows_event_id": true,
1705
+ "windows_event_severity": true
1706
+ },
1707
+ "indexByName": {
1708
+ "_id": 1,
1709
+ "_index": 4,
1710
+ "_type": 5,
1711
+ "agent_id": 6,
1712
+ "agent_ip": 7,
1713
+ "agent_ip_city_name": 78,
1714
+ "agent_ip_country_code": 79,
1715
+ "agent_ip_geolocation": 80,
1716
+ "agent_labels_customer": 63,
1717
+ "agent_name": 2,
1718
+ "data_win_eventdata_company": 59,
1719
+ "data_win_eventdata_description": 57,
1720
+ "data_win_eventdata_fileVersion": 8,
1721
+ "data_win_eventdata_hashes": 9,
1722
+ "data_win_eventdata_image": 3,
1723
+ "data_win_eventdata_imageLoaded": 10,
1724
+ "data_win_eventdata_originalFileName": 58,
1725
+ "data_win_eventdata_processGuid": 11,
1726
+ "data_win_eventdata_processId": 12,
1727
+ "data_win_eventdata_product": 13,
1728
+ "data_win_eventdata_ruleName": 60,
1729
+ "data_win_eventdata_signature": 61,
1730
+ "data_win_eventdata_signatureStatus": 14,
1731
+ "data_win_eventdata_signed": 15,
1732
+ "data_win_eventdata_user": 64,
1733
+ "data_win_eventdata_utcTime": 16,
1734
+ "data_win_system_channel": 17,
1735
+ "data_win_system_computer": 18,
1736
+ "data_win_system_eventID": 19,
1737
+ "data_win_system_eventRecordID": 20,
1738
+ "data_win_system_keywords": 21,
1739
+ "data_win_system_level": 22,
1740
+ "data_win_system_message": 23,
1741
+ "data_win_system_opcode": 24,
1742
+ "data_win_system_processID": 25,
1743
+ "data_win_system_providerGuid": 26,
1744
+ "data_win_system_providerName": 27,
1745
+ "data_win_system_severityValue": 28,
1746
+ "data_win_system_systemTime": 29,
1747
+ "data_win_system_task": 30,
1748
+ "data_win_system_threadID": 31,
1749
+ "data_win_system_version": 32,
1750
+ "decoder_name": 33,
1751
+ "dll_hashes": 65,
1752
+ "dll_name": 66,
1753
+ "dll_signature": 67,
1754
+ "dll_signature_status": 68,
1755
+ "dll_signed": 69,
1756
+ "gl2_accounted_message_size": 34,
1757
+ "gl2_message_id": 35,
1758
+ "gl2_processing_error": 70,
1759
+ "gl2_remote_ip": 36,
1760
+ "gl2_remote_port": 37,
1761
+ "gl2_source_input": 38,
1762
+ "gl2_source_node": 39,
1763
+ "highlight": 55,
1764
+ "id": 40,
1765
+ "image_loaded": 71,
1766
+ "location": 41,
1767
+ "manager_name": 42,
1768
+ "message": 43,
1769
+ "process_id": 44,
1770
+ "process_image": 45,
1771
+ "rule_description": 46,
1772
+ "rule_firedtimes": 47,
1773
+ "rule_group1": 72,
1774
+ "rule_group2": 73,
1775
+ "rule_group3": 74,
1776
+ "rule_groups": 48,
1777
+ "rule_id": 49,
1778
+ "rule_level": 50,
1779
+ "rule_mail": 51,
1780
+ "rule_mitre_id": 75,
1781
+ "rule_mitre_tactic": 76,
1782
+ "rule_mitre_technique": 77,
1783
+ "software_vendor": 62,
1784
+ "sort": 56,
1785
+ "source": 52,
1786
+ "streams": 53,
1787
+ "syslog_level": 81,
1788
+ "syslog_type": 54,
1789
+ "timestamp": 0,
1790
+ "true": 82
1791
+ },
1792
+ "renameByName": {
1793
+ "SHA256": "DLL HASH (SHA256)",
1794
+ "_id": "EVENT ID",
1795
+ "agent_name": "AGENT",
1796
+ "data_win_eventdata_company": "VENDOR",
1797
+ "data_win_eventdata_image": "PROCESS FILE",
1798
+ "data_win_eventdata_imageLoaded": "DLL LOCATION",
1799
+ "data_win_eventdata_signatureStatus": "CERT STATUS",
1800
+ "data_win_eventdata_signed": "DIGITAL SIGNATURE",
1801
+ "process_name": "DLL",
1802
+ "software_package": "SOFTWARE",
1803
+ "software_vendor": "VENDOR",
1804
+ "source": "",
1805
+ "syslog_level": "LEVEL",
1806
+ "timestamp": "DATE/TIME"
1807
+ }
1808
+ }
1809
+ },
1810
+ {
1811
+ "id": "filterFieldsByName",
1812
+ "options": {
1813
+ "include": {
1814
+ "names": [
1815
+ "DATE/TIME",
1816
+ "AGENT",
1817
+ "PROCESS FILE",
1818
+ "DLL LOCATION",
1819
+ "CERT STATUS",
1820
+ "DIGITAL SIGNATURE",
1821
+ "LEVEL",
1822
+ "EVENT ID"
1823
+ ]
1824
+ }
1825
+ }
1826
+ }
1827
+ ],
1828
+ "type": "table"
1829
+ }
1830
+ ],
1831
+ "refresh": false,
1832
+ "schemaVersion": 36,
1833
+ "style": "dark",
1834
+ "tags": ["EDR"],
1835
+ "templating": {
1836
+ "list": [
1837
+ {
1838
+ "datasource": {
1839
+ "type": "elasticsearch",
1840
+ "uid": "wazuh_datasource_uid"
1841
+ },
1842
+ "filters": [],
1843
+ "hide": 0,
1844
+ "label": "",
1845
+ "name": "Filters",
1846
+ "skipUrlSync": false,
1847
+ "type": "adhoc"
1848
+ },
1849
+ {
1850
+ "current": {
1851
+ "selected": false,
1852
+ "text": "All",
1853
+ "value": "$__all"
1854
+ },
1855
+ "datasource": {
1856
+ "type": "elasticsearch",
1857
+ "uid": "wazuh_datasource_uid"
1858
+ },
1859
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event7\"}",
1860
+ "hide": 0,
1861
+ "includeAll": true,
1862
+ "label": "Agent",
1863
+ "multi": false,
1864
+ "name": "agent_name",
1865
+ "options": [],
1866
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event7\"}",
1867
+ "refresh": 2,
1868
+ "regex": "",
1869
+ "skipUrlSync": false,
1870
+ "sort": 2,
1871
+ "tagValuesQuery": "",
1872
+ "tagsQuery": "",
1873
+ "type": "query",
1874
+ "useTags": false
1875
+ },
1876
+ {
1877
+ "current": {
1878
+ "isNone": true,
1879
+ "selected": false,
1880
+ "text": "None",
1881
+ "value": ""
1882
+ },
1883
+ "datasource": {
1884
+ "type": "elasticsearch",
1885
+ "uid": "wazuh_datasource_uid"
1886
+ },
1887
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_name\", \"query\": \"rule_group3:sysmon_event7\"}",
1888
+ "hide": 2,
1889
+ "includeAll": false,
1890
+ "multi": false,
1891
+ "name": "process_name",
1892
+ "options": [],
1893
+ "query": "{ \"find\": \"terms\", \"field\": \"process_name\", \"query\": \"rule_group3:sysmon_event7\"}",
1894
+ "refresh": 1,
1895
+ "regex": "",
1896
+ "skipUrlSync": false,
1897
+ "sort": 0,
1898
+ "tagValuesQuery": "",
1899
+ "tagsQuery": "",
1900
+ "type": "query",
1901
+ "useTags": false
1902
+ },
1903
+ {
1904
+ "current": {
1905
+ "isNone": true,
1906
+ "selected": false,
1907
+ "text": "None",
1908
+ "value": ""
1909
+ },
1910
+ "datasource": {
1911
+ "type": "elasticsearch",
1912
+ "uid": "wazuh_datasource_uid"
1913
+ },
1914
+ "definition": "{ \"find\": \"terms\", \"field\": \"parent_cmd_line\", \"query\": \"rule_group3:sysmon_event7\"}",
1915
+ "hide": 2,
1916
+ "includeAll": false,
1917
+ "multi": false,
1918
+ "name": "parent_cmd_line",
1919
+ "options": [],
1920
+ "query": "{ \"find\": \"terms\", \"field\": \"parent_cmd_line\", \"query\": \"rule_group3:sysmon_event7\"}",
1921
+ "refresh": 1,
1922
+ "regex": "",
1923
+ "skipUrlSync": false,
1924
+ "sort": 0,
1925
+ "tagValuesQuery": "",
1926
+ "tagsQuery": "",
1927
+ "type": "query",
1928
+ "useTags": false
1929
+ },
1930
+ {
1931
+ "current": {
1932
+ "isNone": true,
1933
+ "selected": false,
1934
+ "text": "None",
1935
+ "value": ""
1936
+ },
1937
+ "datasource": {
1938
+ "type": "elasticsearch",
1939
+ "uid": "wazuh_datasource_uid"
1940
+ },
1941
+ "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_id\", \"query\": \"rule_group3:sysmon_event7\"}",
1942
+ "hide": 2,
1943
+ "includeAll": false,
1944
+ "multi": false,
1945
+ "name": "parent_process_id",
1946
+ "options": [],
1947
+ "query": "{ \"find\": \"terms\", \"field\": \"parent_process_id\", \"query\": \"rule_group3:sysmon_event7\"}",
1948
+ "refresh": 1,
1949
+ "regex": "",
1950
+ "skipUrlSync": false,
1951
+ "sort": 0,
1952
+ "tagValuesQuery": "",
1953
+ "tagsQuery": "",
1954
+ "type": "query",
1955
+ "useTags": false
1956
+ },
1957
+ {
1958
+ "current": {
1959
+ "isNone": true,
1960
+ "selected": false,
1961
+ "text": "None",
1962
+ "value": ""
1963
+ },
1964
+ "datasource": {
1965
+ "type": "elasticsearch",
1966
+ "uid": "wazuh_datasource_uid"
1967
+ },
1968
+ "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_image\", \"query\": \"rule_group3:sysmon_event7\"}",
1969
+ "hide": 2,
1970
+ "includeAll": false,
1971
+ "multi": false,
1972
+ "name": "parent_process_image",
1973
+ "options": [],
1974
+ "query": "{ \"find\": \"terms\", \"field\": \"parent_process_image\", \"query\": \"rule_group3:sysmon_event7\"}",
1975
+ "refresh": 1,
1976
+ "regex": "",
1977
+ "skipUrlSync": false,
1978
+ "sort": 0,
1979
+ "tagValuesQuery": "",
1980
+ "tagsQuery": "",
1981
+ "type": "query",
1982
+ "useTags": false
1983
+ },
1984
+ {
1985
+ "current": {
1986
+ "selected": false,
1987
+ "text": "C:\\\\Program Files (x86)\\\\DesktopCentral_Agent\\\\dcconfig.exe",
1988
+ "value": "C:\\\\Program Files (x86)\\\\DesktopCentral_Agent\\\\dcconfig.exe"
1989
+ },
1990
+ "datasource": {
1991
+ "type": "elasticsearch",
1992
+ "uid": "wazuh_datasource_uid"
1993
+ },
1994
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_image\", \"query\": \"rule_group3:sysmon_event7\"}",
1995
+ "hide": 2,
1996
+ "includeAll": false,
1997
+ "multi": false,
1998
+ "name": "process_image",
1999
+ "options": [],
2000
+ "query": "{ \"find\": \"terms\", \"field\": \"process_image\", \"query\": \"rule_group3:sysmon_event7\"}",
2001
+ "refresh": 1,
2002
+ "regex": "",
2003
+ "skipUrlSync": false,
2004
+ "sort": 0,
2005
+ "tagValuesQuery": "",
2006
+ "tagsQuery": "",
2007
+ "type": "query",
2008
+ "useTags": false
2009
+ },
2010
+ {
2011
+ "current": {
2012
+ "isNone": true,
2013
+ "selected": false,
2014
+ "text": "None",
2015
+ "value": ""
2016
+ },
2017
+ "datasource": {
2018
+ "type": "elasticsearch",
2019
+ "uid": "wazuh_datasource_uid"
2020
+ },
2021
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_cmd_line\", \"query\": \"rule_group3:sysmon_event7\"}",
2022
+ "hide": 2,
2023
+ "includeAll": false,
2024
+ "multi": false,
2025
+ "name": "process_cmd_line",
2026
+ "options": [],
2027
+ "query": "{ \"find\": \"terms\", \"field\": \"process_cmd_line\", \"query\": \"rule_group3:sysmon_event7\"}",
2028
+ "refresh": 1,
2029
+ "regex": "",
2030
+ "skipUrlSync": false,
2031
+ "sort": 0,
2032
+ "tagValuesQuery": "",
2033
+ "tagsQuery": "",
2034
+ "type": "query",
2035
+ "useTags": false
2036
+ },
2037
+ {
2038
+ "current": {
2039
+ "selected": false,
2040
+ "text": "10008",
2041
+ "value": "10008"
2042
+ },
2043
+ "datasource": {
2044
+ "type": "elasticsearch",
2045
+ "uid": "wazuh_datasource_uid"
2046
+ },
2047
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_id\", \"query\": \"rule_group3:sysmon_event7\"}",
2048
+ "hide": 2,
2049
+ "includeAll": false,
2050
+ "multi": false,
2051
+ "name": "process_id",
2052
+ "options": [],
2053
+ "query": "{ \"find\": \"terms\", \"field\": \"process_id\", \"query\": \"rule_group3:sysmon_event7\"}",
2054
+ "refresh": 1,
2055
+ "regex": "",
2056
+ "skipUrlSync": false,
2057
+ "sort": 0,
2058
+ "tagValuesQuery": "",
2059
+ "tagsQuery": "",
2060
+ "type": "query",
2061
+ "useTags": false
2062
+ }
2063
+ ]
2064
+ },
2065
+ "time": {
2066
+ "from": "now-6h",
2067
+ "to": "now"
2068
+ },
2069
+ "timepicker": {
2070
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2071
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2072
+ },
2073
+ "timezone": "",
2074
+ "title": "EDR - DLL-Side LOADING",
2075
+ "uid": null,
2076
+ "version": 6,
2077
+ "weekStart": ""
2078
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_dns_requests.json
new
+1274
@@ -0,0 +1,1274 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194226116,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "collapsed": false,
45
+ "datasource": {
46
+ "type": "elasticsearch",
47
+ "uid": "wazuh_datasource_uid"
48
+ },
49
+ "gridPos": {
50
+ "h": 1,
51
+ "w": 24,
52
+ "x": 0,
53
+ "y": 0
54
+ },
55
+ "id": 75,
56
+ "panels": [],
57
+ "title": "DNS TELEMETRY",
58
+ "type": "row"
59
+ },
60
+ {
61
+ "datasource": {
62
+ "type": "elasticsearch",
63
+ "uid": "wazuh_datasource_uid"
64
+ },
65
+ "fieldConfig": {
66
+ "defaults": {
67
+ "mappings": [
68
+ {
69
+ "options": {
70
+ "match": "null",
71
+ "result": {
72
+ "text": "N/A"
73
+ }
74
+ },
75
+ "type": "special"
76
+ }
77
+ ],
78
+ "thresholds": {
79
+ "mode": "absolute",
80
+ "steps": [
81
+ {
82
+ "color": "blue",
83
+ "value": null
84
+ }
85
+ ]
86
+ },
87
+ "unit": "short"
88
+ },
89
+ "overrides": []
90
+ },
91
+ "gridPos": {
92
+ "h": 7,
93
+ "w": 4,
94
+ "x": 0,
95
+ "y": 1
96
+ },
97
+ "id": 68,
98
+ "links": [],
99
+ "options": {
100
+ "colorMode": "value",
101
+ "graphMode": "area",
102
+ "justifyMode": "auto",
103
+ "orientation": "horizontal",
104
+ "reduceOptions": {
105
+ "calcs": ["sum"],
106
+ "fields": "",
107
+ "values": false
108
+ },
109
+ "text": {},
110
+ "textMode": "auto"
111
+ },
112
+ "pluginVersion": "9.0.0",
113
+ "targets": [
114
+ {
115
+ "bucketAggs": [
116
+ {
117
+ "field": "timestamp",
118
+ "id": "2",
119
+ "settings": {
120
+ "interval": "auto",
121
+ "min_doc_count": 0,
122
+ "trimEdges": 0
123
+ },
124
+ "type": "date_histogram"
125
+ }
126
+ ],
127
+ "datasource": {
128
+ "type": "elasticsearch",
129
+ "uid": "wazuh_datasource_uid"
130
+ },
131
+ "metrics": [
132
+ {
133
+ "field": "select field",
134
+ "id": "1",
135
+ "type": "count"
136
+ }
137
+ ],
138
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
139
+ "refId": "A",
140
+ "timeField": "timestamp"
141
+ }
142
+ ],
143
+ "title": "DNS QUERIES",
144
+ "type": "stat"
145
+ },
146
+ {
147
+ "columns": [],
148
+ "datasource": {
149
+ "type": "elasticsearch",
150
+ "uid": "wazuh_datasource_uid"
151
+ },
152
+ "fontSize": "100%",
153
+ "gridPos": {
154
+ "h": 7,
155
+ "w": 6,
156
+ "x": 4,
157
+ "y": 1
158
+ },
159
+ "id": 31,
160
+ "showHeader": true,
161
+ "sort": {
162
+ "col": 0,
163
+ "desc": true
164
+ },
165
+ "styles": [
166
+ {
167
+ "$$hashKey": "object:289",
168
+ "alias": "Time",
169
+ "align": "auto",
170
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
171
+ "pattern": "Time",
172
+ "type": "date"
173
+ },
174
+ {
175
+ "$$hashKey": "object:290",
176
+ "alias": "",
177
+ "align": "auto",
178
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
179
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
180
+ "decimals": -1,
181
+ "mappingType": 1,
182
+ "pattern": "Count",
183
+ "thresholds": [],
184
+ "type": "number",
185
+ "unit": "short"
186
+ },
187
+ {
188
+ "$$hashKey": "object:291",
189
+ "alias": "AGENT",
190
+ "align": "auto",
191
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
192
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
193
+ "decimals": 2,
194
+ "mappingType": 1,
195
+ "pattern": "agent_name",
196
+ "thresholds": [],
197
+ "type": "number",
198
+ "unit": "short"
199
+ }
200
+ ],
201
+ "targets": [
202
+ {
203
+ "bucketAggs": [
204
+ {
205
+ "fake": true,
206
+ "field": "agent_name",
207
+ "id": "4",
208
+ "settings": {
209
+ "min_doc_count": 1,
210
+ "order": "desc",
211
+ "orderBy": "_count",
212
+ "size": "0"
213
+ },
214
+ "type": "terms"
215
+ }
216
+ ],
217
+ "datasource": {
218
+ "type": "elasticsearch",
219
+ "uid": "wazuh_datasource_uid"
220
+ },
221
+ "metrics": [
222
+ {
223
+ "field": "select field",
224
+ "id": "1",
225
+ "type": "count"
226
+ }
227
+ ],
228
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
229
+ "refId": "A",
230
+ "timeField": "timestamp"
231
+ }
232
+ ],
233
+ "title": "DNS QUERIES / AGENTS",
234
+ "transform": "table",
235
+ "type": "table-old"
236
+ },
237
+ {
238
+ "datasource": {
239
+ "type": "elasticsearch",
240
+ "uid": "wazuh_datasource_uid"
241
+ },
242
+ "fieldConfig": {
243
+ "defaults": {
244
+ "color": {
245
+ "mode": "palette-classic"
246
+ },
247
+ "custom": {
248
+ "axisLabel": "",
249
+ "axisPlacement": "auto",
250
+ "barAlignment": 0,
251
+ "drawStyle": "bars",
252
+ "fillOpacity": 0,
253
+ "gradientMode": "none",
254
+ "hideFrom": {
255
+ "legend": false,
256
+ "tooltip": false,
257
+ "viz": false
258
+ },
259
+ "lineInterpolation": "linear",
260
+ "lineWidth": 1,
261
+ "pointSize": 5,
262
+ "scaleDistribution": {
263
+ "type": "linear"
264
+ },
265
+ "showPoints": "auto",
266
+ "spanNulls": false,
267
+ "stacking": {
268
+ "group": "A",
269
+ "mode": "normal"
270
+ },
271
+ "thresholdsStyle": {
272
+ "mode": "off"
273
+ }
274
+ },
275
+ "mappings": [],
276
+ "thresholds": {
277
+ "mode": "absolute",
278
+ "steps": [
279
+ {
280
+ "color": "green",
281
+ "value": null
282
+ },
283
+ {
284
+ "color": "red",
285
+ "value": 80
286
+ }
287
+ ]
288
+ }
289
+ },
290
+ "overrides": []
291
+ },
292
+ "gridPos": {
293
+ "h": 7,
294
+ "w": 14,
295
+ "x": 10,
296
+ "y": 1
297
+ },
298
+ "id": 77,
299
+ "options": {
300
+ "legend": {
301
+ "calcs": [],
302
+ "displayMode": "table",
303
+ "placement": "right"
304
+ },
305
+ "tooltip": {
306
+ "mode": "single",
307
+ "sort": "none"
308
+ }
309
+ },
310
+ "targets": [
311
+ {
312
+ "alias": "",
313
+ "bucketAggs": [
314
+ {
315
+ "field": "agent_name",
316
+ "id": "3",
317
+ "settings": {
318
+ "min_doc_count": "1",
319
+ "order": "desc",
320
+ "orderBy": "_term",
321
+ "size": "10"
322
+ },
323
+ "type": "terms"
324
+ },
325
+ {
326
+ "field": "timestamp",
327
+ "id": "2",
328
+ "settings": {
329
+ "interval": "auto"
330
+ },
331
+ "type": "date_histogram"
332
+ }
333
+ ],
334
+ "datasource": {
335
+ "type": "elasticsearch",
336
+ "uid": "wazuh_datasource_uid"
337
+ },
338
+ "metrics": [
339
+ {
340
+ "id": "1",
341
+ "type": "count"
342
+ }
343
+ ],
344
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
345
+ "refId": "A",
346
+ "timeField": "timestamp"
347
+ }
348
+ ],
349
+ "title": "TOP 10 AGENTS - HISTOGRAM",
350
+ "transparent": true,
351
+ "type": "timeseries"
352
+ },
353
+ {
354
+ "datasource": {
355
+ "type": "elasticsearch",
356
+ "uid": "wazuh_datasource_uid"
357
+ },
358
+ "fieldConfig": {
359
+ "defaults": {
360
+ "color": {
361
+ "mode": "palette-classic"
362
+ },
363
+ "custom": {
364
+ "hideFrom": {
365
+ "legend": false,
366
+ "tooltip": false,
367
+ "viz": false
368
+ }
369
+ },
370
+ "decimals": 0,
371
+ "mappings": [],
372
+ "unit": "short"
373
+ },
374
+ "overrides": []
375
+ },
376
+ "gridPos": {
377
+ "h": 9,
378
+ "w": 4,
379
+ "x": 0,
380
+ "y": 8
381
+ },
382
+ "id": 65,
383
+ "links": [],
384
+ "options": {
385
+ "displayLabels": [],
386
+ "legend": {
387
+ "calcs": [],
388
+ "displayMode": "hidden",
389
+ "placement": "right",
390
+ "values": ["value", "percent"]
391
+ },
392
+ "pieType": "pie",
393
+ "reduceOptions": {
394
+ "calcs": ["sum"],
395
+ "fields": "",
396
+ "values": false
397
+ },
398
+ "text": {},
399
+ "tooltip": {
400
+ "mode": "single",
401
+ "sort": "none"
402
+ }
403
+ },
404
+ "pluginVersion": "7.3.4",
405
+ "targets": [
406
+ {
407
+ "bucketAggs": [
408
+ {
409
+ "$$hashKey": "object:79",
410
+ "fake": true,
411
+ "field": "dns_query",
412
+ "id": "6",
413
+ "settings": {
414
+ "min_doc_count": 1,
415
+ "order": "desc",
416
+ "orderBy": "_count",
417
+ "size": "10"
418
+ },
419
+ "type": "terms"
420
+ },
421
+ {
422
+ "$$hashKey": "object:80",
423
+ "fake": true,
424
+ "field": "timestamp",
425
+ "id": "5",
426
+ "settings": {
427
+ "interval": "auto",
428
+ "min_doc_count": 0,
429
+ "trimEdges": 0
430
+ },
431
+ "type": "date_histogram"
432
+ }
433
+ ],
434
+ "datasource": {
435
+ "type": "elasticsearch",
436
+ "uid": "wazuh_datasource_uid"
437
+ },
438
+ "metrics": [
439
+ {
440
+ "$$hashKey": "object:77",
441
+ "field": "type",
442
+ "id": "1",
443
+ "meta": {},
444
+ "settings": {},
445
+ "type": "count"
446
+ }
447
+ ],
448
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
449
+ "refId": "A",
450
+ "timeField": "timestamp"
451
+ }
452
+ ],
453
+ "title": "TOP 10 DNS QUERIES",
454
+ "type": "piechart"
455
+ },
456
+ {
457
+ "datasource": {
458
+ "type": "elasticsearch",
459
+ "uid": "wazuh_datasource_uid"
460
+ },
461
+ "fieldConfig": {
462
+ "defaults": {
463
+ "custom": {
464
+ "align": "auto",
465
+ "displayMode": "auto",
466
+ "filterable": false,
467
+ "inspect": false
468
+ },
469
+ "mappings": [],
470
+ "thresholds": {
471
+ "mode": "absolute",
472
+ "steps": [
473
+ {
474
+ "color": "green",
475
+ "value": null
476
+ },
477
+ {
478
+ "color": "red",
479
+ "value": 80
480
+ }
481
+ ]
482
+ }
483
+ },
484
+ "overrides": [
485
+ {
486
+ "matcher": {
487
+ "id": "byName",
488
+ "options": "dns_query"
489
+ },
490
+ "properties": [
491
+ {
492
+ "id": "custom.width",
493
+ "value": 976
494
+ }
495
+ ]
496
+ }
497
+ ]
498
+ },
499
+ "gridPos": {
500
+ "h": 9,
501
+ "w": 20,
502
+ "x": 4,
503
+ "y": 8
504
+ },
505
+ "id": 71,
506
+ "options": {
507
+ "footer": {
508
+ "fields": "",
509
+ "reducer": ["sum"],
510
+ "show": false
511
+ },
512
+ "showHeader": true,
513
+ "sortBy": []
514
+ },
515
+ "pluginVersion": "9.0.0",
516
+ "targets": [
517
+ {
518
+ "bucketAggs": [
519
+ {
520
+ "$$hashKey": "object:171",
521
+ "fake": true,
522
+ "field": "dns_query",
523
+ "id": "6",
524
+ "settings": {
525
+ "min_doc_count": 1,
526
+ "order": "desc",
527
+ "orderBy": "_count",
528
+ "size": "0"
529
+ },
530
+ "type": "terms"
531
+ }
532
+ ],
533
+ "datasource": {
534
+ "type": "elasticsearch",
535
+ "uid": "wazuh_datasource_uid"
536
+ },
537
+ "metrics": [
538
+ {
539
+ "$$hashKey": "object:169",
540
+ "field": "type",
541
+ "id": "1",
542
+ "meta": {},
543
+ "settings": {},
544
+ "type": "count"
545
+ }
546
+ ],
547
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
548
+ "refId": "A",
549
+ "timeField": "timestamp"
550
+ }
551
+ ],
552
+ "title": "TOP 10 DNS QUERIES",
553
+ "type": "table"
554
+ },
555
+ {
556
+ "datasource": {
557
+ "type": "elasticsearch",
558
+ "uid": "wazuh_datasource_uid"
559
+ },
560
+ "fieldConfig": {
561
+ "defaults": {
562
+ "mappings": [],
563
+ "thresholds": {
564
+ "mode": "absolute",
565
+ "steps": [
566
+ {
567
+ "color": "green",
568
+ "value": null
569
+ },
570
+ {
571
+ "color": "red",
572
+ "value": 80
573
+ }
574
+ ]
575
+ }
576
+ },
577
+ "overrides": []
578
+ },
579
+ "gridPos": {
580
+ "h": 7,
581
+ "w": 14,
582
+ "x": 0,
583
+ "y": 17
584
+ },
585
+ "id": 59,
586
+ "options": {
587
+ "displayMode": "gradient",
588
+ "minVizHeight": 10,
589
+ "minVizWidth": 0,
590
+ "orientation": "horizontal",
591
+ "reduceOptions": {
592
+ "calcs": ["sum"],
593
+ "fields": "",
594
+ "values": false
595
+ },
596
+ "showUnfilled": true,
597
+ "text": {}
598
+ },
599
+ "pluginVersion": "9.0.0",
600
+ "targets": [
601
+ {
602
+ "bucketAggs": [
603
+ {
604
+ "$$hashKey": "object:484",
605
+ "fake": true,
606
+ "field": "process_image",
607
+ "id": "6",
608
+ "settings": {
609
+ "min_doc_count": 1,
610
+ "order": "desc",
611
+ "orderBy": "_count",
612
+ "size": "10"
613
+ },
614
+ "type": "terms"
615
+ },
616
+ {
617
+ "$$hashKey": "object:485",
618
+ "fake": true,
619
+ "field": "timestamp",
620
+ "id": "5",
621
+ "settings": {
622
+ "interval": "auto",
623
+ "min_doc_count": 0,
624
+ "trimEdges": 0
625
+ },
626
+ "type": "date_histogram"
627
+ }
628
+ ],
629
+ "datasource": {
630
+ "type": "elasticsearch",
631
+ "uid": "wazuh_datasource_uid"
632
+ },
633
+ "metrics": [
634
+ {
635
+ "$$hashKey": "object:482",
636
+ "field": "type",
637
+ "id": "1",
638
+ "meta": {},
639
+ "settings": {},
640
+ "type": "count"
641
+ }
642
+ ],
643
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
644
+ "refId": "A",
645
+ "timeField": "timestamp"
646
+ }
647
+ ],
648
+ "title": "TOP 10 PROCESSES - DNS REQs",
649
+ "type": "bargauge"
650
+ },
651
+ {
652
+ "datasource": {
653
+ "type": "elasticsearch",
654
+ "uid": "wazuh_datasource_uid"
655
+ },
656
+ "fieldConfig": {
657
+ "defaults": {
658
+ "custom": {
659
+ "align": "auto",
660
+ "displayMode": "auto",
661
+ "filterable": false,
662
+ "inspect": false
663
+ },
664
+ "mappings": [],
665
+ "thresholds": {
666
+ "mode": "absolute",
667
+ "steps": [
668
+ {
669
+ "color": "green",
670
+ "value": null
671
+ },
672
+ {
673
+ "color": "red",
674
+ "value": 80
675
+ }
676
+ ]
677
+ }
678
+ },
679
+ "overrides": [
680
+ {
681
+ "matcher": {
682
+ "id": "byName",
683
+ "options": "process_image"
684
+ },
685
+ "properties": [
686
+ {
687
+ "id": "custom.width",
688
+ "value": 611
689
+ }
690
+ ]
691
+ }
692
+ ]
693
+ },
694
+ "gridPos": {
695
+ "h": 14,
696
+ "w": 10,
697
+ "x": 14,
698
+ "y": 17
699
+ },
700
+ "id": 70,
701
+ "options": {
702
+ "footer": {
703
+ "fields": "",
704
+ "reducer": ["sum"],
705
+ "show": false
706
+ },
707
+ "showHeader": true,
708
+ "sortBy": []
709
+ },
710
+ "pluginVersion": "9.0.0",
711
+ "targets": [
712
+ {
713
+ "bucketAggs": [
714
+ {
715
+ "$$hashKey": "object:536",
716
+ "fake": true,
717
+ "field": "process_image",
718
+ "id": "6",
719
+ "settings": {
720
+ "min_doc_count": 1,
721
+ "order": "desc",
722
+ "orderBy": "_count",
723
+ "size": "0"
724
+ },
725
+ "type": "terms"
726
+ }
727
+ ],
728
+ "datasource": {
729
+ "type": "elasticsearch",
730
+ "uid": "wazuh_datasource_uid"
731
+ },
732
+ "metrics": [
733
+ {
734
+ "$$hashKey": "object:534",
735
+ "field": "type",
736
+ "id": "1",
737
+ "meta": {},
738
+ "settings": {},
739
+ "type": "count"
740
+ }
741
+ ],
742
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
743
+ "refId": "A",
744
+ "timeField": "timestamp"
745
+ }
746
+ ],
747
+ "title": "PROCESSES - DNS REQs",
748
+ "type": "table"
749
+ },
750
+ {
751
+ "datasource": {
752
+ "type": "elasticsearch",
753
+ "uid": "wazuh_datasource_uid"
754
+ },
755
+ "fieldConfig": {
756
+ "defaults": {
757
+ "mappings": [],
758
+ "thresholds": {
759
+ "mode": "absolute",
760
+ "steps": [
761
+ {
762
+ "color": "green"
763
+ },
764
+ {
765
+ "color": "red",
766
+ "value": 80
767
+ }
768
+ ]
769
+ }
770
+ },
771
+ "overrides": []
772
+ },
773
+ "gridPos": {
774
+ "h": 7,
775
+ "w": 14,
776
+ "x": 0,
777
+ "y": 24
778
+ },
779
+ "id": 55,
780
+ "options": {
781
+ "displayMode": "gradient",
782
+ "minVizHeight": 10,
783
+ "minVizWidth": 0,
784
+ "orientation": "horizontal",
785
+ "reduceOptions": {
786
+ "calcs": ["sum"],
787
+ "fields": "",
788
+ "values": false
789
+ },
790
+ "showUnfilled": true,
791
+ "text": {}
792
+ },
793
+ "pluginVersion": "9.0.0",
794
+ "targets": [
795
+ {
796
+ "bucketAggs": [
797
+ {
798
+ "$$hashKey": "object:510",
799
+ "fake": true,
800
+ "field": "process_image",
801
+ "id": "6",
802
+ "settings": {
803
+ "min_doc_count": 1,
804
+ "order": "asc",
805
+ "orderBy": "_count",
806
+ "size": "10"
807
+ },
808
+ "type": "terms"
809
+ },
810
+ {
811
+ "$$hashKey": "object:511",
812
+ "fake": true,
813
+ "field": "timestamp",
814
+ "id": "5",
815
+ "settings": {
816
+ "interval": "auto",
817
+ "min_doc_count": 0,
818
+ "trimEdges": 0
819
+ },
820
+ "type": "date_histogram"
821
+ }
822
+ ],
823
+ "datasource": {
824
+ "type": "elasticsearch",
825
+ "uid": "wazuh_datasource_uid"
826
+ },
827
+ "metrics": [
828
+ {
829
+ "$$hashKey": "object:508",
830
+ "field": "type",
831
+ "id": "1",
832
+ "meta": {},
833
+ "settings": {},
834
+ "type": "count"
835
+ }
836
+ ],
837
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
838
+ "refId": "A",
839
+ "timeField": "timestamp"
840
+ }
841
+ ],
842
+ "title": "LEAST SEEN PROCESSES - DNS REQs",
843
+ "type": "bargauge"
844
+ },
845
+ {
846
+ "datasource": {
847
+ "type": "elasticsearch",
848
+ "uid": "wazuh_datasource_uid"
849
+ },
850
+ "fieldConfig": {
851
+ "defaults": {
852
+ "color": {
853
+ "mode": "thresholds"
854
+ },
855
+ "custom": {
856
+ "align": "auto",
857
+ "displayMode": "auto",
858
+ "inspect": false
859
+ },
860
+ "mappings": [],
861
+ "thresholds": {
862
+ "mode": "absolute",
863
+ "steps": [
864
+ {
865
+ "color": "green"
866
+ },
867
+ {
868
+ "color": "red",
869
+ "value": 80
870
+ }
871
+ ]
872
+ }
873
+ },
874
+ "overrides": [
875
+ {
876
+ "matcher": {
877
+ "id": "byName",
878
+ "options": "timestamp"
879
+ },
880
+ "properties": [
881
+ {
882
+ "id": "displayName",
883
+ "value": "DATE/TIME"
884
+ },
885
+ {
886
+ "id": "unit",
887
+ "value": "time: YYYY-MM-DD HH:mm:ss"
888
+ },
889
+ {
890
+ "id": "custom.align"
891
+ }
892
+ ]
893
+ },
894
+ {
895
+ "matcher": {
896
+ "id": "byName",
897
+ "options": "dns_query"
898
+ },
899
+ "properties": [
900
+ {
901
+ "id": "displayName",
902
+ "value": "DNS QUERY"
903
+ },
904
+ {
905
+ "id": "unit",
906
+ "value": "short"
907
+ },
908
+ {
909
+ "id": "decimals",
910
+ "value": -1
911
+ },
912
+ {
913
+ "id": "links",
914
+ "value": [
915
+ {
916
+ "targetBlank": true,
917
+ "title": "TALOS THREAT INTEL",
918
+ "url": "https://talosintelligence.com/reputation_center/lookup?search=${__value.text}"
919
+ }
920
+ ]
921
+ },
922
+ {
923
+ "id": "custom.align"
924
+ }
925
+ ]
926
+ },
927
+ {
928
+ "matcher": {
929
+ "id": "byName",
930
+ "options": "threat_indicated"
931
+ },
932
+ "properties": [
933
+ {
934
+ "id": "displayName",
935
+ "value": "FLAGGED DOMAIN"
936
+ },
937
+ {
938
+ "id": "unit",
939
+ "value": "none"
940
+ },
941
+ {
942
+ "id": "decimals",
943
+ "value": -2
944
+ },
945
+ {
946
+ "id": "custom.displayMode",
947
+ "value": "color-background"
948
+ },
949
+ {
950
+ "id": "custom.align"
951
+ },
952
+ {
953
+ "id": "thresholds",
954
+ "value": {
955
+ "mode": "absolute",
956
+ "steps": [
957
+ {
958
+ "color": "#37872D"
959
+ },
960
+ {
961
+ "color": "#37872D",
962
+ "value": 0
963
+ },
964
+ {
965
+ "color": "#FA6400",
966
+ "value": 1
967
+ }
968
+ ]
969
+ }
970
+ }
971
+ ]
972
+ },
973
+ {
974
+ "matcher": {
975
+ "id": "byName",
976
+ "options": "process_image"
977
+ },
978
+ "properties": [
979
+ {
980
+ "id": "displayName",
981
+ "value": "PROCESS"
982
+ },
983
+ {
984
+ "id": "unit",
985
+ "value": "short"
986
+ },
987
+ {
988
+ "id": "decimals",
989
+ "value": 2
990
+ },
991
+ {
992
+ "id": "custom.align"
993
+ }
994
+ ]
995
+ },
996
+ {
997
+ "matcher": {
998
+ "id": "byName",
999
+ "options": "user_name"
1000
+ },
1001
+ "properties": [
1002
+ {
1003
+ "id": "displayName",
1004
+ "value": "USER/ACCOUNT"
1005
+ },
1006
+ {
1007
+ "id": "unit",
1008
+ "value": "short"
1009
+ },
1010
+ {
1011
+ "id": "decimals",
1012
+ "value": 2
1013
+ },
1014
+ {
1015
+ "id": "custom.align"
1016
+ }
1017
+ ]
1018
+ },
1019
+ {
1020
+ "matcher": {
1021
+ "id": "byName",
1022
+ "options": "agent_name"
1023
+ },
1024
+ "properties": [
1025
+ {
1026
+ "id": "displayName",
1027
+ "value": "AGENT"
1028
+ },
1029
+ {
1030
+ "id": "unit",
1031
+ "value": "short"
1032
+ },
1033
+ {
1034
+ "id": "decimals",
1035
+ "value": 2
1036
+ },
1037
+ {
1038
+ "id": "custom.align"
1039
+ }
1040
+ ]
1041
+ },
1042
+ {
1043
+ "matcher": {
1044
+ "id": "byName",
1045
+ "options": "src_ip"
1046
+ },
1047
+ "properties": [
1048
+ {
1049
+ "id": "displayName",
1050
+ "value": "SRC IP"
1051
+ },
1052
+ {
1053
+ "id": "unit",
1054
+ "value": "short"
1055
+ },
1056
+ {
1057
+ "id": "decimals",
1058
+ "value": 2
1059
+ },
1060
+ {
1061
+ "id": "custom.align"
1062
+ }
1063
+ ]
1064
+ },
1065
+ {
1066
+ "matcher": {
1067
+ "id": "byName",
1068
+ "options": "dst_port"
1069
+ },
1070
+ "properties": [
1071
+ {
1072
+ "id": "displayName",
1073
+ "value": "DST PORT"
1074
+ },
1075
+ {
1076
+ "id": "unit",
1077
+ "value": "short"
1078
+ },
1079
+ {
1080
+ "id": "decimals",
1081
+ "value": 2
1082
+ },
1083
+ {
1084
+ "id": "custom.align"
1085
+ }
1086
+ ]
1087
+ },
1088
+ {
1089
+ "matcher": {
1090
+ "id": "byName",
1091
+ "options": "event_hash"
1092
+ },
1093
+ "properties": [
1094
+ {
1095
+ "id": "displayName",
1096
+ "value": "EVENT HASH"
1097
+ },
1098
+ {
1099
+ "id": "unit",
1100
+ "value": "short"
1101
+ },
1102
+ {
1103
+ "id": "decimals",
1104
+ "value": 2
1105
+ },
1106
+ {
1107
+ "id": "custom.align"
1108
+ }
1109
+ ]
1110
+ },
1111
+ {
1112
+ "matcher": {
1113
+ "id": "byName",
1114
+ "options": "EVENT ID"
1115
+ },
1116
+ "properties": [
1117
+ {
1118
+ "id": "links",
1119
+ "value": [
1120
+ {
1121
+ "targetBlank": true,
1122
+ "title": "VIEW EVENT DETAILS",
1123
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1124
+ }
1125
+ ]
1126
+ }
1127
+ ]
1128
+ }
1129
+ ]
1130
+ },
1131
+ "gridPos": {
1132
+ "h": 12,
1133
+ "w": 24,
1134
+ "x": 0,
1135
+ "y": 31
1136
+ },
1137
+ "id": 69,
1138
+ "options": {
1139
+ "footer": {
1140
+ "fields": "",
1141
+ "reducer": ["sum"],
1142
+ "show": false
1143
+ },
1144
+ "showHeader": true
1145
+ },
1146
+ "pluginVersion": "9.0.0",
1147
+ "targets": [
1148
+ {
1149
+ "bucketAggs": [],
1150
+ "datasource": {
1151
+ "type": "elasticsearch",
1152
+ "uid": "wazuh_datasource_uid"
1153
+ },
1154
+ "metrics": [
1155
+ {
1156
+ "id": "1",
1157
+ "settings": {
1158
+ "size": "500"
1159
+ },
1160
+ "type": "raw_data"
1161
+ }
1162
+ ],
1163
+ "query": "(rule_group3:sysmon_event_22 OR rule_group3:dns) AND agent_name:$agent_name",
1164
+ "refId": "A",
1165
+ "timeField": "timestamp"
1166
+ }
1167
+ ],
1168
+ "title": "DNS QUERIES",
1169
+ "transformations": [
1170
+ {
1171
+ "id": "filterFieldsByName",
1172
+ "options": {
1173
+ "include": {
1174
+ "names": [
1175
+ "timestamp",
1176
+ "agent_ip",
1177
+ "agent_name",
1178
+ "dns_answer",
1179
+ "dns_query",
1180
+ "dns_response_code",
1181
+ "process_image",
1182
+ "_id"
1183
+ ]
1184
+ }
1185
+ }
1186
+ },
1187
+ {
1188
+ "id": "organize",
1189
+ "options": {
1190
+ "excludeByName": {},
1191
+ "indexByName": {
1192
+ "_id": 1,
1193
+ "agent_ip": 3,
1194
+ "agent_name": 2,
1195
+ "dns_answer": 5,
1196
+ "dns_query": 4,
1197
+ "dns_response_code": 6,
1198
+ "process_image": 7,
1199
+ "timestamp": 0
1200
+ },
1201
+ "renameByName": {
1202
+ "_id": "EVENT ID",
1203
+ "agent_ip": "AGENT IP",
1204
+ "dns_answer": "ANSWER",
1205
+ "dns_response_code": "RESPONSE CODE",
1206
+ "process_image": "PROCESS"
1207
+ }
1208
+ }
1209
+ }
1210
+ ],
1211
+ "type": "table"
1212
+ }
1213
+ ],
1214
+ "refresh": false,
1215
+ "schemaVersion": 36,
1216
+ "style": "dark",
1217
+ "tags": ["EDR"],
1218
+ "templating": {
1219
+ "list": [
1220
+ {
1221
+ "datasource": {
1222
+ "type": "elasticsearch",
1223
+ "uid": "wazuh_datasource_uid"
1224
+ },
1225
+ "filters": [],
1226
+ "hide": 0,
1227
+ "label": "",
1228
+ "name": "Filters",
1229
+ "skipUrlSync": false,
1230
+ "type": "adhoc"
1231
+ },
1232
+ {
1233
+ "current": {
1234
+ "selected": false,
1235
+ "text": "All",
1236
+ "value": "$__all"
1237
+ },
1238
+ "datasource": {
1239
+ "type": "elasticsearch",
1240
+ "uid": "wazuh_datasource_uid"
1241
+ },
1242
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event_22 OR rule_group3:dns OR rule_group1:dnsstat\"}",
1243
+ "hide": 0,
1244
+ "includeAll": true,
1245
+ "label": "Agent",
1246
+ "multi": false,
1247
+ "name": "agent_name",
1248
+ "options": [],
1249
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event_22 OR rule_group3:dns OR rule_group1:dnsstat\"}",
1250
+ "refresh": 2,
1251
+ "regex": "",
1252
+ "skipUrlSync": false,
1253
+ "sort": 2,
1254
+ "tagValuesQuery": "",
1255
+ "tagsQuery": "",
1256
+ "type": "query",
1257
+ "useTags": false
1258
+ }
1259
+ ]
1260
+ },
1261
+ "time": {
1262
+ "from": "now-6h",
1263
+ "to": "now"
1264
+ },
1265
+ "timepicker": {
1266
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1267
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1268
+ },
1269
+ "timezone": "",
1270
+ "title": "EDR - DNS REQUESTS",
1271
+ "uid": null,
1272
+ "version": 4,
1273
+ "weekStart": ""
1274
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_docker_monitoring.json
new
+2240
@@ -0,0 +1,2240 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "datasource": {
44
+ "type": "elasticsearch",
45
+ "uid": "wazuh_datasource_uid"
46
+ },
47
+ "fieldConfig": {
48
+ "defaults": {
49
+ "mappings": [
50
+ {
51
+ "options": {
52
+ "match": "null",
53
+ "result": {
54
+ "text": "N/A"
55
+ }
56
+ },
57
+ "type": "special"
58
+ }
59
+ ],
60
+ "thresholds": {
61
+ "mode": "absolute",
62
+ "steps": [
63
+ {
64
+ "color": "blue",
65
+ "value": null
66
+ }
67
+ ]
68
+ },
69
+ "unit": "none"
70
+ },
71
+ "overrides": []
72
+ },
73
+ "gridPos": {
74
+ "h": 5,
75
+ "w": 4,
76
+ "x": 0,
77
+ "y": 0
78
+ },
79
+ "id": 45,
80
+ "links": [],
81
+ "maxDataPoints": 100,
82
+ "options": {
83
+ "colorMode": "value",
84
+ "graphMode": "none",
85
+ "justifyMode": "auto",
86
+ "orientation": "horizontal",
87
+ "reduceOptions": {
88
+ "calcs": ["max"],
89
+ "fields": "",
90
+ "values": false
91
+ },
92
+ "text": {},
93
+ "textMode": "auto"
94
+ },
95
+ "pluginVersion": "9.0.6",
96
+ "targets": [
97
+ {
98
+ "bucketAggs": [
99
+ {
100
+ "$$hashKey": "object:235",
101
+ "field": "timestamp",
102
+ "id": "2",
103
+ "settings": {
104
+ "interval": "1y",
105
+ "min_doc_count": 0,
106
+ "trimEdges": 0
107
+ },
108
+ "type": "date_histogram"
109
+ }
110
+ ],
111
+ "datasource": {
112
+ "type": "elasticsearch",
113
+ "uid": "wazuh_datasource_uid"
114
+ },
115
+ "metrics": [
116
+ {
117
+ "$$hashKey": "object:233",
118
+ "field": "agent_name",
119
+ "id": "1",
120
+ "meta": {},
121
+ "settings": {},
122
+ "type": "cardinality"
123
+ }
124
+ ],
125
+ "query": "rule_group1:docker",
126
+ "refId": "A",
127
+ "timeField": "timestamp"
128
+ }
129
+ ],
130
+ "title": "DOCKER AGENTS",
131
+ "type": "stat"
132
+ },
133
+ {
134
+ "datasource": {
135
+ "type": "elasticsearch",
136
+ "uid": "wazuh_datasource_uid"
137
+ },
138
+ "fieldConfig": {
139
+ "defaults": {
140
+ "color": {
141
+ "mode": "palette-classic"
142
+ },
143
+ "custom": {
144
+ "axisLabel": "",
145
+ "axisPlacement": "auto",
146
+ "barAlignment": 0,
147
+ "drawStyle": "bars",
148
+ "fillOpacity": 0,
149
+ "gradientMode": "none",
150
+ "hideFrom": {
151
+ "legend": false,
152
+ "tooltip": false,
153
+ "viz": false
154
+ },
155
+ "lineInterpolation": "linear",
156
+ "lineWidth": 1,
157
+ "pointSize": 5,
158
+ "scaleDistribution": {
159
+ "type": "linear"
160
+ },
161
+ "showPoints": "auto",
162
+ "spanNulls": false,
163
+ "stacking": {
164
+ "group": "A",
165
+ "mode": "normal"
166
+ },
167
+ "thresholdsStyle": {
168
+ "mode": "off"
169
+ }
170
+ },
171
+ "mappings": [],
172
+ "thresholds": {
173
+ "mode": "absolute",
174
+ "steps": [
175
+ {
176
+ "color": "green",
177
+ "value": null
178
+ },
179
+ {
180
+ "color": "red",
181
+ "value": 80
182
+ }
183
+ ]
184
+ }
185
+ },
186
+ "overrides": []
187
+ },
188
+ "gridPos": {
189
+ "h": 11,
190
+ "w": 20,
191
+ "x": 4,
192
+ "y": 0
193
+ },
194
+ "id": 49,
195
+ "options": {
196
+ "legend": {
197
+ "calcs": [],
198
+ "displayMode": "table",
199
+ "placement": "right"
200
+ },
201
+ "tooltip": {
202
+ "mode": "single",
203
+ "sort": "none"
204
+ }
205
+ },
206
+ "targets": [
207
+ {
208
+ "alias": "",
209
+ "bucketAggs": [
210
+ {
211
+ "field": "agent_name",
212
+ "id": "3",
213
+ "settings": {
214
+ "min_doc_count": "1",
215
+ "order": "desc",
216
+ "orderBy": "_term",
217
+ "size": "10"
218
+ },
219
+ "type": "terms"
220
+ },
221
+ {
222
+ "field": "timestamp",
223
+ "id": "2",
224
+ "settings": {
225
+ "interval": "auto"
226
+ },
227
+ "type": "date_histogram"
228
+ }
229
+ ],
230
+ "datasource": {
231
+ "type": "elasticsearch",
232
+ "uid": "wazuh_datasource_uid"
233
+ },
234
+ "metrics": [
235
+ {
236
+ "id": "1",
237
+ "type": "count"
238
+ }
239
+ ],
240
+ "query": "agent_name:$agent_name AND rule_level:$rule_level AND rule_group1:docker",
241
+ "refId": "A",
242
+ "timeField": "timestamp"
243
+ }
244
+ ],
245
+ "title": "TOP 10 AGENTS - HISTOGRAM",
246
+ "transparent": true,
247
+ "type": "timeseries"
248
+ },
249
+ {
250
+ "datasource": {
251
+ "type": "elasticsearch",
252
+ "uid": "wazuh_datasource_uid"
253
+ },
254
+ "fieldConfig": {
255
+ "defaults": {
256
+ "mappings": [
257
+ {
258
+ "options": {
259
+ "match": "null",
260
+ "result": {
261
+ "text": "N/A"
262
+ }
263
+ },
264
+ "type": "special"
265
+ }
266
+ ],
267
+ "thresholds": {
268
+ "mode": "absolute",
269
+ "steps": [
270
+ {
271
+ "color": "blue",
272
+ "value": null
273
+ }
274
+ ]
275
+ },
276
+ "unit": "locale"
277
+ },
278
+ "overrides": []
279
+ },
280
+ "gridPos": {
281
+ "h": 6,
282
+ "w": 4,
283
+ "x": 0,
284
+ "y": 5
285
+ },
286
+ "id": 18,
287
+ "links": [],
288
+ "options": {
289
+ "colorMode": "value",
290
+ "graphMode": "none",
291
+ "justifyMode": "auto",
292
+ "orientation": "horizontal",
293
+ "reduceOptions": {
294
+ "calcs": ["sum"],
295
+ "fields": "",
296
+ "values": false
297
+ },
298
+ "text": {},
299
+ "textMode": "auto"
300
+ },
301
+ "pluginVersion": "9.0.6",
302
+ "targets": [
303
+ {
304
+ "bucketAggs": [
305
+ {
306
+ "$$hashKey": "object:331",
307
+ "field": "timestamp",
308
+ "id": "2",
309
+ "settings": {
310
+ "interval": "auto",
311
+ "min_doc_count": 0,
312
+ "trimEdges": 0
313
+ },
314
+ "type": "date_histogram"
315
+ }
316
+ ],
317
+ "datasource": {
318
+ "type": "elasticsearch",
319
+ "uid": "wazuh_datasource_uid"
320
+ },
321
+ "metrics": [
322
+ {
323
+ "$$hashKey": "object:329",
324
+ "field": "select field",
325
+ "id": "1",
326
+ "type": "count"
327
+ }
328
+ ],
329
+ "query": "agent_name:$agent_name AND rule_level:$rule_level AND rule_group1:docker",
330
+ "refId": "A",
331
+ "timeField": "timestamp"
332
+ }
333
+ ],
334
+ "title": "DOCKER EVENTS (TOTAL)",
335
+ "type": "stat"
336
+ },
337
+ {
338
+ "datasource": {
339
+ "type": "elasticsearch",
340
+ "uid": "wazuh_datasource_uid"
341
+ },
342
+ "fieldConfig": {
343
+ "defaults": {
344
+ "color": {
345
+ "mode": "palette-classic"
346
+ },
347
+ "custom": {
348
+ "hideFrom": {
349
+ "legend": false,
350
+ "tooltip": false,
351
+ "viz": false
352
+ }
353
+ },
354
+ "decimals": 0,
355
+ "mappings": [],
356
+ "unit": "short"
357
+ },
358
+ "overrides": [
359
+ {
360
+ "matcher": {
361
+ "id": "byName",
362
+ "options": "1"
363
+ },
364
+ "properties": [
365
+ {
366
+ "id": "color",
367
+ "value": {
368
+ "fixedColor": "#C8F2C2",
369
+ "mode": "fixed"
370
+ }
371
+ }
372
+ ]
373
+ },
374
+ {
375
+ "matcher": {
376
+ "id": "byName",
377
+ "options": "2"
378
+ },
379
+ "properties": [
380
+ {
381
+ "id": "color",
382
+ "value": {
383
+ "fixedColor": "#96D98D",
384
+ "mode": "fixed"
385
+ }
386
+ }
387
+ ]
388
+ },
389
+ {
390
+ "matcher": {
391
+ "id": "byName",
392
+ "options": "3"
393
+ },
394
+ "properties": [
395
+ {
396
+ "id": "color",
397
+ "value": {
398
+ "fixedColor": "#56A64B",
399
+ "mode": "fixed"
400
+ }
401
+ }
402
+ ]
403
+ },
404
+ {
405
+ "matcher": {
406
+ "id": "byName",
407
+ "options": "4"
408
+ },
409
+ "properties": [
410
+ {
411
+ "id": "color",
412
+ "value": {
413
+ "fixedColor": "#37872D",
414
+ "mode": "fixed"
415
+ }
416
+ }
417
+ ]
418
+ },
419
+ {
420
+ "matcher": {
421
+ "id": "byName",
422
+ "options": "5"
423
+ },
424
+ "properties": [
425
+ {
426
+ "id": "color",
427
+ "value": {
428
+ "fixedColor": "#FFF899",
429
+ "mode": "fixed"
430
+ }
431
+ }
432
+ ]
433
+ },
434
+ {
435
+ "matcher": {
436
+ "id": "byName",
437
+ "options": "7"
438
+ },
439
+ "properties": [
440
+ {
441
+ "id": "color",
442
+ "value": {
443
+ "fixedColor": "#F2CC0C",
444
+ "mode": "fixed"
445
+ }
446
+ }
447
+ ]
448
+ },
449
+ {
450
+ "matcher": {
451
+ "id": "byName",
452
+ "options": "9"
453
+ },
454
+ "properties": [
455
+ {
456
+ "id": "color",
457
+ "value": {
458
+ "fixedColor": "#FF9830",
459
+ "mode": "fixed"
460
+ }
461
+ }
462
+ ]
463
+ },
464
+ {
465
+ "matcher": {
466
+ "id": "byName",
467
+ "options": "10"
468
+ },
469
+ "properties": [
470
+ {
471
+ "id": "color",
472
+ "value": {
473
+ "fixedColor": "#FF9830",
474
+ "mode": "fixed"
475
+ }
476
+ }
477
+ ]
478
+ },
479
+ {
480
+ "matcher": {
481
+ "id": "byName",
482
+ "options": "12"
483
+ },
484
+ "properties": [
485
+ {
486
+ "id": "color",
487
+ "value": {
488
+ "fixedColor": "#F2495C",
489
+ "mode": "fixed"
490
+ }
491
+ }
492
+ ]
493
+ },
494
+ {
495
+ "matcher": {
496
+ "id": "byName",
497
+ "options": "13"
498
+ },
499
+ "properties": [
500
+ {
501
+ "id": "color",
502
+ "value": {
503
+ "fixedColor": "#FF7383",
504
+ "mode": "fixed"
505
+ }
506
+ }
507
+ ]
508
+ }
509
+ ]
510
+ },
511
+ "gridPos": {
512
+ "h": 12,
513
+ "w": 6,
514
+ "x": 0,
515
+ "y": 11
516
+ },
517
+ "id": 23,
518
+ "links": [],
519
+ "maxDataPoints": 3,
520
+ "options": {
521
+ "displayLabels": [],
522
+ "legend": {
523
+ "calcs": [],
524
+ "displayMode": "table",
525
+ "placement": "right",
526
+ "values": ["value", "percent"]
527
+ },
528
+ "pieType": "donut",
529
+ "reduceOptions": {
530
+ "calcs": ["sum"],
531
+ "fields": "",
532
+ "values": false
533
+ },
534
+ "text": {},
535
+ "tooltip": {
536
+ "mode": "single",
537
+ "sort": "none"
538
+ }
539
+ },
540
+ "targets": [
541
+ {
542
+ "bucketAggs": [
543
+ {
544
+ "$$hashKey": "object:235",
545
+ "fake": true,
546
+ "field": "rule_level",
547
+ "id": "3",
548
+ "settings": {
549
+ "min_doc_count": 1,
550
+ "order": "desc",
551
+ "orderBy": "_count",
552
+ "size": "10"
553
+ },
554
+ "type": "terms"
555
+ },
556
+ {
557
+ "$$hashKey": "object:236",
558
+ "field": "timestamp",
559
+ "id": "2",
560
+ "settings": {
561
+ "interval": "auto",
562
+ "min_doc_count": 0,
563
+ "trimEdges": 0
564
+ },
565
+ "type": "date_histogram"
566
+ }
567
+ ],
568
+ "datasource": {
569
+ "type": "elasticsearch",
570
+ "uid": "wazuh_datasource_uid"
571
+ },
572
+ "metrics": [
573
+ {
574
+ "$$hashKey": "object:233",
575
+ "field": "select field",
576
+ "id": "1",
577
+ "meta": {},
578
+ "settings": {},
579
+ "type": "count"
580
+ }
581
+ ],
582
+ "query": "agent_name:$agent_name AND rule_level:$rule_level AND rule_group1:docker",
583
+ "refId": "A",
584
+ "timeField": "timestamp"
585
+ }
586
+ ],
587
+ "title": "SECURITY EVENTS BY ALERT LEVEL",
588
+ "type": "piechart"
589
+ },
590
+ {
591
+ "datasource": {
592
+ "type": "elasticsearch",
593
+ "uid": "wazuh_datasource_uid"
594
+ },
595
+ "fieldConfig": {
596
+ "defaults": {
597
+ "color": {
598
+ "mode": "palette-classic"
599
+ },
600
+ "custom": {
601
+ "axisLabel": "",
602
+ "axisPlacement": "auto",
603
+ "barAlignment": 0,
604
+ "drawStyle": "bars",
605
+ "fillOpacity": 0,
606
+ "gradientMode": "none",
607
+ "hideFrom": {
608
+ "legend": false,
609
+ "tooltip": false,
610
+ "viz": false
611
+ },
612
+ "lineInterpolation": "linear",
613
+ "lineWidth": 1,
614
+ "pointSize": 5,
615
+ "scaleDistribution": {
616
+ "type": "linear"
617
+ },
618
+ "showPoints": "auto",
619
+ "spanNulls": false,
620
+ "stacking": {
621
+ "group": "A",
622
+ "mode": "normal"
623
+ },
624
+ "thresholdsStyle": {
625
+ "mode": "off"
626
+ }
627
+ },
628
+ "mappings": [],
629
+ "thresholds": {
630
+ "mode": "absolute",
631
+ "steps": [
632
+ {
633
+ "color": "green",
634
+ "value": null
635
+ },
636
+ {
637
+ "color": "red",
638
+ "value": 80
639
+ }
640
+ ]
641
+ }
642
+ },
643
+ "overrides": []
644
+ },
645
+ "gridPos": {
646
+ "h": 12,
647
+ "w": 18,
648
+ "x": 6,
649
+ "y": 11
650
+ },
651
+ "id": 50,
652
+ "options": {
653
+ "legend": {
654
+ "calcs": [],
655
+ "displayMode": "table",
656
+ "placement": "right"
657
+ },
658
+ "tooltip": {
659
+ "mode": "single",
660
+ "sort": "none"
661
+ }
662
+ },
663
+ "targets": [
664
+ {
665
+ "alias": "",
666
+ "bucketAggs": [
667
+ {
668
+ "field": "rule_level",
669
+ "id": "3",
670
+ "settings": {
671
+ "min_doc_count": "1",
672
+ "order": "desc",
673
+ "orderBy": "_count",
674
+ "size": "10"
675
+ },
676
+ "type": "terms"
677
+ },
678
+ {
679
+ "field": "timestamp",
680
+ "id": "2",
681
+ "settings": {
682
+ "interval": "auto"
683
+ },
684
+ "type": "date_histogram"
685
+ }
686
+ ],
687
+ "datasource": {
688
+ "type": "elasticsearch",
689
+ "uid": "wazuh_datasource_uid"
690
+ },
691
+ "metrics": [
692
+ {
693
+ "id": "1",
694
+ "type": "count"
695
+ }
696
+ ],
697
+ "query": "agent_name:$agent_name AND rule_level:$rule_level AND rule_group1:docker",
698
+ "refId": "A",
699
+ "timeField": "timestamp"
700
+ }
701
+ ],
702
+ "title": "EVENTS SEVERITY - HISTOGRAM",
703
+ "type": "timeseries"
704
+ },
705
+ {
706
+ "datasource": {
707
+ "type": "elasticsearch",
708
+ "uid": "wazuh_datasource_uid"
709
+ },
710
+ "fieldConfig": {
711
+ "defaults": {
712
+ "color": {
713
+ "mode": "thresholds"
714
+ },
715
+ "custom": {
716
+ "align": "auto",
717
+ "displayMode": "auto",
718
+ "inspect": false
719
+ },
720
+ "decimals": 2,
721
+ "displayName": "",
722
+ "mappings": [],
723
+ "thresholds": {
724
+ "mode": "absolute",
725
+ "steps": [
726
+ {
727
+ "color": "green",
728
+ "value": null
729
+ },
730
+ {
731
+ "color": "red",
732
+ "value": 80
733
+ }
734
+ ]
735
+ },
736
+ "unit": "short"
737
+ },
738
+ "overrides": [
739
+ {
740
+ "matcher": {
741
+ "id": "byName",
742
+ "options": "Time"
743
+ },
744
+ "properties": [
745
+ {
746
+ "id": "displayName",
747
+ "value": "Time"
748
+ },
749
+ {
750
+ "id": "unit",
751
+ "value": "time: YYYY-MM-DD HH:mm:ss"
752
+ },
753
+ {
754
+ "id": "custom.align"
755
+ }
756
+ ]
757
+ },
758
+ {
759
+ "matcher": {
760
+ "id": "byName",
761
+ "options": "Count"
762
+ },
763
+ "properties": [
764
+ {
765
+ "id": "displayName",
766
+ "value": "Events"
767
+ },
768
+ {
769
+ "id": "unit",
770
+ "value": "short"
771
+ },
772
+ {
773
+ "id": "decimals",
774
+ "value": -1
775
+ },
776
+ {
777
+ "id": "custom.align"
778
+ }
779
+ ]
780
+ },
781
+ {
782
+ "matcher": {
783
+ "id": "byName",
784
+ "options": "rule_groups"
785
+ },
786
+ "properties": [
787
+ {
788
+ "id": "displayName",
789
+ "value": "Rule Groups"
790
+ },
791
+ {
792
+ "id": "unit",
793
+ "value": "short"
794
+ },
795
+ {
796
+ "id": "decimals",
797
+ "value": 2
798
+ },
799
+ {
800
+ "id": "custom.align"
801
+ },
802
+ {
803
+ "id": "mappings",
804
+ "value": [
805
+ {
806
+ "options": {
807
+ "apache, web, modsecurity": {
808
+ "index": 7,
809
+ "text": "Apache ModSec"
810
+ },
811
+ "dnsstat, dnsstat_alert": {
812
+ "index": 47,
813
+ "text": "Domain Stats - Alert"
814
+ },
815
+ "dnsstat, dnsstat_error": {
816
+ "index": 41,
817
+ "text": "Domain Stats - Entry Not found in RDAP"
818
+ },
819
+ "docker, docker-error": {
820
+ "index": 43,
821
+ "text": "Docker Error"
822
+ },
823
+ "linux, docker, falco": {
824
+ "index": 56,
825
+ "text": "Linux Docker: Container Event"
826
+ },
827
+ "linux, packetbeat, dns": {
828
+ "index": 58,
829
+ "text": "Linux - DNS Request"
830
+ },
831
+ "linux, packetbeat, http": {
832
+ "index": 73,
833
+ "text": "Linux Packetbeat - HTTP Connection"
834
+ },
835
+ "linux, packetbeat, tls": {
836
+ "index": 72,
837
+ "text": "Linux Packetbeat - HTTPS Connection"
838
+ },
839
+ "linux, sysmon, sysmon_event1": {
840
+ "index": 3,
841
+ "text": "Linux Sysmon - Process Started"
842
+ },
843
+ "linux, sysmon, sysmon_event3": {
844
+ "index": 2,
845
+ "text": "Linux Sysmon - Network Connection"
846
+ },
847
+ "linux, sysmon, sysmon_event5": {
848
+ "index": 1,
849
+ "text": "Linux Sysmon - Process Terminated"
850
+ },
851
+ "linux, sysmon, sysmon_event9": {
852
+ "index": 46,
853
+ "text": "Linux Sysmon - RawAccessRead"
854
+ },
855
+ "linux, sysmon, sysmon_event_11": {
856
+ "index": 4,
857
+ "text": "Linux Sysmon - FileCreate"
858
+ },
859
+ "linux, sysmon, sysmon_event_16": {
860
+ "index": 6,
861
+ "text": "Linux Sysmon - Sysmon Config Changed"
862
+ },
863
+ "linux, sysmon, sysmon_event_23": {
864
+ "index": 5,
865
+ "text": "Linux Sysmon - File Removed"
866
+ },
867
+ "local, systemd": {
868
+ "index": 74,
869
+ "text": "Linux Systemd"
870
+ },
871
+ "openvpn, authentication_success": {
872
+ "index": 68,
873
+ "text": "OpenVPN Client - Auth Success"
874
+ },
875
+ "ossec": {
876
+ "index": 15,
877
+ "text": "OSSEC Event"
878
+ },
879
+ "ossec, rootcheck": {
880
+ "index": 19,
881
+ "text": "OSSEC - Rootcheck"
882
+ },
883
+ "ossec, syscheck, syscheck_entry_added, syscheck_file": {
884
+ "index": 9,
885
+ "text": "Syscheck - File Added"
886
+ },
887
+ "ossec, syscheck, syscheck_entry_added, syscheck_registry": {
888
+ "index": 39,
889
+ "text": "Syscheck - Windows Registry (Entry Added)"
890
+ },
891
+ "ossec, syscheck, syscheck_entry_deleted, syscheck_file": {
892
+ "index": 52,
893
+ "text": "Syscheck - File Deleted"
894
+ },
895
+ "ossec, syscheck, syscheck_entry_deleted, syscheck_registry": {
896
+ "index": 45,
897
+ "text": "Syscheck - Windows Registry (Entry Deleted)"
898
+ },
899
+ "ossec, syscheck, syscheck_entry_modified, syscheck_file": {
900
+ "index": 14,
901
+ "text": "Syscheck - File Modified"
902
+ },
903
+ "ossec, syscheck, syscheck_entry_modified, syscheck_registry": {
904
+ "index": 30,
905
+ "text": "Syscheck - Windows Registry (Entry Modified)"
906
+ },
907
+ "pam, syslog": {
908
+ "index": 18,
909
+ "text": "Linux PAM"
910
+ },
911
+ "pam, syslog, authentication_failed": {
912
+ "index": 67,
913
+ "text": "Linux PAM - Auth Failed"
914
+ },
915
+ "pam, syslog, authentication_success": {
916
+ "index": 12,
917
+ "text": "Linux PAM - Auth Success"
918
+ },
919
+ "sca": {
920
+ "index": 17,
921
+ "text": "Security Config Assessment"
922
+ },
923
+ "syslog, adduser": {
924
+ "index": 54,
925
+ "text": "Linux - User Added"
926
+ },
927
+ "syslog, dpkg": {
928
+ "index": 11,
929
+ "text": "Lunux dpkg"
930
+ },
931
+ "syslog, dpkg, config_changed": {
932
+ "index": 10,
933
+ "text": "Linux dpkg - Config Changed"
934
+ },
935
+ "syslog, errors, service_availability": {
936
+ "index": 75,
937
+ "text": "Linux Syslog - System Error"
938
+ },
939
+ "syslog, linuxkernel": {
940
+ "index": 57,
941
+ "text": "Linux - Kernel Event"
942
+ },
943
+ "syslog, linuxkernel, promisc": {
944
+ "index": 29,
945
+ "text": "Linux Kernel - Promisc. Interface"
946
+ },
947
+ "syslog, sshd, authentication_success": {
948
+ "index": 13,
949
+ "text": "SSH - Auth Success"
950
+ },
951
+ "syslog, sshd, recon": {
952
+ "index": 51,
953
+ "text": "Linux - SSH Daemon Alert"
954
+ },
955
+ "syslog, sudo": {
956
+ "index": 16,
957
+ "text": "Lunux - Sudo"
958
+ },
959
+ "threat_intel, alienvault, otx_alert": {
960
+ "index": 63,
961
+ "text": "Threat Intel - AlienVault OTX IoC Alert"
962
+ },
963
+ "threat_intel, misp, misp_alert": {
964
+ "index": 40,
965
+ "text": "Threat Intel - MISP IoC Alert"
966
+ },
967
+ "threat_intel, opencti, opencti_alert": {
968
+ "index": 62,
969
+ "text": "Threat Intel - OpenCTI IoC Alert"
970
+ },
971
+ "threat_intel, opencti, opencti_error": {
972
+ "index": 64,
973
+ "text": "Threat Intel - OpenCTI API Error"
974
+ },
975
+ "usb": {
976
+ "index": 69,
977
+ "text": "USB Port Event"
978
+ },
979
+ "vulnerability-detector": {
980
+ "index": 0,
981
+ "text": "Vulnerability Detector"
982
+ },
983
+ "vulnerability-detector, snyk": {
984
+ "index": 55,
985
+ "text": "Vulnerability Detector - Docker Images"
986
+ },
987
+ "wazuh, agent_flooding": {
988
+ "index": 33,
989
+ "text": "Wazuh Agent - Event Queue Flooding"
990
+ },
991
+ "windows, inventory": {
992
+ "index": 27,
993
+ "text": "Windows Agent Inventory"
994
+ },
995
+ "windows, sysmon, sysmon_event1, windows_sysmon_event1": {
996
+ "index": 48,
997
+ "text": "Windows Sysmon - Process Started"
998
+ },
999
+ "windows, sysmon, sysmon_event1, windows_sysmon_event1, sysmon_anomaly": {
1000
+ "index": 77,
1001
+ "text": "Windows Sysmon - Process Started Anomaly"
1002
+ },
1003
+ "windows, sysmon, sysmon_event2": {
1004
+ "index": 78,
1005
+ "text": "Windows Sysmon - A Process changed File Creation Time"
1006
+ },
1007
+ "windows, sysmon, sysmon_event3": {
1008
+ "index": 36,
1009
+ "text": "Windows Sysmon - Network Connection"
1010
+ },
1011
+ "windows, sysmon, sysmon_event3, sysmon_anomaly": {
1012
+ "index": 76,
1013
+ "text": "Windows Sysmon - Network Connection Anomaly"
1014
+ },
1015
+ "windows, sysmon, sysmon_event7": {
1016
+ "index": 25,
1017
+ "text": "Windows Sysmon - DLL SideLoading"
1018
+ },
1019
+ "windows, sysmon, sysmon_event_10": {
1020
+ "index": 32,
1021
+ "text": "Windows Sysmon - Process Injection"
1022
+ },
1023
+ "windows, sysmon, sysmon_event_11": {
1024
+ "index": 20,
1025
+ "text": "Windows Sysmon - FileCreate"
1026
+ },
1027
+ "windows, sysmon, sysmon_event_12": {
1028
+ "index": 23,
1029
+ "text": "Windows Sysmon - RegistryEvent (Object create and delete)"
1030
+ },
1031
+ "windows, sysmon, sysmon_event_13": {
1032
+ "index": 24,
1033
+ "text": "Windows Sysmon - RegistryEvent (ValueSet)"
1034
+ },
1035
+ "windows, sysmon, sysmon_event_15": {
1036
+ "index": 61,
1037
+ "text": "Windows Sysmon - FileCreateStreamHash"
1038
+ },
1039
+ "windows, sysmon, sysmon_event_17": {
1040
+ "index": 70,
1041
+ "text": "Windows Sysmon - Pipe Created"
1042
+ },
1043
+ "windows, sysmon, sysmon_event_22": {
1044
+ "index": 38,
1045
+ "text": "Windows Sysmon - DNS Request"
1046
+ },
1047
+ "windows, sysmon, sysmon_event_23": {
1048
+ "index": 28,
1049
+ "text": "Windows Sysmon - File Removed"
1050
+ },
1051
+ "windows, sysmon, sysmon_event_25": {
1052
+ "index": 71,
1053
+ "text": "Windows Sysmon - Process Tampering"
1054
+ },
1055
+ "windows, sysmon, sysmon_process-anomalies": {
1056
+ "index": 53,
1057
+ "text": "Windows Sysmon - Process Anomalies"
1058
+ },
1059
+ "windows, system_error": {
1060
+ "index": 49,
1061
+ "text": "Windows - System Error"
1062
+ },
1063
+ "windows, windows_application": {
1064
+ "index": 31,
1065
+ "text": "WinEvtLogs - Application"
1066
+ },
1067
+ "windows, windows_application, system_error": {
1068
+ "index": 59,
1069
+ "text": "WinEvtLogs - Application Error"
1070
+ },
1071
+ "windows, windows_autoruns": {
1072
+ "index": 37,
1073
+ "text": "Windows Persistent Footholds"
1074
+ },
1075
+ "windows, windows_defender": {
1076
+ "index": 35,
1077
+ "text": "Windows Defender"
1078
+ },
1079
+ "windows, windows_firewall, firewall": {
1080
+ "index": 60,
1081
+ "text": "Windows - Windows Firewall"
1082
+ },
1083
+ "windows, windows_logonsessions": {
1084
+ "index": 26,
1085
+ "text": "Windows Logon Sessions (Snapshot)"
1086
+ },
1087
+ "windows, windows_powershell": {
1088
+ "index": 50,
1089
+ "text": "Windows - PowerShell"
1090
+ },
1091
+ "windows, windows_security": {
1092
+ "index": 22,
1093
+ "text": "WinEvtLogs - Security"
1094
+ },
1095
+ "windows, windows_security, authentication_failed": {
1096
+ "index": 65,
1097
+ "text": "Windows - Failed Authentication"
1098
+ },
1099
+ "windows, windows_security, authentication_success": {
1100
+ "index": 21,
1101
+ "text": "Windows - Successful Auths"
1102
+ },
1103
+ "windows, windows_sigcheck": {
1104
+ "index": 42,
1105
+ "text": "Windows Exec Analysis"
1106
+ },
1107
+ "windows, windows_system": {
1108
+ "index": 44,
1109
+ "text": "WinEvtLogs - System"
1110
+ },
1111
+ "windows, windows_system, policy_changed": {
1112
+ "index": 34,
1113
+ "text": "Windows Group Policy"
1114
+ },
1115
+ "windows, windows_system, system_error": {
1116
+ "index": 66,
1117
+ "text": "Windows - System Error"
1118
+ },
1119
+ "yara": {
1120
+ "index": 8,
1121
+ "text": "Yara Malware Scanner"
1122
+ }
1123
+ },
1124
+ "type": "value"
1125
+ }
1126
+ ]
1127
+ },
1128
+ {
1129
+ "id": "links",
1130
+ "value": [
1131
+ {
1132
+ "targetBlank": true,
1133
+ "title": "VIEW EVENTS",
1134
+ "url": "https://grafana.company.local/explore?orgId=2&left=%5B%22now-1h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22rule_groups:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
1135
+ }
1136
+ ]
1137
+ }
1138
+ ]
1139
+ },
1140
+ {
1141
+ "matcher": {
1142
+ "id": "byName",
1143
+ "options": "Rule Groups"
1144
+ },
1145
+ "properties": [
1146
+ {
1147
+ "id": "custom.width",
1148
+ "value": 302
1149
+ }
1150
+ ]
1151
+ }
1152
+ ]
1153
+ },
1154
+ "gridPos": {
1155
+ "h": 14,
1156
+ "w": 6,
1157
+ "x": 0,
1158
+ "y": 23
1159
+ },
1160
+ "id": 24,
1161
+ "links": [],
1162
+ "options": {
1163
+ "footer": {
1164
+ "fields": "",
1165
+ "reducer": ["sum"],
1166
+ "show": false
1167
+ },
1168
+ "showHeader": true,
1169
+ "sortBy": []
1170
+ },
1171
+ "pluginVersion": "9.0.6",
1172
+ "targets": [
1173
+ {
1174
+ "bucketAggs": [
1175
+ {
1176
+ "$$hashKey": "object:332",
1177
+ "field": "data_docker_Action",
1178
+ "id": "2",
1179
+ "settings": {
1180
+ "min_doc_count": 1,
1181
+ "order": "desc",
1182
+ "orderBy": "_count",
1183
+ "size": "0"
1184
+ },
1185
+ "type": "terms"
1186
+ }
1187
+ ],
1188
+ "datasource": {
1189
+ "type": "elasticsearch",
1190
+ "uid": "wazuh_datasource_uid"
1191
+ },
1192
+ "metrics": [
1193
+ {
1194
+ "$$hashKey": "object:330",
1195
+ "field": "select field",
1196
+ "id": "1",
1197
+ "meta": {},
1198
+ "settings": {},
1199
+ "type": "count"
1200
+ }
1201
+ ],
1202
+ "query": "agent_name:$agent_name AND rule_level:$rule_level AND rule_group1:docker",
1203
+ "refId": "A",
1204
+ "timeField": "timestamp"
1205
+ }
1206
+ ],
1207
+ "title": "EVENTS BY CATEGORY GROUP",
1208
+ "transformations": [
1209
+ {
1210
+ "id": "organize",
1211
+ "options": {
1212
+ "excludeByName": {},
1213
+ "indexByName": {},
1214
+ "renameByName": {
1215
+ "data_docker_Action": "Docker Action"
1216
+ }
1217
+ }
1218
+ }
1219
+ ],
1220
+ "type": "table"
1221
+ },
1222
+ {
1223
+ "datasource": {
1224
+ "type": "elasticsearch",
1225
+ "uid": "wazuh_datasource_uid"
1226
+ },
1227
+ "fieldConfig": {
1228
+ "defaults": {
1229
+ "color": {
1230
+ "mode": "palette-classic"
1231
+ },
1232
+ "custom": {
1233
+ "axisLabel": "",
1234
+ "axisPlacement": "auto",
1235
+ "barAlignment": 0,
1236
+ "drawStyle": "bars",
1237
+ "fillOpacity": 0,
1238
+ "gradientMode": "none",
1239
+ "hideFrom": {
1240
+ "legend": false,
1241
+ "tooltip": false,
1242
+ "viz": false
1243
+ },
1244
+ "lineInterpolation": "linear",
1245
+ "lineWidth": 1,
1246
+ "pointSize": 5,
1247
+ "scaleDistribution": {
1248
+ "type": "linear"
1249
+ },
1250
+ "showPoints": "auto",
1251
+ "spanNulls": false,
1252
+ "stacking": {
1253
+ "group": "A",
1254
+ "mode": "normal"
1255
+ },
1256
+ "thresholdsStyle": {
1257
+ "mode": "off"
1258
+ }
1259
+ },
1260
+ "mappings": [],
1261
+ "thresholds": {
1262
+ "mode": "absolute",
1263
+ "steps": [
1264
+ {
1265
+ "color": "green",
1266
+ "value": null
1267
+ },
1268
+ {
1269
+ "color": "red",
1270
+ "value": 80
1271
+ }
1272
+ ]
1273
+ }
1274
+ },
1275
+ "overrides": []
1276
+ },
1277
+ "gridPos": {
1278
+ "h": 14,
1279
+ "w": 18,
1280
+ "x": 6,
1281
+ "y": 23
1282
+ },
1283
+ "id": 51,
1284
+ "options": {
1285
+ "legend": {
1286
+ "calcs": [],
1287
+ "displayMode": "table",
1288
+ "placement": "right"
1289
+ },
1290
+ "tooltip": {
1291
+ "mode": "single",
1292
+ "sort": "none"
1293
+ }
1294
+ },
1295
+ "targets": [
1296
+ {
1297
+ "alias": "",
1298
+ "bucketAggs": [
1299
+ {
1300
+ "field": "data_docker_Action",
1301
+ "id": "3",
1302
+ "settings": {
1303
+ "min_doc_count": "1",
1304
+ "order": "desc",
1305
+ "orderBy": "_count",
1306
+ "size": "10"
1307
+ },
1308
+ "type": "terms"
1309
+ },
1310
+ {
1311
+ "field": "timestamp",
1312
+ "id": "2",
1313
+ "settings": {
1314
+ "interval": "auto"
1315
+ },
1316
+ "type": "date_histogram"
1317
+ }
1318
+ ],
1319
+ "datasource": {
1320
+ "type": "elasticsearch",
1321
+ "uid": "wazuh_datasource_uid"
1322
+ },
1323
+ "metrics": [
1324
+ {
1325
+ "id": "1",
1326
+ "type": "count"
1327
+ }
1328
+ ],
1329
+ "query": "agent_name:$agent_name AND rule_level:$rule_level AND rule_group1:docker",
1330
+ "refId": "A",
1331
+ "timeField": "timestamp"
1332
+ }
1333
+ ],
1334
+ "title": "DOCKER EVENTS BY ACTION - HISTOGRAM",
1335
+ "transparent": true,
1336
+ "type": "timeseries"
1337
+ },
1338
+ {
1339
+ "datasource": {
1340
+ "type": "elasticsearch",
1341
+ "uid": "wazuh_datasource_uid"
1342
+ },
1343
+ "fieldConfig": {
1344
+ "defaults": {
1345
+ "color": {
1346
+ "mode": "thresholds"
1347
+ },
1348
+ "custom": {
1349
+ "align": "auto",
1350
+ "displayMode": "auto",
1351
+ "filterable": true,
1352
+ "inspect": false
1353
+ },
1354
+ "mappings": [],
1355
+ "thresholds": {
1356
+ "mode": "absolute",
1357
+ "steps": [
1358
+ {
1359
+ "color": "green",
1360
+ "value": null
1361
+ },
1362
+ {
1363
+ "color": "red",
1364
+ "value": 80
1365
+ }
1366
+ ]
1367
+ }
1368
+ },
1369
+ "overrides": [
1370
+ {
1371
+ "matcher": {
1372
+ "id": "byName",
1373
+ "options": "timestamp"
1374
+ },
1375
+ "properties": [
1376
+ {
1377
+ "id": "displayName",
1378
+ "value": "Date/Time"
1379
+ },
1380
+ {
1381
+ "id": "unit",
1382
+ "value": "time: YYYY-MM-DD HH:mm:ss"
1383
+ },
1384
+ {
1385
+ "id": "custom.align"
1386
+ }
1387
+ ]
1388
+ },
1389
+ {
1390
+ "matcher": {
1391
+ "id": "byName",
1392
+ "options": "agent_name"
1393
+ },
1394
+ "properties": [
1395
+ {
1396
+ "id": "displayName",
1397
+ "value": "AGENT"
1398
+ },
1399
+ {
1400
+ "id": "unit",
1401
+ "value": "short"
1402
+ },
1403
+ {
1404
+ "id": "decimals",
1405
+ "value": 2
1406
+ },
1407
+ {
1408
+ "id": "custom.align"
1409
+ }
1410
+ ]
1411
+ },
1412
+ {
1413
+ "matcher": {
1414
+ "id": "byName",
1415
+ "options": "agent_ip"
1416
+ },
1417
+ "properties": [
1418
+ {
1419
+ "id": "displayName",
1420
+ "value": "IP ADDRESS"
1421
+ },
1422
+ {
1423
+ "id": "unit",
1424
+ "value": "short"
1425
+ },
1426
+ {
1427
+ "id": "decimals",
1428
+ "value": 2
1429
+ },
1430
+ {
1431
+ "id": "custom.align"
1432
+ }
1433
+ ]
1434
+ },
1435
+ {
1436
+ "matcher": {
1437
+ "id": "byName",
1438
+ "options": "rule_level"
1439
+ },
1440
+ "properties": [
1441
+ {
1442
+ "id": "displayName",
1443
+ "value": "RULE LEVEL"
1444
+ },
1445
+ {
1446
+ "id": "unit",
1447
+ "value": "short"
1448
+ },
1449
+ {
1450
+ "id": "decimals",
1451
+ "value": -1
1452
+ },
1453
+ {
1454
+ "id": "custom.displayMode",
1455
+ "value": "color-background"
1456
+ },
1457
+ {
1458
+ "id": "custom.align"
1459
+ },
1460
+ {
1461
+ "id": "thresholds",
1462
+ "value": {
1463
+ "mode": "absolute",
1464
+ "steps": [
1465
+ {
1466
+ "color": "#37872D",
1467
+ "value": null
1468
+ },
1469
+ {
1470
+ "color": "rgba(237, 129, 40, 0.89)",
1471
+ "value": 7
1472
+ },
1473
+ {
1474
+ "color": "rgba(245, 54, 54, 0.9)",
1475
+ "value": 12
1476
+ }
1477
+ ]
1478
+ }
1479
+ }
1480
+ ]
1481
+ },
1482
+ {
1483
+ "matcher": {
1484
+ "id": "byName",
1485
+ "options": "rule_description"
1486
+ },
1487
+ "properties": [
1488
+ {
1489
+ "id": "displayName",
1490
+ "value": "RULE DESCRIPTION"
1491
+ },
1492
+ {
1493
+ "id": "unit",
1494
+ "value": "short"
1495
+ },
1496
+ {
1497
+ "id": "decimals",
1498
+ "value": 2
1499
+ },
1500
+ {
1501
+ "id": "custom.align"
1502
+ }
1503
+ ]
1504
+ },
1505
+ {
1506
+ "matcher": {
1507
+ "id": "byName",
1508
+ "options": "Date/Time"
1509
+ },
1510
+ "properties": [
1511
+ {
1512
+ "id": "custom.width",
1513
+ "value": 242
1514
+ }
1515
+ ]
1516
+ },
1517
+ {
1518
+ "matcher": {
1519
+ "id": "byName",
1520
+ "options": "AGENT"
1521
+ },
1522
+ "properties": [
1523
+ {
1524
+ "id": "custom.width",
1525
+ "value": 160
1526
+ }
1527
+ ]
1528
+ },
1529
+ {
1530
+ "matcher": {
1531
+ "id": "byName",
1532
+ "options": "MITRE TACTIC"
1533
+ },
1534
+ "properties": [
1535
+ {
1536
+ "id": "custom.width",
1537
+ "value": 332
1538
+ }
1539
+ ]
1540
+ },
1541
+ {
1542
+ "matcher": {
1543
+ "id": "byName",
1544
+ "options": "RULE LEVEL"
1545
+ },
1546
+ "properties": [
1547
+ {
1548
+ "id": "custom.width",
1549
+ "value": 122
1550
+ }
1551
+ ]
1552
+ },
1553
+ {
1554
+ "matcher": {
1555
+ "id": "byName",
1556
+ "options": "IP ADDRESS"
1557
+ },
1558
+ "properties": [
1559
+ {
1560
+ "id": "custom.width",
1561
+ "value": 163
1562
+ }
1563
+ ]
1564
+ },
1565
+ {
1566
+ "matcher": {
1567
+ "id": "byName",
1568
+ "options": "MITRE TECHNIQUE"
1569
+ },
1570
+ "properties": [
1571
+ {
1572
+ "id": "custom.width",
1573
+ "value": 312
1574
+ }
1575
+ ]
1576
+ },
1577
+ {
1578
+ "matcher": {
1579
+ "id": "byName",
1580
+ "options": "rule_id"
1581
+ },
1582
+ "properties": [
1583
+ {
1584
+ "id": "custom.width",
1585
+ "value": 96
1586
+ }
1587
+ ]
1588
+ },
1589
+ {
1590
+ "matcher": {
1591
+ "id": "byName",
1592
+ "options": "EVENT ID"
1593
+ },
1594
+ "properties": [
1595
+ {
1596
+ "id": "links",
1597
+ "value": [
1598
+ {
1599
+ "targetBlank": true,
1600
+ "title": "VIEW EVENT DETAILS",
1601
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D&orgId=1"
1602
+ }
1603
+ ]
1604
+ }
1605
+ ]
1606
+ }
1607
+ ]
1608
+ },
1609
+ "gridPos": {
1610
+ "h": 16,
1611
+ "w": 24,
1612
+ "x": 0,
1613
+ "y": 37
1614
+ },
1615
+ "id": 27,
1616
+ "options": {
1617
+ "footer": {
1618
+ "enablePagination": true,
1619
+ "fields": "",
1620
+ "reducer": ["sum"],
1621
+ "show": false
1622
+ },
1623
+ "showHeader": true,
1624
+ "sortBy": [
1625
+ {
1626
+ "desc": true,
1627
+ "displayName": "Date/Time"
1628
+ }
1629
+ ]
1630
+ },
1631
+ "pluginVersion": "9.0.6",
1632
+ "targets": [
1633
+ {
1634
+ "bucketAggs": [],
1635
+ "datasource": {
1636
+ "type": "elasticsearch",
1637
+ "uid": "wazuh_datasource_uid"
1638
+ },
1639
+ "metrics": [
1640
+ {
1641
+ "id": "1",
1642
+ "settings": {
1643
+ "size": "250"
1644
+ },
1645
+ "type": "raw_data"
1646
+ }
1647
+ ],
1648
+ "query": "agent_name:$agent_name AND rule_level:$rule_level AND rule_group1:docker",
1649
+ "refId": "A",
1650
+ "timeField": "timestamp"
1651
+ }
1652
+ ],
1653
+ "title": "DOCKER EVENTS",
1654
+ "transformations": [
1655
+ {
1656
+ "id": "merge",
1657
+ "options": {
1658
+ "reducers": []
1659
+ }
1660
+ },
1661
+ {
1662
+ "id": "filterFieldsByName",
1663
+ "options": {
1664
+ "include": {
1665
+ "names": [
1666
+ "timestamp",
1667
+ "_id",
1668
+ "agent_ip",
1669
+ "agent_name",
1670
+ "rule_description",
1671
+ "rule_id",
1672
+ "rule_level",
1673
+ "rule_mitre_tactic",
1674
+ "rule_mitre_technique",
1675
+ "data_docker_Action",
1676
+ "data_docker_Type"
1677
+ ]
1678
+ }
1679
+ }
1680
+ },
1681
+ {
1682
+ "id": "organize",
1683
+ "options": {
1684
+ "excludeByName": {
1685
+ "@metadata_beat": true,
1686
+ "@metadata_type": true,
1687
+ "@metadata_version": true,
1688
+ "IMPHASH": true,
1689
+ "MD5": true,
1690
+ "SHA1": true,
1691
+ "SHA256": true,
1692
+ "_id": false,
1693
+ "_index": true,
1694
+ "_type": true,
1695
+ "agent_ephemeral_id": true,
1696
+ "agent_hostname": true,
1697
+ "agent_id": true,
1698
+ "agent_ip_city_name": true,
1699
+ "agent_ip_country_code": true,
1700
+ "agent_ip_geolocation": true,
1701
+ "agent_name": false,
1702
+ "agent_type": true,
1703
+ "agent_version": true,
1704
+ "beats_type": true,
1705
+ "collector_node_id": true,
1706
+ "data_alert_action": true,
1707
+ "data_alert_category": true,
1708
+ "data_alert_gid": true,
1709
+ "data_alert_rev": true,
1710
+ "data_alert_severity": true,
1711
+ "data_alert_signature": true,
1712
+ "data_alert_signature_id": true,
1713
+ "data_app_proto": true,
1714
+ "data_audit_auid": true,
1715
+ "data_audit_command": true,
1716
+ "data_audit_euid": true,
1717
+ "data_audit_exe": true,
1718
+ "data_audit_gid": true,
1719
+ "data_audit_id": true,
1720
+ "data_audit_pid": true,
1721
+ "data_audit_res": true,
1722
+ "data_audit_session": true,
1723
+ "data_audit_type": true,
1724
+ "data_audit_uid": true,
1725
+ "data_dest_ip": true,
1726
+ "data_dest_port": true,
1727
+ "data_dstuser": true,
1728
+ "data_event_type": true,
1729
+ "data_extra_data": true,
1730
+ "data_file": true,
1731
+ "data_flow_bytes_toclient": true,
1732
+ "data_flow_bytes_toserver": true,
1733
+ "data_flow_id": true,
1734
+ "data_flow_pkts_toclient": true,
1735
+ "data_flow_pkts_toserver": true,
1736
+ "data_flow_start": true,
1737
+ "data_http_http_content_type": true,
1738
+ "data_http_http_port": true,
1739
+ "data_http_length": true,
1740
+ "data_http_status": true,
1741
+ "data_http_url": true,
1742
+ "data_id": true,
1743
+ "data_in_iface": true,
1744
+ "data_metadata_flowbits": true,
1745
+ "data_metadata_flowints_http_anomaly_count": true,
1746
+ "data_metadata_flowints_tcp_retransmission_count": true,
1747
+ "data_osquery_action": true,
1748
+ "data_osquery_calendarTime": true,
1749
+ "data_osquery_columns_address": true,
1750
+ "data_osquery_columns_address_city_name": true,
1751
+ "data_osquery_columns_address_country_code": true,
1752
+ "data_osquery_columns_address_geolocation": true,
1753
+ "data_osquery_columns_cmdline": true,
1754
+ "data_osquery_columns_cwd": true,
1755
+ "data_osquery_columns_description": true,
1756
+ "data_osquery_columns_directory": true,
1757
+ "data_osquery_columns_disk_bytes_read": true,
1758
+ "data_osquery_columns_disk_bytes_written": true,
1759
+ "data_osquery_columns_egid": true,
1760
+ "data_osquery_columns_euid": true,
1761
+ "data_osquery_columns_family": true,
1762
+ "data_osquery_columns_fd": true,
1763
+ "data_osquery_columns_gid": true,
1764
+ "data_osquery_columns_gid_signed": true,
1765
+ "data_osquery_columns_host": true,
1766
+ "data_osquery_columns_interface": true,
1767
+ "data_osquery_columns_local_address": true,
1768
+ "data_osquery_columns_local_address_city_name": true,
1769
+ "data_osquery_columns_local_address_country_code": true,
1770
+ "data_osquery_columns_local_address_geolocation": true,
1771
+ "data_osquery_columns_local_port": true,
1772
+ "data_osquery_columns_mac": true,
1773
+ "data_osquery_columns_name": true,
1774
+ "data_osquery_columns_net_namespace": true,
1775
+ "data_osquery_columns_nice": true,
1776
+ "data_osquery_columns_on_disk": true,
1777
+ "data_osquery_columns_parent": true,
1778
+ "data_osquery_columns_path": true,
1779
+ "data_osquery_columns_pgroup": true,
1780
+ "data_osquery_columns_pid": true,
1781
+ "data_osquery_columns_port": true,
1782
+ "data_osquery_columns_protocol": true,
1783
+ "data_osquery_columns_remote_address": true,
1784
+ "data_osquery_columns_remote_address_city_name": true,
1785
+ "data_osquery_columns_remote_address_country_code": true,
1786
+ "data_osquery_columns_remote_address_geolocation": true,
1787
+ "data_osquery_columns_remote_port": true,
1788
+ "data_osquery_columns_resident_size": true,
1789
+ "data_osquery_columns_root": true,
1790
+ "data_osquery_columns_sgid": true,
1791
+ "data_osquery_columns_shell": true,
1792
+ "data_osquery_columns_socket": true,
1793
+ "data_osquery_columns_start_time": true,
1794
+ "data_osquery_columns_state": true,
1795
+ "data_osquery_columns_suid": true,
1796
+ "data_osquery_columns_system_time": true,
1797
+ "data_osquery_columns_threads": true,
1798
+ "data_osquery_columns_time_utc": true,
1799
+ "data_osquery_columns_total_size": true,
1800
+ "data_osquery_columns_tty": true,
1801
+ "data_osquery_columns_type": true,
1802
+ "data_osquery_columns_uid": true,
1803
+ "data_osquery_columns_uid_signed": true,
1804
+ "data_osquery_columns_user": true,
1805
+ "data_osquery_columns_user_time": true,
1806
+ "data_osquery_columns_username": true,
1807
+ "data_osquery_columns_wired_size": true,
1808
+ "data_osquery_counter": true,
1809
+ "data_osquery_decorations_host_uuid": true,
1810
+ "data_osquery_decorations_hostname": true,
1811
+ "data_osquery_epoch": true,
1812
+ "data_osquery_hostIdentifier": true,
1813
+ "data_osquery_name": true,
1814
+ "data_osquery_numerics": true,
1815
+ "data_osquery_unixTime": true,
1816
+ "data_proto": true,
1817
+ "data_sca_check_command": true,
1818
+ "data_sca_check_compliance_cis": true,
1819
+ "data_sca_check_compliance_cis_csc": true,
1820
+ "data_sca_check_compliance_gdpr_IV": true,
1821
+ "data_sca_check_compliance_gpg_13": true,
1822
+ "data_sca_check_compliance_hipaa": true,
1823
+ "data_sca_check_compliance_nist_800_53": true,
1824
+ "data_sca_check_compliance_pci_dss": true,
1825
+ "data_sca_check_compliance_tsc": true,
1826
+ "data_sca_check_description": true,
1827
+ "data_sca_check_id": true,
1828
+ "data_sca_check_previous_result": true,
1829
+ "data_sca_check_rationale": true,
1830
+ "data_sca_check_remediation": true,
1831
+ "data_sca_check_result": true,
1832
+ "data_sca_check_title": true,
1833
+ "data_sca_description": true,
1834
+ "data_sca_failed": true,
1835
+ "data_sca_file": true,
1836
+ "data_sca_invalid": true,
1837
+ "data_sca_passed": true,
1838
+ "data_sca_policy": true,
1839
+ "data_sca_policy_id": true,
1840
+ "data_sca_scan_id": true,
1841
+ "data_sca_score": true,
1842
+ "data_sca_total_checks": true,
1843
+ "data_sca_type": true,
1844
+ "data_script": true,
1845
+ "data_src_ip": true,
1846
+ "data_src_ip_city_name": true,
1847
+ "data_src_ip_country_code": true,
1848
+ "data_src_ip_geolocation": true,
1849
+ "data_src_port": true,
1850
+ "data_srcip": true,
1851
+ "data_srcip_city_name": true,
1852
+ "data_srcip_country_code": true,
1853
+ "data_srcip_geolocation": true,
1854
+ "data_srcuser": true,
1855
+ "data_timestamp": true,
1856
+ "data_title": true,
1857
+ "data_tls_session_resumed": true,
1858
+ "data_tls_version": true,
1859
+ "data_tx_id": true,
1860
+ "data_type": true,
1861
+ "data_win_eventXML_binaryData": true,
1862
+ "data_win_eventXML_binaryDataSize": true,
1863
+ "data_win_eventXML_param1": true,
1864
+ "data_win_eventdata_authenticationPackageName": true,
1865
+ "data_win_eventdata_callTrace": true,
1866
+ "data_win_eventdata_commandLine": true,
1867
+ "data_win_eventdata_company": true,
1868
+ "data_win_eventdata_creationUtcTime": true,
1869
+ "data_win_eventdata_currentDirectory": true,
1870
+ "data_win_eventdata_description": true,
1871
+ "data_win_eventdata_destinationHostname": true,
1872
+ "data_win_eventdata_destinationIp": true,
1873
+ "data_win_eventdata_destinationIp_city_name": true,
1874
+ "data_win_eventdata_destinationIp_country_code": true,
1875
+ "data_win_eventdata_destinationIp_geolocation": true,
1876
+ "data_win_eventdata_destinationIsIpv6": true,
1877
+ "data_win_eventdata_destinationPort": true,
1878
+ "data_win_eventdata_destinationPortName": true,
1879
+ "data_win_eventdata_details": true,
1880
+ "data_win_eventdata_elevatedToken": true,
1881
+ "data_win_eventdata_eventType": true,
1882
+ "data_win_eventdata_fileVersion": true,
1883
+ "data_win_eventdata_fileVersion_city_name": true,
1884
+ "data_win_eventdata_fileVersion_country_code": true,
1885
+ "data_win_eventdata_fileVersion_geolocation": true,
1886
+ "data_win_eventdata_grantedAccess": true,
1887
+ "data_win_eventdata_hashes": true,
1888
+ "data_win_eventdata_image": true,
1889
+ "data_win_eventdata_imageLoaded": true,
1890
+ "data_win_eventdata_impersonationLevel": true,
1891
+ "data_win_eventdata_initiated": true,
1892
+ "data_win_eventdata_integrityLevel": true,
1893
+ "data_win_eventdata_ipAddress": true,
1894
+ "data_win_eventdata_ipPort": true,
1895
+ "data_win_eventdata_keyLength": true,
1896
+ "data_win_eventdata_logonGuid": true,
1897
+ "data_win_eventdata_logonId": true,
1898
+ "data_win_eventdata_logonProcessName": true,
1899
+ "data_win_eventdata_logonType": true,
1900
+ "data_win_eventdata_originalFileName": true,
1901
+ "data_win_eventdata_param1": true,
1902
+ "data_win_eventdata_param2": true,
1903
+ "data_win_eventdata_param3": true,
1904
+ "data_win_eventdata_param4": true,
1905
+ "data_win_eventdata_parentCommandLine": true,
1906
+ "data_win_eventdata_parentImage": true,
1907
+ "data_win_eventdata_parentProcessGuid": true,
1908
+ "data_win_eventdata_parentProcessId": true,
1909
+ "data_win_eventdata_processGuid": true,
1910
+ "data_win_eventdata_processId": true,
1911
+ "data_win_eventdata_processName": true,
1912
+ "data_win_eventdata_product": true,
1913
+ "data_win_eventdata_protocol": true,
1914
+ "data_win_eventdata_queryName": true,
1915
+ "data_win_eventdata_queryResults": true,
1916
+ "data_win_eventdata_queryStatus": true,
1917
+ "data_win_eventdata_ruleName": true,
1918
+ "data_win_eventdata_serviceName": true,
1919
+ "data_win_eventdata_serviceSid": true,
1920
+ "data_win_eventdata_signature": true,
1921
+ "data_win_eventdata_signatureStatus": true,
1922
+ "data_win_eventdata_signed": true,
1923
+ "data_win_eventdata_sourceHostname": true,
1924
+ "data_win_eventdata_sourceImage": true,
1925
+ "data_win_eventdata_sourceIp": true,
1926
+ "data_win_eventdata_sourceIp_city_name": true,
1927
+ "data_win_eventdata_sourceIp_country_code": true,
1928
+ "data_win_eventdata_sourceIp_geolocation": true,
1929
+ "data_win_eventdata_sourceIsIpv6": true,
1930
+ "data_win_eventdata_sourcePort": true,
1931
+ "data_win_eventdata_sourceProcessGUID": true,
1932
+ "data_win_eventdata_sourceProcessId": true,
1933
+ "data_win_eventdata_sourceThreadId": true,
1934
+ "data_win_eventdata_status": true,
1935
+ "data_win_eventdata_subjectDomainName": true,
1936
+ "data_win_eventdata_subjectLogonId": true,
1937
+ "data_win_eventdata_subjectUserName": true,
1938
+ "data_win_eventdata_subjectUserSid": true,
1939
+ "data_win_eventdata_targetDomainName": true,
1940
+ "data_win_eventdata_targetFilename": true,
1941
+ "data_win_eventdata_targetImage": true,
1942
+ "data_win_eventdata_targetLinkedLogonId": true,
1943
+ "data_win_eventdata_targetLogonId": true,
1944
+ "data_win_eventdata_targetObject": true,
1945
+ "data_win_eventdata_targetProcessGUID": true,
1946
+ "data_win_eventdata_targetProcessId": true,
1947
+ "data_win_eventdata_targetUserName": true,
1948
+ "data_win_eventdata_targetUserSid": true,
1949
+ "data_win_eventdata_terminalSessionId": true,
1950
+ "data_win_eventdata_ticketEncryptionType": true,
1951
+ "data_win_eventdata_ticketOptions": true,
1952
+ "data_win_eventdata_user": true,
1953
+ "data_win_eventdata_utcTime": true,
1954
+ "data_win_eventdata_virtualAccount": true,
1955
+ "data_win_system_channel": true,
1956
+ "data_win_system_computer": true,
1957
+ "data_win_system_eventID": true,
1958
+ "data_win_system_eventRecordID": true,
1959
+ "data_win_system_eventSourceName": true,
1960
+ "data_win_system_keywords": true,
1961
+ "data_win_system_level": true,
1962
+ "data_win_system_message": true,
1963
+ "data_win_system_opcode": true,
1964
+ "data_win_system_processID": true,
1965
+ "data_win_system_providerGuid": true,
1966
+ "data_win_system_providerName": true,
1967
+ "data_win_system_severityValue": true,
1968
+ "data_win_system_systemTime": true,
1969
+ "data_win_system_task": true,
1970
+ "data_win_system_threadID": true,
1971
+ "data_win_system_version": true,
1972
+ "decoder_name": true,
1973
+ "decoder_parent": true,
1974
+ "dns_query": true,
1975
+ "dns_query_threat_indicated": true,
1976
+ "dst_ip": true,
1977
+ "dst_ip_city_name": true,
1978
+ "dst_ip_country_code": true,
1979
+ "dst_ip_geolocation": true,
1980
+ "dst_ip_threat_indicated": true,
1981
+ "dst_port": true,
1982
+ "ecs_version": true,
1983
+ "error": true,
1984
+ "event_hash": true,
1985
+ "file_path": true,
1986
+ "firewall_rule_name": true,
1987
+ "full_log": false,
1988
+ "gl2_accounted_message_size": true,
1989
+ "gl2_message_id": true,
1990
+ "gl2_remote_ip": true,
1991
+ "gl2_remote_port": true,
1992
+ "gl2_source_collector": true,
1993
+ "gl2_source_input": true,
1994
+ "gl2_source_node": true,
1995
+ "hash_md5": true,
1996
+ "hash_sha1": true,
1997
+ "hash_sha256": true,
1998
+ "highlight": true,
1999
+ "host_architecture": true,
2000
+ "host_containerized": true,
2001
+ "host_hostname": true,
2002
+ "host_id": true,
2003
+ "host_ip": true,
2004
+ "host_mac": true,
2005
+ "host_name": true,
2006
+ "host_os_codename": true,
2007
+ "host_os_kernel": true,
2008
+ "host_os_name": true,
2009
+ "host_os_platform": true,
2010
+ "host_os_version": true,
2011
+ "hostname": true,
2012
+ "id": true,
2013
+ "input_type": true,
2014
+ "level": true,
2015
+ "location": true,
2016
+ "log_file_path": true,
2017
+ "log_offset": true,
2018
+ "manager_name": true,
2019
+ "message": true,
2020
+ "module": true,
2021
+ "parent_process_cmd_line": true,
2022
+ "parent_process_id": true,
2023
+ "parent_process_image": true,
2024
+ "pid": true,
2025
+ "predecoder_hostname": true,
2026
+ "predecoder_program_name": true,
2027
+ "predecoder_timestamp": true,
2028
+ "previous_log": true,
2029
+ "previous_output": true,
2030
+ "process_cmd_line": true,
2031
+ "process_id": true,
2032
+ "process_image": true,
2033
+ "process_name": true,
2034
+ "protocol": true,
2035
+ "rule_cis": true,
2036
+ "rule_cis_csc": true,
2037
+ "rule_firedtimes": true,
2038
+ "rule_gdpr": true,
2039
+ "rule_gdpr_IV": true,
2040
+ "rule_gpg13": true,
2041
+ "rule_gpg_13": true,
2042
+ "rule_groups": true,
2043
+ "rule_hipaa": true,
2044
+ "rule_id": false,
2045
+ "rule_info": true,
2046
+ "rule_mail": true,
2047
+ "rule_mitre_id": true,
2048
+ "rule_mitre_tactic": false,
2049
+ "rule_nist_800_53": true,
2050
+ "rule_pci_dss": true,
2051
+ "rule_tsc": true,
2052
+ "scanid": true,
2053
+ "service": true,
2054
+ "software_package": true,
2055
+ "software_vendor": true,
2056
+ "sort": true,
2057
+ "source": true,
2058
+ "src_ip": true,
2059
+ "src_ip_city_name": true,
2060
+ "src_ip_country_code": true,
2061
+ "src_ip_geolocation": true,
2062
+ "src_port": true,
2063
+ "streams": true,
2064
+ "syscheck_attrs_after": true,
2065
+ "syscheck_audit_effective_user_id": true,
2066
+ "syscheck_audit_effective_user_name": true,
2067
+ "syscheck_audit_group_id": true,
2068
+ "syscheck_audit_group_name": true,
2069
+ "syscheck_audit_login_user_id": true,
2070
+ "syscheck_audit_login_user_name": true,
2071
+ "syscheck_audit_process_cwd": true,
2072
+ "syscheck_audit_process_id": true,
2073
+ "syscheck_audit_process_name": true,
2074
+ "syscheck_audit_process_parent_cwd": true,
2075
+ "syscheck_audit_process_parent_name": true,
2076
+ "syscheck_audit_process_ppid": true,
2077
+ "syscheck_audit_user_id": true,
2078
+ "syscheck_audit_user_name": true,
2079
+ "syscheck_changed_attributes": true,
2080
+ "syscheck_event": true,
2081
+ "syscheck_gid_after": true,
2082
+ "syscheck_gname_after": true,
2083
+ "syscheck_hard_links": true,
2084
+ "syscheck_inode_after": true,
2085
+ "syscheck_inode_before": true,
2086
+ "syscheck_md5_after": true,
2087
+ "syscheck_md5_before": true,
2088
+ "syscheck_mode": true,
2089
+ "syscheck_mtime_after": true,
2090
+ "syscheck_mtime_before": true,
2091
+ "syscheck_path": true,
2092
+ "syscheck_perm_after": true,
2093
+ "syscheck_perm_before": true,
2094
+ "syscheck_sha1_after": true,
2095
+ "syscheck_sha1_before": true,
2096
+ "syscheck_sha256_after": true,
2097
+ "syscheck_sha256_before": true,
2098
+ "syscheck_size_after": true,
2099
+ "syscheck_size_before": true,
2100
+ "syscheck_uid_after": true,
2101
+ "syscheck_uname_after": true,
2102
+ "syscheck_win_perm_after": true,
2103
+ "syscheck_win_perm_after_0_allowed": true,
2104
+ "syscheck_win_perm_after_0_name": true,
2105
+ "syscheck_win_perm_after_1_allowed": true,
2106
+ "syscheck_win_perm_after_1_name": true,
2107
+ "syscheck_win_perm_after_2_allowed": true,
2108
+ "syscheck_win_perm_after_2_name": true,
2109
+ "syscheck_win_perm_after_3_allowed": true,
2110
+ "syscheck_win_perm_after_3_name": true,
2111
+ "syslog_customer": true,
2112
+ "syslog_tag": true,
2113
+ "syslog_type": true,
2114
+ "sysmon_event_description": true,
2115
+ "threat_ids": true,
2116
+ "threat_indicated": true,
2117
+ "threat_names": true,
2118
+ "time": true,
2119
+ "timestamp": false,
2120
+ "user_name": true,
2121
+ "win_registry_key": true,
2122
+ "win_system_eventID": true,
2123
+ "windows_auth_package": true,
2124
+ "windows_domain": true,
2125
+ "windows_event_id": true,
2126
+ "windows_event_severity": true,
2127
+ "windows_logon_type": true
2128
+ },
2129
+ "indexByName": {
2130
+ "_id": 1,
2131
+ "agent_ip": 3,
2132
+ "agent_name": 2,
2133
+ "data_docker_Action": 4,
2134
+ "data_docker_Type": 5,
2135
+ "rule_description": 6,
2136
+ "rule_id": 8,
2137
+ "rule_level": 7,
2138
+ "rule_mitre_tactic": 9,
2139
+ "rule_mitre_technique": 10,
2140
+ "timestamp": 0
2141
+ },
2142
+ "renameByName": {
2143
+ "_id": "EVENT ID",
2144
+ "data_docker_Action": "Docker Action",
2145
+ "data_docker_Type": "Docker Type",
2146
+ "rule_id": "RULE ID",
2147
+ "rule_mitre_tactic": "MITRE TACTIC",
2148
+ "rule_mitre_technique": "MITRE TECHNIQUE",
2149
+ "timestamp": ""
2150
+ }
2151
+ }
2152
+ }
2153
+ ],
2154
+ "transparent": true,
2155
+ "type": "table"
2156
+ }
2157
+ ],
2158
+ "refresh": false,
2159
+ "schemaVersion": 36,
2160
+ "style": "dark",
2161
+ "tags": ["EDR"],
2162
+ "templating": {
2163
+ "list": [
2164
+ {
2165
+ "datasource": {
2166
+ "type": "elasticsearch",
2167
+ "uid": "wazuh_datasource_uid"
2168
+ },
2169
+ "filters": [],
2170
+ "hide": 0,
2171
+ "label": "",
2172
+ "name": "Filters",
2173
+ "skipUrlSync": false,
2174
+ "type": "adhoc"
2175
+ },
2176
+ {
2177
+ "current": {
2178
+ "selected": false,
2179
+ "text": "All",
2180
+ "value": "$__all"
2181
+ },
2182
+ "datasource": {
2183
+ "type": "elasticsearch",
2184
+ "uid": "wazuh_datasource_uid"
2185
+ },
2186
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group1:docker\"}",
2187
+ "hide": 0,
2188
+ "includeAll": true,
2189
+ "label": "Agent",
2190
+ "multi": false,
2191
+ "name": "agent_name",
2192
+ "options": [],
2193
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group1:docker\"}",
2194
+ "refresh": 2,
2195
+ "regex": "",
2196
+ "skipUrlSync": false,
2197
+ "sort": 2,
2198
+ "tagValuesQuery": "",
2199
+ "tagsQuery": "",
2200
+ "type": "query",
2201
+ "useTags": false
2202
+ },
2203
+ {
2204
+ "current": {
2205
+ "selected": false,
2206
+ "text": "All",
2207
+ "value": "$__all"
2208
+ },
2209
+ "datasource": {
2210
+ "type": "elasticsearch",
2211
+ "uid": "wazuh_datasource_uid"
2212
+ },
2213
+ "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"rule_group1:docker\"}",
2214
+ "hide": 0,
2215
+ "includeAll": true,
2216
+ "label": "Rule Level",
2217
+ "multi": false,
2218
+ "name": "rule_level",
2219
+ "options": [],
2220
+ "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"rule_group1:docker\"}",
2221
+ "refresh": 2,
2222
+ "regex": "",
2223
+ "skipUrlSync": false,
2224
+ "sort": 0,
2225
+ "type": "query"
2226
+ }
2227
+ ]
2228
+ },
2229
+ "time": {
2230
+ "from": "now-24h",
2231
+ "to": "now"
2232
+ },
2233
+ "timepicker": {
2234
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2235
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2236
+ },
2237
+ "timezone": "",
2238
+ "title": "EDR - DOCKER MONITORING",
2239
+ "weekStart": ""
2240
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_fim.json
new
+6239
@@ -0,0 +1,6239 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "collapsed": false,
44
+ "datasource": {
45
+ "type": "datasource",
46
+ "uid": "grafana"
47
+ },
48
+ "gridPos": {
49
+ "h": 1,
50
+ "w": 24,
51
+ "x": 0,
52
+ "y": 0
53
+ },
54
+ "id": 72,
55
+ "panels": [],
56
+ "title": "SUMMARY",
57
+ "type": "row"
58
+ },
59
+ {
60
+ "datasource": {
61
+ "type": "elasticsearch",
62
+ "uid": "wazuh_datasource_uid"
63
+ },
64
+ "fieldConfig": {
65
+ "defaults": {
66
+ "mappings": [
67
+ {
68
+ "options": {
69
+ "match": "null",
70
+ "result": {
71
+ "text": "N/A"
72
+ }
73
+ },
74
+ "type": "special"
75
+ }
76
+ ],
77
+ "thresholds": {
78
+ "mode": "absolute",
79
+ "steps": [
80
+ {
81
+ "color": "orange",
82
+ "value": null
83
+ }
84
+ ]
85
+ },
86
+ "unit": "short"
87
+ },
88
+ "overrides": []
89
+ },
90
+ "gridPos": {
91
+ "h": 8,
92
+ "w": 4,
93
+ "x": 0,
94
+ "y": 1
95
+ },
96
+ "id": 137,
97
+ "links": [],
98
+ "options": {
99
+ "colorMode": "value",
100
+ "graphMode": "area",
101
+ "justifyMode": "auto",
102
+ "orientation": "horizontal",
103
+ "reduceOptions": {
104
+ "calcs": ["sum"],
105
+ "fields": "",
106
+ "values": false
107
+ },
108
+ "text": {},
109
+ "textMode": "auto"
110
+ },
111
+ "pluginVersion": "10.0.2",
112
+ "targets": [
113
+ {
114
+ "bucketAggs": [
115
+ {
116
+ "$$hashKey": "object:50",
117
+ "field": "timestamp",
118
+ "id": "2",
119
+ "settings": {
120
+ "interval": "auto",
121
+ "min_doc_count": 0,
122
+ "trimEdges": 0
123
+ },
124
+ "type": "date_histogram"
125
+ }
126
+ ],
127
+ "datasource": {
128
+ "type": "elasticsearch",
129
+ "uid": "wazuh_datasource_uid"
130
+ },
131
+ "metrics": [
132
+ {
133
+ "$$hashKey": "object:48",
134
+ "field": "select field",
135
+ "id": "1",
136
+ "type": "count"
137
+ }
138
+ ],
139
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level AND _exists_:threat_intel_type",
140
+ "refId": "A",
141
+ "timeField": "timestamp"
142
+ }
143
+ ],
144
+ "title": "FIM - IoCs",
145
+ "type": "stat"
146
+ },
147
+ {
148
+ "datasource": {
149
+ "type": "elasticsearch",
150
+ "uid": "wazuh_datasource_uid"
151
+ },
152
+ "fieldConfig": {
153
+ "defaults": {
154
+ "custom": {
155
+ "align": "auto",
156
+ "cellOptions": {
157
+ "type": "auto"
158
+ },
159
+ "filterable": false,
160
+ "inspect": false
161
+ },
162
+ "mappings": [],
163
+ "thresholds": {
164
+ "mode": "absolute",
165
+ "steps": [
166
+ {
167
+ "color": "blue",
168
+ "value": null
169
+ },
170
+ {
171
+ "color": "red",
172
+ "value": 50
173
+ }
174
+ ]
175
+ }
176
+ },
177
+ "overrides": [
178
+ {
179
+ "matcher": {
180
+ "id": "byName",
181
+ "options": "Count"
182
+ },
183
+ "properties": [
184
+ {
185
+ "id": "custom.cellOptions",
186
+ "value": {
187
+ "mode": "basic",
188
+ "type": "gauge"
189
+ }
190
+ }
191
+ ]
192
+ },
193
+ {
194
+ "matcher": {
195
+ "id": "byName",
196
+ "options": "rule_description"
197
+ },
198
+ "properties": [
199
+ {
200
+ "id": "custom.width",
201
+ "value": 703
202
+ }
203
+ ]
204
+ },
205
+ {
206
+ "matcher": {
207
+ "id": "byName",
208
+ "options": "rule_level"
209
+ },
210
+ "properties": [
211
+ {
212
+ "id": "custom.width",
213
+ "value": 212
214
+ },
215
+ {
216
+ "id": "mappings",
217
+ "value": [
218
+ {
219
+ "options": {
220
+ "from": 1,
221
+ "result": {
222
+ "color": "green",
223
+ "index": 0
224
+ },
225
+ "to": 3
226
+ },
227
+ "type": "range"
228
+ },
229
+ {
230
+ "options": {
231
+ "from": 4,
232
+ "result": {
233
+ "color": "dark-yellow",
234
+ "index": 1
235
+ },
236
+ "to": 6
237
+ },
238
+ "type": "range"
239
+ },
240
+ {
241
+ "options": {
242
+ "from": 7,
243
+ "result": {
244
+ "color": "orange",
245
+ "index": 2
246
+ },
247
+ "to": 9
248
+ },
249
+ "type": "range"
250
+ },
251
+ {
252
+ "options": {
253
+ "from": 10,
254
+ "result": {
255
+ "color": "semi-dark-red",
256
+ "index": 3
257
+ },
258
+ "to": 15
259
+ },
260
+ "type": "range"
261
+ }
262
+ ]
263
+ }
264
+ ]
265
+ },
266
+ {
267
+ "matcher": {
268
+ "id": "byName",
269
+ "options": "RULE GROUPS"
270
+ },
271
+ "properties": [
272
+ {
273
+ "id": "custom.width",
274
+ "value": 441
275
+ }
276
+ ]
277
+ },
278
+ {
279
+ "matcher": {
280
+ "id": "byName",
281
+ "options": "LEVEL"
282
+ },
283
+ "properties": [
284
+ {
285
+ "id": "custom.width",
286
+ "value": 171
287
+ }
288
+ ]
289
+ },
290
+ {
291
+ "matcher": {
292
+ "id": "byName",
293
+ "options": "IoC"
294
+ },
295
+ "properties": [
296
+ {
297
+ "id": "links",
298
+ "value": [
299
+ {
300
+ "targetBlank": true,
301
+ "title": "VIRUS TOTAL",
302
+ "url": "https://www.virustotal.com/gui/file/${__value.text}/detection"
303
+ }
304
+ ]
305
+ }
306
+ ]
307
+ }
308
+ ]
309
+ },
310
+ "gridPos": {
311
+ "h": 8,
312
+ "w": 20,
313
+ "x": 4,
314
+ "y": 1
315
+ },
316
+ "id": 138,
317
+ "links": [],
318
+ "maxDataPoints": 3,
319
+ "options": {
320
+ "cellHeight": "sm",
321
+ "footer": {
322
+ "countRows": false,
323
+ "fields": "",
324
+ "reducer": ["sum"],
325
+ "show": false
326
+ },
327
+ "showHeader": true,
328
+ "sortBy": []
329
+ },
330
+ "pluginVersion": "10.0.2",
331
+ "targets": [
332
+ {
333
+ "bucketAggs": [
334
+ {
335
+ "$$hashKey": "object:3082",
336
+ "fake": true,
337
+ "field": "rule_groups",
338
+ "id": "4",
339
+ "settings": {
340
+ "min_doc_count": 0,
341
+ "order": "desc",
342
+ "orderBy": "_count",
343
+ "size": "10"
344
+ },
345
+ "type": "terms"
346
+ },
347
+ {
348
+ "$$hashKey": "object:73",
349
+ "fake": true,
350
+ "field": "syslog_level",
351
+ "id": "3",
352
+ "settings": {
353
+ "min_doc_count": 1,
354
+ "order": "desc",
355
+ "orderBy": "_count",
356
+ "size": "0"
357
+ },
358
+ "type": "terms"
359
+ },
360
+ {
361
+ "field": "misp_value",
362
+ "id": "5",
363
+ "settings": {
364
+ "min_doc_count": "1",
365
+ "order": "desc",
366
+ "orderBy": "_term",
367
+ "size": "10"
368
+ },
369
+ "type": "terms"
370
+ }
371
+ ],
372
+ "datasource": {
373
+ "type": "elasticsearch",
374
+ "uid": "wazuh_datasource_uid"
375
+ },
376
+ "metrics": [
377
+ {
378
+ "$$hashKey": "object:71",
379
+ "field": "select field",
380
+ "id": "1",
381
+ "type": "count"
382
+ }
383
+ ],
384
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level AND _exists_:threat_intel_type",
385
+ "refId": "A",
386
+ "timeField": "timestamp"
387
+ }
388
+ ],
389
+ "title": "IoCs BY TYPE AND SEVERITY",
390
+ "transformations": [
391
+ {
392
+ "id": "organize",
393
+ "options": {
394
+ "excludeByName": {},
395
+ "indexByName": {},
396
+ "renameByName": {
397
+ "misp_value": "IoC",
398
+ "rule_groups": "RULE GROUPS",
399
+ "rule_level": "RULE LEVEL",
400
+ "syslog_level": "LEVEL"
401
+ }
402
+ }
403
+ }
404
+ ],
405
+ "type": "table"
406
+ },
407
+ {
408
+ "datasource": {
409
+ "type": "elasticsearch",
410
+ "uid": "wazuh_datasource_uid"
411
+ },
412
+ "fieldConfig": {
413
+ "defaults": {
414
+ "mappings": [
415
+ {
416
+ "options": {
417
+ "match": "null",
418
+ "result": {
419
+ "text": "N/A"
420
+ }
421
+ },
422
+ "type": "special"
423
+ }
424
+ ],
425
+ "thresholds": {
426
+ "mode": "absolute",
427
+ "steps": [
428
+ {
429
+ "color": "blue",
430
+ "value": null
431
+ }
432
+ ]
433
+ },
434
+ "unit": "short"
435
+ },
436
+ "overrides": []
437
+ },
438
+ "gridPos": {
439
+ "h": 8,
440
+ "w": 4,
441
+ "x": 0,
442
+ "y": 9
443
+ },
444
+ "id": 113,
445
+ "links": [],
446
+ "options": {
447
+ "colorMode": "value",
448
+ "graphMode": "area",
449
+ "justifyMode": "auto",
450
+ "orientation": "horizontal",
451
+ "reduceOptions": {
452
+ "calcs": ["sum"],
453
+ "fields": "",
454
+ "values": false
455
+ },
456
+ "text": {},
457
+ "textMode": "auto"
458
+ },
459
+ "pluginVersion": "10.0.2",
460
+ "targets": [
461
+ {
462
+ "bucketAggs": [
463
+ {
464
+ "$$hashKey": "object:50",
465
+ "field": "timestamp",
466
+ "id": "2",
467
+ "settings": {
468
+ "interval": "auto",
469
+ "min_doc_count": 0,
470
+ "trimEdges": 0
471
+ },
472
+ "type": "date_histogram"
473
+ }
474
+ ],
475
+ "datasource": {
476
+ "type": "elasticsearch",
477
+ "uid": "wazuh_datasource_uid"
478
+ },
479
+ "metrics": [
480
+ {
481
+ "$$hashKey": "object:48",
482
+ "field": "select field",
483
+ "id": "1",
484
+ "type": "count"
485
+ }
486
+ ],
487
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level",
488
+ "refId": "A",
489
+ "timeField": "timestamp"
490
+ }
491
+ ],
492
+ "title": "FIM - EVENTS",
493
+ "type": "stat"
494
+ },
495
+ {
496
+ "datasource": {
497
+ "type": "elasticsearch",
498
+ "uid": "wazuh_datasource_uid"
499
+ },
500
+ "fieldConfig": {
501
+ "defaults": {
502
+ "color": {
503
+ "mode": "palette-classic"
504
+ },
505
+ "custom": {
506
+ "hideFrom": {
507
+ "legend": false,
508
+ "tooltip": false,
509
+ "viz": false
510
+ }
511
+ },
512
+ "decimals": 0,
513
+ "mappings": [],
514
+ "unit": "short"
515
+ },
516
+ "overrides": [
517
+ {
518
+ "matcher": {
519
+ "id": "byName",
520
+ "options": "1"
521
+ },
522
+ "properties": [
523
+ {
524
+ "id": "color",
525
+ "value": {
526
+ "fixedColor": "#FF9830",
527
+ "mode": "fixed"
528
+ }
529
+ }
530
+ ]
531
+ },
532
+ {
533
+ "matcher": {
534
+ "id": "byName",
535
+ "options": "Alert"
536
+ },
537
+ "properties": [
538
+ {
539
+ "id": "color",
540
+ "value": {
541
+ "fixedColor": "#F2495C",
542
+ "mode": "fixed"
543
+ }
544
+ }
545
+ ]
546
+ },
547
+ {
548
+ "matcher": {
549
+ "id": "byName",
550
+ "options": "Error"
551
+ },
552
+ "properties": [
553
+ {
554
+ "id": "color",
555
+ "value": {
556
+ "fixedColor": "#F2495C",
557
+ "mode": "fixed"
558
+ }
559
+ }
560
+ ]
561
+ },
562
+ {
563
+ "matcher": {
564
+ "id": "byName",
565
+ "options": "Info"
566
+ },
567
+ "properties": [
568
+ {
569
+ "id": "color",
570
+ "value": {
571
+ "fixedColor": "#73BF69",
572
+ "mode": "fixed"
573
+ }
574
+ }
575
+ ]
576
+ },
577
+ {
578
+ "matcher": {
579
+ "id": "byName",
580
+ "options": "NOTICE"
581
+ },
582
+ "properties": [
583
+ {
584
+ "id": "color",
585
+ "value": {
586
+ "fixedColor": "#5794F2",
587
+ "mode": "fixed"
588
+ }
589
+ }
590
+ ]
591
+ },
592
+ {
593
+ "matcher": {
594
+ "id": "byName",
595
+ "options": "Notice"
596
+ },
597
+ "properties": [
598
+ {
599
+ "id": "color",
600
+ "value": {
601
+ "fixedColor": "#5794F2",
602
+ "mode": "fixed"
603
+ }
604
+ }
605
+ ]
606
+ },
607
+ {
608
+ "matcher": {
609
+ "id": "byName",
610
+ "options": "Result"
611
+ },
612
+ "properties": [
613
+ {
614
+ "id": "color",
615
+ "value": {
616
+ "fixedColor": "#B877D9",
617
+ "mode": "fixed"
618
+ }
619
+ }
620
+ ]
621
+ },
622
+ {
623
+ "matcher": {
624
+ "id": "byName",
625
+ "options": "Warning"
626
+ },
627
+ "properties": [
628
+ {
629
+ "id": "color",
630
+ "value": {
631
+ "fixedColor": "#FF9830",
632
+ "mode": "fixed"
633
+ }
634
+ }
635
+ ]
636
+ },
637
+ {
638
+ "matcher": {
639
+ "id": "byName",
640
+ "options": "INFORMATION"
641
+ },
642
+ "properties": [
643
+ {
644
+ "id": "color",
645
+ "value": {
646
+ "fixedColor": "green",
647
+ "mode": "fixed"
648
+ }
649
+ }
650
+ ]
651
+ },
652
+ {
653
+ "matcher": {
654
+ "id": "byName",
655
+ "options": "WARNING"
656
+ },
657
+ "properties": [
658
+ {
659
+ "id": "color",
660
+ "value": {
661
+ "fixedColor": "orange",
662
+ "mode": "fixed"
663
+ }
664
+ }
665
+ ]
666
+ },
667
+ {
668
+ "matcher": {
669
+ "id": "byName",
670
+ "options": "ERROR"
671
+ },
672
+ "properties": [
673
+ {
674
+ "id": "color",
675
+ "value": {
676
+ "fixedColor": "red",
677
+ "mode": "fixed"
678
+ }
679
+ }
680
+ ]
681
+ },
682
+ {
683
+ "matcher": {
684
+ "id": "byName",
685
+ "options": "13"
686
+ },
687
+ "properties": [
688
+ {
689
+ "id": "color",
690
+ "value": {
691
+ "fixedColor": "red",
692
+ "mode": "fixed"
693
+ }
694
+ }
695
+ ]
696
+ },
697
+ {
698
+ "matcher": {
699
+ "id": "byName",
700
+ "options": "12"
701
+ },
702
+ "properties": [
703
+ {
704
+ "id": "color",
705
+ "value": {
706
+ "fixedColor": "red",
707
+ "mode": "fixed"
708
+ }
709
+ }
710
+ ]
711
+ },
712
+ {
713
+ "matcher": {
714
+ "id": "byName",
715
+ "options": "9"
716
+ },
717
+ "properties": [
718
+ {
719
+ "id": "color",
720
+ "value": {
721
+ "fixedColor": "super-light-red",
722
+ "mode": "fixed"
723
+ }
724
+ }
725
+ ]
726
+ }
727
+ ]
728
+ },
729
+ "gridPos": {
730
+ "h": 8,
731
+ "w": 5,
732
+ "x": 4,
733
+ "y": 9
734
+ },
735
+ "id": 68,
736
+ "links": [],
737
+ "maxDataPoints": 3,
738
+ "options": {
739
+ "displayLabels": [],
740
+ "legend": {
741
+ "calcs": [],
742
+ "displayMode": "table",
743
+ "placement": "right",
744
+ "showLegend": true,
745
+ "values": ["value"]
746
+ },
747
+ "pieType": "donut",
748
+ "reduceOptions": {
749
+ "calcs": ["sum"],
750
+ "fields": "",
751
+ "values": false
752
+ },
753
+ "text": {},
754
+ "tooltip": {
755
+ "mode": "single",
756
+ "sort": "none"
757
+ }
758
+ },
759
+ "targets": [
760
+ {
761
+ "bucketAggs": [
762
+ {
763
+ "$$hashKey": "object:73",
764
+ "fake": true,
765
+ "field": "rule_level",
766
+ "id": "3",
767
+ "settings": {
768
+ "min_doc_count": 1,
769
+ "order": "desc",
770
+ "orderBy": "_count",
771
+ "size": "0"
772
+ },
773
+ "type": "terms"
774
+ },
775
+ {
776
+ "$$hashKey": "object:74",
777
+ "field": "timestamp",
778
+ "id": "2",
779
+ "settings": {
780
+ "interval": "auto",
781
+ "min_doc_count": 0,
782
+ "trimEdges": 0
783
+ },
784
+ "type": "date_histogram"
785
+ }
786
+ ],
787
+ "datasource": {
788
+ "type": "elasticsearch",
789
+ "uid": "wazuh_datasource_uid"
790
+ },
791
+ "metrics": [
792
+ {
793
+ "$$hashKey": "object:71",
794
+ "field": "select field",
795
+ "id": "1",
796
+ "type": "count"
797
+ }
798
+ ],
799
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level",
800
+ "refId": "A",
801
+ "timeField": "timestamp"
802
+ }
803
+ ],
804
+ "title": "SEVERITY LEVELS",
805
+ "type": "piechart"
806
+ },
807
+ {
808
+ "datasource": {
809
+ "type": "elasticsearch",
810
+ "uid": "wazuh_datasource_uid"
811
+ },
812
+ "fieldConfig": {
813
+ "defaults": {
814
+ "custom": {
815
+ "align": "auto",
816
+ "cellOptions": {
817
+ "type": "auto"
818
+ },
819
+ "filterable": false,
820
+ "inspect": false
821
+ },
822
+ "mappings": [],
823
+ "thresholds": {
824
+ "mode": "absolute",
825
+ "steps": [
826
+ {
827
+ "color": "blue",
828
+ "value": null
829
+ },
830
+ {
831
+ "color": "red",
832
+ "value": 50
833
+ }
834
+ ]
835
+ }
836
+ },
837
+ "overrides": [
838
+ {
839
+ "matcher": {
840
+ "id": "byName",
841
+ "options": "Count"
842
+ },
843
+ "properties": [
844
+ {
845
+ "id": "custom.cellOptions",
846
+ "value": {
847
+ "mode": "basic",
848
+ "type": "gauge"
849
+ }
850
+ }
851
+ ]
852
+ },
853
+ {
854
+ "matcher": {
855
+ "id": "byName",
856
+ "options": "rule_description"
857
+ },
858
+ "properties": [
859
+ {
860
+ "id": "custom.width",
861
+ "value": 703
862
+ }
863
+ ]
864
+ },
865
+ {
866
+ "matcher": {
867
+ "id": "byName",
868
+ "options": "rule_level"
869
+ },
870
+ "properties": [
871
+ {
872
+ "id": "custom.width",
873
+ "value": 212
874
+ },
875
+ {
876
+ "id": "mappings",
877
+ "value": [
878
+ {
879
+ "options": {
880
+ "from": 1,
881
+ "result": {
882
+ "color": "green",
883
+ "index": 0
884
+ },
885
+ "to": 3
886
+ },
887
+ "type": "range"
888
+ },
889
+ {
890
+ "options": {
891
+ "from": 4,
892
+ "result": {
893
+ "color": "dark-yellow",
894
+ "index": 1
895
+ },
896
+ "to": 6
897
+ },
898
+ "type": "range"
899
+ },
900
+ {
901
+ "options": {
902
+ "from": 7,
903
+ "result": {
904
+ "color": "orange",
905
+ "index": 2
906
+ },
907
+ "to": 9
908
+ },
909
+ "type": "range"
910
+ },
911
+ {
912
+ "options": {
913
+ "from": 10,
914
+ "result": {
915
+ "color": "semi-dark-red",
916
+ "index": 3
917
+ },
918
+ "to": 15
919
+ },
920
+ "type": "range"
921
+ }
922
+ ]
923
+ }
924
+ ]
925
+ },
926
+ {
927
+ "matcher": {
928
+ "id": "byName",
929
+ "options": "RULE GROUPS"
930
+ },
931
+ "properties": [
932
+ {
933
+ "id": "custom.width",
934
+ "value": 441
935
+ },
936
+ {
937
+ "id": "mappings",
938
+ "value": [
939
+ {
940
+ "options": {
941
+ "ossec, syscheck, syscheck_entry_added, syscheck_registry": {
942
+ "index": 3,
943
+ "text": "Syscheck - Registry Added"
944
+ },
945
+ "ossec, syscheck, syscheck_entry_deleted, syscheck_registry": {
946
+ "index": 4,
947
+ "text": "Syscheck - Registry Deleted"
948
+ },
949
+ "ossec, syscheck, syscheck_entry_modified, syscheck_registry": {
950
+ "index": 2,
951
+ "text": "Syscheck - Registry Modified"
952
+ },
953
+ "windows, sysmon, sysmon_event_11": {
954
+ "index": 6,
955
+ "text": "Sysmon - FileCreate"
956
+ },
957
+ "windows, sysmon, sysmon_event_12": {
958
+ "index": 1,
959
+ "text": "Sysmon - RegistryEvent (Object create and delete)"
960
+ },
961
+ "windows, sysmon, sysmon_event_13": {
962
+ "index": 0,
963
+ "text": "Sysmon - RegistryEvent (Value Set)"
964
+ },
965
+ "windows, sysmon, sysmon_event_15": {
966
+ "index": 5,
967
+ "text": "Sysmon - FileCreateStreamHash"
968
+ }
969
+ },
970
+ "type": "value"
971
+ }
972
+ ]
973
+ }
974
+ ]
975
+ }
976
+ ]
977
+ },
978
+ "gridPos": {
979
+ "h": 8,
980
+ "w": 15,
981
+ "x": 9,
982
+ "y": 9
983
+ },
984
+ "id": 115,
985
+ "links": [],
986
+ "maxDataPoints": 3,
987
+ "options": {
988
+ "cellHeight": "sm",
989
+ "footer": {
990
+ "countRows": false,
991
+ "fields": "",
992
+ "reducer": ["sum"],
993
+ "show": false
994
+ },
995
+ "showHeader": true,
996
+ "sortBy": []
997
+ },
998
+ "pluginVersion": "10.0.2",
999
+ "targets": [
1000
+ {
1001
+ "bucketAggs": [
1002
+ {
1003
+ "$$hashKey": "object:3082",
1004
+ "fake": true,
1005
+ "field": "rule_groups",
1006
+ "id": "4",
1007
+ "settings": {
1008
+ "min_doc_count": 0,
1009
+ "order": "desc",
1010
+ "orderBy": "_count",
1011
+ "size": "10"
1012
+ },
1013
+ "type": "terms"
1014
+ },
1015
+ {
1016
+ "$$hashKey": "object:73",
1017
+ "fake": true,
1018
+ "field": "rule_level",
1019
+ "id": "3",
1020
+ "settings": {
1021
+ "min_doc_count": 1,
1022
+ "order": "desc",
1023
+ "orderBy": "_count",
1024
+ "size": "0"
1025
+ },
1026
+ "type": "terms"
1027
+ }
1028
+ ],
1029
+ "datasource": {
1030
+ "type": "elasticsearch",
1031
+ "uid": "wazuh_datasource_uid"
1032
+ },
1033
+ "metrics": [
1034
+ {
1035
+ "$$hashKey": "object:71",
1036
+ "field": "select field",
1037
+ "id": "1",
1038
+ "type": "count"
1039
+ }
1040
+ ],
1041
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level",
1042
+ "refId": "A",
1043
+ "timeField": "timestamp"
1044
+ }
1045
+ ],
1046
+ "title": "EVENTS BY TYPE AND SEVERITY",
1047
+ "transformations": [
1048
+ {
1049
+ "id": "organize",
1050
+ "options": {
1051
+ "excludeByName": {},
1052
+ "indexByName": {},
1053
+ "renameByName": {
1054
+ "rule_groups": "RULE GROUPS",
1055
+ "rule_level": "RULE LEVEL"
1056
+ }
1057
+ }
1058
+ }
1059
+ ],
1060
+ "type": "table"
1061
+ },
1062
+ {
1063
+ "datasource": {
1064
+ "type": "elasticsearch",
1065
+ "uid": "wazuh_datasource_uid"
1066
+ },
1067
+ "fieldConfig": {
1068
+ "defaults": {
1069
+ "custom": {
1070
+ "align": "auto",
1071
+ "cellOptions": {
1072
+ "type": "auto"
1073
+ },
1074
+ "filterable": false,
1075
+ "inspect": false
1076
+ },
1077
+ "mappings": [],
1078
+ "thresholds": {
1079
+ "mode": "absolute",
1080
+ "steps": [
1081
+ {
1082
+ "color": "green",
1083
+ "value": null
1084
+ },
1085
+ {
1086
+ "color": "red",
1087
+ "value": 80
1088
+ }
1089
+ ]
1090
+ }
1091
+ },
1092
+ "overrides": [
1093
+ {
1094
+ "matcher": {
1095
+ "id": "byName",
1096
+ "options": "agent_name"
1097
+ },
1098
+ "properties": [
1099
+ {
1100
+ "id": "custom.width",
1101
+ "value": 492
1102
+ }
1103
+ ]
1104
+ }
1105
+ ]
1106
+ },
1107
+ "gridPos": {
1108
+ "h": 7,
1109
+ "w": 9,
1110
+ "x": 0,
1111
+ "y": 17
1112
+ },
1113
+ "id": 70,
1114
+ "links": [],
1115
+ "maxDataPoints": 3,
1116
+ "options": {
1117
+ "cellHeight": "sm",
1118
+ "footer": {
1119
+ "countRows": false,
1120
+ "fields": "",
1121
+ "reducer": ["sum"],
1122
+ "show": false
1123
+ },
1124
+ "showHeader": true,
1125
+ "sortBy": []
1126
+ },
1127
+ "pluginVersion": "10.0.2",
1128
+ "targets": [
1129
+ {
1130
+ "bucketAggs": [
1131
+ {
1132
+ "$$hashKey": "object:73",
1133
+ "fake": true,
1134
+ "field": "agent_name",
1135
+ "id": "3",
1136
+ "settings": {
1137
+ "min_doc_count": 1,
1138
+ "order": "desc",
1139
+ "orderBy": "_count",
1140
+ "size": "0"
1141
+ },
1142
+ "type": "terms"
1143
+ }
1144
+ ],
1145
+ "datasource": {
1146
+ "type": "elasticsearch",
1147
+ "uid": "wazuh_datasource_uid"
1148
+ },
1149
+ "metrics": [
1150
+ {
1151
+ "$$hashKey": "object:71",
1152
+ "field": "select field",
1153
+ "id": "1",
1154
+ "type": "count"
1155
+ }
1156
+ ],
1157
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level",
1158
+ "refId": "A",
1159
+ "timeField": "timestamp"
1160
+ }
1161
+ ],
1162
+ "title": "EVENTS BY AGENT",
1163
+ "transformations": [
1164
+ {
1165
+ "id": "organize",
1166
+ "options": {
1167
+ "excludeByName": {},
1168
+ "indexByName": {},
1169
+ "renameByName": {
1170
+ "agent_name": "AGENT"
1171
+ }
1172
+ }
1173
+ }
1174
+ ],
1175
+ "type": "table"
1176
+ },
1177
+ {
1178
+ "aliasColors": {},
1179
+ "bars": true,
1180
+ "dashLength": 10,
1181
+ "dashes": false,
1182
+ "datasource": {
1183
+ "type": "elasticsearch",
1184
+ "uid": "wazuh_datasource_uid"
1185
+ },
1186
+ "fill": 1,
1187
+ "fillGradient": 0,
1188
+ "gridPos": {
1189
+ "h": 7,
1190
+ "w": 15,
1191
+ "x": 9,
1192
+ "y": 17
1193
+ },
1194
+ "hiddenSeries": false,
1195
+ "id": 83,
1196
+ "legend": {
1197
+ "alignAsTable": true,
1198
+ "avg": false,
1199
+ "current": false,
1200
+ "max": false,
1201
+ "min": false,
1202
+ "rightSide": true,
1203
+ "show": true,
1204
+ "total": false,
1205
+ "values": false
1206
+ },
1207
+ "lines": false,
1208
+ "linewidth": 1,
1209
+ "links": [],
1210
+ "maxDataPoints": 3,
1211
+ "nullPointMode": "null",
1212
+ "options": {
1213
+ "alertThreshold": true
1214
+ },
1215
+ "percentage": false,
1216
+ "pluginVersion": "10.0.2",
1217
+ "pointradius": 2,
1218
+ "points": false,
1219
+ "renderer": "flot",
1220
+ "seriesOverrides": [],
1221
+ "spaceLength": 10,
1222
+ "stack": true,
1223
+ "steppedLine": false,
1224
+ "targets": [
1225
+ {
1226
+ "alias": "",
1227
+ "bucketAggs": [
1228
+ {
1229
+ "field": "agent_name",
1230
+ "id": "4",
1231
+ "settings": {
1232
+ "min_doc_count": "1",
1233
+ "order": "desc",
1234
+ "orderBy": "_count",
1235
+ "size": "10"
1236
+ },
1237
+ "type": "terms"
1238
+ },
1239
+ {
1240
+ "field": "timestamp",
1241
+ "id": "5",
1242
+ "settings": {
1243
+ "interval": "auto",
1244
+ "min_doc_count": "0",
1245
+ "trimEdges": "0"
1246
+ },
1247
+ "type": "date_histogram"
1248
+ }
1249
+ ],
1250
+ "datasource": {
1251
+ "type": "elasticsearch",
1252
+ "uid": "wazuh_datasource_uid"
1253
+ },
1254
+ "metrics": [
1255
+ {
1256
+ "$$hashKey": "object:71",
1257
+ "field": "select field",
1258
+ "id": "1",
1259
+ "type": "count"
1260
+ }
1261
+ ],
1262
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level",
1263
+ "refId": "A",
1264
+ "timeField": "timestamp"
1265
+ }
1266
+ ],
1267
+ "thresholds": [],
1268
+ "timeRegions": [],
1269
+ "title": "EVENTS BY AGENT (HISTOGRAM)",
1270
+ "tooltip": {
1271
+ "shared": true,
1272
+ "sort": 0,
1273
+ "value_type": "individual"
1274
+ },
1275
+ "type": "graph",
1276
+ "xaxis": {
1277
+ "mode": "time",
1278
+ "show": true,
1279
+ "values": []
1280
+ },
1281
+ "yaxes": [
1282
+ {
1283
+ "format": "short",
1284
+ "logBase": 1,
1285
+ "show": true
1286
+ },
1287
+ {
1288
+ "format": "short",
1289
+ "logBase": 1,
1290
+ "show": true
1291
+ }
1292
+ ],
1293
+ "yaxis": {
1294
+ "align": false
1295
+ }
1296
+ },
1297
+ {
1298
+ "datasource": {
1299
+ "type": "elasticsearch",
1300
+ "uid": "wazuh_datasource_uid"
1301
+ },
1302
+ "fieldConfig": {
1303
+ "defaults": {
1304
+ "color": {
1305
+ "mode": "thresholds"
1306
+ },
1307
+ "custom": {
1308
+ "align": "auto",
1309
+ "cellOptions": {
1310
+ "type": "auto"
1311
+ },
1312
+ "inspect": false
1313
+ },
1314
+ "mappings": [],
1315
+ "thresholds": {
1316
+ "mode": "absolute",
1317
+ "steps": [
1318
+ {
1319
+ "color": "green",
1320
+ "value": null
1321
+ },
1322
+ {
1323
+ "color": "red",
1324
+ "value": 80
1325
+ }
1326
+ ]
1327
+ }
1328
+ },
1329
+ "overrides": [
1330
+ {
1331
+ "matcher": {
1332
+ "id": "byName",
1333
+ "options": "rule_level"
1334
+ },
1335
+ "properties": [
1336
+ {
1337
+ "id": "custom.width",
1338
+ "value": 93
1339
+ }
1340
+ ]
1341
+ },
1342
+ {
1343
+ "matcher": {
1344
+ "id": "byName",
1345
+ "options": "windows_event_id"
1346
+ },
1347
+ "properties": [
1348
+ {
1349
+ "id": "custom.width",
1350
+ "value": 186
1351
+ }
1352
+ ]
1353
+ },
1354
+ {
1355
+ "matcher": {
1356
+ "id": "byName",
1357
+ "options": "DATE/TIME"
1358
+ },
1359
+ "properties": [
1360
+ {
1361
+ "id": "custom.width",
1362
+ "value": 202
1363
+ }
1364
+ ]
1365
+ },
1366
+ {
1367
+ "matcher": {
1368
+ "id": "byName",
1369
+ "options": "AGENT"
1370
+ },
1371
+ "properties": [
1372
+ {
1373
+ "id": "custom.width",
1374
+ "value": 171
1375
+ }
1376
+ ]
1377
+ },
1378
+ {
1379
+ "matcher": {
1380
+ "id": "byName",
1381
+ "options": "SRC IP"
1382
+ },
1383
+ "properties": [
1384
+ {
1385
+ "id": "custom.width",
1386
+ "value": 167
1387
+ }
1388
+ ]
1389
+ },
1390
+ {
1391
+ "matcher": {
1392
+ "id": "byName",
1393
+ "options": "MESSAGE"
1394
+ },
1395
+ "properties": [
1396
+ {
1397
+ "id": "custom.width",
1398
+ "value": 1519
1399
+ }
1400
+ ]
1401
+ },
1402
+ {
1403
+ "matcher": {
1404
+ "id": "byName",
1405
+ "options": "rule_description"
1406
+ },
1407
+ "properties": [
1408
+ {
1409
+ "id": "custom.width",
1410
+ "value": 524
1411
+ }
1412
+ ]
1413
+ },
1414
+ {
1415
+ "matcher": {
1416
+ "id": "byName",
1417
+ "options": "EVENT ID"
1418
+ },
1419
+ "properties": [
1420
+ {
1421
+ "id": "links",
1422
+ "value": [
1423
+ {
1424
+ "targetBlank": true,
1425
+ "title": "VIEW EVENT DETAILS",
1426
+ "url": "https://grafana.company.local/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
1427
+ }
1428
+ ]
1429
+ },
1430
+ {
1431
+ "id": "custom.width",
1432
+ "value": 320
1433
+ }
1434
+ ]
1435
+ },
1436
+ {
1437
+ "matcher": {
1438
+ "id": "byName",
1439
+ "options": "EVENT DESCRIPTION"
1440
+ },
1441
+ "properties": [
1442
+ {
1443
+ "id": "custom.width",
1444
+ "value": 702
1445
+ }
1446
+ ]
1447
+ },
1448
+ {
1449
+ "matcher": {
1450
+ "id": "byName",
1451
+ "options": "RULE LEVEL"
1452
+ },
1453
+ "properties": [
1454
+ {
1455
+ "id": "custom.width",
1456
+ "value": 139
1457
+ }
1458
+ ]
1459
+ },
1460
+ {
1461
+ "matcher": {
1462
+ "id": "byName",
1463
+ "options": "MITRE ID"
1464
+ },
1465
+ "properties": [
1466
+ {
1467
+ "id": "custom.width",
1468
+ "value": 113
1469
+ }
1470
+ ]
1471
+ },
1472
+ {
1473
+ "matcher": {
1474
+ "id": "byName",
1475
+ "options": "TACTIC"
1476
+ },
1477
+ "properties": [
1478
+ {
1479
+ "id": "custom.width",
1480
+ "value": 294
1481
+ }
1482
+ ]
1483
+ }
1484
+ ]
1485
+ },
1486
+ "gridPos": {
1487
+ "h": 10,
1488
+ "w": 24,
1489
+ "x": 0,
1490
+ "y": 24
1491
+ },
1492
+ "id": 85,
1493
+ "options": {
1494
+ "cellHeight": "sm",
1495
+ "footer": {
1496
+ "countRows": false,
1497
+ "fields": "",
1498
+ "reducer": ["sum"],
1499
+ "show": false
1500
+ },
1501
+ "showHeader": true,
1502
+ "sortBy": []
1503
+ },
1504
+ "pluginVersion": "10.0.2",
1505
+ "targets": [
1506
+ {
1507
+ "alias": "",
1508
+ "bucketAggs": [],
1509
+ "datasource": {
1510
+ "type": "elasticsearch",
1511
+ "uid": "wazuh_datasource_uid"
1512
+ },
1513
+ "metrics": [
1514
+ {
1515
+ "id": "1",
1516
+ "settings": {
1517
+ "size": "500"
1518
+ },
1519
+ "type": "raw_data"
1520
+ }
1521
+ ],
1522
+ "query": "(rule_group3:sysmon_event_11 OR rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_group3:sysmon_event_15 OR rule_group2:syscheck) AND rule_level:$rule_level",
1523
+ "queryType": "lucene",
1524
+ "refId": "A",
1525
+ "timeField": "timestamp"
1526
+ }
1527
+ ],
1528
+ "title": "EVENTS SUMMARY",
1529
+ "transformations": [
1530
+ {
1531
+ "id": "organize",
1532
+ "options": {
1533
+ "excludeByName": {
1534
+ "@metadata_beat": true,
1535
+ "@metadata_type": true,
1536
+ "@metadata_version": true,
1537
+ "_id": false,
1538
+ "_index": true,
1539
+ "_type": true,
1540
+ "agent_ephemeral_id": true,
1541
+ "agent_hostname": true,
1542
+ "agent_id": true,
1543
+ "agent_ip": false,
1544
+ "agent_ip_city_name": true,
1545
+ "agent_ip_country_code": true,
1546
+ "agent_ip_geolocation": true,
1547
+ "agent_ip_reserved_ip": true,
1548
+ "agent_labels_customer": true,
1549
+ "agent_name": false,
1550
+ "agent_type": true,
1551
+ "agent_version": true,
1552
+ "beats_type": true,
1553
+ "cluster_name": true,
1554
+ "cluster_node": true,
1555
+ "collector_node_id": true,
1556
+ "data_win_eventdata_creationUtcTime": true,
1557
+ "data_win_eventdata_details": true,
1558
+ "data_win_eventdata_domain": true,
1559
+ "data_win_eventdata_eventType": true,
1560
+ "data_win_eventdata_image": true,
1561
+ "data_win_eventdata_imagePath": true,
1562
+ "data_win_eventdata_processGuid": true,
1563
+ "data_win_eventdata_processId": true,
1564
+ "data_win_eventdata_ruleName": true,
1565
+ "data_win_eventdata_sID": true,
1566
+ "data_win_eventdata_serviceName": true,
1567
+ "data_win_eventdata_serviceType": true,
1568
+ "data_win_eventdata_startType": true,
1569
+ "data_win_eventdata_targetFilename": true,
1570
+ "data_win_eventdata_targetObject": true,
1571
+ "data_win_eventdata_timestamp": true,
1572
+ "data_win_eventdata_user": true,
1573
+ "data_win_eventdata_utcTime": true,
1574
+ "data_win_system_channel": true,
1575
+ "data_win_system_computer": true,
1576
+ "data_win_system_eventID": true,
1577
+ "data_win_system_eventRecordID": true,
1578
+ "data_win_system_eventSourceName": true,
1579
+ "data_win_system_keywords": true,
1580
+ "data_win_system_level": true,
1581
+ "data_win_system_message": true,
1582
+ "data_win_system_opcode": true,
1583
+ "data_win_system_processID": true,
1584
+ "data_win_system_providerGuid": true,
1585
+ "data_win_system_providerName": true,
1586
+ "data_win_system_severityValue": true,
1587
+ "data_win_system_systemTime": true,
1588
+ "data_win_system_task": true,
1589
+ "data_win_system_threadID": true,
1590
+ "data_win_system_version": true,
1591
+ "decoder_name": true,
1592
+ "ecs_version": true,
1593
+ "event_type": true,
1594
+ "full_log": true,
1595
+ "gl2_accounted_message_size": true,
1596
+ "gl2_message_id": true,
1597
+ "gl2_processing_error": true,
1598
+ "gl2_remote_ip": true,
1599
+ "gl2_remote_port": true,
1600
+ "gl2_source_collector": true,
1601
+ "gl2_source_input": true,
1602
+ "gl2_source_node": true,
1603
+ "highlight": true,
1604
+ "host_name": true,
1605
+ "id": true,
1606
+ "location": true,
1607
+ "log_file_path": true,
1608
+ "log_offset": true,
1609
+ "manager_name": true,
1610
+ "message": true,
1611
+ "msg_timestamp": true,
1612
+ "previous_output": true,
1613
+ "process_id": true,
1614
+ "process_image": true,
1615
+ "rule_description": false,
1616
+ "rule_firedtimes": true,
1617
+ "rule_frequency": true,
1618
+ "rule_gdpr": true,
1619
+ "rule_gpg13": true,
1620
+ "rule_group1": true,
1621
+ "rule_group2": true,
1622
+ "rule_group3": true,
1623
+ "rule_groups": true,
1624
+ "rule_hipaa": true,
1625
+ "rule_id": true,
1626
+ "rule_mail": true,
1627
+ "rule_mitre_id": false,
1628
+ "rule_mitre_tactic": false,
1629
+ "rule_mitre_technique": false,
1630
+ "rule_nist_800_53": true,
1631
+ "rule_pci_dss": true,
1632
+ "rule_tsc": true,
1633
+ "sha256": true,
1634
+ "sort": true,
1635
+ "source": true,
1636
+ "source_reserved_ip": true,
1637
+ "src_ip": true,
1638
+ "src_ip_city_name": true,
1639
+ "src_ip_country_code": true,
1640
+ "src_ip_geolocation": true,
1641
+ "streams": true,
1642
+ "syscheck_arch": true,
1643
+ "syscheck_attrs_after": true,
1644
+ "syscheck_changed_attributes": true,
1645
+ "syscheck_event": true,
1646
+ "syscheck_gid_after": true,
1647
+ "syscheck_gname_after": true,
1648
+ "syscheck_md5_after": true,
1649
+ "syscheck_md5_before": true,
1650
+ "syscheck_mode": true,
1651
+ "syscheck_mtime_after": true,
1652
+ "syscheck_mtime_before": true,
1653
+ "syscheck_path": true,
1654
+ "syscheck_sha1_after": true,
1655
+ "syscheck_sha1_before": true,
1656
+ "syscheck_sha256_after": true,
1657
+ "syscheck_sha256_before": true,
1658
+ "syscheck_size_after": true,
1659
+ "syscheck_uid_after": true,
1660
+ "syscheck_uname_after": true,
1661
+ "syscheck_value_name": true,
1662
+ "syscheck_win_perm_after": true,
1663
+ "syslog_level": true,
1664
+ "syslog_tag": true,
1665
+ "syslog_type": true,
1666
+ "target_file": true,
1667
+ "target_object": true,
1668
+ "timestamp": false,
1669
+ "timestamp_utc": true,
1670
+ "true": true,
1671
+ "user_name": true,
1672
+ "win_system_eventID": true,
1673
+ "windows_event_id": true,
1674
+ "windows_event_severity": false
1675
+ },
1676
+ "indexByName": {
1677
+ "_id": 1,
1678
+ "_index": 3,
1679
+ "_type": 4,
1680
+ "agent_id": 5,
1681
+ "agent_ip": 6,
1682
+ "agent_ip_reserved_ip": 52,
1683
+ "agent_labels_customer": 46,
1684
+ "agent_name": 2,
1685
+ "cluster_name": 53,
1686
+ "cluster_node": 54,
1687
+ "data_win_eventdata_creationUtcTime": 55,
1688
+ "data_win_eventdata_details": 56,
1689
+ "data_win_eventdata_eventType": 57,
1690
+ "data_win_eventdata_image": 58,
1691
+ "data_win_eventdata_processGuid": 59,
1692
+ "data_win_eventdata_processId": 60,
1693
+ "data_win_eventdata_ruleName": 61,
1694
+ "data_win_eventdata_targetFilename": 62,
1695
+ "data_win_eventdata_targetObject": 63,
1696
+ "data_win_eventdata_user": 7,
1697
+ "data_win_eventdata_utcTime": 64,
1698
+ "data_win_system_channel": 8,
1699
+ "data_win_system_computer": 9,
1700
+ "data_win_system_eventID": 10,
1701
+ "data_win_system_eventRecordID": 11,
1702
+ "data_win_system_keywords": 12,
1703
+ "data_win_system_level": 13,
1704
+ "data_win_system_message": 14,
1705
+ "data_win_system_opcode": 15,
1706
+ "data_win_system_processID": 16,
1707
+ "data_win_system_providerGuid": 17,
1708
+ "data_win_system_providerName": 18,
1709
+ "data_win_system_severityValue": 19,
1710
+ "data_win_system_systemTime": 20,
1711
+ "data_win_system_task": 21,
1712
+ "data_win_system_threadID": 22,
1713
+ "data_win_system_version": 23,
1714
+ "decoder_name": 24,
1715
+ "event_type": 65,
1716
+ "gl2_accounted_message_size": 25,
1717
+ "gl2_message_id": 26,
1718
+ "gl2_processing_error": 47,
1719
+ "gl2_remote_ip": 27,
1720
+ "gl2_remote_port": 28,
1721
+ "gl2_source_input": 29,
1722
+ "gl2_source_node": 30,
1723
+ "highlight": 31,
1724
+ "id": 32,
1725
+ "location": 33,
1726
+ "manager_name": 34,
1727
+ "message": 35,
1728
+ "msg_timestamp": 66,
1729
+ "process_id": 67,
1730
+ "process_image": 68,
1731
+ "rule_description": 36,
1732
+ "rule_firedtimes": 37,
1733
+ "rule_group1": 48,
1734
+ "rule_group2": 49,
1735
+ "rule_group3": 69,
1736
+ "rule_groups": 38,
1737
+ "rule_id": 39,
1738
+ "rule_level": 40,
1739
+ "rule_mail": 41,
1740
+ "rule_mitre_id": 70,
1741
+ "rule_mitre_tactic": 71,
1742
+ "rule_mitre_technique": 72,
1743
+ "sort": 42,
1744
+ "source": 43,
1745
+ "source_reserved_ip": 73,
1746
+ "streams": 44,
1747
+ "syslog_level": 50,
1748
+ "syslog_type": 45,
1749
+ "target_file": 74,
1750
+ "target_object": 75,
1751
+ "timestamp": 0,
1752
+ "timestamp_utc": 76,
1753
+ "true": 51,
1754
+ "user_name": 77
1755
+ },
1756
+ "renameByName": {
1757
+ "_id": "EVENT ID",
1758
+ "agent_ip": "SRC IP",
1759
+ "agent_name": "AGENT",
1760
+ "data_win_system_message": "MESSAGE",
1761
+ "data_win_system_providerGuid": "",
1762
+ "rule_description": "EVENT DESCRIPTION",
1763
+ "rule_level": "RULE LEVEL",
1764
+ "rule_mitre_id": "MITRE ID",
1765
+ "rule_mitre_tactic": "TACTIC",
1766
+ "rule_mitre_technique": "TECHNIQUE",
1767
+ "timestamp": "DATE/TIME",
1768
+ "windows_event_severity": "EVENT LOG SEVERITY"
1769
+ }
1770
+ }
1771
+ }
1772
+ ],
1773
+ "transparent": true,
1774
+ "type": "table"
1775
+ },
1776
+ {
1777
+ "collapsed": true,
1778
+ "datasource": {
1779
+ "type": "datasource",
1780
+ "uid": "grafana"
1781
+ },
1782
+ "gridPos": {
1783
+ "h": 1,
1784
+ "w": 24,
1785
+ "x": 0,
1786
+ "y": 34
1787
+ },
1788
+ "id": 118,
1789
+ "panels": [
1790
+ {
1791
+ "datasource": {
1792
+ "type": "elasticsearch",
1793
+ "uid": "wazuh_datasource_uid"
1794
+ },
1795
+ "fieldConfig": {
1796
+ "defaults": {
1797
+ "mappings": [
1798
+ {
1799
+ "options": {
1800
+ "match": "null",
1801
+ "result": {
1802
+ "text": "N/A"
1803
+ }
1804
+ },
1805
+ "type": "special"
1806
+ }
1807
+ ],
1808
+ "thresholds": {
1809
+ "mode": "absolute",
1810
+ "steps": [
1811
+ {
1812
+ "color": "blue",
1813
+ "value": null
1814
+ }
1815
+ ]
1816
+ },
1817
+ "unit": "short"
1818
+ },
1819
+ "overrides": []
1820
+ },
1821
+ "gridPos": {
1822
+ "h": 7,
1823
+ "w": 4,
1824
+ "x": 0,
1825
+ "y": 35
1826
+ },
1827
+ "id": 119,
1828
+ "links": [],
1829
+ "options": {
1830
+ "colorMode": "value",
1831
+ "graphMode": "area",
1832
+ "justifyMode": "auto",
1833
+ "orientation": "horizontal",
1834
+ "reduceOptions": {
1835
+ "calcs": ["sum"],
1836
+ "fields": "",
1837
+ "values": false
1838
+ },
1839
+ "text": {},
1840
+ "textMode": "auto"
1841
+ },
1842
+ "pluginVersion": "10.0.2",
1843
+ "targets": [
1844
+ {
1845
+ "bucketAggs": [
1846
+ {
1847
+ "$$hashKey": "object:50",
1848
+ "field": "timestamp",
1849
+ "id": "2",
1850
+ "settings": {
1851
+ "interval": "auto",
1852
+ "min_doc_count": 0,
1853
+ "trimEdges": 0
1854
+ },
1855
+ "type": "date_histogram"
1856
+ }
1857
+ ],
1858
+ "datasource": {
1859
+ "type": "elasticsearch",
1860
+ "uid": "wazuh_datasource_uid"
1861
+ },
1862
+ "metrics": [
1863
+ {
1864
+ "$$hashKey": "object:48",
1865
+ "field": "select field",
1866
+ "id": "1",
1867
+ "type": "count"
1868
+ }
1869
+ ],
1870
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
1871
+ "refId": "A",
1872
+ "timeField": "timestamp"
1873
+ }
1874
+ ],
1875
+ "title": "EVENTS",
1876
+ "type": "stat"
1877
+ },
1878
+ {
1879
+ "datasource": {
1880
+ "type": "elasticsearch",
1881
+ "uid": "wazuh_datasource_uid"
1882
+ },
1883
+ "fieldConfig": {
1884
+ "defaults": {
1885
+ "custom": {
1886
+ "align": "auto",
1887
+ "cellOptions": {
1888
+ "type": "auto"
1889
+ },
1890
+ "filterable": false,
1891
+ "inspect": false
1892
+ },
1893
+ "mappings": [],
1894
+ "thresholds": {
1895
+ "mode": "absolute",
1896
+ "steps": [
1897
+ {
1898
+ "color": "green",
1899
+ "value": null
1900
+ },
1901
+ {
1902
+ "color": "red",
1903
+ "value": 80
1904
+ }
1905
+ ]
1906
+ }
1907
+ },
1908
+ "overrides": [
1909
+ {
1910
+ "matcher": {
1911
+ "id": "byName",
1912
+ "options": "agent_name"
1913
+ },
1914
+ "properties": [
1915
+ {
1916
+ "id": "custom.width",
1917
+ "value": 224
1918
+ }
1919
+ ]
1920
+ }
1921
+ ]
1922
+ },
1923
+ "gridPos": {
1924
+ "h": 7,
1925
+ "w": 5,
1926
+ "x": 4,
1927
+ "y": 35
1928
+ },
1929
+ "id": 120,
1930
+ "links": [],
1931
+ "maxDataPoints": 3,
1932
+ "options": {
1933
+ "cellHeight": "sm",
1934
+ "footer": {
1935
+ "countRows": false,
1936
+ "fields": "",
1937
+ "reducer": ["sum"],
1938
+ "show": false
1939
+ },
1940
+ "showHeader": true,
1941
+ "sortBy": []
1942
+ },
1943
+ "pluginVersion": "10.0.2",
1944
+ "targets": [
1945
+ {
1946
+ "bucketAggs": [
1947
+ {
1948
+ "$$hashKey": "object:73",
1949
+ "fake": true,
1950
+ "field": "agent_name",
1951
+ "id": "3",
1952
+ "settings": {
1953
+ "min_doc_count": 1,
1954
+ "order": "desc",
1955
+ "orderBy": "_count",
1956
+ "size": "0"
1957
+ },
1958
+ "type": "terms"
1959
+ }
1960
+ ],
1961
+ "datasource": {
1962
+ "type": "elasticsearch",
1963
+ "uid": "wazuh_datasource_uid"
1964
+ },
1965
+ "metrics": [
1966
+ {
1967
+ "$$hashKey": "object:71",
1968
+ "field": "select field",
1969
+ "id": "1",
1970
+ "type": "count"
1971
+ }
1972
+ ],
1973
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
1974
+ "refId": "A",
1975
+ "timeField": "timestamp"
1976
+ }
1977
+ ],
1978
+ "title": "EVENTS BY AGENT",
1979
+ "transformations": [
1980
+ {
1981
+ "id": "organize",
1982
+ "options": {
1983
+ "excludeByName": {},
1984
+ "indexByName": {},
1985
+ "renameByName": {
1986
+ "agent_name": "AGENT"
1987
+ }
1988
+ }
1989
+ }
1990
+ ],
1991
+ "type": "table"
1992
+ },
1993
+ {
1994
+ "datasource": {
1995
+ "type": "elasticsearch",
1996
+ "uid": "wazuh_datasource_uid"
1997
+ },
1998
+ "fieldConfig": {
1999
+ "defaults": {
2000
+ "color": {
2001
+ "mode": "palette-classic"
2002
+ },
2003
+ "custom": {
2004
+ "hideFrom": {
2005
+ "legend": false,
2006
+ "tooltip": false,
2007
+ "viz": false
2008
+ }
2009
+ },
2010
+ "mappings": []
2011
+ },
2012
+ "overrides": [
2013
+ {
2014
+ "matcher": {
2015
+ "id": "byName",
2016
+ "options": "13"
2017
+ },
2018
+ "properties": [
2019
+ {
2020
+ "id": "color",
2021
+ "value": {
2022
+ "fixedColor": "red",
2023
+ "mode": "fixed"
2024
+ }
2025
+ }
2026
+ ]
2027
+ },
2028
+ {
2029
+ "matcher": {
2030
+ "id": "byName",
2031
+ "options": "3"
2032
+ },
2033
+ "properties": [
2034
+ {
2035
+ "id": "color",
2036
+ "value": {
2037
+ "fixedColor": "green",
2038
+ "mode": "fixed"
2039
+ }
2040
+ }
2041
+ ]
2042
+ },
2043
+ {
2044
+ "matcher": {
2045
+ "id": "byName",
2046
+ "options": "5"
2047
+ },
2048
+ "properties": [
2049
+ {
2050
+ "id": "color",
2051
+ "value": {
2052
+ "fixedColor": "yellow",
2053
+ "mode": "fixed"
2054
+ }
2055
+ }
2056
+ ]
2057
+ }
2058
+ ]
2059
+ },
2060
+ "gridPos": {
2061
+ "h": 7,
2062
+ "w": 5,
2063
+ "x": 9,
2064
+ "y": 35
2065
+ },
2066
+ "id": 124,
2067
+ "options": {
2068
+ "legend": {
2069
+ "displayMode": "table",
2070
+ "placement": "right",
2071
+ "showLegend": true
2072
+ },
2073
+ "pieType": "donut",
2074
+ "reduceOptions": {
2075
+ "calcs": ["sum"],
2076
+ "fields": "",
2077
+ "values": false
2078
+ },
2079
+ "tooltip": {
2080
+ "mode": "single",
2081
+ "sort": "none"
2082
+ }
2083
+ },
2084
+ "targets": [
2085
+ {
2086
+ "alias": "",
2087
+ "bucketAggs": [
2088
+ {
2089
+ "field": "rule_level",
2090
+ "id": "3",
2091
+ "settings": {
2092
+ "min_doc_count": "1",
2093
+ "order": "desc",
2094
+ "orderBy": "_count",
2095
+ "size": "10"
2096
+ },
2097
+ "type": "terms"
2098
+ },
2099
+ {
2100
+ "field": "timestamp",
2101
+ "id": "2",
2102
+ "settings": {
2103
+ "interval": "auto"
2104
+ },
2105
+ "type": "date_histogram"
2106
+ }
2107
+ ],
2108
+ "datasource": {
2109
+ "type": "elasticsearch",
2110
+ "uid": "wazuh_datasource_uid"
2111
+ },
2112
+ "metrics": [
2113
+ {
2114
+ "id": "1",
2115
+ "type": "count"
2116
+ }
2117
+ ],
2118
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
2119
+ "refId": "A",
2120
+ "timeField": "timestamp"
2121
+ }
2122
+ ],
2123
+ "title": "EVENTS BY SEVERITY",
2124
+ "type": "piechart"
2125
+ },
2126
+ {
2127
+ "datasource": {
2128
+ "type": "elasticsearch",
2129
+ "uid": "wazuh_datasource_uid"
2130
+ },
2131
+ "fieldConfig": {
2132
+ "defaults": {
2133
+ "custom": {
2134
+ "align": "auto",
2135
+ "cellOptions": {
2136
+ "type": "auto"
2137
+ },
2138
+ "filterable": false,
2139
+ "inspect": false
2140
+ },
2141
+ "mappings": [],
2142
+ "thresholds": {
2143
+ "mode": "absolute",
2144
+ "steps": [
2145
+ {
2146
+ "color": "orange",
2147
+ "value": null
2148
+ }
2149
+ ]
2150
+ }
2151
+ },
2152
+ "overrides": [
2153
+ {
2154
+ "matcher": {
2155
+ "id": "byName",
2156
+ "options": "Count"
2157
+ },
2158
+ "properties": [
2159
+ {
2160
+ "id": "custom.cellOptions",
2161
+ "value": {
2162
+ "mode": "basic",
2163
+ "type": "gauge"
2164
+ }
2165
+ }
2166
+ ]
2167
+ },
2168
+ {
2169
+ "matcher": {
2170
+ "id": "byName",
2171
+ "options": "rule_description"
2172
+ },
2173
+ "properties": [
2174
+ {
2175
+ "id": "custom.width",
2176
+ "value": 703
2177
+ }
2178
+ ]
2179
+ },
2180
+ {
2181
+ "matcher": {
2182
+ "id": "byName",
2183
+ "options": "rule_level"
2184
+ },
2185
+ "properties": [
2186
+ {
2187
+ "id": "custom.width",
2188
+ "value": 212
2189
+ },
2190
+ {
2191
+ "id": "mappings",
2192
+ "value": [
2193
+ {
2194
+ "options": {
2195
+ "from": 1,
2196
+ "result": {
2197
+ "color": "green",
2198
+ "index": 0
2199
+ },
2200
+ "to": 3
2201
+ },
2202
+ "type": "range"
2203
+ },
2204
+ {
2205
+ "options": {
2206
+ "from": 4,
2207
+ "result": {
2208
+ "color": "dark-yellow",
2209
+ "index": 1
2210
+ },
2211
+ "to": 6
2212
+ },
2213
+ "type": "range"
2214
+ },
2215
+ {
2216
+ "options": {
2217
+ "from": 7,
2218
+ "result": {
2219
+ "color": "orange",
2220
+ "index": 2
2221
+ },
2222
+ "to": 9
2223
+ },
2224
+ "type": "range"
2225
+ },
2226
+ {
2227
+ "options": {
2228
+ "from": 10,
2229
+ "result": {
2230
+ "color": "semi-dark-red",
2231
+ "index": 3
2232
+ },
2233
+ "to": 15
2234
+ },
2235
+ "type": "range"
2236
+ }
2237
+ ]
2238
+ }
2239
+ ]
2240
+ }
2241
+ ]
2242
+ },
2243
+ "gridPos": {
2244
+ "h": 7,
2245
+ "w": 10,
2246
+ "x": 14,
2247
+ "y": 35
2248
+ },
2249
+ "id": 121,
2250
+ "links": [],
2251
+ "maxDataPoints": 3,
2252
+ "options": {
2253
+ "cellHeight": "sm",
2254
+ "footer": {
2255
+ "countRows": false,
2256
+ "fields": "",
2257
+ "reducer": ["sum"],
2258
+ "show": false
2259
+ },
2260
+ "showHeader": true,
2261
+ "sortBy": []
2262
+ },
2263
+ "pluginVersion": "10.0.2",
2264
+ "targets": [
2265
+ {
2266
+ "bucketAggs": [
2267
+ {
2268
+ "$$hashKey": "object:3082",
2269
+ "fake": true,
2270
+ "field": "rule_groups",
2271
+ "id": "4",
2272
+ "settings": {
2273
+ "min_doc_count": "1",
2274
+ "order": "desc",
2275
+ "orderBy": "_count",
2276
+ "size": "10"
2277
+ },
2278
+ "type": "terms"
2279
+ }
2280
+ ],
2281
+ "datasource": {
2282
+ "type": "elasticsearch",
2283
+ "uid": "wazuh_datasource_uid"
2284
+ },
2285
+ "metrics": [
2286
+ {
2287
+ "$$hashKey": "object:71",
2288
+ "field": "select field",
2289
+ "id": "1",
2290
+ "type": "count"
2291
+ }
2292
+ ],
2293
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
2294
+ "refId": "A",
2295
+ "timeField": "timestamp"
2296
+ }
2297
+ ],
2298
+ "title": "EVENTS BY TYPE",
2299
+ "transformations": [
2300
+ {
2301
+ "id": "organize",
2302
+ "options": {
2303
+ "excludeByName": {},
2304
+ "indexByName": {},
2305
+ "renameByName": {
2306
+ "rule_groups": "RULE GROUPS"
2307
+ }
2308
+ }
2309
+ }
2310
+ ],
2311
+ "type": "table"
2312
+ },
2313
+ {
2314
+ "datasource": {
2315
+ "type": "elasticsearch",
2316
+ "uid": "wazuh_datasource_uid"
2317
+ },
2318
+ "fieldConfig": {
2319
+ "defaults": {
2320
+ "custom": {
2321
+ "align": "auto",
2322
+ "cellOptions": {
2323
+ "type": "auto"
2324
+ },
2325
+ "filterable": false,
2326
+ "inspect": false
2327
+ },
2328
+ "mappings": [],
2329
+ "thresholds": {
2330
+ "mode": "absolute",
2331
+ "steps": [
2332
+ {
2333
+ "color": "orange",
2334
+ "value": null
2335
+ }
2336
+ ]
2337
+ }
2338
+ },
2339
+ "overrides": [
2340
+ {
2341
+ "matcher": {
2342
+ "id": "byName",
2343
+ "options": "Count"
2344
+ },
2345
+ "properties": [
2346
+ {
2347
+ "id": "custom.cellOptions",
2348
+ "value": {
2349
+ "mode": "basic",
2350
+ "type": "gauge"
2351
+ }
2352
+ }
2353
+ ]
2354
+ },
2355
+ {
2356
+ "matcher": {
2357
+ "id": "byName",
2358
+ "options": "rule_description"
2359
+ },
2360
+ "properties": [
2361
+ {
2362
+ "id": "custom.width",
2363
+ "value": 703
2364
+ }
2365
+ ]
2366
+ },
2367
+ {
2368
+ "matcher": {
2369
+ "id": "byName",
2370
+ "options": "rule_level"
2371
+ },
2372
+ "properties": [
2373
+ {
2374
+ "id": "custom.width",
2375
+ "value": 212
2376
+ },
2377
+ {
2378
+ "id": "mappings",
2379
+ "value": [
2380
+ {
2381
+ "options": {
2382
+ "from": 1,
2383
+ "result": {
2384
+ "color": "green",
2385
+ "index": 0
2386
+ },
2387
+ "to": 3
2388
+ },
2389
+ "type": "range"
2390
+ },
2391
+ {
2392
+ "options": {
2393
+ "from": 4,
2394
+ "result": {
2395
+ "color": "dark-yellow",
2396
+ "index": 1
2397
+ },
2398
+ "to": 6
2399
+ },
2400
+ "type": "range"
2401
+ },
2402
+ {
2403
+ "options": {
2404
+ "from": 7,
2405
+ "result": {
2406
+ "color": "orange",
2407
+ "index": 2
2408
+ },
2409
+ "to": 9
2410
+ },
2411
+ "type": "range"
2412
+ },
2413
+ {
2414
+ "options": {
2415
+ "from": 10,
2416
+ "result": {
2417
+ "color": "semi-dark-red",
2418
+ "index": 3
2419
+ },
2420
+ "to": 15
2421
+ },
2422
+ "type": "range"
2423
+ }
2424
+ ]
2425
+ }
2426
+ ]
2427
+ }
2428
+ ]
2429
+ },
2430
+ "gridPos": {
2431
+ "h": 12,
2432
+ "w": 10,
2433
+ "x": 0,
2434
+ "y": 42
2435
+ },
2436
+ "id": 132,
2437
+ "links": [],
2438
+ "maxDataPoints": 3,
2439
+ "options": {
2440
+ "cellHeight": "sm",
2441
+ "footer": {
2442
+ "countRows": false,
2443
+ "fields": "",
2444
+ "reducer": ["sum"],
2445
+ "show": false
2446
+ },
2447
+ "showHeader": true,
2448
+ "sortBy": []
2449
+ },
2450
+ "pluginVersion": "10.0.2",
2451
+ "targets": [
2452
+ {
2453
+ "bucketAggs": [
2454
+ {
2455
+ "$$hashKey": "object:3082",
2456
+ "fake": true,
2457
+ "field": "data_win_eventdata_user",
2458
+ "id": "4",
2459
+ "settings": {
2460
+ "min_doc_count": "1",
2461
+ "order": "desc",
2462
+ "orderBy": "_count",
2463
+ "size": "100"
2464
+ },
2465
+ "type": "terms"
2466
+ }
2467
+ ],
2468
+ "datasource": {
2469
+ "type": "elasticsearch",
2470
+ "uid": "wazuh_datasource_uid"
2471
+ },
2472
+ "metrics": [
2473
+ {
2474
+ "$$hashKey": "object:71",
2475
+ "field": "select field",
2476
+ "id": "1",
2477
+ "type": "count"
2478
+ }
2479
+ ],
2480
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
2481
+ "refId": "A",
2482
+ "timeField": "timestamp"
2483
+ }
2484
+ ],
2485
+ "title": "EVENTS BY USER ACCT (Top 100)",
2486
+ "transformations": [
2487
+ {
2488
+ "id": "organize",
2489
+ "options": {
2490
+ "excludeByName": {},
2491
+ "indexByName": {},
2492
+ "renameByName": {
2493
+ "data_win_eventdata_user": "USER ACCOUNT",
2494
+ "rule_groups": "RULE GROUPS"
2495
+ }
2496
+ }
2497
+ }
2498
+ ],
2499
+ "type": "table"
2500
+ },
2501
+ {
2502
+ "datasource": {
2503
+ "type": "elasticsearch",
2504
+ "uid": "wazuh_datasource_uid"
2505
+ },
2506
+ "fieldConfig": {
2507
+ "defaults": {
2508
+ "custom": {
2509
+ "align": "auto",
2510
+ "cellOptions": {
2511
+ "type": "auto"
2512
+ },
2513
+ "filterable": false,
2514
+ "inspect": false
2515
+ },
2516
+ "mappings": [],
2517
+ "thresholds": {
2518
+ "mode": "absolute",
2519
+ "steps": [
2520
+ {
2521
+ "color": "orange",
2522
+ "value": null
2523
+ }
2524
+ ]
2525
+ }
2526
+ },
2527
+ "overrides": [
2528
+ {
2529
+ "matcher": {
2530
+ "id": "byName",
2531
+ "options": "Count"
2532
+ },
2533
+ "properties": [
2534
+ {
2535
+ "id": "custom.cellOptions",
2536
+ "value": {
2537
+ "mode": "basic",
2538
+ "type": "gauge"
2539
+ }
2540
+ }
2541
+ ]
2542
+ },
2543
+ {
2544
+ "matcher": {
2545
+ "id": "byName",
2546
+ "options": "rule_description"
2547
+ },
2548
+ "properties": [
2549
+ {
2550
+ "id": "custom.width",
2551
+ "value": 703
2552
+ }
2553
+ ]
2554
+ },
2555
+ {
2556
+ "matcher": {
2557
+ "id": "byName",
2558
+ "options": "rule_level"
2559
+ },
2560
+ "properties": [
2561
+ {
2562
+ "id": "custom.width",
2563
+ "value": 212
2564
+ },
2565
+ {
2566
+ "id": "mappings",
2567
+ "value": [
2568
+ {
2569
+ "options": {
2570
+ "from": 1,
2571
+ "result": {
2572
+ "color": "green",
2573
+ "index": 0
2574
+ },
2575
+ "to": 3
2576
+ },
2577
+ "type": "range"
2578
+ },
2579
+ {
2580
+ "options": {
2581
+ "from": 4,
2582
+ "result": {
2583
+ "color": "dark-yellow",
2584
+ "index": 1
2585
+ },
2586
+ "to": 6
2587
+ },
2588
+ "type": "range"
2589
+ },
2590
+ {
2591
+ "options": {
2592
+ "from": 7,
2593
+ "result": {
2594
+ "color": "orange",
2595
+ "index": 2
2596
+ },
2597
+ "to": 9
2598
+ },
2599
+ "type": "range"
2600
+ },
2601
+ {
2602
+ "options": {
2603
+ "from": 10,
2604
+ "result": {
2605
+ "color": "semi-dark-red",
2606
+ "index": 3
2607
+ },
2608
+ "to": 15
2609
+ },
2610
+ "type": "range"
2611
+ }
2612
+ ]
2613
+ }
2614
+ ]
2615
+ },
2616
+ {
2617
+ "matcher": {
2618
+ "id": "byName",
2619
+ "options": "syscheck_path"
2620
+ },
2621
+ "properties": [
2622
+ {
2623
+ "id": "custom.width",
2624
+ "value": 708
2625
+ }
2626
+ ]
2627
+ }
2628
+ ]
2629
+ },
2630
+ "gridPos": {
2631
+ "h": 12,
2632
+ "w": 14,
2633
+ "x": 10,
2634
+ "y": 42
2635
+ },
2636
+ "id": 133,
2637
+ "links": [],
2638
+ "maxDataPoints": 3,
2639
+ "options": {
2640
+ "cellHeight": "sm",
2641
+ "footer": {
2642
+ "countRows": false,
2643
+ "fields": "",
2644
+ "reducer": ["sum"],
2645
+ "show": false
2646
+ },
2647
+ "frameIndex": 1,
2648
+ "showHeader": true,
2649
+ "sortBy": []
2650
+ },
2651
+ "pluginVersion": "10.0.2",
2652
+ "targets": [
2653
+ {
2654
+ "bucketAggs": [
2655
+ {
2656
+ "$$hashKey": "object:3082",
2657
+ "fake": true,
2658
+ "field": "data_win_eventdata_targetObject",
2659
+ "id": "4",
2660
+ "settings": {
2661
+ "min_doc_count": "1",
2662
+ "order": "desc",
2663
+ "orderBy": "_count",
2664
+ "size": "100"
2665
+ },
2666
+ "type": "terms"
2667
+ }
2668
+ ],
2669
+ "datasource": {
2670
+ "type": "elasticsearch",
2671
+ "uid": "wazuh_datasource_uid"
2672
+ },
2673
+ "metrics": [
2674
+ {
2675
+ "$$hashKey": "object:71",
2676
+ "field": "select field",
2677
+ "id": "1",
2678
+ "type": "count"
2679
+ }
2680
+ ],
2681
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
2682
+ "refId": "A",
2683
+ "timeField": "timestamp"
2684
+ },
2685
+ {
2686
+ "alias": "",
2687
+ "bucketAggs": [
2688
+ {
2689
+ "field": "syscheck_path",
2690
+ "id": "2",
2691
+ "settings": {
2692
+ "min_doc_count": "1",
2693
+ "order": "desc",
2694
+ "orderBy": "_term",
2695
+ "size": "10"
2696
+ },
2697
+ "type": "terms"
2698
+ }
2699
+ ],
2700
+ "datasource": {
2701
+ "type": "elasticsearch",
2702
+ "uid": "wazuh_datasource_uid"
2703
+ },
2704
+ "hide": false,
2705
+ "metrics": [
2706
+ {
2707
+ "id": "1",
2708
+ "type": "count"
2709
+ }
2710
+ ],
2711
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
2712
+ "refId": "B",
2713
+ "timeField": "timestamp"
2714
+ }
2715
+ ],
2716
+ "title": "EVENTS BY REGISTRY OBJECT (Top 100)",
2717
+ "transformations": [
2718
+ {
2719
+ "id": "organize",
2720
+ "options": {
2721
+ "excludeByName": {},
2722
+ "indexByName": {},
2723
+ "renameByName": {
2724
+ "data_win_eventdata_targetObject": "REGISTRY OBJECT",
2725
+ "data_win_eventdata_user": "USER ACCOUNT",
2726
+ "rule_groups": "RULE GROUPS"
2727
+ }
2728
+ }
2729
+ }
2730
+ ],
2731
+ "type": "table"
2732
+ },
2733
+ {
2734
+ "datasource": {
2735
+ "type": "elasticsearch",
2736
+ "uid": "wazuh_datasource_uid"
2737
+ },
2738
+ "fieldConfig": {
2739
+ "defaults": {
2740
+ "color": {
2741
+ "mode": "thresholds"
2742
+ },
2743
+ "custom": {
2744
+ "align": "auto",
2745
+ "cellOptions": {
2746
+ "type": "auto"
2747
+ },
2748
+ "inspect": false
2749
+ },
2750
+ "mappings": [],
2751
+ "thresholds": {
2752
+ "mode": "absolute",
2753
+ "steps": [
2754
+ {
2755
+ "color": "red",
2756
+ "value": null
2757
+ }
2758
+ ]
2759
+ }
2760
+ },
2761
+ "overrides": [
2762
+ {
2763
+ "matcher": {
2764
+ "id": "byName",
2765
+ "options": "rule_level"
2766
+ },
2767
+ "properties": [
2768
+ {
2769
+ "id": "custom.width",
2770
+ "value": 93
2771
+ }
2772
+ ]
2773
+ },
2774
+ {
2775
+ "matcher": {
2776
+ "id": "byName",
2777
+ "options": "DATE/TIME"
2778
+ },
2779
+ "properties": [
2780
+ {
2781
+ "id": "custom.width",
2782
+ "value": 202
2783
+ }
2784
+ ]
2785
+ },
2786
+ {
2787
+ "matcher": {
2788
+ "id": "byName",
2789
+ "options": "AGENT"
2790
+ },
2791
+ "properties": [
2792
+ {
2793
+ "id": "custom.width",
2794
+ "value": 171
2795
+ }
2796
+ ]
2797
+ },
2798
+ {
2799
+ "matcher": {
2800
+ "id": "byName",
2801
+ "options": "SRC IP"
2802
+ },
2803
+ "properties": [
2804
+ {
2805
+ "id": "custom.width",
2806
+ "value": 167
2807
+ }
2808
+ ]
2809
+ },
2810
+ {
2811
+ "matcher": {
2812
+ "id": "byName",
2813
+ "options": "rule_description"
2814
+ },
2815
+ "properties": [
2816
+ {
2817
+ "id": "custom.width",
2818
+ "value": 524
2819
+ }
2820
+ ]
2821
+ },
2822
+ {
2823
+ "matcher": {
2824
+ "id": "byName",
2825
+ "options": "RULE LEVEL"
2826
+ },
2827
+ "properties": [
2828
+ {
2829
+ "id": "custom.width",
2830
+ "value": 96
2831
+ }
2832
+ ]
2833
+ },
2834
+ {
2835
+ "matcher": {
2836
+ "id": "byName",
2837
+ "options": "IoC"
2838
+ },
2839
+ "properties": [
2840
+ {
2841
+ "id": "custom.cellOptions",
2842
+ "value": {
2843
+ "type": "color-text"
2844
+ }
2845
+ }
2846
+ ]
2847
+ },
2848
+ {
2849
+ "matcher": {
2850
+ "id": "byName",
2851
+ "options": "LABEL"
2852
+ },
2853
+ "properties": [
2854
+ {
2855
+ "id": "custom.width",
2856
+ "value": 93
2857
+ }
2858
+ ]
2859
+ },
2860
+ {
2861
+ "matcher": {
2862
+ "id": "byName",
2863
+ "options": "EVENT ID"
2864
+ },
2865
+ "properties": [
2866
+ {
2867
+ "id": "links",
2868
+ "value": [
2869
+ {
2870
+ "targetBlank": true,
2871
+ "title": "VIEW EVENT DETAILS",
2872
+ "url": "https://grafana.company.local/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
2873
+ }
2874
+ ]
2875
+ },
2876
+ {
2877
+ "id": "custom.width",
2878
+ "value": 319
2879
+ }
2880
+ ]
2881
+ },
2882
+ {
2883
+ "matcher": {
2884
+ "id": "byName",
2885
+ "options": "LEVEL"
2886
+ },
2887
+ "properties": [
2888
+ {
2889
+ "id": "custom.width",
2890
+ "value": 100
2891
+ }
2892
+ ]
2893
+ },
2894
+ {
2895
+ "matcher": {
2896
+ "id": "byName",
2897
+ "options": "REGISTRY OPERATION"
2898
+ },
2899
+ "properties": [
2900
+ {
2901
+ "id": "custom.width",
2902
+ "value": 261
2903
+ }
2904
+ ]
2905
+ }
2906
+ ]
2907
+ },
2908
+ "gridPos": {
2909
+ "h": 10,
2910
+ "w": 24,
2911
+ "x": 0,
2912
+ "y": 54
2913
+ },
2914
+ "id": 122,
2915
+ "options": {
2916
+ "cellHeight": "sm",
2917
+ "footer": {
2918
+ "countRows": false,
2919
+ "fields": "",
2920
+ "reducer": ["sum"],
2921
+ "show": false
2922
+ },
2923
+ "showHeader": true,
2924
+ "sortBy": []
2925
+ },
2926
+ "pluginVersion": "10.0.2",
2927
+ "targets": [
2928
+ {
2929
+ "alias": "",
2930
+ "bucketAggs": [],
2931
+ "datasource": {
2932
+ "type": "elasticsearch",
2933
+ "uid": "wazuh_datasource_uid"
2934
+ },
2935
+ "metrics": [
2936
+ {
2937
+ "id": "1",
2938
+ "settings": {
2939
+ "size": "500"
2940
+ },
2941
+ "type": "raw_data"
2942
+ }
2943
+ ],
2944
+ "query": "(rule_group3:sysmon_event_12 OR rule_group3:sysmon_event_13 OR rule_groups:*syscheck_registry) AND rule_level:$rule_level",
2945
+ "queryType": "lucene",
2946
+ "refId": "A",
2947
+ "timeField": "timestamp"
2948
+ }
2949
+ ],
2950
+ "title": "WINDOWS REGISTRY EVENTS",
2951
+ "transformations": [
2952
+ {
2953
+ "id": "organize",
2954
+ "options": {
2955
+ "excludeByName": {
2956
+ "@metadata_beat": true,
2957
+ "@metadata_type": true,
2958
+ "@metadata_version": true,
2959
+ "_id": false,
2960
+ "_index": true,
2961
+ "_type": true,
2962
+ "agent_ephemeral_id": true,
2963
+ "agent_hostname": true,
2964
+ "agent_id": true,
2965
+ "agent_ip": false,
2966
+ "agent_ip_city_name": true,
2967
+ "agent_ip_country_code": true,
2968
+ "agent_ip_geolocation": true,
2969
+ "agent_ip_reserved_ip": true,
2970
+ "agent_labels_customer": true,
2971
+ "agent_name": false,
2972
+ "agent_type": true,
2973
+ "agent_version": true,
2974
+ "beats_type": true,
2975
+ "cluster_name": true,
2976
+ "cluster_node": true,
2977
+ "collector_node_id": true,
2978
+ "data_base_indicator_access_type": true,
2979
+ "data_base_indicator_id": false,
2980
+ "data_base_indicator_indicator_city_name": true,
2981
+ "data_base_indicator_indicator_country_code": true,
2982
+ "data_base_indicator_indicator_geolocation": true,
2983
+ "data_integration": true,
2984
+ "data_opencti_0_node_color": true,
2985
+ "data_opencti_0_node_id": true,
2986
+ "data_opencti_1_node_color": true,
2987
+ "data_opencti_1_node_id": true,
2988
+ "data_opencti_2_node_color": true,
2989
+ "data_opencti_2_node_id": true,
2990
+ "data_opencti_3_node_color": true,
2991
+ "data_opencti_3_node_id": true,
2992
+ "data_opencti_4_node_color": true,
2993
+ "data_opencti_4_node_id": true,
2994
+ "data_opencti_5_node_color": true,
2995
+ "data_opencti_5_node_id": true,
2996
+ "data_opencti_atime": true,
2997
+ "data_opencti_createdBy": true,
2998
+ "data_opencti_createdBy_contact_information": true,
2999
+ "data_opencti_createdBy_created": true,
3000
+ "data_opencti_createdBy_description": true,
3001
+ "data_opencti_createdBy_entity_type": true,
3002
+ "data_opencti_createdBy_id": true,
3003
+ "data_opencti_createdBy_identity_class": true,
3004
+ "data_opencti_createdBy_modified": true,
3005
+ "data_opencti_createdBy_name": false,
3006
+ "data_opencti_createdBy_parent_types": true,
3007
+ "data_opencti_createdBy_roles": true,
3008
+ "data_opencti_createdBy_spec_version": true,
3009
+ "data_opencti_createdBy_standard_id": true,
3010
+ "data_opencti_createdBy_x_opencti_aliases": true,
3011
+ "data_opencti_createdBy_x_opencti_organization_type": true,
3012
+ "data_opencti_createdBy_x_opencti_reliability": true,
3013
+ "data_opencti_created_at": true,
3014
+ "data_opencti_ctime": true,
3015
+ "data_opencti_error": true,
3016
+ "data_opencti_extensions": true,
3017
+ "data_opencti_hashes": true,
3018
+ "data_opencti_id": true,
3019
+ "data_opencti_indicators_edges": true,
3020
+ "data_opencti_mime_type": true,
3021
+ "data_opencti_mtime": true,
3022
+ "data_opencti_objectLabel_edges": true,
3023
+ "data_opencti_objectMarking_edges": true,
3024
+ "data_opencti_observable_value": true,
3025
+ "data_opencti_observable_value_city_name": true,
3026
+ "data_opencti_observable_value_country_code": true,
3027
+ "data_opencti_observable_value_geolocation": true,
3028
+ "data_opencti_parent_types": true,
3029
+ "data_opencti_size": true,
3030
+ "data_opencti_spec_version": true,
3031
+ "data_opencti_standard_id": true,
3032
+ "data_opencti_updated_at": true,
3033
+ "data_opencti_value_city_name": true,
3034
+ "data_opencti_value_country_code": true,
3035
+ "data_opencti_value_geolocation": true,
3036
+ "data_opencti_x_opencti_additional_names": true,
3037
+ "data_opencti_x_opencti_description": true,
3038
+ "data_type": true,
3039
+ "data_win_eventdata_details": true,
3040
+ "data_win_eventdata_domain": true,
3041
+ "data_win_eventdata_eventType": true,
3042
+ "data_win_eventdata_image": true,
3043
+ "data_win_eventdata_imagePath": true,
3044
+ "data_win_eventdata_processGuid": true,
3045
+ "data_win_eventdata_processId": true,
3046
+ "data_win_eventdata_queryName": true,
3047
+ "data_win_eventdata_queryResults": true,
3048
+ "data_win_eventdata_queryStatus": true,
3049
+ "data_win_eventdata_ruleName": true,
3050
+ "data_win_eventdata_sID": true,
3051
+ "data_win_eventdata_serviceName": true,
3052
+ "data_win_eventdata_serviceType": true,
3053
+ "data_win_eventdata_startType": true,
3054
+ "data_win_eventdata_targetObject": true,
3055
+ "data_win_eventdata_timestamp": true,
3056
+ "data_win_eventdata_user": true,
3057
+ "data_win_eventdata_utcTime": true,
3058
+ "data_win_system_channel": true,
3059
+ "data_win_system_computer": true,
3060
+ "data_win_system_eventID": true,
3061
+ "data_win_system_eventRecordID": true,
3062
+ "data_win_system_eventSourceName": true,
3063
+ "data_win_system_keywords": true,
3064
+ "data_win_system_level": true,
3065
+ "data_win_system_opcode": true,
3066
+ "data_win_system_processID": true,
3067
+ "data_win_system_providerGuid": true,
3068
+ "data_win_system_providerName": true,
3069
+ "data_win_system_severityValue": true,
3070
+ "data_win_system_systemTime": true,
3071
+ "data_win_system_task": true,
3072
+ "data_win_system_threadID": true,
3073
+ "data_win_system_version": true,
3074
+ "decoder_name": true,
3075
+ "dns_answer": true,
3076
+ "dns_query": true,
3077
+ "dns_response_code": true,
3078
+ "ecs_version": true,
3079
+ "event_type": true,
3080
+ "full_log": true,
3081
+ "gl2_accounted_message_size": true,
3082
+ "gl2_message_id": true,
3083
+ "gl2_processing_error": true,
3084
+ "gl2_remote_ip": true,
3085
+ "gl2_remote_port": true,
3086
+ "gl2_source_collector": true,
3087
+ "gl2_source_input": true,
3088
+ "gl2_source_node": true,
3089
+ "highlight": true,
3090
+ "host_name": true,
3091
+ "id": true,
3092
+ "location": true,
3093
+ "log_file_path": true,
3094
+ "log_offset": true,
3095
+ "manager_name": true,
3096
+ "message": true,
3097
+ "misp_Event.distribution": true,
3098
+ "misp_Event.id": true,
3099
+ "misp_Event.info": true,
3100
+ "misp_Event.org_id": true,
3101
+ "misp_Event.orgc_id": true,
3102
+ "misp_Event.uuid": true,
3103
+ "misp_Object.distribution": true,
3104
+ "misp_Object.id": true,
3105
+ "misp_Object.sharing_group_id": true,
3106
+ "misp_category": true,
3107
+ "misp_deleted": true,
3108
+ "misp_disable_correlation": true,
3109
+ "misp_distribution": true,
3110
+ "misp_event_id": true,
3111
+ "misp_id": true,
3112
+ "misp_object_id": true,
3113
+ "misp_object_relation": true,
3114
+ "misp_sharing_group_id": true,
3115
+ "misp_timestamp": true,
3116
+ "misp_to_ids": true,
3117
+ "misp_type": true,
3118
+ "misp_uuid": true,
3119
+ "misp_value": true,
3120
+ "msg_timestamp": true,
3121
+ "opencti_base_type": true,
3122
+ "opencti_created_at": false,
3123
+ "opencti_hashes.MD5": true,
3124
+ "opencti_hashes.SHA-1": true,
3125
+ "opencti_hashes.SHA-256": true,
3126
+ "opencti_i_created_at_day": true,
3127
+ "opencti_i_created_at_month": true,
3128
+ "opencti_i_created_at_year": true,
3129
+ "opencti_id": true,
3130
+ "opencti_internal_id": true,
3131
+ "opencti_modified": true,
3132
+ "opencti_name": true,
3133
+ "opencti_parent_types": true,
3134
+ "opencti_rel_based-on_internal_id": true,
3135
+ "opencti_rel_created-by_internal_id": true,
3136
+ "opencti_rel_external-reference_internal_id": true,
3137
+ "opencti_rel_object-label_internal_id": true,
3138
+ "opencti_rel_object-marking_internal_id": true,
3139
+ "opencti_rel_object_internal_id": true,
3140
+ "opencti_size": true,
3141
+ "opencti_spec_version": true,
3142
+ "opencti_standard_id": true,
3143
+ "opencti_updated_at": true,
3144
+ "opencti_x_opencti_additional_names": true,
3145
+ "opencti_x_opencti_description": false,
3146
+ "opencti_x_opencti_score": true,
3147
+ "opencti_x_opencti_stix_ids": true,
3148
+ "previous_output": true,
3149
+ "process_id": true,
3150
+ "process_image": true,
3151
+ "rule_description": true,
3152
+ "rule_firedtimes": true,
3153
+ "rule_frequency": true,
3154
+ "rule_gdpr": true,
3155
+ "rule_gpg13": true,
3156
+ "rule_group1": true,
3157
+ "rule_group2": true,
3158
+ "rule_group3": false,
3159
+ "rule_groups": true,
3160
+ "rule_hipaa": true,
3161
+ "rule_id": true,
3162
+ "rule_mail": true,
3163
+ "rule_mitre_id": true,
3164
+ "rule_mitre_tactic": true,
3165
+ "rule_mitre_technique": true,
3166
+ "rule_nist_800_53": true,
3167
+ "rule_pci_dss": true,
3168
+ "rule_tsc": true,
3169
+ "sha256": true,
3170
+ "sort": true,
3171
+ "source": true,
3172
+ "source_reserved_ip": true,
3173
+ "src_ip": true,
3174
+ "src_ip_city_name": true,
3175
+ "src_ip_country_code": true,
3176
+ "src_ip_geolocation": true,
3177
+ "streams": true,
3178
+ "syscheck_arch": true,
3179
+ "syscheck_event": true,
3180
+ "syscheck_gid_after": true,
3181
+ "syscheck_gname_after": true,
3182
+ "syscheck_md5_after": true,
3183
+ "syscheck_mode": true,
3184
+ "syscheck_mtime_after": true,
3185
+ "syscheck_sha1_after": true,
3186
+ "syscheck_sha256_after": true,
3187
+ "syscheck_size_after": true,
3188
+ "syscheck_uid_after": true,
3189
+ "syscheck_uname_after": true,
3190
+ "syscheck_value_name": true,
3191
+ "syscheck_win_perm_after": true,
3192
+ "syslog_tag": true,
3193
+ "syslog_type": true,
3194
+ "target_object": true,
3195
+ "timestamp": false,
3196
+ "timestamp_utc": true,
3197
+ "true": true,
3198
+ "user_name": true,
3199
+ "win_system_eventID": true,
3200
+ "windows_event_id": true,
3201
+ "windows_event_severity": false
3202
+ },
3203
+ "indexByName": {
3204
+ "_id": 1,
3205
+ "_index": 3,
3206
+ "_type": 4,
3207
+ "agent_id": 5,
3208
+ "agent_ip": 6,
3209
+ "agent_labels_customer": 33,
3210
+ "agent_name": 2,
3211
+ "data_integration": 34,
3212
+ "data_opencti_0_node_color": 35,
3213
+ "data_opencti_0_node_id": 36,
3214
+ "data_opencti_0_node_value": 37,
3215
+ "data_opencti_1_node_color": 38,
3216
+ "data_opencti_1_node_id": 39,
3217
+ "data_opencti_1_node_value": 40,
3218
+ "data_opencti_atime": 69,
3219
+ "data_opencti_createdBy": 70,
3220
+ "data_opencti_createdBy_contact_information": 41,
3221
+ "data_opencti_createdBy_created": 42,
3222
+ "data_opencti_createdBy_description": 71,
3223
+ "data_opencti_createdBy_entity_type": 43,
3224
+ "data_opencti_createdBy_id": 44,
3225
+ "data_opencti_createdBy_identity_class": 45,
3226
+ "data_opencti_createdBy_modified": 46,
3227
+ "data_opencti_createdBy_name": 9,
3228
+ "data_opencti_createdBy_parent_types": 47,
3229
+ "data_opencti_createdBy_roles": 48,
3230
+ "data_opencti_createdBy_spec_version": 49,
3231
+ "data_opencti_createdBy_standard_id": 50,
3232
+ "data_opencti_createdBy_x_opencti_aliases": 10,
3233
+ "data_opencti_createdBy_x_opencti_organization_type": 51,
3234
+ "data_opencti_createdBy_x_opencti_reliability": 52,
3235
+ "data_opencti_created_at": 53,
3236
+ "data_opencti_ctime": 72,
3237
+ "data_opencti_entity_type": 8,
3238
+ "data_opencti_extensions": 73,
3239
+ "data_opencti_hashes": 74,
3240
+ "data_opencti_id": 54,
3241
+ "data_opencti_indicators_edges": 55,
3242
+ "data_opencti_mime_type": 75,
3243
+ "data_opencti_mtime": 76,
3244
+ "data_opencti_name": 77,
3245
+ "data_opencti_objectLabel_edges": 56,
3246
+ "data_opencti_objectMarking_edges": 57,
3247
+ "data_opencti_observable_value": 58,
3248
+ "data_opencti_parent_types": 59,
3249
+ "data_opencti_size": 78,
3250
+ "data_opencti_spec_version": 60,
3251
+ "data_opencti_standard_id": 61,
3252
+ "data_opencti_updated_at": 62,
3253
+ "data_opencti_value": 7,
3254
+ "data_opencti_x_opencti_additional_names": 79,
3255
+ "data_opencti_x_opencti_description": 63,
3256
+ "data_opencti_x_opencti_score": 64,
3257
+ "decoder_name": 11,
3258
+ "gl2_accounted_message_size": 12,
3259
+ "gl2_message_id": 13,
3260
+ "gl2_processing_error": 65,
3261
+ "gl2_remote_ip": 14,
3262
+ "gl2_remote_port": 15,
3263
+ "gl2_source_input": 16,
3264
+ "gl2_source_node": 17,
3265
+ "highlight": 18,
3266
+ "id": 19,
3267
+ "location": 20,
3268
+ "manager_name": 21,
3269
+ "message": 22,
3270
+ "rule_description": 23,
3271
+ "rule_firedtimes": 24,
3272
+ "rule_group1": 66,
3273
+ "rule_group2": 67,
3274
+ "rule_group3": 68,
3275
+ "rule_groups": 25,
3276
+ "rule_id": 26,
3277
+ "rule_level": 27,
3278
+ "rule_mail": 28,
3279
+ "sort": 29,
3280
+ "source": 30,
3281
+ "streams": 31,
3282
+ "syslog_level": 80,
3283
+ "syslog_type": 32,
3284
+ "timestamp": 0,
3285
+ "true": 81
3286
+ },
3287
+ "renameByName": {
3288
+ "_id": "EVENT ID",
3289
+ "_type": "",
3290
+ "agent_ip": "SRC IP",
3291
+ "agent_name": "AGENT",
3292
+ "data_base_indicator_access_type": "",
3293
+ "data_base_indicator_id": "OTX IoC ID",
3294
+ "data_base_indicator_indicator": "IoC",
3295
+ "data_base_indicator_indicator_country_code": "",
3296
+ "data_base_indicator_type": "IoC TYPE",
3297
+ "data_opencti_0_node_value": "LABEL",
3298
+ "data_opencti_1_node_value": "LABEL",
3299
+ "data_opencti_2_node_value": "LABEL",
3300
+ "data_opencti_3_node_value": "LABEL",
3301
+ "data_opencti_4_node_value": "LABEL",
3302
+ "data_opencti_5_node_value": "LABEL",
3303
+ "data_opencti_createdBy_contact_information": "",
3304
+ "data_opencti_createdBy_name": "SECURITY FEED",
3305
+ "data_opencti_createdBy_x_opencti_aliases": "",
3306
+ "data_opencti_entity_type": "TYPE",
3307
+ "data_opencti_value": "IoC",
3308
+ "data_opencti_x_opencti_description": "",
3309
+ "data_opencti_x_opencti_score": "SCORE",
3310
+ "data_sections": "OTX SECTIONS",
3311
+ "data_type": "",
3312
+ "data_win_system_message": "MESSAGE",
3313
+ "data_win_system_providerGuid": "",
3314
+ "opencti_created_at": "IoC CREATE AT",
3315
+ "opencti_entity_type": "TYPE",
3316
+ "opencti_value": "IoC",
3317
+ "opencti_x_opencti_description": "COMMENTS",
3318
+ "rule_group3": "REGISTRY OPERATION",
3319
+ "rule_level": "RULE LEVEL",
3320
+ "syscheck_path": "REGISTRY PATH",
3321
+ "syslog_level": "LEVEL",
3322
+ "timestamp": "DATE/TIME",
3323
+ "windows_event_severity": "EVENT LOG SEVERITY"
3324
+ }
3325
+ }
3326
+ }
3327
+ ],
3328
+ "transparent": true,
3329
+ "type": "table"
3330
+ }
3331
+ ],
3332
+ "title": "WINDOWS REGISTRY INTEGRITY MONITORING",
3333
+ "type": "row"
3334
+ },
3335
+ {
3336
+ "collapsed": true,
3337
+ "gridPos": {
3338
+ "h": 1,
3339
+ "w": 24,
3340
+ "x": 0,
3341
+ "y": 35
3342
+ },
3343
+ "id": 126,
3344
+ "panels": [
3345
+ {
3346
+ "datasource": {
3347
+ "type": "elasticsearch",
3348
+ "uid": "wazuh_datasource_uid"
3349
+ },
3350
+ "fieldConfig": {
3351
+ "defaults": {
3352
+ "mappings": [
3353
+ {
3354
+ "options": {
3355
+ "match": "null",
3356
+ "result": {
3357
+ "text": "N/A"
3358
+ }
3359
+ },
3360
+ "type": "special"
3361
+ }
3362
+ ],
3363
+ "thresholds": {
3364
+ "mode": "absolute",
3365
+ "steps": [
3366
+ {
3367
+ "color": "blue",
3368
+ "value": null
3369
+ }
3370
+ ]
3371
+ },
3372
+ "unit": "short"
3373
+ },
3374
+ "overrides": []
3375
+ },
3376
+ "gridPos": {
3377
+ "h": 7,
3378
+ "w": 4,
3379
+ "x": 0,
3380
+ "y": 36
3381
+ },
3382
+ "id": 127,
3383
+ "links": [],
3384
+ "options": {
3385
+ "colorMode": "value",
3386
+ "graphMode": "area",
3387
+ "justifyMode": "auto",
3388
+ "orientation": "horizontal",
3389
+ "reduceOptions": {
3390
+ "calcs": ["sum"],
3391
+ "fields": "",
3392
+ "values": false
3393
+ },
3394
+ "text": {},
3395
+ "textMode": "auto"
3396
+ },
3397
+ "pluginVersion": "10.0.2",
3398
+ "targets": [
3399
+ {
3400
+ "bucketAggs": [
3401
+ {
3402
+ "$$hashKey": "object:50",
3403
+ "field": "timestamp",
3404
+ "id": "2",
3405
+ "settings": {
3406
+ "interval": "auto",
3407
+ "min_doc_count": 0,
3408
+ "trimEdges": 0
3409
+ },
3410
+ "type": "date_histogram"
3411
+ }
3412
+ ],
3413
+ "datasource": {
3414
+ "type": "elasticsearch",
3415
+ "uid": "wazuh_datasource_uid"
3416
+ },
3417
+ "metrics": [
3418
+ {
3419
+ "$$hashKey": "object:48",
3420
+ "field": "select field",
3421
+ "id": "1",
3422
+ "type": "count"
3423
+ }
3424
+ ],
3425
+ "query": "(rule_group3:sysmon_event_11 OR rule_groups:*syscheck_file) AND rule_level:$rule_level",
3426
+ "refId": "A",
3427
+ "timeField": "timestamp"
3428
+ }
3429
+ ],
3430
+ "title": "FIM - EVENTS",
3431
+ "type": "stat"
3432
+ },
3433
+ {
3434
+ "datasource": {
3435
+ "type": "elasticsearch",
3436
+ "uid": "wazuh_datasource_uid"
3437
+ },
3438
+ "fieldConfig": {
3439
+ "defaults": {
3440
+ "custom": {
3441
+ "align": "auto",
3442
+ "cellOptions": {
3443
+ "type": "auto"
3444
+ },
3445
+ "filterable": false,
3446
+ "inspect": false
3447
+ },
3448
+ "mappings": [],
3449
+ "thresholds": {
3450
+ "mode": "absolute",
3451
+ "steps": [
3452
+ {
3453
+ "color": "green",
3454
+ "value": null
3455
+ },
3456
+ {
3457
+ "color": "red",
3458
+ "value": 80
3459
+ }
3460
+ ]
3461
+ }
3462
+ },
3463
+ "overrides": [
3464
+ {
3465
+ "matcher": {
3466
+ "id": "byName",
3467
+ "options": "agent_name"
3468
+ },
3469
+ "properties": [
3470
+ {
3471
+ "id": "custom.width",
3472
+ "value": 224
3473
+ }
3474
+ ]
3475
+ }
3476
+ ]
3477
+ },
3478
+ "gridPos": {
3479
+ "h": 7,
3480
+ "w": 5,
3481
+ "x": 4,
3482
+ "y": 36
3483
+ },
3484
+ "id": 128,
3485
+ "links": [],
3486
+ "maxDataPoints": 3,
3487
+ "options": {
3488
+ "cellHeight": "sm",
3489
+ "footer": {
3490
+ "countRows": false,
3491
+ "fields": "",
3492
+ "reducer": ["sum"],
3493
+ "show": false
3494
+ },
3495
+ "showHeader": true,
3496
+ "sortBy": []
3497
+ },
3498
+ "pluginVersion": "10.0.2",
3499
+ "targets": [
3500
+ {
3501
+ "bucketAggs": [
3502
+ {
3503
+ "$$hashKey": "object:73",
3504
+ "fake": true,
3505
+ "field": "agent_name",
3506
+ "id": "3",
3507
+ "settings": {
3508
+ "min_doc_count": 1,
3509
+ "order": "desc",
3510
+ "orderBy": "_count",
3511
+ "size": "0"
3512
+ },
3513
+ "type": "terms"
3514
+ }
3515
+ ],
3516
+ "datasource": {
3517
+ "type": "elasticsearch",
3518
+ "uid": "wazuh_datasource_uid"
3519
+ },
3520
+ "metrics": [
3521
+ {
3522
+ "$$hashKey": "object:71",
3523
+ "field": "select field",
3524
+ "id": "1",
3525
+ "type": "count"
3526
+ }
3527
+ ],
3528
+ "query": "(rule_group3:sysmon_event_11 OR rule_groups:*syscheck_file) AND rule_level:$rule_level",
3529
+ "refId": "A",
3530
+ "timeField": "timestamp"
3531
+ }
3532
+ ],
3533
+ "title": "FIM - EVENTS BY AGENT",
3534
+ "transformations": [
3535
+ {
3536
+ "id": "organize",
3537
+ "options": {
3538
+ "excludeByName": {},
3539
+ "indexByName": {},
3540
+ "renameByName": {
3541
+ "agent_name": "AGENT"
3542
+ }
3543
+ }
3544
+ }
3545
+ ],
3546
+ "type": "table"
3547
+ },
3548
+ {
3549
+ "datasource": {
3550
+ "type": "elasticsearch",
3551
+ "uid": "wazuh_datasource_uid"
3552
+ },
3553
+ "fieldConfig": {
3554
+ "defaults": {
3555
+ "color": {
3556
+ "mode": "palette-classic"
3557
+ },
3558
+ "custom": {
3559
+ "hideFrom": {
3560
+ "legend": false,
3561
+ "tooltip": false,
3562
+ "viz": false
3563
+ }
3564
+ },
3565
+ "mappings": []
3566
+ },
3567
+ "overrides": []
3568
+ },
3569
+ "gridPos": {
3570
+ "h": 7,
3571
+ "w": 5,
3572
+ "x": 9,
3573
+ "y": 36
3574
+ },
3575
+ "id": 130,
3576
+ "options": {
3577
+ "legend": {
3578
+ "displayMode": "table",
3579
+ "placement": "right",
3580
+ "showLegend": true
3581
+ },
3582
+ "pieType": "donut",
3583
+ "reduceOptions": {
3584
+ "calcs": ["sum"],
3585
+ "fields": "",
3586
+ "values": false
3587
+ },
3588
+ "tooltip": {
3589
+ "mode": "single",
3590
+ "sort": "none"
3591
+ }
3592
+ },
3593
+ "targets": [
3594
+ {
3595
+ "alias": "",
3596
+ "bucketAggs": [
3597
+ {
3598
+ "field": "rule_level",
3599
+ "id": "3",
3600
+ "settings": {
3601
+ "min_doc_count": "1",
3602
+ "order": "desc",
3603
+ "orderBy": "_count",
3604
+ "size": "10"
3605
+ },
3606
+ "type": "terms"
3607
+ },
3608
+ {
3609
+ "field": "timestamp",
3610
+ "id": "2",
3611
+ "settings": {
3612
+ "interval": "auto"
3613
+ },
3614
+ "type": "date_histogram"
3615
+ }
3616
+ ],
3617
+ "datasource": {
3618
+ "type": "elasticsearch",
3619
+ "uid": "wazuh_datasource_uid"
3620
+ },
3621
+ "metrics": [
3622
+ {
3623
+ "id": "1",
3624
+ "type": "count"
3625
+ }
3626
+ ],
3627
+ "query": "(rule_group3:sysmon_event_11 OR rule_groups:*syscheck_file) AND rule_level:$rule_level",
3628
+ "refId": "A",
3629
+ "timeField": "timestamp"
3630
+ }
3631
+ ],
3632
+ "title": "FIM - EVENTS BY SEVERITY",
3633
+ "type": "piechart"
3634
+ },
3635
+ {
3636
+ "datasource": {
3637
+ "type": "elasticsearch",
3638
+ "uid": "wazuh_datasource_uid"
3639
+ },
3640
+ "fieldConfig": {
3641
+ "defaults": {
3642
+ "custom": {
3643
+ "align": "auto",
3644
+ "cellOptions": {
3645
+ "type": "auto"
3646
+ },
3647
+ "filterable": false,
3648
+ "inspect": false
3649
+ },
3650
+ "mappings": [],
3651
+ "thresholds": {
3652
+ "mode": "absolute",
3653
+ "steps": [
3654
+ {
3655
+ "color": "orange",
3656
+ "value": null
3657
+ }
3658
+ ]
3659
+ }
3660
+ },
3661
+ "overrides": [
3662
+ {
3663
+ "matcher": {
3664
+ "id": "byName",
3665
+ "options": "Count"
3666
+ },
3667
+ "properties": [
3668
+ {
3669
+ "id": "custom.cellOptions",
3670
+ "value": {
3671
+ "mode": "basic",
3672
+ "type": "gauge"
3673
+ }
3674
+ }
3675
+ ]
3676
+ },
3677
+ {
3678
+ "matcher": {
3679
+ "id": "byName",
3680
+ "options": "rule_description"
3681
+ },
3682
+ "properties": [
3683
+ {
3684
+ "id": "custom.width",
3685
+ "value": 703
3686
+ }
3687
+ ]
3688
+ },
3689
+ {
3690
+ "matcher": {
3691
+ "id": "byName",
3692
+ "options": "rule_level"
3693
+ },
3694
+ "properties": [
3695
+ {
3696
+ "id": "custom.width",
3697
+ "value": 212
3698
+ },
3699
+ {
3700
+ "id": "mappings",
3701
+ "value": [
3702
+ {
3703
+ "options": {
3704
+ "from": 1,
3705
+ "result": {
3706
+ "color": "green",
3707
+ "index": 0
3708
+ },
3709
+ "to": 3
3710
+ },
3711
+ "type": "range"
3712
+ },
3713
+ {
3714
+ "options": {
3715
+ "from": 4,
3716
+ "result": {
3717
+ "color": "dark-yellow",
3718
+ "index": 1
3719
+ },
3720
+ "to": 6
3721
+ },
3722
+ "type": "range"
3723
+ },
3724
+ {
3725
+ "options": {
3726
+ "from": 7,
3727
+ "result": {
3728
+ "color": "orange",
3729
+ "index": 2
3730
+ },
3731
+ "to": 9
3732
+ },
3733
+ "type": "range"
3734
+ },
3735
+ {
3736
+ "options": {
3737
+ "from": 10,
3738
+ "result": {
3739
+ "color": "semi-dark-red",
3740
+ "index": 3
3741
+ },
3742
+ "to": 15
3743
+ },
3744
+ "type": "range"
3745
+ }
3746
+ ]
3747
+ }
3748
+ ]
3749
+ }
3750
+ ]
3751
+ },
3752
+ "gridPos": {
3753
+ "h": 7,
3754
+ "w": 10,
3755
+ "x": 14,
3756
+ "y": 36
3757
+ },
3758
+ "id": 129,
3759
+ "links": [],
3760
+ "maxDataPoints": 3,
3761
+ "options": {
3762
+ "cellHeight": "sm",
3763
+ "footer": {
3764
+ "countRows": false,
3765
+ "fields": "",
3766
+ "reducer": ["sum"],
3767
+ "show": false
3768
+ },
3769
+ "showHeader": true,
3770
+ "sortBy": []
3771
+ },
3772
+ "pluginVersion": "10.0.2",
3773
+ "targets": [
3774
+ {
3775
+ "bucketAggs": [
3776
+ {
3777
+ "$$hashKey": "object:3082",
3778
+ "fake": true,
3779
+ "field": "rule_groups",
3780
+ "id": "4",
3781
+ "settings": {
3782
+ "min_doc_count": "1",
3783
+ "order": "desc",
3784
+ "orderBy": "_count",
3785
+ "size": "10"
3786
+ },
3787
+ "type": "terms"
3788
+ }
3789
+ ],
3790
+ "datasource": {
3791
+ "type": "elasticsearch",
3792
+ "uid": "wazuh_datasource_uid"
3793
+ },
3794
+ "metrics": [
3795
+ {
3796
+ "$$hashKey": "object:71",
3797
+ "field": "select field",
3798
+ "id": "1",
3799
+ "type": "count"
3800
+ }
3801
+ ],
3802
+ "query": "(rule_group3:sysmon_event_11 OR rule_groups:*syscheck_file) AND rule_level:$rule_level",
3803
+ "refId": "A",
3804
+ "timeField": "timestamp"
3805
+ }
3806
+ ],
3807
+ "title": "EVENTS BY RULE GROUPS",
3808
+ "transformations": [
3809
+ {
3810
+ "id": "organize",
3811
+ "options": {
3812
+ "excludeByName": {},
3813
+ "indexByName": {},
3814
+ "renameByName": {
3815
+ "rule_groups": "RULE GROUPS"
3816
+ }
3817
+ }
3818
+ }
3819
+ ],
3820
+ "type": "table"
3821
+ },
3822
+ {
3823
+ "datasource": {
3824
+ "type": "elasticsearch",
3825
+ "uid": "wazuh_datasource_uid"
3826
+ },
3827
+ "fieldConfig": {
3828
+ "defaults": {
3829
+ "custom": {
3830
+ "align": "auto",
3831
+ "cellOptions": {
3832
+ "type": "auto"
3833
+ },
3834
+ "filterable": false,
3835
+ "inspect": false
3836
+ },
3837
+ "mappings": [],
3838
+ "thresholds": {
3839
+ "mode": "absolute",
3840
+ "steps": [
3841
+ {
3842
+ "color": "orange",
3843
+ "value": null
3844
+ }
3845
+ ]
3846
+ }
3847
+ },
3848
+ "overrides": [
3849
+ {
3850
+ "matcher": {
3851
+ "id": "byName",
3852
+ "options": "Count"
3853
+ },
3854
+ "properties": [
3855
+ {
3856
+ "id": "custom.cellOptions",
3857
+ "value": {
3858
+ "mode": "basic",
3859
+ "type": "gauge"
3860
+ }
3861
+ }
3862
+ ]
3863
+ },
3864
+ {
3865
+ "matcher": {
3866
+ "id": "byName",
3867
+ "options": "rule_description"
3868
+ },
3869
+ "properties": [
3870
+ {
3871
+ "id": "custom.width",
3872
+ "value": 703
3873
+ }
3874
+ ]
3875
+ },
3876
+ {
3877
+ "matcher": {
3878
+ "id": "byName",
3879
+ "options": "rule_level"
3880
+ },
3881
+ "properties": [
3882
+ {
3883
+ "id": "custom.width",
3884
+ "value": 212
3885
+ },
3886
+ {
3887
+ "id": "mappings",
3888
+ "value": [
3889
+ {
3890
+ "options": {
3891
+ "from": 1,
3892
+ "result": {
3893
+ "color": "green",
3894
+ "index": 0
3895
+ },
3896
+ "to": 3
3897
+ },
3898
+ "type": "range"
3899
+ },
3900
+ {
3901
+ "options": {
3902
+ "from": 4,
3903
+ "result": {
3904
+ "color": "dark-yellow",
3905
+ "index": 1
3906
+ },
3907
+ "to": 6
3908
+ },
3909
+ "type": "range"
3910
+ },
3911
+ {
3912
+ "options": {
3913
+ "from": 7,
3914
+ "result": {
3915
+ "color": "orange",
3916
+ "index": 2
3917
+ },
3918
+ "to": 9
3919
+ },
3920
+ "type": "range"
3921
+ },
3922
+ {
3923
+ "options": {
3924
+ "from": 10,
3925
+ "result": {
3926
+ "color": "semi-dark-red",
3927
+ "index": 3
3928
+ },
3929
+ "to": 15
3930
+ },
3931
+ "type": "range"
3932
+ }
3933
+ ]
3934
+ }
3935
+ ]
3936
+ }
3937
+ ]
3938
+ },
3939
+ "gridPos": {
3940
+ "h": 12,
3941
+ "w": 10,
3942
+ "x": 0,
3943
+ "y": 43
3944
+ },
3945
+ "id": 134,
3946
+ "links": [],
3947
+ "maxDataPoints": 3,
3948
+ "options": {
3949
+ "cellHeight": "sm",
3950
+ "footer": {
3951
+ "countRows": false,
3952
+ "fields": "",
3953
+ "reducer": ["sum"],
3954
+ "show": false
3955
+ },
3956
+ "showHeader": true,
3957
+ "sortBy": []
3958
+ },
3959
+ "pluginVersion": "10.0.2",
3960
+ "targets": [
3961
+ {
3962
+ "bucketAggs": [
3963
+ {
3964
+ "$$hashKey": "object:3082",
3965
+ "fake": true,
3966
+ "field": "data_win_eventdata_user",
3967
+ "id": "4",
3968
+ "settings": {
3969
+ "min_doc_count": "1",
3970
+ "order": "desc",
3971
+ "orderBy": "_count",
3972
+ "size": "100"
3973
+ },
3974
+ "type": "terms"
3975
+ }
3976
+ ],
3977
+ "datasource": {
3978
+ "type": "elasticsearch",
3979
+ "uid": "wazuh_datasource_uid"
3980
+ },
3981
+ "metrics": [
3982
+ {
3983
+ "$$hashKey": "object:71",
3984
+ "field": "select field",
3985
+ "id": "1",
3986
+ "type": "count"
3987
+ }
3988
+ ],
3989
+ "query": "(rule_group3:sysmon_event_11 OR rule_groups:*syscheck_file) AND rule_level:$rule_level",
3990
+ "refId": "A",
3991
+ "timeField": "timestamp"
3992
+ }
3993
+ ],
3994
+ "title": "EVENTS BY USER ACCT (Top 100)",
3995
+ "transformations": [
3996
+ {
3997
+ "id": "organize",
3998
+ "options": {
3999
+ "excludeByName": {},
4000
+ "indexByName": {},
4001
+ "renameByName": {
4002
+ "data_win_eventdata_user": "USER ACCOUNT",
4003
+ "rule_groups": "RULE GROUPS"
4004
+ }
4005
+ }
4006
+ }
4007
+ ],
4008
+ "type": "table"
4009
+ },
4010
+ {
4011
+ "datasource": {
4012
+ "type": "elasticsearch",
4013
+ "uid": "wazuh_datasource_uid"
4014
+ },
4015
+ "fieldConfig": {
4016
+ "defaults": {
4017
+ "custom": {
4018
+ "align": "auto",
4019
+ "cellOptions": {
4020
+ "type": "auto"
4021
+ },
4022
+ "filterable": false,
4023
+ "inspect": false
4024
+ },
4025
+ "mappings": [],
4026
+ "thresholds": {
4027
+ "mode": "absolute",
4028
+ "steps": [
4029
+ {
4030
+ "color": "orange",
4031
+ "value": null
4032
+ }
4033
+ ]
4034
+ }
4035
+ },
4036
+ "overrides": [
4037
+ {
4038
+ "matcher": {
4039
+ "id": "byName",
4040
+ "options": "Count"
4041
+ },
4042
+ "properties": [
4043
+ {
4044
+ "id": "custom.cellOptions",
4045
+ "value": {
4046
+ "mode": "basic",
4047
+ "type": "gauge"
4048
+ }
4049
+ }
4050
+ ]
4051
+ },
4052
+ {
4053
+ "matcher": {
4054
+ "id": "byName",
4055
+ "options": "rule_description"
4056
+ },
4057
+ "properties": [
4058
+ {
4059
+ "id": "custom.width",
4060
+ "value": 703
4061
+ }
4062
+ ]
4063
+ },
4064
+ {
4065
+ "matcher": {
4066
+ "id": "byName",
4067
+ "options": "rule_level"
4068
+ },
4069
+ "properties": [
4070
+ {
4071
+ "id": "custom.width",
4072
+ "value": 212
4073
+ },
4074
+ {
4075
+ "id": "mappings",
4076
+ "value": [
4077
+ {
4078
+ "options": {
4079
+ "from": 1,
4080
+ "result": {
4081
+ "color": "green",
4082
+ "index": 0
4083
+ },
4084
+ "to": 3
4085
+ },
4086
+ "type": "range"
4087
+ },
4088
+ {
4089
+ "options": {
4090
+ "from": 4,
4091
+ "result": {
4092
+ "color": "dark-yellow",
4093
+ "index": 1
4094
+ },
4095
+ "to": 6
4096
+ },
4097
+ "type": "range"
4098
+ },
4099
+ {
4100
+ "options": {
4101
+ "from": 7,
4102
+ "result": {
4103
+ "color": "orange",
4104
+ "index": 2
4105
+ },
4106
+ "to": 9
4107
+ },
4108
+ "type": "range"
4109
+ },
4110
+ {
4111
+ "options": {
4112
+ "from": 10,
4113
+ "result": {
4114
+ "color": "semi-dark-red",
4115
+ "index": 3
4116
+ },
4117
+ "to": 15
4118
+ },
4119
+ "type": "range"
4120
+ }
4121
+ ]
4122
+ }
4123
+ ]
4124
+ },
4125
+ {
4126
+ "matcher": {
4127
+ "id": "byName",
4128
+ "options": "target_file"
4129
+ },
4130
+ "properties": [
4131
+ {
4132
+ "id": "custom.width",
4133
+ "value": 837
4134
+ }
4135
+ ]
4136
+ }
4137
+ ]
4138
+ },
4139
+ "gridPos": {
4140
+ "h": 12,
4141
+ "w": 14,
4142
+ "x": 10,
4143
+ "y": 43
4144
+ },
4145
+ "id": 135,
4146
+ "links": [],
4147
+ "maxDataPoints": 3,
4148
+ "options": {
4149
+ "cellHeight": "sm",
4150
+ "footer": {
4151
+ "countRows": false,
4152
+ "fields": "",
4153
+ "reducer": ["sum"],
4154
+ "show": false
4155
+ },
4156
+ "showHeader": true,
4157
+ "sortBy": []
4158
+ },
4159
+ "pluginVersion": "10.0.2",
4160
+ "targets": [
4161
+ {
4162
+ "bucketAggs": [
4163
+ {
4164
+ "$$hashKey": "object:3082",
4165
+ "fake": true,
4166
+ "field": "target_file",
4167
+ "id": "4",
4168
+ "settings": {
4169
+ "min_doc_count": "1",
4170
+ "order": "desc",
4171
+ "orderBy": "_count",
4172
+ "size": "100"
4173
+ },
4174
+ "type": "terms"
4175
+ }
4176
+ ],
4177
+ "datasource": {
4178
+ "type": "elasticsearch",
4179
+ "uid": "wazuh_datasource_uid"
4180
+ },
4181
+ "metrics": [
4182
+ {
4183
+ "$$hashKey": "object:71",
4184
+ "field": "select field",
4185
+ "id": "1",
4186
+ "type": "count"
4187
+ }
4188
+ ],
4189
+ "query": "(rule_group3:sysmon_event_11 OR rule_groups:*syscheck_file) AND rule_level:$rule_level",
4190
+ "refId": "A",
4191
+ "timeField": "timestamp"
4192
+ }
4193
+ ],
4194
+ "title": "EVENTS BY FILE PATH (Top 100)",
4195
+ "transformations": [
4196
+ {
4197
+ "id": "organize",
4198
+ "options": {
4199
+ "excludeByName": {},
4200
+ "indexByName": {},
4201
+ "renameByName": {
4202
+ "data_win_eventdata_user": "USER ACCOUNT",
4203
+ "rule_groups": "RULE GROUPS",
4204
+ "target_file": "FILE"
4205
+ }
4206
+ }
4207
+ }
4208
+ ],
4209
+ "type": "table"
4210
+ },
4211
+ {
4212
+ "datasource": {
4213
+ "type": "elasticsearch",
4214
+ "uid": "wazuh_datasource_uid"
4215
+ },
4216
+ "fieldConfig": {
4217
+ "defaults": {
4218
+ "color": {
4219
+ "mode": "thresholds"
4220
+ },
4221
+ "custom": {
4222
+ "align": "auto",
4223
+ "cellOptions": {
4224
+ "type": "auto"
4225
+ },
4226
+ "inspect": false
4227
+ },
4228
+ "mappings": [],
4229
+ "thresholds": {
4230
+ "mode": "absolute",
4231
+ "steps": [
4232
+ {
4233
+ "color": "red",
4234
+ "value": null
4235
+ }
4236
+ ]
4237
+ }
4238
+ },
4239
+ "overrides": [
4240
+ {
4241
+ "matcher": {
4242
+ "id": "byName",
4243
+ "options": "rule_level"
4244
+ },
4245
+ "properties": [
4246
+ {
4247
+ "id": "custom.width",
4248
+ "value": 93
4249
+ }
4250
+ ]
4251
+ },
4252
+ {
4253
+ "matcher": {
4254
+ "id": "byName",
4255
+ "options": "DATE/TIME"
4256
+ },
4257
+ "properties": [
4258
+ {
4259
+ "id": "custom.width",
4260
+ "value": 202
4261
+ }
4262
+ ]
4263
+ },
4264
+ {
4265
+ "matcher": {
4266
+ "id": "byName",
4267
+ "options": "AGENT"
4268
+ },
4269
+ "properties": [
4270
+ {
4271
+ "id": "custom.width",
4272
+ "value": 171
4273
+ }
4274
+ ]
4275
+ },
4276
+ {
4277
+ "matcher": {
4278
+ "id": "byName",
4279
+ "options": "SRC IP"
4280
+ },
4281
+ "properties": [
4282
+ {
4283
+ "id": "custom.width",
4284
+ "value": 167
4285
+ }
4286
+ ]
4287
+ },
4288
+ {
4289
+ "matcher": {
4290
+ "id": "byName",
4291
+ "options": "rule_description"
4292
+ },
4293
+ "properties": [
4294
+ {
4295
+ "id": "custom.width",
4296
+ "value": 524
4297
+ }
4298
+ ]
4299
+ },
4300
+ {
4301
+ "matcher": {
4302
+ "id": "byName",
4303
+ "options": "RULE LEVEL"
4304
+ },
4305
+ "properties": [
4306
+ {
4307
+ "id": "custom.width",
4308
+ "value": 96
4309
+ }
4310
+ ]
4311
+ },
4312
+ {
4313
+ "matcher": {
4314
+ "id": "byName",
4315
+ "options": "IoC"
4316
+ },
4317
+ "properties": [
4318
+ {
4319
+ "id": "custom.cellOptions",
4320
+ "value": {
4321
+ "type": "color-text"
4322
+ }
4323
+ }
4324
+ ]
4325
+ },
4326
+ {
4327
+ "matcher": {
4328
+ "id": "byName",
4329
+ "options": "LABEL"
4330
+ },
4331
+ "properties": [
4332
+ {
4333
+ "id": "custom.width",
4334
+ "value": 93
4335
+ }
4336
+ ]
4337
+ },
4338
+ {
4339
+ "matcher": {
4340
+ "id": "byName",
4341
+ "options": "EVENT ID"
4342
+ },
4343
+ "properties": [
4344
+ {
4345
+ "id": "links",
4346
+ "value": [
4347
+ {
4348
+ "targetBlank": true,
4349
+ "title": "VIEW EVENT DETAILS",
4350
+ "url": "https://grafana.company.local/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
4351
+ }
4352
+ ]
4353
+ },
4354
+ {
4355
+ "id": "custom.width",
4356
+ "value": 367
4357
+ }
4358
+ ]
4359
+ },
4360
+ {
4361
+ "matcher": {
4362
+ "id": "byName",
4363
+ "options": "LEVEL"
4364
+ },
4365
+ "properties": [
4366
+ {
4367
+ "id": "custom.width",
4368
+ "value": 111
4369
+ }
4370
+ ]
4371
+ }
4372
+ ]
4373
+ },
4374
+ "gridPos": {
4375
+ "h": 12,
4376
+ "w": 24,
4377
+ "x": 0,
4378
+ "y": 55
4379
+ },
4380
+ "id": 131,
4381
+ "options": {
4382
+ "cellHeight": "sm",
4383
+ "footer": {
4384
+ "countRows": false,
4385
+ "fields": "",
4386
+ "reducer": ["sum"],
4387
+ "show": false
4388
+ },
4389
+ "showHeader": true,
4390
+ "sortBy": []
4391
+ },
4392
+ "pluginVersion": "10.0.2",
4393
+ "targets": [
4394
+ {
4395
+ "alias": "",
4396
+ "bucketAggs": [],
4397
+ "datasource": {
4398
+ "type": "elasticsearch",
4399
+ "uid": "wazuh_datasource_uid"
4400
+ },
4401
+ "metrics": [
4402
+ {
4403
+ "id": "1",
4404
+ "settings": {
4405
+ "size": "500"
4406
+ },
4407
+ "type": "raw_data"
4408
+ }
4409
+ ],
4410
+ "query": "(rule_group3:sysmon_event_11 OR rule_groups:*syscheck_file) AND rule_level:$rule_level",
4411
+ "queryType": "lucene",
4412
+ "refId": "A",
4413
+ "timeField": "timestamp"
4414
+ }
4415
+ ],
4416
+ "title": "FIM - EVENTS",
4417
+ "transformations": [
4418
+ {
4419
+ "id": "organize",
4420
+ "options": {
4421
+ "excludeByName": {
4422
+ "@metadata_beat": true,
4423
+ "@metadata_type": true,
4424
+ "@metadata_version": true,
4425
+ "_id": false,
4426
+ "_index": true,
4427
+ "_type": true,
4428
+ "agent_ephemeral_id": true,
4429
+ "agent_hostname": true,
4430
+ "agent_id": true,
4431
+ "agent_ip": false,
4432
+ "agent_ip_city_name": true,
4433
+ "agent_ip_country_code": true,
4434
+ "agent_ip_geolocation": true,
4435
+ "agent_ip_reserved_ip": true,
4436
+ "agent_labels_customer": true,
4437
+ "agent_name": false,
4438
+ "agent_type": true,
4439
+ "agent_version": true,
4440
+ "beats_type": true,
4441
+ "cluster_name": true,
4442
+ "cluster_node": true,
4443
+ "collector_node_id": true,
4444
+ "data_base_indicator_access_type": true,
4445
+ "data_base_indicator_id": false,
4446
+ "data_base_indicator_indicator_city_name": true,
4447
+ "data_base_indicator_indicator_country_code": true,
4448
+ "data_base_indicator_indicator_geolocation": true,
4449
+ "data_integration": true,
4450
+ "data_opencti_0_node_color": true,
4451
+ "data_opencti_0_node_id": true,
4452
+ "data_opencti_1_node_color": true,
4453
+ "data_opencti_1_node_id": true,
4454
+ "data_opencti_2_node_color": true,
4455
+ "data_opencti_2_node_id": true,
4456
+ "data_opencti_3_node_color": true,
4457
+ "data_opencti_3_node_id": true,
4458
+ "data_opencti_4_node_color": true,
4459
+ "data_opencti_4_node_id": true,
4460
+ "data_opencti_5_node_color": true,
4461
+ "data_opencti_5_node_id": true,
4462
+ "data_opencti_atime": true,
4463
+ "data_opencti_createdBy": true,
4464
+ "data_opencti_createdBy_contact_information": true,
4465
+ "data_opencti_createdBy_created": true,
4466
+ "data_opencti_createdBy_description": true,
4467
+ "data_opencti_createdBy_entity_type": true,
4468
+ "data_opencti_createdBy_id": true,
4469
+ "data_opencti_createdBy_identity_class": true,
4470
+ "data_opencti_createdBy_modified": true,
4471
+ "data_opencti_createdBy_name": false,
4472
+ "data_opencti_createdBy_parent_types": true,
4473
+ "data_opencti_createdBy_roles": true,
4474
+ "data_opencti_createdBy_spec_version": true,
4475
+ "data_opencti_createdBy_standard_id": true,
4476
+ "data_opencti_createdBy_x_opencti_aliases": true,
4477
+ "data_opencti_createdBy_x_opencti_organization_type": true,
4478
+ "data_opencti_createdBy_x_opencti_reliability": true,
4479
+ "data_opencti_created_at": true,
4480
+ "data_opencti_ctime": true,
4481
+ "data_opencti_error": true,
4482
+ "data_opencti_extensions": true,
4483
+ "data_opencti_hashes": true,
4484
+ "data_opencti_id": true,
4485
+ "data_opencti_indicators_edges": true,
4486
+ "data_opencti_mime_type": true,
4487
+ "data_opencti_mtime": true,
4488
+ "data_opencti_objectLabel_edges": true,
4489
+ "data_opencti_objectMarking_edges": true,
4490
+ "data_opencti_observable_value": true,
4491
+ "data_opencti_observable_value_city_name": true,
4492
+ "data_opencti_observable_value_country_code": true,
4493
+ "data_opencti_observable_value_geolocation": true,
4494
+ "data_opencti_parent_types": true,
4495
+ "data_opencti_size": true,
4496
+ "data_opencti_spec_version": true,
4497
+ "data_opencti_standard_id": true,
4498
+ "data_opencti_updated_at": true,
4499
+ "data_opencti_value_city_name": true,
4500
+ "data_opencti_value_country_code": true,
4501
+ "data_opencti_value_geolocation": true,
4502
+ "data_opencti_x_opencti_additional_names": true,
4503
+ "data_opencti_x_opencti_description": true,
4504
+ "data_type": true,
4505
+ "data_win_eventdata_commandLine": true,
4506
+ "data_win_eventdata_company": true,
4507
+ "data_win_eventdata_creationUtcTime": true,
4508
+ "data_win_eventdata_currentDirectory": true,
4509
+ "data_win_eventdata_description": true,
4510
+ "data_win_eventdata_destinationIp": true,
4511
+ "data_win_eventdata_destinationIp_city_name": true,
4512
+ "data_win_eventdata_destinationIp_country_code": true,
4513
+ "data_win_eventdata_destinationIp_geolocation": true,
4514
+ "data_win_eventdata_destinationIsIpv6": true,
4515
+ "data_win_eventdata_destinationPort": true,
4516
+ "data_win_eventdata_domain": true,
4517
+ "data_win_eventdata_fileVersion": true,
4518
+ "data_win_eventdata_fileVersion_city_name": true,
4519
+ "data_win_eventdata_fileVersion_country_code": true,
4520
+ "data_win_eventdata_fileVersion_geolocation": true,
4521
+ "data_win_eventdata_hashes": true,
4522
+ "data_win_eventdata_image": true,
4523
+ "data_win_eventdata_imageLoaded": true,
4524
+ "data_win_eventdata_imagePath": true,
4525
+ "data_win_eventdata_initiated": true,
4526
+ "data_win_eventdata_integrityLevel": true,
4527
+ "data_win_eventdata_logonGuid": true,
4528
+ "data_win_eventdata_logonId": true,
4529
+ "data_win_eventdata_originalFileName": true,
4530
+ "data_win_eventdata_parentCommandLine": true,
4531
+ "data_win_eventdata_parentImage": true,
4532
+ "data_win_eventdata_parentProcessGuid": true,
4533
+ "data_win_eventdata_parentProcessId": true,
4534
+ "data_win_eventdata_parentUser": true,
4535
+ "data_win_eventdata_processGuid": true,
4536
+ "data_win_eventdata_processId": true,
4537
+ "data_win_eventdata_product": true,
4538
+ "data_win_eventdata_protocol": true,
4539
+ "data_win_eventdata_queryName": true,
4540
+ "data_win_eventdata_queryResults": true,
4541
+ "data_win_eventdata_queryStatus": true,
4542
+ "data_win_eventdata_ruleName": true,
4543
+ "data_win_eventdata_sID": true,
4544
+ "data_win_eventdata_serviceName": true,
4545
+ "data_win_eventdata_serviceType": true,
4546
+ "data_win_eventdata_signatureStatus": true,
4547
+ "data_win_eventdata_signed": true,
4548
+ "data_win_eventdata_sourceIp": true,
4549
+ "data_win_eventdata_sourceIsIpv6": true,
4550
+ "data_win_eventdata_sourcePort": true,
4551
+ "data_win_eventdata_startType": true,
4552
+ "data_win_eventdata_targetFilename": true,
4553
+ "data_win_eventdata_terminalSessionId": true,
4554
+ "data_win_eventdata_timestamp": true,
4555
+ "data_win_eventdata_user": true,
4556
+ "data_win_eventdata_utcTime": true,
4557
+ "data_win_system_channel": true,
4558
+ "data_win_system_computer": true,
4559
+ "data_win_system_eventID": true,
4560
+ "data_win_system_eventRecordID": true,
4561
+ "data_win_system_eventSourceName": true,
4562
+ "data_win_system_keywords": true,
4563
+ "data_win_system_level": true,
4564
+ "data_win_system_message": true,
4565
+ "data_win_system_opcode": true,
4566
+ "data_win_system_processID": true,
4567
+ "data_win_system_providerGuid": true,
4568
+ "data_win_system_providerName": true,
4569
+ "data_win_system_severityValue": true,
4570
+ "data_win_system_systemTime": true,
4571
+ "data_win_system_task": true,
4572
+ "data_win_system_threadID": true,
4573
+ "data_win_system_version": true,
4574
+ "decoder_name": true,
4575
+ "dll_hashes": true,
4576
+ "dll_name": true,
4577
+ "dll_signature_status": true,
4578
+ "dll_signed": true,
4579
+ "dns_answer": true,
4580
+ "dns_query": true,
4581
+ "dns_response_code": true,
4582
+ "dst_ip": true,
4583
+ "dst_ip_city_name": true,
4584
+ "dst_ip_country_code": true,
4585
+ "dst_ip_geolocation": true,
4586
+ "dst_port": true,
4587
+ "ecs_version": true,
4588
+ "full_log": true,
4589
+ "gl2_accounted_message_size": true,
4590
+ "gl2_message_id": true,
4591
+ "gl2_processing_error": true,
4592
+ "gl2_remote_ip": true,
4593
+ "gl2_remote_port": true,
4594
+ "gl2_source_collector": true,
4595
+ "gl2_source_input": true,
4596
+ "gl2_source_node": true,
4597
+ "hash_sha256": true,
4598
+ "highlight": true,
4599
+ "host_name": true,
4600
+ "id": true,
4601
+ "image_loaded": true,
4602
+ "location": true,
4603
+ "log_file_path": true,
4604
+ "log_offset": true,
4605
+ "manager_name": true,
4606
+ "message": true,
4607
+ "misp_Event.distribution": true,
4608
+ "misp_Event.id": true,
4609
+ "misp_Event.info": true,
4610
+ "misp_Event.org_id": true,
4611
+ "misp_Event.orgc_id": true,
4612
+ "misp_Event.uuid": true,
4613
+ "misp_Object.distribution": true,
4614
+ "misp_Object.id": true,
4615
+ "misp_Object.sharing_group_id": true,
4616
+ "misp_Tag": true,
4617
+ "misp_category": true,
4618
+ "misp_comment": true,
4619
+ "misp_deleted": true,
4620
+ "misp_disable_correlation": true,
4621
+ "misp_distribution": true,
4622
+ "misp_event_id": true,
4623
+ "misp_id": true,
4624
+ "misp_object_id": true,
4625
+ "misp_object_relation": true,
4626
+ "misp_sharing_group_id": true,
4627
+ "misp_timestamp": true,
4628
+ "misp_to_ids": true,
4629
+ "misp_type": true,
4630
+ "misp_uuid": true,
4631
+ "misp_value": false,
4632
+ "misp_value_city_name": true,
4633
+ "misp_value_country_code": true,
4634
+ "misp_value_geolocation": true,
4635
+ "msg_timestamp": true,
4636
+ "opencti_base_type": true,
4637
+ "opencti_created_at": false,
4638
+ "opencti_i_created_at_day": true,
4639
+ "opencti_i_created_at_month": true,
4640
+ "opencti_i_created_at_year": true,
4641
+ "opencti_id": true,
4642
+ "opencti_internal_id": true,
4643
+ "opencti_parent_types": true,
4644
+ "opencti_rel_based-on_internal_id": true,
4645
+ "opencti_rel_created-by_internal_id": true,
4646
+ "opencti_rel_object-label_internal_id": true,
4647
+ "opencti_rel_object-marking_internal_id": true,
4648
+ "opencti_rel_object_internal_id": true,
4649
+ "opencti_spec_version": true,
4650
+ "opencti_standard_id": true,
4651
+ "opencti_updated_at": true,
4652
+ "opencti_x_opencti_score": true,
4653
+ "opencti_x_opencti_stix_ids": true,
4654
+ "parent_cmd_line": true,
4655
+ "parent_process_id": true,
4656
+ "parent_process_image": true,
4657
+ "parent_process_user": true,
4658
+ "port_common": true,
4659
+ "previous_output": true,
4660
+ "process_cmd_line": true,
4661
+ "process_id": true,
4662
+ "process_image": true,
4663
+ "process_image_hashes": true,
4664
+ "protocol": true,
4665
+ "rule_description": true,
4666
+ "rule_firedtimes": true,
4667
+ "rule_frequency": true,
4668
+ "rule_gdpr": true,
4669
+ "rule_gpg13": true,
4670
+ "rule_group1": true,
4671
+ "rule_group2": true,
4672
+ "rule_group3": true,
4673
+ "rule_groups": true,
4674
+ "rule_hipaa": true,
4675
+ "rule_id": true,
4676
+ "rule_mail": true,
4677
+ "rule_mitre_id": true,
4678
+ "rule_mitre_tactic": true,
4679
+ "rule_mitre_technique": true,
4680
+ "rule_nist_800_53": true,
4681
+ "rule_pci_dss": true,
4682
+ "rule_tsc": true,
4683
+ "sha256": true,
4684
+ "software_approved": true,
4685
+ "software_vendor": true,
4686
+ "sort": true,
4687
+ "source": true,
4688
+ "source_reserved_ip": true,
4689
+ "src_ip": true,
4690
+ "src_ip_city_name": true,
4691
+ "src_ip_country_code": true,
4692
+ "src_ip_geolocation": true,
4693
+ "src_port": true,
4694
+ "streams": true,
4695
+ "syscheck_arch": true,
4696
+ "syscheck_attrs_after": true,
4697
+ "syscheck_changed_attributes": true,
4698
+ "syscheck_event": true,
4699
+ "syscheck_md5_after": true,
4700
+ "syscheck_md5_before": true,
4701
+ "syscheck_mode": true,
4702
+ "syscheck_mtime_after": true,
4703
+ "syscheck_mtime_before": true,
4704
+ "syscheck_path": true,
4705
+ "syscheck_sha1_after": true,
4706
+ "syscheck_sha1_before": true,
4707
+ "syscheck_sha256_after": true,
4708
+ "syscheck_sha256_before": true,
4709
+ "syscheck_size_after": true,
4710
+ "syscheck_uid_after": true,
4711
+ "syscheck_uname_after": true,
4712
+ "syscheck_value_name": true,
4713
+ "syscheck_win_perm_after": true,
4714
+ "syslog_tag": true,
4715
+ "syslog_type": true,
4716
+ "target_file": false,
4717
+ "timestamp": false,
4718
+ "timestamp_utc": true,
4719
+ "traffic_direction": true,
4720
+ "true": true,
4721
+ "user_name": true,
4722
+ "win_system_eventID": true,
4723
+ "windows_event_id": true,
4724
+ "windows_event_severity": false
4725
+ },
4726
+ "indexByName": {
4727
+ "_id": 1,
4728
+ "_index": 3,
4729
+ "_type": 4,
4730
+ "agent_id": 5,
4731
+ "agent_ip": 6,
4732
+ "agent_labels_customer": 33,
4733
+ "agent_name": 2,
4734
+ "data_integration": 34,
4735
+ "data_opencti_0_node_color": 35,
4736
+ "data_opencti_0_node_id": 36,
4737
+ "data_opencti_0_node_value": 37,
4738
+ "data_opencti_1_node_color": 38,
4739
+ "data_opencti_1_node_id": 39,
4740
+ "data_opencti_1_node_value": 40,
4741
+ "data_opencti_atime": 69,
4742
+ "data_opencti_createdBy": 70,
4743
+ "data_opencti_createdBy_contact_information": 41,
4744
+ "data_opencti_createdBy_created": 42,
4745
+ "data_opencti_createdBy_description": 71,
4746
+ "data_opencti_createdBy_entity_type": 43,
4747
+ "data_opencti_createdBy_id": 44,
4748
+ "data_opencti_createdBy_identity_class": 45,
4749
+ "data_opencti_createdBy_modified": 46,
4750
+ "data_opencti_createdBy_name": 9,
4751
+ "data_opencti_createdBy_parent_types": 47,
4752
+ "data_opencti_createdBy_roles": 48,
4753
+ "data_opencti_createdBy_spec_version": 49,
4754
+ "data_opencti_createdBy_standard_id": 50,
4755
+ "data_opencti_createdBy_x_opencti_aliases": 10,
4756
+ "data_opencti_createdBy_x_opencti_organization_type": 51,
4757
+ "data_opencti_createdBy_x_opencti_reliability": 52,
4758
+ "data_opencti_created_at": 53,
4759
+ "data_opencti_ctime": 72,
4760
+ "data_opencti_entity_type": 8,
4761
+ "data_opencti_extensions": 73,
4762
+ "data_opencti_hashes": 74,
4763
+ "data_opencti_id": 54,
4764
+ "data_opencti_indicators_edges": 55,
4765
+ "data_opencti_mime_type": 75,
4766
+ "data_opencti_mtime": 76,
4767
+ "data_opencti_name": 77,
4768
+ "data_opencti_objectLabel_edges": 56,
4769
+ "data_opencti_objectMarking_edges": 57,
4770
+ "data_opencti_observable_value": 58,
4771
+ "data_opencti_parent_types": 59,
4772
+ "data_opencti_size": 78,
4773
+ "data_opencti_spec_version": 60,
4774
+ "data_opencti_standard_id": 61,
4775
+ "data_opencti_updated_at": 62,
4776
+ "data_opencti_value": 7,
4777
+ "data_opencti_x_opencti_additional_names": 79,
4778
+ "data_opencti_x_opencti_description": 63,
4779
+ "data_opencti_x_opencti_score": 64,
4780
+ "decoder_name": 11,
4781
+ "gl2_accounted_message_size": 12,
4782
+ "gl2_message_id": 13,
4783
+ "gl2_processing_error": 65,
4784
+ "gl2_remote_ip": 14,
4785
+ "gl2_remote_port": 15,
4786
+ "gl2_source_input": 16,
4787
+ "gl2_source_node": 17,
4788
+ "highlight": 18,
4789
+ "id": 19,
4790
+ "location": 20,
4791
+ "manager_name": 21,
4792
+ "message": 22,
4793
+ "rule_description": 23,
4794
+ "rule_firedtimes": 24,
4795
+ "rule_group1": 66,
4796
+ "rule_group2": 67,
4797
+ "rule_group3": 68,
4798
+ "rule_groups": 25,
4799
+ "rule_id": 26,
4800
+ "rule_level": 27,
4801
+ "rule_mail": 28,
4802
+ "sort": 29,
4803
+ "source": 30,
4804
+ "streams": 31,
4805
+ "syslog_level": 80,
4806
+ "syslog_type": 32,
4807
+ "timestamp": 0,
4808
+ "true": 81
4809
+ },
4810
+ "renameByName": {
4811
+ "_id": "EVENT ID",
4812
+ "_type": "",
4813
+ "agent_ip": "SRC IP",
4814
+ "agent_name": "AGENT",
4815
+ "data_base_indicator_access_type": "",
4816
+ "data_base_indicator_id": "OTX IoC ID",
4817
+ "data_base_indicator_indicator": "IoC",
4818
+ "data_base_indicator_indicator_country_code": "",
4819
+ "data_base_indicator_type": "IoC TYPE",
4820
+ "data_opencti_0_node_value": "LABEL",
4821
+ "data_opencti_1_node_value": "LABEL",
4822
+ "data_opencti_2_node_value": "LABEL",
4823
+ "data_opencti_3_node_value": "LABEL",
4824
+ "data_opencti_4_node_value": "LABEL",
4825
+ "data_opencti_5_node_value": "LABEL",
4826
+ "data_opencti_createdBy_contact_information": "",
4827
+ "data_opencti_createdBy_name": "SECURITY FEED",
4828
+ "data_opencti_createdBy_x_opencti_aliases": "",
4829
+ "data_opencti_entity_type": "TYPE",
4830
+ "data_opencti_value": "IoC",
4831
+ "data_opencti_x_opencti_description": "",
4832
+ "data_opencti_x_opencti_score": "SCORE",
4833
+ "data_sections": "OTX SECTIONS",
4834
+ "data_type": "",
4835
+ "data_win_system_message": "MESSAGE",
4836
+ "data_win_system_providerGuid": "",
4837
+ "misp_category": "CATEGORY",
4838
+ "misp_type": "TYPE",
4839
+ "misp_value": "IoC",
4840
+ "opencti_created_at": "IoC CREATE AT",
4841
+ "opencti_entity_type": "TYPE",
4842
+ "opencti_value": "IoC",
4843
+ "rule_level": "RULE LEVEL",
4844
+ "syslog_level": "LEVEL",
4845
+ "target_file": "FILE",
4846
+ "timestamp": "DATE/TIME",
4847
+ "windows_event_severity": "EVENT LOG SEVERITY"
4848
+ }
4849
+ }
4850
+ }
4851
+ ],
4852
+ "transparent": true,
4853
+ "type": "table"
4854
+ }
4855
+ ],
4856
+ "title": "FILE INTEGRITY MONITORING",
4857
+ "type": "row"
4858
+ },
4859
+ {
4860
+ "collapsed": true,
4861
+ "datasource": {
4862
+ "type": "datasource",
4863
+ "uid": "grafana"
4864
+ },
4865
+ "gridPos": {
4866
+ "h": 1,
4867
+ "w": 24,
4868
+ "x": 0,
4869
+ "y": 36
4870
+ },
4871
+ "id": 99,
4872
+ "panels": [
4873
+ {
4874
+ "datasource": {
4875
+ "type": "elasticsearch",
4876
+ "uid": "wazuh_datasource_uid"
4877
+ },
4878
+ "fieldConfig": {
4879
+ "defaults": {
4880
+ "mappings": [
4881
+ {
4882
+ "options": {
4883
+ "match": "null",
4884
+ "result": {
4885
+ "text": "N/A"
4886
+ }
4887
+ },
4888
+ "type": "special"
4889
+ }
4890
+ ],
4891
+ "thresholds": {
4892
+ "mode": "absolute",
4893
+ "steps": [
4894
+ {
4895
+ "color": "blue",
4896
+ "value": null
4897
+ }
4898
+ ]
4899
+ },
4900
+ "unit": "short"
4901
+ },
4902
+ "overrides": []
4903
+ },
4904
+ "gridPos": {
4905
+ "h": 7,
4906
+ "w": 4,
4907
+ "x": 0,
4908
+ "y": 37
4909
+ },
4910
+ "id": 100,
4911
+ "links": [],
4912
+ "options": {
4913
+ "colorMode": "value",
4914
+ "graphMode": "area",
4915
+ "justifyMode": "auto",
4916
+ "orientation": "horizontal",
4917
+ "reduceOptions": {
4918
+ "calcs": ["sum"],
4919
+ "fields": "",
4920
+ "values": false
4921
+ },
4922
+ "text": {},
4923
+ "textMode": "auto"
4924
+ },
4925
+ "pluginVersion": "10.0.2",
4926
+ "targets": [
4927
+ {
4928
+ "bucketAggs": [
4929
+ {
4930
+ "$$hashKey": "object:50",
4931
+ "field": "timestamp",
4932
+ "id": "2",
4933
+ "settings": {
4934
+ "interval": "auto",
4935
+ "min_doc_count": 0,
4936
+ "trimEdges": 0
4937
+ },
4938
+ "type": "date_histogram"
4939
+ }
4940
+ ],
4941
+ "datasource": {
4942
+ "type": "elasticsearch",
4943
+ "uid": "wazuh_datasource_uid"
4944
+ },
4945
+ "metrics": [
4946
+ {
4947
+ "$$hashKey": "object:48",
4948
+ "field": "select field",
4949
+ "id": "1",
4950
+ "type": "count"
4951
+ }
4952
+ ],
4953
+ "query": "rule_group3:sysmon_event_15 AND rule_level:$rule_level",
4954
+ "refId": "A",
4955
+ "timeField": "timestamp"
4956
+ }
4957
+ ],
4958
+ "title": "REMOTE THREADS - EVENTS",
4959
+ "type": "stat"
4960
+ },
4961
+ {
4962
+ "datasource": {
4963
+ "type": "elasticsearch",
4964
+ "uid": "wazuh_datasource_uid"
4965
+ },
4966
+ "fieldConfig": {
4967
+ "defaults": {
4968
+ "custom": {
4969
+ "align": "auto",
4970
+ "cellOptions": {
4971
+ "type": "auto"
4972
+ },
4973
+ "filterable": false,
4974
+ "inspect": false
4975
+ },
4976
+ "mappings": [],
4977
+ "thresholds": {
4978
+ "mode": "absolute",
4979
+ "steps": [
4980
+ {
4981
+ "color": "green",
4982
+ "value": null
4983
+ },
4984
+ {
4985
+ "color": "red",
4986
+ "value": 80
4987
+ }
4988
+ ]
4989
+ }
4990
+ },
4991
+ "overrides": [
4992
+ {
4993
+ "matcher": {
4994
+ "id": "byName",
4995
+ "options": "agent_name"
4996
+ },
4997
+ "properties": [
4998
+ {
4999
+ "id": "custom.width",
This file is too large to show in full.
backend/app/connectors/grafana/dashboards/Wazuh/edr_mitre.json
new
+1624
@@ -0,0 +1,1624 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194253277,
29
+ "links": [
30
+ {
31
+ "$$hashKey": "object:325",
32
+ "asDropdown": true,
33
+ "icon": "external link",
34
+ "includeVars": true,
35
+ "keepTime": true,
36
+ "tags": ["EDR"],
37
+ "targetBlank": true,
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "datasource": {
45
+ "type": "elasticsearch",
46
+ "uid": "wazuh_datasource_uid"
47
+ },
48
+ "fieldConfig": {
49
+ "defaults": {
50
+ "mappings": [],
51
+ "thresholds": {
52
+ "mode": "absolute",
53
+ "steps": [
54
+ {
55
+ "color": "light-red",
56
+ "value": null
57
+ }
58
+ ]
59
+ }
60
+ },
61
+ "overrides": [
62
+ {
63
+ "matcher": {
64
+ "id": "byName",
65
+ "options": "MITRE ENRICHED EVENTS"
66
+ },
67
+ "properties": [
68
+ {
69
+ "id": "color",
70
+ "value": {
71
+ "mode": "palette-classic"
72
+ }
73
+ }
74
+ ]
75
+ },
76
+ {
77
+ "matcher": {
78
+ "id": "byName",
79
+ "options": "ALL EVENTS"
80
+ },
81
+ "properties": [
82
+ {
83
+ "id": "color",
84
+ "value": {
85
+ "mode": "palette-classic"
86
+ }
87
+ }
88
+ ]
89
+ }
90
+ ]
91
+ },
92
+ "gridPos": {
93
+ "h": 7,
94
+ "w": 4,
95
+ "x": 0,
96
+ "y": 0
97
+ },
98
+ "id": 2,
99
+ "options": {
100
+ "colorMode": "value",
101
+ "graphMode": "area",
102
+ "justifyMode": "auto",
103
+ "orientation": "horizontal",
104
+ "reduceOptions": {
105
+ "calcs": ["sum"],
106
+ "fields": "",
107
+ "values": false
108
+ },
109
+ "text": {},
110
+ "textMode": "auto"
111
+ },
112
+ "pluginVersion": "9.0.0",
113
+ "targets": [
114
+ {
115
+ "alias": "MITRE ENRICHED EVENTS",
116
+ "bucketAggs": [
117
+ {
118
+ "$$hashKey": "object:266",
119
+ "field": "timestamp",
120
+ "id": "2",
121
+ "settings": {
122
+ "interval": "auto",
123
+ "min_doc_count": 0,
124
+ "trimEdges": 0
125
+ },
126
+ "type": "date_histogram"
127
+ }
128
+ ],
129
+ "datasource": {
130
+ "type": "elasticsearch",
131
+ "uid": "wazuh_datasource_uid"
132
+ },
133
+ "metrics": [
134
+ {
135
+ "$$hashKey": "object:264",
136
+ "field": "select field",
137
+ "id": "1",
138
+ "type": "count"
139
+ }
140
+ ],
141
+ "query": "_exists_:rule_mitre_tactic AND agent_name:$agent_name",
142
+ "refId": "A",
143
+ "timeField": "timestamp"
144
+ },
145
+ {
146
+ "alias": "ALL EVENTS",
147
+ "bucketAggs": [
148
+ {
149
+ "field": "timestamp",
150
+ "id": "2",
151
+ "settings": {
152
+ "interval": "auto"
153
+ },
154
+ "type": "date_histogram"
155
+ }
156
+ ],
157
+ "datasource": {
158
+ "type": "elasticsearch",
159
+ "uid": "wazuh_datasource_uid"
160
+ },
161
+ "hide": false,
162
+ "metrics": [
163
+ {
164
+ "id": "1",
165
+ "type": "count"
166
+ }
167
+ ],
168
+ "query": "agent_name:$agent_name",
169
+ "refId": "B",
170
+ "timeField": "timestamp"
171
+ }
172
+ ],
173
+ "title": "MITRE ATT&CK EBRICHMENT",
174
+ "type": "stat"
175
+ },
176
+ {
177
+ "datasource": {
178
+ "type": "elasticsearch",
179
+ "uid": "wazuh_datasource_uid"
180
+ },
181
+ "fieldConfig": {
182
+ "defaults": {
183
+ "mappings": [],
184
+ "thresholds": {
185
+ "mode": "absolute",
186
+ "steps": [
187
+ {
188
+ "color": "light-red",
189
+ "value": null
190
+ }
191
+ ]
192
+ }
193
+ },
194
+ "overrides": []
195
+ },
196
+ "gridPos": {
197
+ "h": 7,
198
+ "w": 4,
199
+ "x": 4,
200
+ "y": 0
201
+ },
202
+ "id": 35,
203
+ "options": {
204
+ "colorMode": "value",
205
+ "graphMode": "area",
206
+ "justifyMode": "auto",
207
+ "orientation": "auto",
208
+ "reduceOptions": {
209
+ "calcs": ["sum"],
210
+ "fields": "",
211
+ "values": false
212
+ },
213
+ "text": {},
214
+ "textMode": "auto"
215
+ },
216
+ "pluginVersion": "9.0.0",
217
+ "targets": [
218
+ {
219
+ "bucketAggs": [
220
+ {
221
+ "$$hashKey": "object:266",
222
+ "field": "timestamp",
223
+ "id": "2",
224
+ "settings": {
225
+ "interval": "auto",
226
+ "min_doc_count": 0,
227
+ "trimEdges": 0
228
+ },
229
+ "type": "date_histogram"
230
+ }
231
+ ],
232
+ "metrics": [
233
+ {
234
+ "$$hashKey": "object:264",
235
+ "field": "select field",
236
+ "id": "1",
237
+ "type": "count"
238
+ }
239
+ ],
240
+ "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND agent_name:$agent_name",
241
+ "refId": "A",
242
+ "timeField": "timestamp"
243
+ }
244
+ ],
245
+ "title": "MITRE ATT&CK ALERTS",
246
+ "type": "stat"
247
+ },
248
+ {
249
+ "datasource": {
250
+ "type": "elasticsearch",
251
+ "uid": "wazuh_datasource_uid"
252
+ },
253
+ "fieldConfig": {
254
+ "defaults": {
255
+ "mappings": [],
256
+ "thresholds": {
257
+ "mode": "absolute",
258
+ "steps": [
259
+ {
260
+ "color": "light-red",
261
+ "value": null
262
+ }
263
+ ]
264
+ }
265
+ },
266
+ "overrides": []
267
+ },
268
+ "gridPos": {
269
+ "h": 7,
270
+ "w": 4,
271
+ "x": 8,
272
+ "y": 0
273
+ },
274
+ "id": 12,
275
+ "options": {
276
+ "colorMode": "value",
277
+ "graphMode": "area",
278
+ "justifyMode": "auto",
279
+ "orientation": "auto",
280
+ "reduceOptions": {
281
+ "calcs": ["sum"],
282
+ "fields": "",
283
+ "values": false
284
+ },
285
+ "text": {},
286
+ "textMode": "auto"
287
+ },
288
+ "pluginVersion": "9.0.0",
289
+ "targets": [
290
+ {
291
+ "bucketAggs": [
292
+ {
293
+ "$$hashKey": "object:161",
294
+ "field": "agent_name",
295
+ "id": "2",
296
+ "settings": {
297
+ "min_doc_count": 1,
298
+ "order": "desc",
299
+ "orderBy": "_term",
300
+ "size": "10"
301
+ },
302
+ "type": "terms"
303
+ }
304
+ ],
305
+ "metrics": [
306
+ {
307
+ "$$hashKey": "object:159",
308
+ "field": "agent_name",
309
+ "id": "1",
310
+ "meta": {},
311
+ "settings": {},
312
+ "type": "cardinality"
313
+ }
314
+ ],
315
+ "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND agent_name:$agent_name",
316
+ "refId": "A",
317
+ "timeField": "timestamp"
318
+ }
319
+ ],
320
+ "title": "HOSTS AFFECTED",
321
+ "type": "stat"
322
+ },
323
+ {
324
+ "datasource": {
325
+ "type": "elasticsearch",
326
+ "uid": "wazuh_datasource_uid"
327
+ },
328
+ "fieldConfig": {
329
+ "defaults": {
330
+ "color": {
331
+ "mode": "palette-classic"
332
+ },
333
+ "custom": {
334
+ "hideFrom": {
335
+ "legend": false,
336
+ "tooltip": false,
337
+ "viz": false
338
+ }
339
+ },
340
+ "decimals": 0,
341
+ "mappings": [],
342
+ "unit": "short"
343
+ },
344
+ "overrides": []
345
+ },
346
+ "gridPos": {
347
+ "h": 7,
348
+ "w": 6,
349
+ "x": 12,
350
+ "y": 0
351
+ },
352
+ "id": 15,
353
+ "links": [],
354
+ "maxDataPoints": 3,
355
+ "options": {
356
+ "displayLabels": [],
357
+ "legend": {
358
+ "calcs": [],
359
+ "displayMode": "table",
360
+ "placement": "right",
361
+ "values": ["value"]
362
+ },
363
+ "pieType": "donut",
364
+ "reduceOptions": {
365
+ "calcs": ["sum"],
366
+ "fields": "",
367
+ "values": false
368
+ },
369
+ "text": {},
370
+ "tooltip": {
371
+ "mode": "single",
372
+ "sort": "none"
373
+ }
374
+ },
375
+ "pluginVersion": "6.6.2",
376
+ "targets": [
377
+ {
378
+ "bucketAggs": [
379
+ {
380
+ "$$hashKey": "object:188",
381
+ "fake": true,
382
+ "field": "agent_name",
383
+ "id": "3",
384
+ "settings": {
385
+ "min_doc_count": 1,
386
+ "order": "desc",
387
+ "orderBy": "_count",
388
+ "size": "0"
389
+ },
390
+ "type": "terms"
391
+ },
392
+ {
393
+ "$$hashKey": "object:189",
394
+ "field": "timestamp",
395
+ "id": "2",
396
+ "settings": {
397
+ "interval": "auto",
398
+ "min_doc_count": 0,
399
+ "trimEdges": 0
400
+ },
401
+ "type": "date_histogram"
402
+ }
403
+ ],
404
+ "metrics": [
405
+ {
406
+ "$$hashKey": "object:186",
407
+ "field": "select field",
408
+ "id": "1",
409
+ "type": "count"
410
+ }
411
+ ],
412
+ "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND agent_name:$agent_name",
413
+ "refId": "A",
414
+ "timeField": "timestamp"
415
+ }
416
+ ],
417
+ "title": "HOSTS",
418
+ "type": "piechart"
419
+ },
420
+ {
421
+ "datasource": {
422
+ "type": "elasticsearch",
423
+ "uid": "wazuh_datasource_uid"
424
+ },
425
+ "fieldConfig": {
426
+ "defaults": {
427
+ "color": {
428
+ "mode": "thresholds"
429
+ },
430
+ "custom": {
431
+ "align": "auto",
432
+ "displayMode": "auto",
433
+ "inspect": false
434
+ },
435
+ "mappings": [],
436
+ "thresholds": {
437
+ "mode": "absolute",
438
+ "steps": [
439
+ {
440
+ "color": "light-red",
441
+ "value": null
442
+ }
443
+ ]
444
+ }
445
+ },
446
+ "overrides": []
447
+ },
448
+ "gridPos": {
449
+ "h": 7,
450
+ "w": 6,
451
+ "x": 18,
452
+ "y": 0
453
+ },
454
+ "id": 13,
455
+ "options": {
456
+ "footer": {
457
+ "fields": "",
458
+ "reducer": ["sum"],
459
+ "show": false
460
+ },
461
+ "showHeader": true
462
+ },
463
+ "pluginVersion": "9.0.0",
464
+ "targets": [
465
+ {
466
+ "bucketAggs": [
467
+ {
468
+ "$$hashKey": "object:228",
469
+ "field": "user_name",
470
+ "id": "2",
471
+ "settings": {
472
+ "min_doc_count": 1,
473
+ "order": "desc",
474
+ "orderBy": "_term",
475
+ "size": "10"
476
+ },
477
+ "type": "terms"
478
+ }
479
+ ],
480
+ "metrics": [
481
+ {
482
+ "$$hashKey": "object:226",
483
+ "field": "user_name",
484
+ "id": "1",
485
+ "meta": {},
486
+ "settings": {},
487
+ "type": "cardinality"
488
+ }
489
+ ],
490
+ "query": "rule_level:>=12 AND _exists_:rule_mitre_tactic AND agent_name:$agent_name",
491
+ "refId": "A",
492
+ "timeField": "timestamp"
493
+ }
494
+ ],
495
+ "title": "USERS/ACCOUNTS AFFECTED",
496
+ "type": "table"
497
+ },
498
+ {
499
+ "datasource": {
500
+ "type": "elasticsearch",
501
+ "uid": "wazuh_datasource_uid"
502
+ },
503
+ "fieldConfig": {
504
+ "defaults": {
505
+ "color": {
506
+ "mode": "palette-classic"
507
+ },
508
+ "custom": {
509
+ "hideFrom": {
510
+ "legend": false,
511
+ "tooltip": false,
512
+ "viz": false
513
+ }
514
+ },
515
+ "decimals": 0,
516
+ "mappings": [],
517
+ "unit": "short"
518
+ },
519
+ "overrides": []
520
+ },
521
+ "gridPos": {
522
+ "h": 11,
523
+ "w": 5,
524
+ "x": 0,
525
+ "y": 7
526
+ },
527
+ "id": 16,
528
+ "links": [],
529
+ "options": {
530
+ "displayLabels": [],
531
+ "legend": {
532
+ "calcs": [],
533
+ "displayMode": "hidden",
534
+ "placement": "right",
535
+ "values": ["value"]
536
+ },
537
+ "pieType": "pie",
538
+ "reduceOptions": {
539
+ "calcs": ["sum"],
540
+ "fields": "",
541
+ "values": false
542
+ },
543
+ "text": {},
544
+ "tooltip": {
545
+ "mode": "single",
546
+ "sort": "none"
547
+ }
548
+ },
549
+ "pluginVersion": "7.1.0",
550
+ "targets": [
551
+ {
552
+ "bucketAggs": [
553
+ {
554
+ "$$hashKey": "object:82",
555
+ "fake": true,
556
+ "field": "rule_mitre_tactic",
557
+ "id": "3",
558
+ "settings": {
559
+ "min_doc_count": 1,
560
+ "order": "desc",
561
+ "orderBy": "_count",
562
+ "size": "10"
563
+ },
564
+ "type": "terms"
565
+ },
566
+ {
567
+ "$$hashKey": "object:83",
568
+ "field": "timestamp",
569
+ "id": "2",
570
+ "settings": {
571
+ "interval": "auto",
572
+ "min_doc_count": 0,
573
+ "trimEdges": 0
574
+ },
575
+ "type": "date_histogram"
576
+ }
577
+ ],
578
+ "metrics": [
579
+ {
580
+ "$$hashKey": "object:80",
581
+ "field": "select field",
582
+ "id": "1",
583
+ "type": "count"
584
+ }
585
+ ],
586
+ "query": "agent_name:$agent_name",
587
+ "refId": "A",
588
+ "timeField": "timestamp"
589
+ }
590
+ ],
591
+ "title": "MITRE ATT&CK TACTICS (TOP 10)",
592
+ "type": "piechart"
593
+ },
594
+ {
595
+ "datasource": {
596
+ "type": "elasticsearch",
597
+ "uid": "wazuh_datasource_uid"
598
+ },
599
+ "fieldConfig": {
600
+ "defaults": {
601
+ "custom": {
602
+ "align": "auto",
603
+ "displayMode": "auto",
604
+ "filterable": false,
605
+ "inspect": false
606
+ },
607
+ "mappings": [
608
+ {
609
+ "options": {
610
+ "mitre_attack": {
611
+ "text": "Total"
612
+ }
613
+ },
614
+ "type": "value"
615
+ }
616
+ ],
617
+ "thresholds": {
618
+ "mode": "absolute",
619
+ "steps": [
620
+ {
621
+ "color": "green",
622
+ "value": null
623
+ },
624
+ {
625
+ "color": "red",
626
+ "value": 80
627
+ }
628
+ ]
629
+ }
630
+ },
631
+ "overrides": []
632
+ },
633
+ "gridPos": {
634
+ "h": 11,
635
+ "w": 6,
636
+ "x": 5,
637
+ "y": 7
638
+ },
639
+ "id": 28,
640
+ "links": [],
641
+ "options": {
642
+ "footer": {
643
+ "fields": "",
644
+ "reducer": ["sum"],
645
+ "show": false
646
+ },
647
+ "showHeader": true
648
+ },
649
+ "pluginVersion": "9.0.0",
650
+ "targets": [
651
+ {
652
+ "bucketAggs": [
653
+ {
654
+ "$$hashKey": "object:615",
655
+ "fake": true,
656
+ "field": "rule_mitre_tactic",
657
+ "id": "4",
658
+ "settings": {
659
+ "min_doc_count": "1",
660
+ "order": "desc",
661
+ "orderBy": "_count",
662
+ "size": "0"
663
+ },
664
+ "type": "terms"
665
+ }
666
+ ],
667
+ "metrics": [
668
+ {
669
+ "$$hashKey": "object:80",
670
+ "field": "select field",
671
+ "id": "1",
672
+ "type": "count"
673
+ }
674
+ ],
675
+ "query": "agent_name:$agent_name",
676
+ "refId": "A",
677
+ "timeField": "timestamp"
678
+ }
679
+ ],
680
+ "title": "MITRE ATT&CK TACTICS",
681
+ "type": "table"
682
+ },
683
+ {
684
+ "datasource": {
685
+ "type": "elasticsearch",
686
+ "uid": "wazuh_datasource_uid"
687
+ },
688
+ "fieldConfig": {
689
+ "defaults": {
690
+ "custom": {
691
+ "align": "auto",
692
+ "displayMode": "auto",
693
+ "filterable": false,
694
+ "inspect": false
695
+ },
696
+ "mappings": [
697
+ {
698
+ "options": {
699
+ "mitre_attack": {
700
+ "text": "Total"
701
+ }
702
+ },
703
+ "type": "value"
704
+ }
705
+ ],
706
+ "thresholds": {
707
+ "mode": "absolute",
708
+ "steps": [
709
+ {
710
+ "color": "green",
711
+ "value": null
712
+ },
713
+ {
714
+ "color": "red",
715
+ "value": 80
716
+ }
717
+ ]
718
+ }
719
+ },
720
+ "overrides": []
721
+ },
722
+ "gridPos": {
723
+ "h": 22,
724
+ "w": 5,
725
+ "x": 11,
726
+ "y": 7
727
+ },
728
+ "id": 33,
729
+ "links": [],
730
+ "options": {
731
+ "footer": {
732
+ "fields": "",
733
+ "reducer": ["sum"],
734
+ "show": false
735
+ },
736
+ "showHeader": true
737
+ },
738
+ "pluginVersion": "9.0.0",
739
+ "targets": [
740
+ {
741
+ "bucketAggs": [
742
+ {
743
+ "$$hashKey": "object:615",
744
+ "fake": true,
745
+ "field": "rule_mitre_id",
746
+ "id": "4",
747
+ "settings": {
748
+ "min_doc_count": "1",
749
+ "order": "desc",
750
+ "orderBy": "_count",
751
+ "size": "0"
752
+ },
753
+ "type": "terms"
754
+ }
755
+ ],
756
+ "metrics": [
757
+ {
758
+ "$$hashKey": "object:80",
759
+ "field": "select field",
760
+ "id": "1",
761
+ "type": "count"
762
+ }
763
+ ],
764
+ "query": "agent_name:$agent_name AND (_exists_:rule_mitre_tactic OR _exists_:data_win_eventdata_ruleName)",
765
+ "refId": "A",
766
+ "timeField": "timestamp"
767
+ }
768
+ ],
769
+ "title": "MITRE ATT&CK TECHNIQUES",
770
+ "transparent": true,
771
+ "type": "table"
772
+ },
773
+ {
774
+ "datasource": {
775
+ "type": "elasticsearch",
776
+ "uid": "wazuh_datasource_uid"
777
+ },
778
+ "fieldConfig": {
779
+ "defaults": {
780
+ "custom": {
781
+ "align": "auto",
782
+ "displayMode": "auto",
783
+ "filterable": false,
784
+ "inspect": false
785
+ },
786
+ "mappings": [
787
+ {
788
+ "options": {
789
+ "mitre_attack": {
790
+ "text": "Total"
791
+ }
792
+ },
793
+ "type": "value"
794
+ }
795
+ ],
796
+ "thresholds": {
797
+ "mode": "absolute",
798
+ "steps": [
799
+ {
800
+ "color": "green",
801
+ "value": null
802
+ },
803
+ {
804
+ "color": "red",
805
+ "value": 80
806
+ }
807
+ ]
808
+ }
809
+ },
810
+ "overrides": [
811
+ {
812
+ "matcher": {
813
+ "id": "byName",
814
+ "options": "data_win_eventdata_ruleName"
815
+ },
816
+ "properties": [
817
+ {
818
+ "id": "custom.width",
819
+ "value": 602
820
+ }
821
+ ]
822
+ }
823
+ ]
824
+ },
825
+ "gridPos": {
826
+ "h": 22,
827
+ "w": 8,
828
+ "x": 16,
829
+ "y": 7
830
+ },
831
+ "id": 34,
832
+ "links": [],
833
+ "options": {
834
+ "footer": {
835
+ "fields": "",
836
+ "reducer": ["sum"],
837
+ "show": false
838
+ },
839
+ "showHeader": true,
840
+ "sortBy": []
841
+ },
842
+ "pluginVersion": "9.0.0",
843
+ "targets": [
844
+ {
845
+ "bucketAggs": [
846
+ {
847
+ "$$hashKey": "object:615",
848
+ "fake": true,
849
+ "field": "data_win_eventdata_ruleName",
850
+ "id": "4",
851
+ "settings": {
852
+ "min_doc_count": "1",
853
+ "order": "desc",
854
+ "orderBy": "_count",
855
+ "size": "0"
856
+ },
857
+ "type": "terms"
858
+ }
859
+ ],
860
+ "metrics": [
861
+ {
862
+ "$$hashKey": "object:80",
863
+ "field": "select field",
864
+ "id": "1",
865
+ "type": "count"
866
+ }
867
+ ],
868
+ "query": "agent_name:$agent_name",
869
+ "refId": "A",
870
+ "timeField": "timestamp"
871
+ }
872
+ ],
873
+ "title": "MITRE ATT&CK TECHNIQUES (SYSMON)",
874
+ "type": "table"
875
+ },
876
+ {
877
+ "datasource": {
878
+ "type": "elasticsearch",
879
+ "uid": "wazuh_datasource_uid"
880
+ },
881
+ "fieldConfig": {
882
+ "defaults": {
883
+ "color": {
884
+ "mode": "palette-classic"
885
+ },
886
+ "custom": {
887
+ "hideFrom": {
888
+ "legend": false,
889
+ "tooltip": false,
890
+ "viz": false
891
+ }
892
+ },
893
+ "decimals": 0,
894
+ "mappings": [],
895
+ "unit": "short"
896
+ },
897
+ "overrides": []
898
+ },
899
+ "gridPos": {
900
+ "h": 11,
901
+ "w": 5,
902
+ "x": 0,
903
+ "y": 18
904
+ },
905
+ "id": 29,
906
+ "links": [],
907
+ "options": {
908
+ "displayLabels": [],
909
+ "legend": {
910
+ "calcs": [],
911
+ "displayMode": "hidden",
912
+ "placement": "bottom",
913
+ "values": ["value"]
914
+ },
915
+ "pieType": "donut",
916
+ "reduceOptions": {
917
+ "calcs": ["sum"],
918
+ "fields": "",
919
+ "values": false
920
+ },
921
+ "text": {},
922
+ "tooltip": {
923
+ "mode": "single",
924
+ "sort": "none"
925
+ }
926
+ },
927
+ "pluginVersion": "7.1.0",
928
+ "targets": [
929
+ {
930
+ "bucketAggs": [
931
+ {
932
+ "$$hashKey": "object:82",
933
+ "fake": true,
934
+ "field": "rule_mitre_technique",
935
+ "id": "3",
936
+ "settings": {
937
+ "min_doc_count": 1,
938
+ "order": "desc",
939
+ "orderBy": "_count",
940
+ "size": "10"
941
+ },
942
+ "type": "terms"
943
+ },
944
+ {
945
+ "$$hashKey": "object:83",
946
+ "field": "timestamp",
947
+ "id": "2",
948
+ "settings": {
949
+ "interval": "auto",
950
+ "min_doc_count": 0,
951
+ "trimEdges": 0
952
+ },
953
+ "type": "date_histogram"
954
+ }
955
+ ],
956
+ "metrics": [
957
+ {
958
+ "$$hashKey": "object:80",
959
+ "field": "select field",
960
+ "id": "1",
961
+ "type": "count"
962
+ }
963
+ ],
964
+ "query": "agent_name:$agent_name AND (_exists_:rule_mitre_tactic OR _exists_:data_win_eventdata_ruleName)",
965
+ "refId": "A",
966
+ "timeField": "timestamp"
967
+ }
968
+ ],
969
+ "title": "MITRE ATT&CK TECHNIQUES (TOP 10)",
970
+ "type": "piechart"
971
+ },
972
+ {
973
+ "datasource": {
974
+ "type": "elasticsearch",
975
+ "uid": "wazuh_datasource_uid"
976
+ },
977
+ "fieldConfig": {
978
+ "defaults": {
979
+ "custom": {
980
+ "align": "auto",
981
+ "displayMode": "auto",
982
+ "filterable": false,
983
+ "inspect": false
984
+ },
985
+ "mappings": [
986
+ {
987
+ "options": {
988
+ "mitre_attack": {
989
+ "text": "Total"
990
+ }
991
+ },
992
+ "type": "value"
993
+ }
994
+ ],
995
+ "thresholds": {
996
+ "mode": "absolute",
997
+ "steps": [
998
+ {
999
+ "color": "green",
1000
+ "value": null
1001
+ },
1002
+ {
1003
+ "color": "red",
1004
+ "value": 80
1005
+ }
1006
+ ]
1007
+ }
1008
+ },
1009
+ "overrides": []
1010
+ },
1011
+ "gridPos": {
1012
+ "h": 11,
1013
+ "w": 6,
1014
+ "x": 5,
1015
+ "y": 18
1016
+ },
1017
+ "id": 30,
1018
+ "links": [],
1019
+ "options": {
1020
+ "footer": {
1021
+ "fields": "",
1022
+ "reducer": ["sum"],
1023
+ "show": false
1024
+ },
1025
+ "showHeader": true
1026
+ },
1027
+ "pluginVersion": "9.0.0",
1028
+ "targets": [
1029
+ {
1030
+ "bucketAggs": [
1031
+ {
1032
+ "$$hashKey": "object:615",
1033
+ "fake": true,
1034
+ "field": "rule_mitre_technique",
1035
+ "id": "4",
1036
+ "settings": {
1037
+ "min_doc_count": "1",
1038
+ "order": "desc",
1039
+ "orderBy": "_count",
1040
+ "size": "0"
1041
+ },
1042
+ "type": "terms"
1043
+ }
1044
+ ],
1045
+ "metrics": [
1046
+ {
1047
+ "$$hashKey": "object:80",
1048
+ "field": "select field",
1049
+ "id": "1",
1050
+ "type": "count"
1051
+ }
1052
+ ],
1053
+ "query": "agent_name:$agent_name AND (_exists_:rule_mitre_tactic OR _exists_:data_win_eventdata_ruleName)",
1054
+ "refId": "A",
1055
+ "timeField": "timestamp"
1056
+ }
1057
+ ],
1058
+ "title": "MITRE ATT&CK TECHNIQUES",
1059
+ "type": "table"
1060
+ },
1061
+ {
1062
+ "datasource": {
1063
+ "type": "elasticsearch",
1064
+ "uid": "wazuh_datasource_uid"
1065
+ },
1066
+ "fieldConfig": {
1067
+ "defaults": {
1068
+ "color": {
1069
+ "mode": "thresholds"
1070
+ },
1071
+ "custom": {
1072
+ "align": "auto",
1073
+ "displayMode": "auto",
1074
+ "inspect": false
1075
+ },
1076
+ "mappings": [
1077
+ {
1078
+ "options": {
1079
+ "mitre_attack": {
1080
+ "text": "Total"
1081
+ }
1082
+ },
1083
+ "type": "value"
1084
+ }
1085
+ ],
1086
+ "thresholds": {
1087
+ "mode": "absolute",
1088
+ "steps": [
1089
+ {
1090
+ "color": "green"
1091
+ },
1092
+ {
1093
+ "color": "red",
1094
+ "value": 80
1095
+ }
1096
+ ]
1097
+ }
1098
+ },
1099
+ "overrides": []
1100
+ },
1101
+ "gridPos": {
1102
+ "h": 12,
1103
+ "w": 9,
1104
+ "x": 0,
1105
+ "y": 29
1106
+ },
1107
+ "id": 17,
1108
+ "options": {
1109
+ "footer": {
1110
+ "fields": "",
1111
+ "reducer": ["sum"],
1112
+ "show": false
1113
+ },
1114
+ "showHeader": true
1115
+ },
1116
+ "pluginVersion": "9.0.0",
1117
+ "targets": [
1118
+ {
1119
+ "bucketAggs": [
1120
+ {
1121
+ "$$hashKey": "object:82",
1122
+ "fake": true,
1123
+ "field": "agent_name",
1124
+ "id": "3",
1125
+ "settings": {
1126
+ "min_doc_count": 1,
1127
+ "order": "desc",
1128
+ "orderBy": "_count",
1129
+ "size": "10"
1130
+ },
1131
+ "type": "terms"
1132
+ }
1133
+ ],
1134
+ "metrics": [
1135
+ {
1136
+ "$$hashKey": "object:80",
1137
+ "field": "select field",
1138
+ "id": "1",
1139
+ "type": "count"
1140
+ }
1141
+ ],
1142
+ "query": "agent_name:$agent_name AND (_exists_:rule_mitre_tactic OR _exists_:data_win_eventdata_ruleName)",
1143
+ "refId": "A",
1144
+ "timeField": "timestamp"
1145
+ }
1146
+ ],
1147
+ "title": "MITRE ATT&CK - TOP 10 AGENTS",
1148
+ "transparent": true,
1149
+ "type": "table"
1150
+ },
1151
+ {
1152
+ "aliasColors": {},
1153
+ "bars": true,
1154
+ "dashLength": 10,
1155
+ "dashes": false,
1156
+ "datasource": {
1157
+ "type": "elasticsearch",
1158
+ "uid": "wazuh_datasource_uid"
1159
+ },
1160
+ "fill": 1,
1161
+ "fillGradient": 0,
1162
+ "gridPos": {
1163
+ "h": 12,
1164
+ "w": 15,
1165
+ "x": 9,
1166
+ "y": 29
1167
+ },
1168
+ "hiddenSeries": false,
1169
+ "id": 32,
1170
+ "legend": {
1171
+ "alignAsTable": true,
1172
+ "avg": false,
1173
+ "current": false,
1174
+ "max": false,
1175
+ "min": false,
1176
+ "rightSide": true,
1177
+ "show": true,
1178
+ "total": false,
1179
+ "values": false
1180
+ },
1181
+ "lines": false,
1182
+ "linewidth": 1,
1183
+ "nullPointMode": "null",
1184
+ "options": {
1185
+ "alertThreshold": true
1186
+ },
1187
+ "percentage": false,
1188
+ "pluginVersion": "9.0.0",
1189
+ "pointradius": 2,
1190
+ "points": false,
1191
+ "renderer": "flot",
1192
+ "seriesOverrides": [],
1193
+ "spaceLength": 10,
1194
+ "stack": false,
1195
+ "steppedLine": false,
1196
+ "targets": [
1197
+ {
1198
+ "bucketAggs": [
1199
+ {
1200
+ "$$hashKey": "object:644",
1201
+ "fake": true,
1202
+ "field": "agent_name",
1203
+ "id": "3",
1204
+ "settings": {
1205
+ "min_doc_count": "1",
1206
+ "order": "desc",
1207
+ "orderBy": "_term",
1208
+ "size": "10"
1209
+ },
1210
+ "type": "terms"
1211
+ },
1212
+ {
1213
+ "$$hashKey": "object:627",
1214
+ "field": "timestamp",
1215
+ "id": "2",
1216
+ "settings": {
1217
+ "interval": "5m",
1218
+ "min_doc_count": 0,
1219
+ "trimEdges": 0
1220
+ },
1221
+ "type": "date_histogram"
1222
+ }
1223
+ ],
1224
+ "metrics": [
1225
+ {
1226
+ "$$hashKey": "object:625",
1227
+ "field": "select field",
1228
+ "id": "1",
1229
+ "type": "count"
1230
+ }
1231
+ ],
1232
+ "query": "agent_name:$agent_name AND (_exists_:rule_mitre_tactic OR _exists_:data_win_eventdata_ruleName)",
1233
+ "refId": "A",
1234
+ "timeField": "timestamp"
1235
+ }
1236
+ ],
1237
+ "thresholds": [],
1238
+ "timeRegions": [],
1239
+ "title": "MITRE ATT&CK - HISTOGRAM",
1240
+ "tooltip": {
1241
+ "shared": true,
1242
+ "sort": 0,
1243
+ "value_type": "individual"
1244
+ },
1245
+ "type": "graph",
1246
+ "xaxis": {
1247
+ "mode": "time",
1248
+ "show": true,
1249
+ "values": []
1250
+ },
1251
+ "yaxes": [
1252
+ {
1253
+ "$$hashKey": "object:591",
1254
+ "format": "short",
1255
+ "logBase": 1,
1256
+ "show": true
1257
+ },
1258
+ {
1259
+ "$$hashKey": "object:592",
1260
+ "format": "short",
1261
+ "logBase": 1,
1262
+ "show": true
1263
+ }
1264
+ ],
1265
+ "yaxis": {
1266
+ "align": false
1267
+ }
1268
+ },
1269
+ {
1270
+ "datasource": {
1271
+ "type": "elasticsearch",
1272
+ "uid": "wazuh_datasource_uid"
1273
+ },
1274
+ "fieldConfig": {
1275
+ "defaults": {
1276
+ "color": {
1277
+ "mode": "thresholds"
1278
+ },
1279
+ "custom": {
1280
+ "align": "auto",
1281
+ "displayMode": "auto",
1282
+ "inspect": false
1283
+ },
1284
+ "mappings": [],
1285
+ "thresholds": {
1286
+ "mode": "absolute",
1287
+ "steps": [
1288
+ {
1289
+ "color": "green"
1290
+ },
1291
+ {
1292
+ "color": "red",
1293
+ "value": 80
1294
+ }
1295
+ ]
1296
+ }
1297
+ },
1298
+ "overrides": [
1299
+ {
1300
+ "matcher": {
1301
+ "id": "byName",
1302
+ "options": "timestamp"
1303
+ },
1304
+ "properties": [
1305
+ {
1306
+ "id": "displayName",
1307
+ "value": "Date/Time"
1308
+ },
1309
+ {
1310
+ "id": "unit",
1311
+ "value": "time: YYYY-MM-DD HH:mm:ss"
1312
+ },
1313
+ {
1314
+ "id": "custom.align"
1315
+ }
1316
+ ]
1317
+ },
1318
+ {
1319
+ "matcher": {
1320
+ "id": "byName",
1321
+ "options": "agent_name"
1322
+ },
1323
+ "properties": [
1324
+ {
1325
+ "id": "displayName",
1326
+ "value": "AGENT"
1327
+ },
1328
+ {
1329
+ "id": "unit",
1330
+ "value": "short"
1331
+ },
1332
+ {
1333
+ "id": "decimals",
1334
+ "value": 2
1335
+ },
1336
+ {
1337
+ "id": "custom.align"
1338
+ }
1339
+ ]
1340
+ },
1341
+ {
1342
+ "matcher": {
1343
+ "id": "byName",
1344
+ "options": "full_log"
1345
+ },
1346
+ "properties": [
1347
+ {
1348
+ "id": "displayName",
1349
+ "value": "EVENT"
1350
+ },
1351
+ {
1352
+ "id": "unit",
1353
+ "value": "short"
1354
+ },
1355
+ {
1356
+ "id": "decimals",
1357
+ "value": 2
1358
+ }
1359
+ ]
1360
+ },
1361
+ {
1362
+ "matcher": {
1363
+ "id": "byName",
1364
+ "options": "rule_groups"
1365
+ },
1366
+ "properties": [
1367
+ {
1368
+ "id": "displayName",
1369
+ "value": "RULE GROUPS"
1370
+ },
1371
+ {
1372
+ "id": "unit",
1373
+ "value": "short"
1374
+ },
1375
+ {
1376
+ "id": "decimals",
1377
+ "value": 2
1378
+ },
1379
+ {
1380
+ "id": "custom.align"
1381
+ }
1382
+ ]
1383
+ },
1384
+ {
1385
+ "matcher": {
1386
+ "id": "byName",
1387
+ "options": "rule_level"
1388
+ },
1389
+ "properties": [
1390
+ {
1391
+ "id": "displayName",
1392
+ "value": "RULE LEVEL"
1393
+ },
1394
+ {
1395
+ "id": "unit",
1396
+ "value": "short"
1397
+ },
1398
+ {
1399
+ "id": "decimals",
1400
+ "value": -1
1401
+ },
1402
+ {
1403
+ "id": "custom.displayMode",
1404
+ "value": "color-background"
1405
+ },
1406
+ {
1407
+ "id": "custom.align"
1408
+ },
1409
+ {
1410
+ "id": "thresholds",
1411
+ "value": {
1412
+ "mode": "absolute",
1413
+ "steps": [
1414
+ {
1415
+ "color": "#37872D"
1416
+ },
1417
+ {
1418
+ "color": "rgba(237, 129, 40, 0.89)",
1419
+ "value": 7
1420
+ },
1421
+ {
1422
+ "color": "rgba(245, 54, 54, 0.9)",
1423
+ "value": 12
1424
+ }
1425
+ ]
1426
+ }
1427
+ }
1428
+ ]
1429
+ },
1430
+ {
1431
+ "matcher": {
1432
+ "id": "byName",
1433
+ "options": "rule_description"
1434
+ },
1435
+ "properties": [
1436
+ {
1437
+ "id": "displayName",
1438
+ "value": "RULE DESCRIPTION"
1439
+ },
1440
+ {
1441
+ "id": "unit",
1442
+ "value": "short"
1443
+ },
1444
+ {
1445
+ "id": "decimals",
1446
+ "value": 2
1447
+ },
1448
+ {
1449
+ "id": "custom.align"
1450
+ }
1451
+ ]
1452
+ },
1453
+ {
1454
+ "matcher": {
1455
+ "id": "byName",
1456
+ "options": "EVENT ID"
1457
+ },
1458
+ "properties": [
1459
+ {
1460
+ "id": "links",
1461
+ "value": [
1462
+ {
1463
+ "targetBlank": true,
1464
+ "title": "VIEW EVENT DETAILS",
1465
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1466
+ }
1467
+ ]
1468
+ }
1469
+ ]
1470
+ }
1471
+ ]
1472
+ },
1473
+ "gridPos": {
1474
+ "h": 16,
1475
+ "w": 24,
1476
+ "x": 0,
1477
+ "y": 41
1478
+ },
1479
+ "id": 27,
1480
+ "options": {
1481
+ "footer": {
1482
+ "fields": "",
1483
+ "reducer": ["sum"],
1484
+ "show": false
1485
+ },
1486
+ "showHeader": true
1487
+ },
1488
+ "pluginVersion": "9.0.0",
1489
+ "targets": [
1490
+ {
1491
+ "bucketAggs": [],
1492
+ "datasource": {
1493
+ "type": "elasticsearch",
1494
+ "uid": "wazuh_datasource_uid"
1495
+ },
1496
+ "metrics": [
1497
+ {
1498
+ "id": "1",
1499
+ "settings": {
1500
+ "size": "500"
1501
+ },
1502
+ "type": "raw_data"
1503
+ }
1504
+ ],
1505
+ "query": "agent_name:$agent_name AND (_exists_:rule_mitre_tactic OR _exists_:data_win_eventdata_ruleName)",
1506
+ "refId": "A",
1507
+ "timeField": "timestamp"
1508
+ }
1509
+ ],
1510
+ "title": "MITRE ATT&CK - TELEMETRY",
1511
+ "transformations": [
1512
+ {
1513
+ "id": "filterFieldsByName",
1514
+ "options": {
1515
+ "include": {
1516
+ "names": [
1517
+ "timestamp",
1518
+ "_id",
1519
+ "agent_ip",
1520
+ "agent_name",
1521
+ "rule_description",
1522
+ "rule_level",
1523
+ "rule_mitre_id",
1524
+ "rule_mitre_tactic",
1525
+ "rule_mitre_technique",
1526
+ "syslog_level"
1527
+ ]
1528
+ }
1529
+ }
1530
+ },
1531
+ {
1532
+ "id": "organize",
1533
+ "options": {
1534
+ "excludeByName": {
1535
+ "agent_ip": true
1536
+ },
1537
+ "indexByName": {
1538
+ "_id": 1,
1539
+ "agent_ip": 3,
1540
+ "agent_name": 2,
1541
+ "rule_description": 4,
1542
+ "rule_level": 5,
1543
+ "rule_mitre_id": 6,
1544
+ "rule_mitre_tactic": 7,
1545
+ "rule_mitre_technique": 8,
1546
+ "syslog_level": 9,
1547
+ "timestamp": 0
1548
+ },
1549
+ "renameByName": {
1550
+ "_id": "EVENT ID",
1551
+ "agent_ip": "",
1552
+ "rule_description": "",
1553
+ "rule_mitre_id": "MITRE ID",
1554
+ "rule_mitre_tactic": "TACTIC",
1555
+ "rule_mitre_technique": "TECHNIQUE",
1556
+ "syslog_level": "LEVEL",
1557
+ "timestamp": "DATE/TIME"
1558
+ }
1559
+ }
1560
+ }
1561
+ ],
1562
+ "type": "table"
1563
+ }
1564
+ ],
1565
+ "refresh": "",
1566
+ "schemaVersion": 36,
1567
+ "style": "dark",
1568
+ "tags": ["EDR"],
1569
+ "templating": {
1570
+ "list": [
1571
+ {
1572
+ "datasource": {
1573
+ "type": "elasticsearch",
1574
+ "uid": "wazuh_datasource_uid"
1575
+ },
1576
+ "filters": [],
1577
+ "hide": 0,
1578
+ "label": "Filters",
1579
+ "name": "Filters",
1580
+ "skipUrlSync": false,
1581
+ "type": "adhoc"
1582
+ },
1583
+ {
1584
+ "current": {
1585
+ "selected": false,
1586
+ "text": "All",
1587
+ "value": "$__all"
1588
+ },
1589
+ "datasource": {
1590
+ "type": "elasticsearch",
1591
+ "uid": "wazuh_datasource_uid"
1592
+ },
1593
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1594
+ "hide": 0,
1595
+ "includeAll": true,
1596
+ "label": "AGENT",
1597
+ "multi": false,
1598
+ "name": "agent_name",
1599
+ "options": [],
1600
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"_exists_:rule_mitre_tactic\"}",
1601
+ "refresh": 2,
1602
+ "regex": "",
1603
+ "skipUrlSync": false,
1604
+ "sort": 0,
1605
+ "tagValuesQuery": "",
1606
+ "tagsQuery": "",
1607
+ "type": "query",
1608
+ "useTags": false
1609
+ }
1610
+ ]
1611
+ },
1612
+ "time": {
1613
+ "from": "now-6h",
1614
+ "to": "now"
1615
+ },
1616
+ "timepicker": {
1617
+ "refresh_intervals": ["10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"]
1618
+ },
1619
+ "timezone": "",
1620
+ "title": "EDR - MITRE ATT&CK",
1621
+ "uid": null,
1622
+ "version": 3,
1623
+ "weekStart": ""
1624
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_network_scan.json
new
+1910
@@ -0,0 +1,1910 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194288994,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "datasource": {
45
+ "type": "elasticsearch",
46
+ "uid": "wazuh_datasource_uid"
47
+ },
48
+ "fieldConfig": {
49
+ "defaults": {
50
+ "mappings": [
51
+ {
52
+ "options": {
53
+ "match": "null",
54
+ "result": {
55
+ "text": "N/A"
56
+ }
57
+ },
58
+ "type": "special"
59
+ }
60
+ ],
61
+ "thresholds": {
62
+ "mode": "absolute",
63
+ "steps": [
64
+ {
65
+ "color": "dark-orange",
66
+ "value": null
67
+ }
68
+ ]
69
+ },
70
+ "unit": "none"
71
+ },
72
+ "overrides": []
73
+ },
74
+ "gridPos": {
75
+ "h": 7,
76
+ "w": 4,
77
+ "x": 0,
78
+ "y": 0
79
+ },
80
+ "id": 56,
81
+ "links": [],
82
+ "options": {
83
+ "colorMode": "value",
84
+ "graphMode": "area",
85
+ "justifyMode": "auto",
86
+ "orientation": "horizontal",
87
+ "reduceOptions": {
88
+ "calcs": ["sum"],
89
+ "fields": "",
90
+ "values": false
91
+ },
92
+ "text": {},
93
+ "textMode": "auto"
94
+ },
95
+ "pluginVersion": "9.0.0",
96
+ "targets": [
97
+ {
98
+ "bucketAggs": [
99
+ {
100
+ "field": "timestamp",
101
+ "id": "2",
102
+ "settings": {
103
+ "interval": "auto",
104
+ "min_doc_count": 0,
105
+ "trimEdges": 0
106
+ },
107
+ "type": "date_histogram"
108
+ }
109
+ ],
110
+ "datasource": {
111
+ "type": "elasticsearch",
112
+ "uid": "wazuh_datasource_uid"
113
+ },
114
+ "metrics": [
115
+ {
116
+ "field": "select field",
117
+ "id": "1",
118
+ "type": "count"
119
+ }
120
+ ],
121
+ "query": "agent_name:$agent_name AND ((rule_group2:opencti AND data_opencti_entity_type:IPv4-Addr) OR (_exists_:misp_category AND misp_type:ip-dst))",
122
+ "refId": "A",
123
+ "timeField": "timestamp"
124
+ }
125
+ ],
126
+ "title": "FLAGGED IPs",
127
+ "type": "stat"
128
+ },
129
+ {
130
+ "datasource": {
131
+ "type": "elasticsearch",
132
+ "uid": "wazuh_datasource_uid"
133
+ },
134
+ "fieldConfig": {
135
+ "defaults": {
136
+ "color": {
137
+ "mode": "thresholds"
138
+ },
139
+ "custom": {
140
+ "align": "auto",
141
+ "displayMode": "auto",
142
+ "inspect": false
143
+ },
144
+ "decimals": -1,
145
+ "mappings": [],
146
+ "thresholds": {
147
+ "mode": "absolute",
148
+ "steps": [
149
+ {
150
+ "color": "green",
151
+ "value": null
152
+ },
153
+ {
154
+ "color": "red",
155
+ "value": 80
156
+ }
157
+ ]
158
+ },
159
+ "unit": "short"
160
+ },
161
+ "overrides": [
162
+ {
163
+ "matcher": {
164
+ "id": "byName",
165
+ "options": "Count"
166
+ },
167
+ "properties": [
168
+ {
169
+ "id": "unit",
170
+ "value": "short"
171
+ },
172
+ {
173
+ "id": "decimals",
174
+ "value": -1
175
+ },
176
+ {
177
+ "id": "custom.displayMode",
178
+ "value": "color-background"
179
+ },
180
+ {
181
+ "id": "custom.align"
182
+ },
183
+ {
184
+ "id": "thresholds",
185
+ "value": {
186
+ "mode": "absolute",
187
+ "steps": [
188
+ {
189
+ "color": "rgba(50, 172, 45, 0.97)",
190
+ "value": null
191
+ },
192
+ {
193
+ "color": "rgba(237, 129, 40, 0.89)",
194
+ "value": 0
195
+ },
196
+ {
197
+ "color": "#FA6400",
198
+ "value": 1
199
+ }
200
+ ]
201
+ }
202
+ }
203
+ ]
204
+ },
205
+ {
206
+ "matcher": {
207
+ "id": "byName",
208
+ "options": "agent_name"
209
+ },
210
+ "properties": [
211
+ {
212
+ "id": "displayName",
213
+ "value": "AGENT"
214
+ },
215
+ {
216
+ "id": "unit",
217
+ "value": "short"
218
+ },
219
+ {
220
+ "id": "decimals",
221
+ "value": 2
222
+ },
223
+ {
224
+ "id": "custom.align"
225
+ }
226
+ ]
227
+ }
228
+ ]
229
+ },
230
+ "gridPos": {
231
+ "h": 7,
232
+ "w": 8,
233
+ "x": 4,
234
+ "y": 0
235
+ },
236
+ "id": 57,
237
+ "options": {
238
+ "footer": {
239
+ "fields": "",
240
+ "reducer": ["sum"],
241
+ "show": false
242
+ },
243
+ "showHeader": true
244
+ },
245
+ "pluginVersion": "9.0.0",
246
+ "targets": [
247
+ {
248
+ "bucketAggs": [
249
+ {
250
+ "$$hashKey": "object:140",
251
+ "fake": true,
252
+ "field": "agent_name",
253
+ "id": "4",
254
+ "settings": {
255
+ "min_doc_count": 1,
256
+ "order": "desc",
257
+ "orderBy": "_term",
258
+ "size": "0"
259
+ },
260
+ "type": "terms"
261
+ }
262
+ ],
263
+ "datasource": {
264
+ "type": "elasticsearch",
265
+ "uid": "wazuh_datasource_uid"
266
+ },
267
+ "metrics": [
268
+ {
269
+ "$$hashKey": "object:138",
270
+ "field": "select field",
271
+ "id": "1",
272
+ "type": "count"
273
+ }
274
+ ],
275
+ "query": "agent_name:$agent_name AND ((rule_group2:opencti AND data_opencti_entity_type:IPv4-Addr) OR (_exists_:misp_category AND misp_type:ip-dst OR misp_type:\"ip-dst|port\"))",
276
+ "refId": "A",
277
+ "timeField": "timestamp"
278
+ }
279
+ ],
280
+ "title": "FLAGGED DST IPs / AGENT",
281
+ "transformations": [
282
+ {
283
+ "id": "merge",
284
+ "options": {
285
+ "reducers": []
286
+ }
287
+ }
288
+ ],
289
+ "type": "table"
290
+ },
291
+ {
292
+ "datasource": {
293
+ "type": "elasticsearch",
294
+ "uid": "wazuh_datasource_uid"
295
+ },
296
+ "fieldConfig": {
297
+ "defaults": {
298
+ "color": {
299
+ "mode": "thresholds"
300
+ },
301
+ "custom": {
302
+ "align": "auto",
303
+ "displayMode": "auto",
304
+ "inspect": false
305
+ },
306
+ "mappings": [],
307
+ "thresholds": {
308
+ "mode": "absolute",
309
+ "steps": [
310
+ {
311
+ "color": "dark-orange",
312
+ "value": null
313
+ }
314
+ ]
315
+ }
316
+ },
317
+ "overrides": [
318
+ {
319
+ "matcher": {
320
+ "id": "byName",
321
+ "options": "data_misp_value"
322
+ },
323
+ "properties": [
324
+ {
325
+ "id": "displayName",
326
+ "value": "DST IP"
327
+ },
328
+ {
329
+ "id": "custom.align"
330
+ }
331
+ ]
332
+ },
333
+ {
334
+ "matcher": {
335
+ "id": "byName",
336
+ "options": "Count"
337
+ },
338
+ "properties": [
339
+ {
340
+ "id": "unit",
341
+ "value": "short"
342
+ },
343
+ {
344
+ "id": "decimals",
345
+ "value": -1
346
+ },
347
+ {
348
+ "id": "custom.align"
349
+ }
350
+ ]
351
+ },
352
+ {
353
+ "matcher": {
354
+ "id": "byName",
355
+ "options": "data_opencti_value"
356
+ },
357
+ "properties": [
358
+ {
359
+ "id": "custom.displayMode",
360
+ "value": "color-background-solid"
361
+ },
362
+ {
363
+ "id": "displayName",
364
+ "value": "DST IP"
365
+ }
366
+ ]
367
+ },
368
+ {
369
+ "matcher": {
370
+ "id": "byName",
371
+ "options": "misp_value"
372
+ },
373
+ "properties": [
374
+ {
375
+ "id": "links",
376
+ "value": [
377
+ {
378
+ "targetBlank": true,
379
+ "title": "TALOS THREAT INTEL",
380
+ "url": "https://talosintelligence.com/reputation_center/lookup?search=${__value.text}"
381
+ }
382
+ ]
383
+ }
384
+ ]
385
+ }
386
+ ]
387
+ },
388
+ "gridPos": {
389
+ "h": 7,
390
+ "w": 12,
391
+ "x": 12,
392
+ "y": 0
393
+ },
394
+ "id": 75,
395
+ "options": {
396
+ "footer": {
397
+ "fields": "",
398
+ "reducer": ["sum"],
399
+ "show": false
400
+ },
401
+ "showHeader": true
402
+ },
403
+ "pluginVersion": "9.0.0",
404
+ "targets": [
405
+ {
406
+ "bucketAggs": [
407
+ {
408
+ "fake": true,
409
+ "field": "misp_value",
410
+ "id": "4",
411
+ "settings": {
412
+ "min_doc_count": 1,
413
+ "order": "desc",
414
+ "orderBy": "_count",
415
+ "size": "0"
416
+ },
417
+ "type": "terms"
418
+ }
419
+ ],
420
+ "datasource": {
421
+ "type": "elasticsearch",
422
+ "uid": "wazuh_datasource_uid"
423
+ },
424
+ "metrics": [
425
+ {
426
+ "field": "select field",
427
+ "id": "1",
428
+ "type": "count"
429
+ }
430
+ ],
431
+ "query": "agent_name:$agent_name AND _exists_:misp_category AND (misp_type:ip-dst OR misp_type:\"ip-dst|port\")",
432
+ "refId": "A",
433
+ "timeField": "timestamp"
434
+ },
435
+ {
436
+ "alias": "",
437
+ "bucketAggs": [
438
+ {
439
+ "field": "data_opencti_value",
440
+ "id": "2",
441
+ "settings": {
442
+ "min_doc_count": "1",
443
+ "order": "desc",
444
+ "orderBy": "_term",
445
+ "size": "10"
446
+ },
447
+ "type": "terms"
448
+ }
449
+ ],
450
+ "datasource": {
451
+ "type": "elasticsearch",
452
+ "uid": "wazuh_datasource_uid"
453
+ },
454
+ "hide": false,
455
+ "metrics": [
456
+ {
457
+ "id": "1",
458
+ "type": "count"
459
+ }
460
+ ],
461
+ "query": "rule_group2:opencti AND agent_name:$agent_name AND data_opencti_entity_type:IPv4-Addr",
462
+ "refId": "B",
463
+ "timeField": "timestamp"
464
+ }
465
+ ],
466
+ "title": "FLAGGED IPs",
467
+ "transformations": [
468
+ {
469
+ "id": "merge",
470
+ "options": {
471
+ "reducers": []
472
+ }
473
+ }
474
+ ],
475
+ "type": "table"
476
+ },
477
+ {
478
+ "datasource": {
479
+ "type": "elasticsearch",
480
+ "uid": "wazuh_datasource_uid"
481
+ },
482
+ "fieldConfig": {
483
+ "defaults": {
484
+ "mappings": [
485
+ {
486
+ "options": {
487
+ "match": "null",
488
+ "result": {
489
+ "text": "N/A"
490
+ }
491
+ },
492
+ "type": "special"
493
+ }
494
+ ],
495
+ "thresholds": {
496
+ "mode": "absolute",
497
+ "steps": [
498
+ {
499
+ "color": "blue",
500
+ "value": null
501
+ }
502
+ ]
503
+ },
504
+ "unit": "short"
505
+ },
506
+ "overrides": []
507
+ },
508
+ "gridPos": {
509
+ "h": 7,
510
+ "w": 4,
511
+ "x": 0,
512
+ "y": 7
513
+ },
514
+ "id": 43,
515
+ "links": [],
516
+ "options": {
517
+ "colorMode": "value",
518
+ "graphMode": "area",
519
+ "justifyMode": "auto",
520
+ "orientation": "horizontal",
521
+ "reduceOptions": {
522
+ "calcs": ["sum"],
523
+ "fields": "",
524
+ "values": false
525
+ },
526
+ "text": {},
527
+ "textMode": "auto"
528
+ },
529
+ "pluginVersion": "9.0.0",
530
+ "targets": [
531
+ {
532
+ "bucketAggs": [
533
+ {
534
+ "$$hashKey": "object:473",
535
+ "field": "timestamp",
536
+ "id": "2",
537
+ "settings": {
538
+ "interval": "auto",
539
+ "min_doc_count": 0,
540
+ "trimEdges": 0
541
+ },
542
+ "type": "date_histogram"
543
+ }
544
+ ],
545
+ "datasource": {
546
+ "type": "elasticsearch",
547
+ "uid": "wazuh_datasource_uid"
548
+ },
549
+ "metrics": [
550
+ {
551
+ "$$hashKey": "object:471",
552
+ "field": "select field",
553
+ "id": "1",
554
+ "type": "count"
555
+ }
556
+ ],
557
+ "query": "(rule_group3:sysmon_event3 OR rule_group2:packetbeat) AND agent_name:$agent_name",
558
+ "refId": "A",
559
+ "timeField": "timestamp"
560
+ }
561
+ ],
562
+ "title": "NETWORK EVENTS",
563
+ "type": "stat"
564
+ },
565
+ {
566
+ "columns": [],
567
+ "datasource": {
568
+ "type": "elasticsearch",
569
+ "uid": "wazuh_datasource_uid"
570
+ },
571
+ "fontSize": "100%",
572
+ "gridPos": {
573
+ "h": 7,
574
+ "w": 8,
575
+ "x": 4,
576
+ "y": 7
577
+ },
578
+ "id": 63,
579
+ "showHeader": true,
580
+ "sort": {
581
+ "col": 0,
582
+ "desc": true
583
+ },
584
+ "styles": [
585
+ {
586
+ "alias": "Time",
587
+ "align": "auto",
588
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
589
+ "pattern": "Time",
590
+ "type": "date"
591
+ },
592
+ {
593
+ "alias": "",
594
+ "align": "auto",
595
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
596
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
597
+ "decimals": -1,
598
+ "mappingType": 1,
599
+ "pattern": "Count",
600
+ "thresholds": [],
601
+ "type": "number",
602
+ "unit": "short"
603
+ },
604
+ {
605
+ "alias": "AGENT",
606
+ "align": "auto",
607
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
608
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
609
+ "decimals": 2,
610
+ "mappingType": 1,
611
+ "pattern": "agent_name",
612
+ "thresholds": [],
613
+ "type": "number",
614
+ "unit": "short"
615
+ }
616
+ ],
617
+ "targets": [
618
+ {
619
+ "bucketAggs": [
620
+ {
621
+ "fake": true,
622
+ "field": "agent_name",
623
+ "id": "4",
624
+ "settings": {
625
+ "min_doc_count": 1,
626
+ "order": "desc",
627
+ "orderBy": "_count",
628
+ "size": "0"
629
+ },
630
+ "type": "terms"
631
+ }
632
+ ],
633
+ "datasource": {
634
+ "type": "elasticsearch",
635
+ "uid": "wazuh_datasource_uid"
636
+ },
637
+ "metrics": [
638
+ {
639
+ "field": "select field",
640
+ "id": "1",
641
+ "type": "count"
642
+ }
643
+ ],
644
+ "query": "(rule_group3:sysmon_event3 OR rule_group2:packetbeat) AND agent_name:$agent_name",
645
+ "refId": "A",
646
+ "timeField": "timestamp"
647
+ }
648
+ ],
649
+ "title": "AGENTS",
650
+ "transform": "table",
651
+ "type": "table-old"
652
+ },
653
+ {
654
+ "datasource": {
655
+ "type": "elasticsearch",
656
+ "uid": "wazuh_datasource_uid"
657
+ },
658
+ "fieldConfig": {
659
+ "defaults": {
660
+ "mappings": [],
661
+ "thresholds": {
662
+ "mode": "absolute",
663
+ "steps": [
664
+ {
665
+ "color": "green",
666
+ "value": null
667
+ },
668
+ {
669
+ "color": "red",
670
+ "value": 80
671
+ }
672
+ ]
673
+ }
674
+ },
675
+ "overrides": []
676
+ },
677
+ "gridPos": {
678
+ "h": 7,
679
+ "w": 12,
680
+ "x": 12,
681
+ "y": 7
682
+ },
683
+ "id": 37,
684
+ "options": {
685
+ "displayMode": "gradient",
686
+ "minVizHeight": 10,
687
+ "minVizWidth": 0,
688
+ "orientation": "horizontal",
689
+ "reduceOptions": {
690
+ "calcs": ["sum"],
691
+ "fields": "",
692
+ "values": false
693
+ },
694
+ "showUnfilled": true,
695
+ "text": {}
696
+ },
697
+ "pluginVersion": "9.0.0",
698
+ "targets": [
699
+ {
700
+ "bucketAggs": [
701
+ {
702
+ "fake": true,
703
+ "field": "dst_ip",
704
+ "id": "6",
705
+ "settings": {
706
+ "min_doc_count": 1,
707
+ "order": "desc",
708
+ "orderBy": "_count",
709
+ "size": "10"
710
+ },
711
+ "type": "terms"
712
+ },
713
+ {
714
+ "fake": true,
715
+ "field": "timestamp",
716
+ "id": "5",
717
+ "settings": {
718
+ "interval": "auto",
719
+ "min_doc_count": 0,
720
+ "trimEdges": 0
721
+ },
722
+ "type": "date_histogram"
723
+ }
724
+ ],
725
+ "datasource": {
726
+ "type": "elasticsearch",
727
+ "uid": "wazuh_datasource_uid"
728
+ },
729
+ "metrics": [
730
+ {
731
+ "field": "type",
732
+ "id": "1",
733
+ "meta": {},
734
+ "settings": {},
735
+ "type": "count"
736
+ }
737
+ ],
738
+ "query": "(rule_group3:sysmon_event3 OR rule_group2:packetbeat) AND agent_name:$agent_name",
739
+ "refId": "A",
740
+ "timeField": "timestamp"
741
+ }
742
+ ],
743
+ "title": "TOP 10 DST IPs",
744
+ "type": "bargauge"
745
+ },
746
+ {
747
+ "datasource": {
748
+ "type": "elasticsearch",
749
+ "uid": "wazuh_datasource_uid"
750
+ },
751
+ "fieldConfig": {
752
+ "defaults": {
753
+ "mappings": [],
754
+ "thresholds": {
755
+ "mode": "absolute",
756
+ "steps": [
757
+ {
758
+ "color": "green",
759
+ "value": null
760
+ },
761
+ {
762
+ "color": "red",
763
+ "value": 80
764
+ }
765
+ ]
766
+ }
767
+ },
768
+ "overrides": []
769
+ },
770
+ "gridPos": {
771
+ "h": 13,
772
+ "w": 24,
773
+ "x": 0,
774
+ "y": 14
775
+ },
776
+ "id": 74,
777
+ "options": {
778
+ "color": "yellow",
779
+ "iteration": 20,
780
+ "monochrome": false,
781
+ "nodeColor": "super-light-purple",
782
+ "nodePadding": 20,
783
+ "nodeWidth": 30
784
+ },
785
+ "targets": [
786
+ {
787
+ "alias": "",
788
+ "bucketAggs": [
789
+ {
790
+ "field": "src_ip",
791
+ "id": "2",
792
+ "settings": {
793
+ "min_doc_count": "1",
794
+ "order": "desc",
795
+ "orderBy": "_term",
796
+ "size": "10"
797
+ },
798
+ "type": "terms"
799
+ },
800
+ {
801
+ "field": "dst_ip",
802
+ "id": "3",
803
+ "settings": {
804
+ "min_doc_count": "1",
805
+ "order": "desc",
806
+ "orderBy": "_term",
807
+ "size": "10"
808
+ },
809
+ "type": "terms"
810
+ },
811
+ {
812
+ "field": "dst_port",
813
+ "id": "4",
814
+ "settings": {
815
+ "min_doc_count": "1",
816
+ "order": "desc",
817
+ "orderBy": "_count",
818
+ "size": "1"
819
+ },
820
+ "type": "terms"
821
+ }
822
+ ],
823
+ "datasource": {
824
+ "type": "elasticsearch",
825
+ "uid": "wazuh_datasource_uid"
826
+ },
827
+ "metrics": [
828
+ {
829
+ "id": "1",
830
+ "type": "count"
831
+ }
832
+ ],
833
+ "query": "(rule_group3:sysmon_event3 OR rule_group2:packetbeat) AND agent_name:$agent_name AND (data_eventdata_sourceIsIpv6:false OR data_win_eventdata_sourceIsIpv6:false)",
834
+ "refId": "A",
835
+ "timeField": "timestamp"
836
+ }
837
+ ],
838
+ "title": "CONNECTIONS MAP (TOP 10 IPs)",
839
+ "transformations": [
840
+ {
841
+ "id": "organize",
842
+ "options": {
843
+ "excludeByName": {},
844
+ "indexByName": {},
845
+ "renameByName": {
846
+ "Count": "Count",
847
+ "dst_ip": "DST IP",
848
+ "dst_port": "DST PORT",
849
+ "src_ip": "SRC IP"
850
+ }
851
+ }
852
+ }
853
+ ],
854
+ "transparent": true,
855
+ "type": "netsage-sankey-panel"
856
+ },
857
+ {
858
+ "datasource": {
859
+ "type": "elasticsearch",
860
+ "uid": "wazuh_datasource_uid"
861
+ },
862
+ "fieldConfig": {
863
+ "defaults": {
864
+ "color": {
865
+ "mode": "palette-classic"
866
+ },
867
+ "custom": {
868
+ "axisLabel": "",
869
+ "axisPlacement": "auto",
870
+ "barAlignment": 0,
871
+ "drawStyle": "bars",
872
+ "fillOpacity": 0,
873
+ "gradientMode": "none",
874
+ "hideFrom": {
875
+ "legend": false,
876
+ "tooltip": false,
877
+ "viz": false
878
+ },
879
+ "lineInterpolation": "linear",
880
+ "lineWidth": 1,
881
+ "pointSize": 5,
882
+ "scaleDistribution": {
883
+ "type": "linear"
884
+ },
885
+ "showPoints": "auto",
886
+ "spanNulls": false,
887
+ "stacking": {
888
+ "group": "A",
889
+ "mode": "normal"
890
+ },
891
+ "thresholdsStyle": {
892
+ "mode": "off"
893
+ }
894
+ },
895
+ "mappings": [],
896
+ "thresholds": {
897
+ "mode": "absolute",
898
+ "steps": [
899
+ {
900
+ "color": "green"
901
+ },
902
+ {
903
+ "color": "red",
904
+ "value": 80
905
+ }
906
+ ]
907
+ }
908
+ },
909
+ "overrides": []
910
+ },
911
+ "gridPos": {
912
+ "h": 11,
913
+ "w": 14,
914
+ "x": 0,
915
+ "y": 27
916
+ },
917
+ "id": 77,
918
+ "options": {
919
+ "legend": {
920
+ "calcs": [],
921
+ "displayMode": "table",
922
+ "placement": "right"
923
+ },
924
+ "tooltip": {
925
+ "mode": "single",
926
+ "sort": "none"
927
+ }
928
+ },
929
+ "targets": [
930
+ {
931
+ "alias": "",
932
+ "bucketAggs": [
933
+ {
934
+ "field": "agent_name",
935
+ "id": "3",
936
+ "settings": {
937
+ "min_doc_count": "1",
938
+ "order": "desc",
939
+ "orderBy": "_term",
940
+ "size": "10"
941
+ },
942
+ "type": "terms"
943
+ },
944
+ {
945
+ "field": "timestamp",
946
+ "id": "2",
947
+ "settings": {
948
+ "interval": "auto"
949
+ },
950
+ "type": "date_histogram"
951
+ }
952
+ ],
953
+ "datasource": {
954
+ "type": "elasticsearch",
955
+ "uid": "wazuh_datasource_uid"
956
+ },
957
+ "metrics": [
958
+ {
959
+ "id": "1",
960
+ "type": "count"
961
+ }
962
+ ],
963
+ "query": "(rule_group3:sysmon_event3 OR rule_group2:packetbeat) AND agent_name:$agent_name",
964
+ "refId": "A",
965
+ "timeField": "timestamp"
966
+ }
967
+ ],
968
+ "title": "TOP 10 AGENTS - HISTOGRAM",
969
+ "transparent": true,
970
+ "type": "timeseries"
971
+ },
972
+ {
973
+ "circleMaxSize": 30,
974
+ "circleMinSize": 2,
975
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
976
+ "datasource": {
977
+ "type": "elasticsearch",
978
+ "uid": "wazuh_datasource_uid"
979
+ },
980
+ "decimals": 0,
981
+ "esMetric": "Count",
982
+ "gridPos": {
983
+ "h": 11,
984
+ "w": 10,
985
+ "x": 14,
986
+ "y": 27
987
+ },
988
+ "hideEmpty": false,
989
+ "hideZero": false,
990
+ "id": 61,
991
+ "initialZoom": 1,
992
+ "locationData": "countries",
993
+ "mapCenter": "(0°, 0°)",
994
+ "mapCenterLatitude": 0,
995
+ "mapCenterLongitude": 0,
996
+ "maxDataPoints": 1,
997
+ "mouseWheelZoom": false,
998
+ "showLegend": true,
999
+ "stickyLabels": false,
1000
+ "tableQueryOptions": {
1001
+ "geohashField": "geohash",
1002
+ "latitudeField": "latitude",
1003
+ "longitudeField": "longitude",
1004
+ "metricField": "metric",
1005
+ "queryType": "geohash"
1006
+ },
1007
+ "targets": [
1008
+ {
1009
+ "bucketAggs": [
1010
+ {
1011
+ "fake": true,
1012
+ "field": "dst_ip_country_code",
1013
+ "id": "3",
1014
+ "settings": {
1015
+ "min_doc_count": 1,
1016
+ "order": "desc",
1017
+ "orderBy": "_term",
1018
+ "size": "0"
1019
+ },
1020
+ "type": "terms"
1021
+ },
1022
+ {
1023
+ "field": "timestamp",
1024
+ "id": "2",
1025
+ "settings": {
1026
+ "interval": "auto",
1027
+ "min_doc_count": 0,
1028
+ "trimEdges": 0
1029
+ },
1030
+ "type": "date_histogram"
1031
+ }
1032
+ ],
1033
+ "datasource": {
1034
+ "type": "elasticsearch",
1035
+ "uid": "wazuh_datasource_uid"
1036
+ },
1037
+ "metrics": [
1038
+ {
1039
+ "field": "select field",
1040
+ "id": "1",
1041
+ "type": "count"
1042
+ }
1043
+ ],
1044
+ "query": "(rule_group3:sysmon_event3 OR rule_group2:packetbeat) AND agent_name:$agent_name",
1045
+ "refId": "A",
1046
+ "timeField": "timestamp"
1047
+ }
1048
+ ],
1049
+ "thresholds": "0,10",
1050
+ "title": "DST GEOIP",
1051
+ "type": "grafana-worldmap-panel",
1052
+ "unitPlural": "",
1053
+ "unitSingle": "",
1054
+ "valueName": "total"
1055
+ },
1056
+ {
1057
+ "datasource": {
1058
+ "type": "elasticsearch",
1059
+ "uid": "wazuh_datasource_uid"
1060
+ },
1061
+ "fieldConfig": {
1062
+ "defaults": {
1063
+ "mappings": [],
1064
+ "thresholds": {
1065
+ "mode": "absolute",
1066
+ "steps": [
1067
+ {
1068
+ "color": "green"
1069
+ },
1070
+ {
1071
+ "color": "red",
1072
+ "value": 80
1073
+ }
1074
+ ]
1075
+ }
1076
+ },
1077
+ "overrides": []
1078
+ },
1079
+ "gridPos": {
1080
+ "h": 7,
1081
+ "w": 14,
1082
+ "x": 0,
1083
+ "y": 38
1084
+ },
1085
+ "id": 59,
1086
+ "options": {
1087
+ "displayMode": "gradient",
1088
+ "minVizHeight": 10,
1089
+ "minVizWidth": 0,
1090
+ "orientation": "horizontal",
1091
+ "reduceOptions": {
1092
+ "calcs": ["sum"],
1093
+ "fields": "",
1094
+ "values": false
1095
+ },
1096
+ "showUnfilled": true,
1097
+ "text": {}
1098
+ },
1099
+ "pluginVersion": "9.0.0",
1100
+ "targets": [
1101
+ {
1102
+ "bucketAggs": [
1103
+ {
1104
+ "fake": true,
1105
+ "field": "process_image",
1106
+ "id": "6",
1107
+ "settings": {
1108
+ "min_doc_count": 1,
1109
+ "order": "desc",
1110
+ "orderBy": "_count",
1111
+ "size": "10"
1112
+ },
1113
+ "type": "terms"
1114
+ },
1115
+ {
1116
+ "fake": true,
1117
+ "field": "timestamp",
1118
+ "id": "5",
1119
+ "settings": {
1120
+ "interval": "auto",
1121
+ "min_doc_count": 0,
1122
+ "trimEdges": 0
1123
+ },
1124
+ "type": "date_histogram"
1125
+ }
1126
+ ],
1127
+ "datasource": {
1128
+ "type": "elasticsearch",
1129
+ "uid": "wazuh_datasource_uid"
1130
+ },
1131
+ "metrics": [
1132
+ {
1133
+ "field": "type",
1134
+ "id": "1",
1135
+ "meta": {},
1136
+ "settings": {},
1137
+ "type": "count"
1138
+ }
1139
+ ],
1140
+ "query": "rule_group3:sysmon_event3 AND agent_name:$agent_name",
1141
+ "refId": "A",
1142
+ "timeField": "timestamp"
1143
+ }
1144
+ ],
1145
+ "title": "TOP 10 PROCESSES - NETWORK CONNS",
1146
+ "type": "bargauge"
1147
+ },
1148
+ {
1149
+ "datasource": {
1150
+ "type": "elasticsearch",
1151
+ "uid": "wazuh_datasource_uid"
1152
+ },
1153
+ "fieldConfig": {
1154
+ "defaults": {
1155
+ "custom": {
1156
+ "align": "auto",
1157
+ "displayMode": "auto",
1158
+ "filterable": false,
1159
+ "inspect": false
1160
+ },
1161
+ "mappings": [],
1162
+ "thresholds": {
1163
+ "mode": "absolute",
1164
+ "steps": [
1165
+ {
1166
+ "color": "green"
1167
+ },
1168
+ {
1169
+ "color": "red",
1170
+ "value": 80
1171
+ }
1172
+ ]
1173
+ }
1174
+ },
1175
+ "overrides": []
1176
+ },
1177
+ "gridPos": {
1178
+ "h": 14,
1179
+ "w": 10,
1180
+ "x": 14,
1181
+ "y": 38
1182
+ },
1183
+ "id": 70,
1184
+ "options": {
1185
+ "footer": {
1186
+ "fields": "",
1187
+ "reducer": ["sum"],
1188
+ "show": false
1189
+ },
1190
+ "frameIndex": 0,
1191
+ "showHeader": true
1192
+ },
1193
+ "pluginVersion": "9.0.0",
1194
+ "targets": [
1195
+ {
1196
+ "bucketAggs": [
1197
+ {
1198
+ "$$hashKey": "object:167",
1199
+ "fake": true,
1200
+ "field": "process_image",
1201
+ "id": "6",
1202
+ "settings": {
1203
+ "min_doc_count": 1,
1204
+ "order": "desc",
1205
+ "orderBy": "_count",
1206
+ "size": "0"
1207
+ },
1208
+ "type": "terms"
1209
+ }
1210
+ ],
1211
+ "datasource": {
1212
+ "type": "elasticsearch",
1213
+ "uid": "wazuh_datasource_uid"
1214
+ },
1215
+ "metrics": [
1216
+ {
1217
+ "$$hashKey": "object:165",
1218
+ "field": "type",
1219
+ "id": "1",
1220
+ "meta": {},
1221
+ "settings": {},
1222
+ "type": "count"
1223
+ }
1224
+ ],
1225
+ "query": "rule_group3:sysmon_event3 AND agent_name:$agent_name",
1226
+ "refId": "A",
1227
+ "timeField": "timestamp"
1228
+ }
1229
+ ],
1230
+ "title": "PROCESSES - NETWORK CONNS",
1231
+ "type": "table"
1232
+ },
1233
+ {
1234
+ "datasource": {
1235
+ "type": "elasticsearch",
1236
+ "uid": "wazuh_datasource_uid"
1237
+ },
1238
+ "fieldConfig": {
1239
+ "defaults": {
1240
+ "mappings": [],
1241
+ "thresholds": {
1242
+ "mode": "absolute",
1243
+ "steps": [
1244
+ {
1245
+ "color": "green"
1246
+ },
1247
+ {
1248
+ "color": "red",
1249
+ "value": 80
1250
+ }
1251
+ ]
1252
+ }
1253
+ },
1254
+ "overrides": []
1255
+ },
1256
+ "gridPos": {
1257
+ "h": 7,
1258
+ "w": 14,
1259
+ "x": 0,
1260
+ "y": 45
1261
+ },
1262
+ "id": 55,
1263
+ "options": {
1264
+ "displayMode": "gradient",
1265
+ "minVizHeight": 10,
1266
+ "minVizWidth": 0,
1267
+ "orientation": "horizontal",
1268
+ "reduceOptions": {
1269
+ "calcs": ["sum"],
1270
+ "fields": "",
1271
+ "values": false
1272
+ },
1273
+ "showUnfilled": true,
1274
+ "text": {}
1275
+ },
1276
+ "pluginVersion": "9.0.0",
1277
+ "targets": [
1278
+ {
1279
+ "bucketAggs": [
1280
+ {
1281
+ "fake": true,
1282
+ "field": "process_image",
1283
+ "id": "6",
1284
+ "settings": {
1285
+ "min_doc_count": 1,
1286
+ "order": "asc",
1287
+ "orderBy": "_count",
1288
+ "size": "10"
1289
+ },
1290
+ "type": "terms"
1291
+ },
1292
+ {
1293
+ "fake": true,
1294
+ "field": "timestamp",
1295
+ "id": "5",
1296
+ "settings": {
1297
+ "interval": "auto",
1298
+ "min_doc_count": 0,
1299
+ "trimEdges": 0
1300
+ },
1301
+ "type": "date_histogram"
1302
+ }
1303
+ ],
1304
+ "datasource": {
1305
+ "type": "elasticsearch",
1306
+ "uid": "wazuh_datasource_uid"
1307
+ },
1308
+ "metrics": [
1309
+ {
1310
+ "field": "type",
1311
+ "id": "1",
1312
+ "meta": {},
1313
+ "settings": {},
1314
+ "type": "count"
1315
+ }
1316
+ ],
1317
+ "query": "rule_group3:sysmon_event3 AND agent_name:$agent_name",
1318
+ "refId": "A",
1319
+ "timeField": "timestamp"
1320
+ }
1321
+ ],
1322
+ "title": "LEAST SEEN PROCESSES - NETWORK CONNS",
1323
+ "type": "bargauge"
1324
+ },
1325
+ {
1326
+ "datasource": {
1327
+ "type": "elasticsearch",
1328
+ "uid": "wazuh_datasource_uid"
1329
+ },
1330
+ "fieldConfig": {
1331
+ "defaults": {
1332
+ "color": {
1333
+ "mode": "palette-classic"
1334
+ },
1335
+ "custom": {
1336
+ "hideFrom": {
1337
+ "legend": false,
1338
+ "tooltip": false,
1339
+ "viz": false
1340
+ }
1341
+ },
1342
+ "decimals": 0,
1343
+ "mappings": [],
1344
+ "unit": "short"
1345
+ },
1346
+ "overrides": []
1347
+ },
1348
+ "gridPos": {
1349
+ "h": 11,
1350
+ "w": 7,
1351
+ "x": 0,
1352
+ "y": 52
1353
+ },
1354
+ "id": 54,
1355
+ "links": [],
1356
+ "maxDataPoints": 3,
1357
+ "options": {
1358
+ "displayLabels": [],
1359
+ "legend": {
1360
+ "calcs": [],
1361
+ "displayMode": "hidden",
1362
+ "placement": "right",
1363
+ "values": ["value", "percent"]
1364
+ },
1365
+ "pieType": "donut",
1366
+ "reduceOptions": {
1367
+ "calcs": ["sum"],
1368
+ "fields": "",
1369
+ "values": false
1370
+ },
1371
+ "text": {},
1372
+ "tooltip": {
1373
+ "mode": "single",
1374
+ "sort": "none"
1375
+ }
1376
+ },
1377
+ "targets": [
1378
+ {
1379
+ "bucketAggs": [
1380
+ {
1381
+ "$$hashKey": "object:378",
1382
+ "fake": true,
1383
+ "field": "user_name",
1384
+ "id": "3",
1385
+ "settings": {
1386
+ "min_doc_count": 1,
1387
+ "order": "desc",
1388
+ "orderBy": "_count",
1389
+ "size": "10"
1390
+ },
1391
+ "type": "terms"
1392
+ },
1393
+ {
1394
+ "$$hashKey": "object:379",
1395
+ "field": "timestamp",
1396
+ "id": "2",
1397
+ "settings": {
1398
+ "interval": "auto",
1399
+ "min_doc_count": 0,
1400
+ "trimEdges": 0
1401
+ },
1402
+ "type": "date_histogram"
1403
+ }
1404
+ ],
1405
+ "datasource": {
1406
+ "type": "elasticsearch",
1407
+ "uid": "wazuh_datasource_uid"
1408
+ },
1409
+ "metrics": [
1410
+ {
1411
+ "$$hashKey": "object:376",
1412
+ "field": "select field",
1413
+ "id": "1",
1414
+ "type": "count"
1415
+ }
1416
+ ],
1417
+ "query": "rule_group3:sysmon_event3 AND agent_name:$agent_name",
1418
+ "refId": "A",
1419
+ "timeField": "timestamp"
1420
+ }
1421
+ ],
1422
+ "title": "NETWORK CONNS - TOP 10 USER ACCOUNTS",
1423
+ "type": "piechart"
1424
+ },
1425
+ {
1426
+ "datasource": {
1427
+ "type": "elasticsearch",
1428
+ "uid": "wazuh_datasource_uid"
1429
+ },
1430
+ "fieldConfig": {
1431
+ "defaults": {
1432
+ "custom": {
1433
+ "align": "auto",
1434
+ "displayMode": "auto",
1435
+ "filterable": false,
1436
+ "inspect": false
1437
+ },
1438
+ "mappings": [],
1439
+ "thresholds": {
1440
+ "mode": "absolute",
1441
+ "steps": [
1442
+ {
1443
+ "color": "green"
1444
+ },
1445
+ {
1446
+ "color": "red",
1447
+ "value": 80
1448
+ }
1449
+ ]
1450
+ }
1451
+ },
1452
+ "overrides": []
1453
+ },
1454
+ "gridPos": {
1455
+ "h": 11,
1456
+ "w": 17,
1457
+ "x": 7,
1458
+ "y": 52
1459
+ },
1460
+ "id": 72,
1461
+ "links": [],
1462
+ "maxDataPoints": 3,
1463
+ "options": {
1464
+ "footer": {
1465
+ "fields": "",
1466
+ "reducer": ["sum"],
1467
+ "show": false
1468
+ },
1469
+ "showHeader": true
1470
+ },
1471
+ "pluginVersion": "9.0.0",
1472
+ "targets": [
1473
+ {
1474
+ "bucketAggs": [
1475
+ {
1476
+ "$$hashKey": "object:327",
1477
+ "fake": true,
1478
+ "field": "user_name",
1479
+ "id": "3",
1480
+ "settings": {
1481
+ "min_doc_count": 1,
1482
+ "order": "desc",
1483
+ "orderBy": "_count",
1484
+ "size": "0"
1485
+ },
1486
+ "type": "terms"
1487
+ }
1488
+ ],
1489
+ "datasource": {
1490
+ "type": "elasticsearch",
1491
+ "uid": "wazuh_datasource_uid"
1492
+ },
1493
+ "metrics": [
1494
+ {
1495
+ "$$hashKey": "object:325",
1496
+ "field": "select field",
1497
+ "id": "1",
1498
+ "type": "count"
1499
+ }
1500
+ ],
1501
+ "query": "rule_group3:sysmon_event3 AND agent_name:$agent_name",
1502
+ "refId": "A",
1503
+ "timeField": "timestamp"
1504
+ }
1505
+ ],
1506
+ "title": "NETWORK CONNS - USER / ACCOUNT",
1507
+ "type": "table"
1508
+ },
1509
+ {
1510
+ "datasource": {
1511
+ "type": "elasticsearch",
1512
+ "uid": "wazuh_datasource_uid"
1513
+ },
1514
+ "fieldConfig": {
1515
+ "defaults": {
1516
+ "color": {
1517
+ "mode": "thresholds"
1518
+ },
1519
+ "custom": {
1520
+ "align": "auto",
1521
+ "displayMode": "auto",
1522
+ "inspect": false
1523
+ },
1524
+ "mappings": [],
1525
+ "thresholds": {
1526
+ "mode": "absolute",
1527
+ "steps": [
1528
+ {
1529
+ "color": "green"
1530
+ },
1531
+ {
1532
+ "color": "red",
1533
+ "value": 80
1534
+ }
1535
+ ]
1536
+ }
1537
+ },
1538
+ "overrides": [
1539
+ {
1540
+ "matcher": {
1541
+ "id": "byName",
1542
+ "options": "timestamp"
1543
+ },
1544
+ "properties": [
1545
+ {
1546
+ "id": "displayName",
1547
+ "value": "DATE/TIME"
1548
+ },
1549
+ {
1550
+ "id": "unit",
1551
+ "value": "time: YYYY-MM-DD HH:mm:ss"
1552
+ },
1553
+ {
1554
+ "id": "custom.align"
1555
+ }
1556
+ ]
1557
+ },
1558
+ {
1559
+ "matcher": {
1560
+ "id": "byName",
1561
+ "options": "dst_ip"
1562
+ },
1563
+ "properties": [
1564
+ {
1565
+ "id": "displayName",
1566
+ "value": "DST IP"
1567
+ },
1568
+ {
1569
+ "id": "unit",
1570
+ "value": "short"
1571
+ },
1572
+ {
1573
+ "id": "decimals",
1574
+ "value": -1
1575
+ },
1576
+ {
1577
+ "id": "links",
1578
+ "value": [
1579
+ {
1580
+ "targetBlank": true,
1581
+ "title": "TALOS THREAT INTEL",
1582
+ "url": "https://talosintelligence.com/reputation_center/lookup?search=${__value.text}"
1583
+ }
1584
+ ]
1585
+ },
1586
+ {
1587
+ "id": "custom.align"
1588
+ }
1589
+ ]
1590
+ },
1591
+ {
1592
+ "matcher": {
1593
+ "id": "byName",
1594
+ "options": "src_port"
1595
+ },
1596
+ "properties": [
1597
+ {
1598
+ "id": "displayName",
1599
+ "value": "SRC PORT"
1600
+ },
1601
+ {
1602
+ "id": "unit",
1603
+ "value": "none"
1604
+ },
1605
+ {
1606
+ "id": "decimals",
1607
+ "value": -2
1608
+ },
1609
+ {
1610
+ "id": "custom.align"
1611
+ }
1612
+ ]
1613
+ },
1614
+ {
1615
+ "matcher": {
1616
+ "id": "byName",
1617
+ "options": "process_image"
1618
+ },
1619
+ "properties": [
1620
+ {
1621
+ "id": "displayName",
1622
+ "value": "FILE IMAGE"
1623
+ },
1624
+ {
1625
+ "id": "unit",
1626
+ "value": "short"
1627
+ },
1628
+ {
1629
+ "id": "decimals",
1630
+ "value": 2
1631
+ },
1632
+ {
1633
+ "id": "custom.align"
1634
+ }
1635
+ ]
1636
+ },
1637
+ {
1638
+ "matcher": {
1639
+ "id": "byName",
1640
+ "options": "user_name"
1641
+ },
1642
+ "properties": [
1643
+ {
1644
+ "id": "displayName",
1645
+ "value": "USER/ACCOUNT"
1646
+ },
1647
+ {
1648
+ "id": "unit",
1649
+ "value": "short"
1650
+ },
1651
+ {
1652
+ "id": "decimals",
1653
+ "value": 2
1654
+ },
1655
+ {
1656
+ "id": "custom.align"
1657
+ }
1658
+ ]
1659
+ },
1660
+ {
1661
+ "matcher": {
1662
+ "id": "byName",
1663
+ "options": "agent_name"
1664
+ },
1665
+ "properties": [
1666
+ {
1667
+ "id": "displayName",
1668
+ "value": "AGENT"
1669
+ },
1670
+ {
1671
+ "id": "unit",
1672
+ "value": "short"
1673
+ },
1674
+ {
1675
+ "id": "decimals",
1676
+ "value": 2
1677
+ },
1678
+ {
1679
+ "id": "custom.align"
1680
+ }
1681
+ ]
1682
+ },
1683
+ {
1684
+ "matcher": {
1685
+ "id": "byName",
1686
+ "options": "src_ip"
1687
+ },
1688
+ "properties": [
1689
+ {
1690
+ "id": "displayName",
1691
+ "value": "SRC IP"
1692
+ },
1693
+ {
1694
+ "id": "unit",
1695
+ "value": "short"
1696
+ },
1697
+ {
1698
+ "id": "decimals",
1699
+ "value": 2
1700
+ },
1701
+ {
1702
+ "id": "custom.align"
1703
+ }
1704
+ ]
1705
+ },
1706
+ {
1707
+ "matcher": {
1708
+ "id": "byName",
1709
+ "options": "dst_port"
1710
+ },
1711
+ "properties": [
1712
+ {
1713
+ "id": "displayName",
1714
+ "value": "DST PORT"
1715
+ },
1716
+ {
1717
+ "id": "unit",
1718
+ "value": "none"
1719
+ },
1720
+ {
1721
+ "id": "decimals",
1722
+ "value": -1
1723
+ },
1724
+ {
1725
+ "id": "custom.align"
1726
+ }
1727
+ ]
1728
+ },
1729
+ {
1730
+ "matcher": {
1731
+ "id": "byName",
1732
+ "options": "EVENT ID"
1733
+ },
1734
+ "properties": [
1735
+ {
1736
+ "id": "links",
1737
+ "value": [
1738
+ {
1739
+ "targetBlank": true,
1740
+ "title": "VIEW EVENT DETAILS",
1741
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1742
+ }
1743
+ ]
1744
+ }
1745
+ ]
1746
+ }
1747
+ ]
1748
+ },
1749
+ "gridPos": {
1750
+ "h": 12,
1751
+ "w": 24,
1752
+ "x": 0,
1753
+ "y": 63
1754
+ },
1755
+ "id": 51,
1756
+ "options": {
1757
+ "footer": {
1758
+ "fields": "",
1759
+ "reducer": ["sum"],
1760
+ "show": false
1761
+ },
1762
+ "showHeader": true,
1763
+ "sortBy": [
1764
+ {
1765
+ "desc": true,
1766
+ "displayName": "DATE/TIME"
1767
+ }
1768
+ ]
1769
+ },
1770
+ "pluginVersion": "9.0.0",
1771
+ "targets": [
1772
+ {
1773
+ "bucketAggs": [],
1774
+ "datasource": {
1775
+ "type": "elasticsearch",
1776
+ "uid": "wazuh_datasource_uid"
1777
+ },
1778
+ "metrics": [
1779
+ {
1780
+ "id": "1",
1781
+ "settings": {
1782
+ "size": "250"
1783
+ },
1784
+ "type": "raw_data"
1785
+ }
1786
+ ],
1787
+ "query": "(rule_group3:sysmon_event3 OR rule_group2:packetbeat) AND agent_name:$agent_name",
1788
+ "refId": "A",
1789
+ "timeField": "timestamp"
1790
+ }
1791
+ ],
1792
+ "title": "NETWORK CONNS",
1793
+ "transformations": [
1794
+ {
1795
+ "id": "filterFieldsByName",
1796
+ "options": {
1797
+ "include": {
1798
+ "names": [
1799
+ "timestamp",
1800
+ "agent_name",
1801
+ "dst_ip",
1802
+ "dst_ip_country_code",
1803
+ "dst_port",
1804
+ "process_image",
1805
+ "protocol",
1806
+ "src_ip",
1807
+ "src_port",
1808
+ "user_name",
1809
+ "_id"
1810
+ ]
1811
+ }
1812
+ }
1813
+ },
1814
+ {
1815
+ "id": "organize",
1816
+ "options": {
1817
+ "excludeByName": {},
1818
+ "indexByName": {
1819
+ "_id": 1,
1820
+ "agent_name": 2,
1821
+ "dst_ip": 5,
1822
+ "dst_ip_country_code": 6,
1823
+ "dst_port": 8,
1824
+ "process_image": 9,
1825
+ "protocol": 7,
1826
+ "src_ip": 3,
1827
+ "src_port": 4,
1828
+ "timestamp": 0,
1829
+ "user_name": 10
1830
+ },
1831
+ "renameByName": {
1832
+ "_id": "EVENT ID",
1833
+ "agent_name": "AGENT",
1834
+ "dst_ip": "DST IP",
1835
+ "dst_ip_country_code": "DST GEOIP",
1836
+ "dst_port": "DST PORT",
1837
+ "process_image": "PROCESS IMAGE",
1838
+ "protocol": "PROTOCOL",
1839
+ "src_ip": "SRC IP",
1840
+ "src_port": "SRC PORT",
1841
+ "timestamp": "DATE/TIME",
1842
+ "user_name": "USER/ACCOUNT"
1843
+ }
1844
+ }
1845
+ }
1846
+ ],
1847
+ "type": "table"
1848
+ }
1849
+ ],
1850
+ "refresh": false,
1851
+ "schemaVersion": 36,
1852
+ "style": "dark",
1853
+ "tags": ["EDR"],
1854
+ "templating": {
1855
+ "list": [
1856
+ {
1857
+ "datasource": {
1858
+ "type": "elasticsearch",
1859
+ "uid": "wazuh_datasource_uid"
1860
+ },
1861
+ "filters": [],
1862
+ "hide": 0,
1863
+ "label": "",
1864
+ "name": "Filters",
1865
+ "skipUrlSync": false,
1866
+ "type": "adhoc"
1867
+ },
1868
+ {
1869
+ "current": {
1870
+ "selected": false,
1871
+ "text": "All",
1872
+ "value": "$__all"
1873
+ },
1874
+ "datasource": {
1875
+ "type": "elasticsearch",
1876
+ "uid": "wazuh_datasource_uid"
1877
+ },
1878
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"(rule_group3:sysmon_event3 OR rule_group2:misp_alert OR rule_group2:packetbeat) AND (data_win_eventdata_destinationIsIpv6:false OR data_eventdata_destinationIsIpv6:false OR data_event_category:\\\"network_traffic, network\\\")\"}",
1879
+ "hide": 0,
1880
+ "includeAll": true,
1881
+ "label": "Agent",
1882
+ "multi": false,
1883
+ "name": "agent_name",
1884
+ "options": [],
1885
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"(rule_group3:sysmon_event3 OR rule_group2:misp_alert OR rule_group2:packetbeat) AND (data_win_eventdata_destinationIsIpv6:false OR data_eventdata_destinationIsIpv6:false OR data_event_category:\\\"network_traffic, network\\\")\"}",
1886
+ "refresh": 2,
1887
+ "regex": "",
1888
+ "skipUrlSync": false,
1889
+ "sort": 2,
1890
+ "tagValuesQuery": "",
1891
+ "tagsQuery": "",
1892
+ "type": "query",
1893
+ "useTags": false
1894
+ }
1895
+ ]
1896
+ },
1897
+ "time": {
1898
+ "from": "now-6h",
1899
+ "to": "now"
1900
+ },
1901
+ "timepicker": {
1902
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1903
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1904
+ },
1905
+ "timezone": "",
1906
+ "title": "EDR - NETWORK CONNECTIONS",
1907
+ "uid": null,
1908
+ "version": 8,
1909
+ "weekStart": ""
1910
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_open_audit.json
new
+10583
@@ -0,0 +1,10583 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "collapsed": false,
44
+ "datasource": {
45
+ "type": "elasticsearch",
46
+ "uid": "wazuh_datasource_uid"
47
+ },
48
+ "gridPos": {
49
+ "h": 1,
50
+ "w": 24,
51
+ "x": 0,
52
+ "y": 0
53
+ },
54
+ "id": 72,
55
+ "panels": [],
56
+ "title": "AGENTS INVENTORY - SUMMARY",
57
+ "type": "row"
58
+ },
59
+ {
60
+ "datasource": {
61
+ "type": "elasticsearch",
62
+ "uid": "wazuh_datasource_uid"
63
+ },
64
+ "fieldConfig": {
65
+ "defaults": {
66
+ "mappings": [
67
+ {
68
+ "options": {
69
+ "match": "null",
70
+ "result": {
71
+ "text": "N/A"
72
+ }
73
+ },
74
+ "type": "special"
75
+ }
76
+ ],
77
+ "thresholds": {
78
+ "mode": "absolute",
79
+ "steps": [
80
+ {
81
+ "color": "blue",
82
+ "value": null
83
+ }
84
+ ]
85
+ },
86
+ "unit": "short"
87
+ },
88
+ "overrides": []
89
+ },
90
+ "gridPos": {
91
+ "h": 8,
92
+ "w": 4,
93
+ "x": 0,
94
+ "y": 1
95
+ },
96
+ "id": 113,
97
+ "links": [],
98
+ "options": {
99
+ "colorMode": "value",
100
+ "graphMode": "area",
101
+ "justifyMode": "auto",
102
+ "orientation": "horizontal",
103
+ "reduceOptions": {
104
+ "calcs": ["sum"],
105
+ "fields": "",
106
+ "values": false
107
+ },
108
+ "text": {},
109
+ "textMode": "auto"
110
+ },
111
+ "pluginVersion": "10.0.2",
112
+ "targets": [
113
+ {
114
+ "bucketAggs": [
115
+ {
116
+ "$$hashKey": "object:50",
117
+ "field": "timestamp",
118
+ "id": "2",
119
+ "settings": {
120
+ "interval": "auto",
121
+ "min_doc_count": 0,
122
+ "trimEdges": 0
123
+ },
124
+ "type": "date_histogram"
125
+ }
126
+ ],
127
+ "datasource": {
128
+ "type": "elasticsearch",
129
+ "uid": "wazuh_datasource_uid"
130
+ },
131
+ "metrics": [
132
+ {
133
+ "$$hashKey": "object:48",
134
+ "field": "select field",
135
+ "id": "1",
136
+ "type": "count"
137
+ }
138
+ ],
139
+ "query": "agent_name:$agent_name AND rule_groups:open-audit",
140
+ "refId": "A",
141
+ "timeField": "timestamp"
142
+ }
143
+ ],
144
+ "title": "INVENTORY ITEMS",
145
+ "type": "stat"
146
+ },
147
+ {
148
+ "datasource": {
149
+ "type": "elasticsearch",
150
+ "uid": "wazuh_datasource_uid"
151
+ },
152
+ "fieldConfig": {
153
+ "defaults": {
154
+ "color": {
155
+ "mode": "palette-classic"
156
+ },
157
+ "custom": {
158
+ "hideFrom": {
159
+ "legend": false,
160
+ "tooltip": false,
161
+ "viz": false
162
+ }
163
+ },
164
+ "decimals": 0,
165
+ "mappings": [],
166
+ "unit": "short"
167
+ },
168
+ "overrides": [
169
+ {
170
+ "matcher": {
171
+ "id": "byName",
172
+ "options": "1"
173
+ },
174
+ "properties": [
175
+ {
176
+ "id": "color",
177
+ "value": {
178
+ "fixedColor": "#FF9830",
179
+ "mode": "fixed"
180
+ }
181
+ }
182
+ ]
183
+ },
184
+ {
185
+ "matcher": {
186
+ "id": "byName",
187
+ "options": "Alert"
188
+ },
189
+ "properties": [
190
+ {
191
+ "id": "color",
192
+ "value": {
193
+ "fixedColor": "#F2495C",
194
+ "mode": "fixed"
195
+ }
196
+ }
197
+ ]
198
+ },
199
+ {
200
+ "matcher": {
201
+ "id": "byName",
202
+ "options": "Error"
203
+ },
204
+ "properties": [
205
+ {
206
+ "id": "color",
207
+ "value": {
208
+ "fixedColor": "#F2495C",
209
+ "mode": "fixed"
210
+ }
211
+ }
212
+ ]
213
+ },
214
+ {
215
+ "matcher": {
216
+ "id": "byName",
217
+ "options": "Info"
218
+ },
219
+ "properties": [
220
+ {
221
+ "id": "color",
222
+ "value": {
223
+ "fixedColor": "#73BF69",
224
+ "mode": "fixed"
225
+ }
226
+ }
227
+ ]
228
+ },
229
+ {
230
+ "matcher": {
231
+ "id": "byName",
232
+ "options": "NOTICE"
233
+ },
234
+ "properties": [
235
+ {
236
+ "id": "color",
237
+ "value": {
238
+ "fixedColor": "#5794F2",
239
+ "mode": "fixed"
240
+ }
241
+ }
242
+ ]
243
+ },
244
+ {
245
+ "matcher": {
246
+ "id": "byName",
247
+ "options": "Notice"
248
+ },
249
+ "properties": [
250
+ {
251
+ "id": "color",
252
+ "value": {
253
+ "fixedColor": "#5794F2",
254
+ "mode": "fixed"
255
+ }
256
+ }
257
+ ]
258
+ },
259
+ {
260
+ "matcher": {
261
+ "id": "byName",
262
+ "options": "Result"
263
+ },
264
+ "properties": [
265
+ {
266
+ "id": "color",
267
+ "value": {
268
+ "fixedColor": "#B877D9",
269
+ "mode": "fixed"
270
+ }
271
+ }
272
+ ]
273
+ },
274
+ {
275
+ "matcher": {
276
+ "id": "byName",
277
+ "options": "Warning"
278
+ },
279
+ "properties": [
280
+ {
281
+ "id": "color",
282
+ "value": {
283
+ "fixedColor": "#FF9830",
284
+ "mode": "fixed"
285
+ }
286
+ }
287
+ ]
288
+ },
289
+ {
290
+ "matcher": {
291
+ "id": "byName",
292
+ "options": "INFORMATION"
293
+ },
294
+ "properties": [
295
+ {
296
+ "id": "color",
297
+ "value": {
298
+ "fixedColor": "green",
299
+ "mode": "fixed"
300
+ }
301
+ }
302
+ ]
303
+ },
304
+ {
305
+ "matcher": {
306
+ "id": "byName",
307
+ "options": "WARNING"
308
+ },
309
+ "properties": [
310
+ {
311
+ "id": "color",
312
+ "value": {
313
+ "fixedColor": "orange",
314
+ "mode": "fixed"
315
+ }
316
+ }
317
+ ]
318
+ },
319
+ {
320
+ "matcher": {
321
+ "id": "byName",
322
+ "options": "ERROR"
323
+ },
324
+ "properties": [
325
+ {
326
+ "id": "color",
327
+ "value": {
328
+ "fixedColor": "red",
329
+ "mode": "fixed"
330
+ }
331
+ }
332
+ ]
333
+ }
334
+ ]
335
+ },
336
+ "gridPos": {
337
+ "h": 8,
338
+ "w": 5,
339
+ "x": 4,
340
+ "y": 1
341
+ },
342
+ "id": 68,
343
+ "links": [],
344
+ "maxDataPoints": 3,
345
+ "options": {
346
+ "displayLabels": [],
347
+ "legend": {
348
+ "calcs": [],
349
+ "displayMode": "list",
350
+ "placement": "bottom",
351
+ "showLegend": false,
352
+ "values": ["value"]
353
+ },
354
+ "pieType": "donut",
355
+ "reduceOptions": {
356
+ "calcs": ["sum"],
357
+ "fields": "",
358
+ "values": false
359
+ },
360
+ "text": {},
361
+ "tooltip": {
362
+ "mode": "single",
363
+ "sort": "none"
364
+ }
365
+ },
366
+ "targets": [
367
+ {
368
+ "bucketAggs": [
369
+ {
370
+ "$$hashKey": "object:73",
371
+ "fake": true,
372
+ "field": "rule_description",
373
+ "id": "3",
374
+ "settings": {
375
+ "min_doc_count": 1,
376
+ "order": "desc",
377
+ "orderBy": "_count",
378
+ "size": "0"
379
+ },
380
+ "type": "terms"
381
+ },
382
+ {
383
+ "$$hashKey": "object:74",
384
+ "field": "timestamp",
385
+ "id": "2",
386
+ "settings": {
387
+ "interval": "auto",
388
+ "min_doc_count": 0,
389
+ "trimEdges": 0
390
+ },
391
+ "type": "date_histogram"
392
+ }
393
+ ],
394
+ "datasource": {
395
+ "type": "elasticsearch",
396
+ "uid": "wazuh_datasource_uid"
397
+ },
398
+ "metrics": [
399
+ {
400
+ "$$hashKey": "object:71",
401
+ "field": "select field",
402
+ "id": "1",
403
+ "type": "count"
404
+ }
405
+ ],
406
+ "query": "agent_name:$agent_name AND rule_groups:open-audit",
407
+ "refId": "A",
408
+ "timeField": "timestamp"
409
+ }
410
+ ],
411
+ "title": "INVENTORY ITEMS BY MODULE",
412
+ "type": "piechart"
413
+ },
414
+ {
415
+ "datasource": {
416
+ "type": "elasticsearch",
417
+ "uid": "wazuh_datasource_uid"
418
+ },
419
+ "fieldConfig": {
420
+ "defaults": {
421
+ "color": {
422
+ "mode": "thresholds"
423
+ },
424
+ "custom": {
425
+ "align": "auto",
426
+ "cellOptions": {
427
+ "type": "auto"
428
+ },
429
+ "inspect": false
430
+ },
431
+ "decimals": 0,
432
+ "mappings": [],
433
+ "thresholds": {
434
+ "mode": "absolute",
435
+ "steps": [
436
+ {
437
+ "color": "green",
438
+ "value": null
439
+ },
440
+ {
441
+ "color": "red",
442
+ "value": 80
443
+ }
444
+ ]
445
+ },
446
+ "unit": "short"
447
+ },
448
+ "overrides": [
449
+ {
450
+ "matcher": {
451
+ "id": "byName",
452
+ "options": "1"
453
+ },
454
+ "properties": [
455
+ {
456
+ "id": "color",
457
+ "value": {
458
+ "fixedColor": "#FF9830",
459
+ "mode": "fixed"
460
+ }
461
+ }
462
+ ]
463
+ },
464
+ {
465
+ "matcher": {
466
+ "id": "byName",
467
+ "options": "Alert"
468
+ },
469
+ "properties": [
470
+ {
471
+ "id": "color",
472
+ "value": {
473
+ "fixedColor": "#F2495C",
474
+ "mode": "fixed"
475
+ }
476
+ }
477
+ ]
478
+ },
479
+ {
480
+ "matcher": {
481
+ "id": "byName",
482
+ "options": "Error"
483
+ },
484
+ "properties": [
485
+ {
486
+ "id": "color",
487
+ "value": {
488
+ "fixedColor": "#F2495C",
489
+ "mode": "fixed"
490
+ }
491
+ }
492
+ ]
493
+ },
494
+ {
495
+ "matcher": {
496
+ "id": "byName",
497
+ "options": "Info"
498
+ },
499
+ "properties": [
500
+ {
501
+ "id": "color",
502
+ "value": {
503
+ "fixedColor": "#73BF69",
504
+ "mode": "fixed"
505
+ }
506
+ }
507
+ ]
508
+ },
509
+ {
510
+ "matcher": {
511
+ "id": "byName",
512
+ "options": "NOTICE"
513
+ },
514
+ "properties": [
515
+ {
516
+ "id": "color",
517
+ "value": {
518
+ "fixedColor": "#5794F2",
519
+ "mode": "fixed"
520
+ }
521
+ }
522
+ ]
523
+ },
524
+ {
525
+ "matcher": {
526
+ "id": "byName",
527
+ "options": "Notice"
528
+ },
529
+ "properties": [
530
+ {
531
+ "id": "color",
532
+ "value": {
533
+ "fixedColor": "#5794F2",
534
+ "mode": "fixed"
535
+ }
536
+ }
537
+ ]
538
+ },
539
+ {
540
+ "matcher": {
541
+ "id": "byName",
542
+ "options": "Result"
543
+ },
544
+ "properties": [
545
+ {
546
+ "id": "color",
547
+ "value": {
548
+ "fixedColor": "#B877D9",
549
+ "mode": "fixed"
550
+ }
551
+ }
552
+ ]
553
+ },
554
+ {
555
+ "matcher": {
556
+ "id": "byName",
557
+ "options": "Warning"
558
+ },
559
+ "properties": [
560
+ {
561
+ "id": "color",
562
+ "value": {
563
+ "fixedColor": "#FF9830",
564
+ "mode": "fixed"
565
+ }
566
+ }
567
+ ]
568
+ },
569
+ {
570
+ "matcher": {
571
+ "id": "byName",
572
+ "options": "INFORMATION"
573
+ },
574
+ "properties": [
575
+ {
576
+ "id": "color",
577
+ "value": {
578
+ "fixedColor": "green",
579
+ "mode": "fixed"
580
+ }
581
+ }
582
+ ]
583
+ },
584
+ {
585
+ "matcher": {
586
+ "id": "byName",
587
+ "options": "WARNING"
588
+ },
589
+ "properties": [
590
+ {
591
+ "id": "color",
592
+ "value": {
593
+ "fixedColor": "orange",
594
+ "mode": "fixed"
595
+ }
596
+ }
597
+ ]
598
+ },
599
+ {
600
+ "matcher": {
601
+ "id": "byName",
602
+ "options": "ERROR"
603
+ },
604
+ "properties": [
605
+ {
606
+ "id": "color",
607
+ "value": {
608
+ "fixedColor": "red",
609
+ "mode": "fixed"
610
+ }
611
+ }
612
+ ]
613
+ }
614
+ ]
615
+ },
616
+ "gridPos": {
617
+ "h": 8,
618
+ "w": 6,
619
+ "x": 9,
620
+ "y": 1
621
+ },
622
+ "id": 118,
623
+ "links": [],
624
+ "maxDataPoints": 3,
625
+ "options": {
626
+ "cellHeight": "sm",
627
+ "footer": {
628
+ "countRows": false,
629
+ "fields": "",
630
+ "reducer": ["sum"],
631
+ "show": false
632
+ },
633
+ "showHeader": true
634
+ },
635
+ "pluginVersion": "10.0.2",
636
+ "targets": [
637
+ {
638
+ "bucketAggs": [
639
+ {
640
+ "$$hashKey": "object:73",
641
+ "fake": true,
642
+ "field": "rule_description",
643
+ "id": "3",
644
+ "settings": {
645
+ "min_doc_count": 1,
646
+ "order": "desc",
647
+ "orderBy": "_count",
648
+ "size": "0"
649
+ },
650
+ "type": "terms"
651
+ }
652
+ ],
653
+ "datasource": {
654
+ "type": "elasticsearch",
655
+ "uid": "wazuh_datasource_uid"
656
+ },
657
+ "metrics": [
658
+ {
659
+ "$$hashKey": "object:71",
660
+ "field": "select field",
661
+ "id": "1",
662
+ "type": "count"
663
+ }
664
+ ],
665
+ "query": "agent_name:$agent_name AND rule_groups:open-audit",
666
+ "refId": "A",
667
+ "timeField": "timestamp"
668
+ }
669
+ ],
670
+ "title": "INVENTORY ITEMS BY MODULE",
671
+ "transformations": [
672
+ {
673
+ "id": "organize",
674
+ "options": {
675
+ "excludeByName": {},
676
+ "indexByName": {},
677
+ "renameByName": {
678
+ "rule_description": "MODULE"
679
+ }
680
+ }
681
+ }
682
+ ],
683
+ "type": "table"
684
+ },
685
+ {
686
+ "datasource": {
687
+ "type": "elasticsearch",
688
+ "uid": "wazuh_datasource_uid"
689
+ },
690
+ "fieldConfig": {
691
+ "defaults": {
692
+ "custom": {
693
+ "align": "auto",
694
+ "cellOptions": {
695
+ "type": "auto"
696
+ },
697
+ "filterable": false,
698
+ "inspect": false
699
+ },
700
+ "mappings": [],
701
+ "thresholds": {
702
+ "mode": "absolute",
703
+ "steps": [
704
+ {
705
+ "color": "blue",
706
+ "value": null
707
+ }
708
+ ]
709
+ }
710
+ },
711
+ "overrides": [
712
+ {
713
+ "matcher": {
714
+ "id": "byName",
715
+ "options": "Count"
716
+ },
717
+ "properties": [
718
+ {
719
+ "id": "custom.cellOptions",
720
+ "value": {
721
+ "mode": "basic",
722
+ "type": "gauge"
723
+ }
724
+ }
725
+ ]
726
+ },
727
+ {
728
+ "matcher": {
729
+ "id": "byName",
730
+ "options": "rule_description"
731
+ },
732
+ "properties": [
733
+ {
734
+ "id": "custom.width",
735
+ "value": 703
736
+ }
737
+ ]
738
+ },
739
+ {
740
+ "matcher": {
741
+ "id": "byName",
742
+ "options": "rule_level"
743
+ },
744
+ "properties": [
745
+ {
746
+ "id": "custom.width",
747
+ "value": 212
748
+ },
749
+ {
750
+ "id": "mappings",
751
+ "value": [
752
+ {
753
+ "options": {
754
+ "from": 1,
755
+ "result": {
756
+ "color": "green",
757
+ "index": 0
758
+ },
759
+ "to": 3
760
+ },
761
+ "type": "range"
762
+ },
763
+ {
764
+ "options": {
765
+ "from": 4,
766
+ "result": {
767
+ "color": "dark-yellow",
768
+ "index": 1
769
+ },
770
+ "to": 6
771
+ },
772
+ "type": "range"
773
+ },
774
+ {
775
+ "options": {
776
+ "from": 7,
777
+ "result": {
778
+ "color": "orange",
779
+ "index": 2
780
+ },
781
+ "to": 9
782
+ },
783
+ "type": "range"
784
+ },
785
+ {
786
+ "options": {
787
+ "from": 10,
788
+ "result": {
789
+ "color": "semi-dark-red",
790
+ "index": 3
791
+ },
792
+ "to": 15
793
+ },
794
+ "type": "range"
795
+ }
796
+ ]
797
+ }
798
+ ]
799
+ }
800
+ ]
801
+ },
802
+ "gridPos": {
803
+ "h": 8,
804
+ "w": 9,
805
+ "x": 15,
806
+ "y": 1
807
+ },
808
+ "id": 115,
809
+ "links": [],
810
+ "maxDataPoints": 3,
811
+ "options": {
812
+ "cellHeight": "sm",
813
+ "footer": {
814
+ "countRows": false,
815
+ "fields": "",
816
+ "reducer": ["sum"],
817
+ "show": false
818
+ },
819
+ "showHeader": true,
820
+ "sortBy": []
821
+ },
822
+ "pluginVersion": "10.0.2",
823
+ "targets": [
824
+ {
825
+ "bucketAggs": [
826
+ {
827
+ "$$hashKey": "object:3082",
828
+ "fake": true,
829
+ "field": "agent_name",
830
+ "id": "4",
831
+ "settings": {
832
+ "min_doc_count": 0,
833
+ "order": "desc",
834
+ "orderBy": "_count",
835
+ "size": "10"
836
+ },
837
+ "type": "terms"
838
+ }
839
+ ],
840
+ "datasource": {
841
+ "type": "elasticsearch",
842
+ "uid": "wazuh_datasource_uid"
843
+ },
844
+ "metrics": [
845
+ {
846
+ "$$hashKey": "object:71",
847
+ "field": "select field",
848
+ "id": "1",
849
+ "type": "count"
850
+ }
851
+ ],
852
+ "query": "agent_name:$agent_name AND rule_groups:open-audit",
853
+ "refId": "A",
854
+ "timeField": "timestamp"
855
+ }
856
+ ],
857
+ "title": "INVENTORY ITEMS BY AGENT",
858
+ "transformations": [
859
+ {
860
+ "id": "organize",
861
+ "options": {
862
+ "excludeByName": {},
863
+ "indexByName": {},
864
+ "renameByName": {
865
+ "agent_name": "AGENT"
866
+ }
867
+ }
868
+ }
869
+ ],
870
+ "type": "table"
871
+ },
872
+ {
873
+ "collapsed": true,
874
+ "datasource": {
875
+ "type": "elasticsearch",
876
+ "uid": "wazuh_datasource_uid"
877
+ },
878
+ "gridPos": {
879
+ "h": 1,
880
+ "w": 24,
881
+ "x": 0,
882
+ "y": 9
883
+ },
884
+ "id": 112,
885
+ "panels": [
886
+ {
887
+ "datasource": {
888
+ "type": "elasticsearch",
889
+ "uid": "wazuh_datasource_uid"
890
+ },
891
+ "fieldConfig": {
892
+ "defaults": {
893
+ "color": {
894
+ "mode": "palette-classic"
895
+ },
896
+ "custom": {
897
+ "hideFrom": {
898
+ "legend": false,
899
+ "tooltip": false,
900
+ "viz": false
901
+ }
902
+ },
903
+ "decimals": 0,
904
+ "mappings": [],
905
+ "unit": "short"
906
+ },
907
+ "overrides": []
908
+ },
909
+ "gridPos": {
910
+ "h": 8,
911
+ "w": 5,
912
+ "x": 0,
913
+ "y": 10
914
+ },
915
+ "id": 138,
916
+ "links": [],
917
+ "maxDataPoints": 3,
918
+ "options": {
919
+ "displayLabels": [],
920
+ "legend": {
921
+ "calcs": [],
922
+ "displayMode": "table",
923
+ "placement": "right",
924
+ "showLegend": true,
925
+ "values": ["value"]
926
+ },
927
+ "pieType": "donut",
928
+ "reduceOptions": {
929
+ "calcs": ["sum"],
930
+ "fields": "",
931
+ "values": false
932
+ },
933
+ "text": {},
934
+ "tooltip": {
935
+ "mode": "single",
936
+ "sort": "none"
937
+ }
938
+ },
939
+ "targets": [
940
+ {
941
+ "bucketAggs": [
942
+ {
943
+ "$$hashKey": "object:73",
944
+ "fake": true,
945
+ "field": "data_system_sys_manufacturer",
946
+ "id": "3",
947
+ "settings": {
948
+ "min_doc_count": 1,
949
+ "order": "desc",
950
+ "orderBy": "_count",
951
+ "size": "0"
952
+ },
953
+ "type": "terms"
954
+ },
955
+ {
956
+ "$$hashKey": "object:74",
957
+ "field": "timestamp",
958
+ "id": "2",
959
+ "settings": {
960
+ "interval": "auto",
961
+ "min_doc_count": 0,
962
+ "trimEdges": 0
963
+ },
964
+ "type": "date_histogram"
965
+ }
966
+ ],
967
+ "datasource": {
968
+ "type": "elasticsearch",
969
+ "uid": "wazuh_datasource_uid"
970
+ },
971
+ "metrics": [
972
+ {
973
+ "$$hashKey": "object:71",
974
+ "field": "select field",
975
+ "id": "1",
976
+ "type": "count"
977
+ }
978
+ ],
979
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
980
+ "refId": "A",
981
+ "timeField": "timestamp"
982
+ }
983
+ ],
984
+ "title": "HARDWARE MANUFACTURERS",
985
+ "type": "piechart"
986
+ },
987
+ {
988
+ "datasource": {
989
+ "type": "elasticsearch",
990
+ "uid": "wazuh_datasource_uid"
991
+ },
992
+ "fieldConfig": {
993
+ "defaults": {
994
+ "color": {
995
+ "mode": "palette-classic"
996
+ },
997
+ "custom": {
998
+ "hideFrom": {
999
+ "legend": false,
1000
+ "tooltip": false,
1001
+ "viz": false
1002
+ }
1003
+ },
1004
+ "decimals": 0,
1005
+ "mappings": [],
1006
+ "unit": "short"
1007
+ },
1008
+ "overrides": []
1009
+ },
1010
+ "gridPos": {
1011
+ "h": 8,
1012
+ "w": 5,
1013
+ "x": 5,
1014
+ "y": 10
1015
+ },
1016
+ "id": 139,
1017
+ "links": [],
1018
+ "maxDataPoints": 3,
1019
+ "options": {
1020
+ "displayLabels": [],
1021
+ "legend": {
1022
+ "calcs": [],
1023
+ "displayMode": "table",
1024
+ "placement": "right",
1025
+ "showLegend": true,
1026
+ "values": ["value"]
1027
+ },
1028
+ "pieType": "donut",
1029
+ "reduceOptions": {
1030
+ "calcs": ["sum"],
1031
+ "fields": "",
1032
+ "values": false
1033
+ },
1034
+ "text": {},
1035
+ "tooltip": {
1036
+ "mode": "single",
1037
+ "sort": "none"
1038
+ }
1039
+ },
1040
+ "targets": [
1041
+ {
1042
+ "bucketAggs": [
1043
+ {
1044
+ "$$hashKey": "object:73",
1045
+ "fake": true,
1046
+ "field": "data_system_sys_model",
1047
+ "id": "3",
1048
+ "settings": {
1049
+ "min_doc_count": 1,
1050
+ "order": "desc",
1051
+ "orderBy": "_count",
1052
+ "size": "0"
1053
+ },
1054
+ "type": "terms"
1055
+ },
1056
+ {
1057
+ "$$hashKey": "object:74",
1058
+ "field": "timestamp",
1059
+ "id": "2",
1060
+ "settings": {
1061
+ "interval": "auto",
1062
+ "min_doc_count": 0,
1063
+ "trimEdges": 0
1064
+ },
1065
+ "type": "date_histogram"
1066
+ }
1067
+ ],
1068
+ "datasource": {
1069
+ "type": "elasticsearch",
1070
+ "uid": "wazuh_datasource_uid"
1071
+ },
1072
+ "metrics": [
1073
+ {
1074
+ "$$hashKey": "object:71",
1075
+ "field": "select field",
1076
+ "id": "1",
1077
+ "type": "count"
1078
+ }
1079
+ ],
1080
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
1081
+ "refId": "A",
1082
+ "timeField": "timestamp"
1083
+ }
1084
+ ],
1085
+ "title": "HARDWARE MODELS",
1086
+ "type": "piechart"
1087
+ },
1088
+ {
1089
+ "datasource": {
1090
+ "type": "elasticsearch",
1091
+ "uid": "wazuh_datasource_uid"
1092
+ },
1093
+ "fieldConfig": {
1094
+ "defaults": {
1095
+ "color": {
1096
+ "mode": "thresholds"
1097
+ },
1098
+ "custom": {
1099
+ "align": "auto",
1100
+ "cellOptions": {
1101
+ "type": "auto"
1102
+ },
1103
+ "inspect": false
1104
+ },
1105
+ "mappings": [],
1106
+ "thresholds": {
1107
+ "mode": "absolute",
1108
+ "steps": [
1109
+ {
1110
+ "color": "green"
1111
+ },
1112
+ {
1113
+ "color": "red",
1114
+ "value": 80
1115
+ }
1116
+ ]
1117
+ }
1118
+ },
1119
+ "overrides": [
1120
+ {
1121
+ "matcher": {
1122
+ "id": "byName",
1123
+ "options": "rule_level"
1124
+ },
1125
+ "properties": [
1126
+ {
1127
+ "id": "custom.width",
1128
+ "value": 93
1129
+ }
1130
+ ]
1131
+ },
1132
+ {
1133
+ "matcher": {
1134
+ "id": "byName",
1135
+ "options": "windows_event_id"
1136
+ },
1137
+ "properties": [
1138
+ {
1139
+ "id": "custom.width",
1140
+ "value": 186
1141
+ }
1142
+ ]
1143
+ },
1144
+ {
1145
+ "matcher": {
1146
+ "id": "byName",
1147
+ "options": "DATE/TIME"
1148
+ },
1149
+ "properties": [
1150
+ {
1151
+ "id": "custom.width",
1152
+ "value": 202
1153
+ }
1154
+ ]
1155
+ },
1156
+ {
1157
+ "matcher": {
1158
+ "id": "byName",
1159
+ "options": "AGENT"
1160
+ },
1161
+ "properties": [
1162
+ {
1163
+ "id": "custom.width",
1164
+ "value": 171
1165
+ }
1166
+ ]
1167
+ },
1168
+ {
1169
+ "matcher": {
1170
+ "id": "byName",
1171
+ "options": "SRC IP"
1172
+ },
1173
+ "properties": [
1174
+ {
1175
+ "id": "custom.width",
1176
+ "value": 167
1177
+ }
1178
+ ]
1179
+ }
1180
+ ]
1181
+ },
1182
+ "gridPos": {
1183
+ "h": 8,
1184
+ "w": 14,
1185
+ "x": 10,
1186
+ "y": 10
1187
+ },
1188
+ "id": 140,
1189
+ "options": {
1190
+ "cellHeight": "sm",
1191
+ "footer": {
1192
+ "countRows": false,
1193
+ "fields": "",
1194
+ "reducer": ["sum"],
1195
+ "show": false
1196
+ },
1197
+ "showHeader": true,
1198
+ "sortBy": []
1199
+ },
1200
+ "pluginVersion": "10.0.2",
1201
+ "targets": [
1202
+ {
1203
+ "alias": "",
1204
+ "bucketAggs": [],
1205
+ "datasource": {
1206
+ "type": "elasticsearch",
1207
+ "uid": "wazuh_datasource_uid"
1208
+ },
1209
+ "metrics": [
1210
+ {
1211
+ "id": "1",
1212
+ "settings": {
1213
+ "size": "500"
1214
+ },
1215
+ "type": "raw_data"
1216
+ }
1217
+ ],
1218
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
1219
+ "queryType": "lucene",
1220
+ "refId": "A",
1221
+ "timeField": "timestamp"
1222
+ }
1223
+ ],
1224
+ "title": "SYSTEM INFO",
1225
+ "transformations": [
1226
+ {
1227
+ "id": "organize",
1228
+ "options": {
1229
+ "excludeByName": {
1230
+ "@metadata_beat": true,
1231
+ "@metadata_type": true,
1232
+ "@metadata_version": true,
1233
+ "_id": true,
1234
+ "_index": true,
1235
+ "_type": true,
1236
+ "agent_ephemeral_id": true,
1237
+ "agent_hostname": true,
1238
+ "agent_id": true,
1239
+ "agent_ip": false,
1240
+ "agent_ip_city_name": true,
1241
+ "agent_ip_country_code": true,
1242
+ "agent_ip_geolocation": true,
1243
+ "agent_labels_customer": true,
1244
+ "agent_name": false,
1245
+ "agent_type": true,
1246
+ "agent_version": true,
1247
+ "beats_type": true,
1248
+ "collector_node_id": true,
1249
+ "data_base_indicator_access_type": true,
1250
+ "data_base_indicator_id": false,
1251
+ "data_base_indicator_indicator_city_name": true,
1252
+ "data_base_indicator_indicator_country_code": true,
1253
+ "data_base_indicator_indicator_geolocation": true,
1254
+ "data_inventory_module": true,
1255
+ "data_system_sys_domain": true,
1256
+ "data_system_sys_form_factor": true,
1257
+ "data_system_sys_hostname": true,
1258
+ "data_system_sys_icon": true,
1259
+ "data_system_sys_ip": true,
1260
+ "data_system_sys_ip_city_name": true,
1261
+ "data_system_sys_ip_country_code": true,
1262
+ "data_system_sys_ip_geolocation": true,
1263
+ "data_system_sys_last_seen_by": true,
1264
+ "data_system_sys_memory_count": true,
1265
+ "data_system_sys_os_arch": true,
1266
+ "data_system_sys_os_bit": true,
1267
+ "data_system_sys_os_family": true,
1268
+ "data_system_sys_os_group": true,
1269
+ "data_system_sys_os_installation_date": true,
1270
+ "data_system_sys_os_version": true,
1271
+ "data_system_sys_processor_count": true,
1272
+ "data_system_sys_script_version": true,
1273
+ "data_system_sys_serial": true,
1274
+ "data_system_sys_type": true,
1275
+ "data_system_sys_uuid": true,
1276
+ "data_type": true,
1277
+ "data_win_eventdata_domain": true,
1278
+ "data_win_eventdata_imagePath": true,
1279
+ "data_win_eventdata_sID": true,
1280
+ "data_win_eventdata_serviceName": true,
1281
+ "data_win_eventdata_serviceType": true,
1282
+ "data_win_eventdata_startType": true,
1283
+ "data_win_eventdata_timestamp": true,
1284
+ "data_win_eventdata_user": true,
1285
+ "data_win_system_channel": true,
1286
+ "data_win_system_computer": true,
1287
+ "data_win_system_eventID": true,
1288
+ "data_win_system_eventRecordID": true,
1289
+ "data_win_system_eventSourceName": true,
1290
+ "data_win_system_keywords": true,
1291
+ "data_win_system_level": true,
1292
+ "data_win_system_opcode": true,
1293
+ "data_win_system_processID": true,
1294
+ "data_win_system_providerGuid": true,
1295
+ "data_win_system_providerName": true,
1296
+ "data_win_system_severityValue": true,
1297
+ "data_win_system_systemTime": true,
1298
+ "data_win_system_task": true,
1299
+ "data_win_system_threadID": true,
1300
+ "data_win_system_version": true,
1301
+ "date": true,
1302
+ "decoder_name": true,
1303
+ "ecs_version": true,
1304
+ "gl2_accounted_message_size": true,
1305
+ "gl2_message_id": true,
1306
+ "gl2_processing_error": true,
1307
+ "gl2_remote_ip": true,
1308
+ "gl2_remote_port": true,
1309
+ "gl2_source_collector": true,
1310
+ "gl2_source_input": true,
1311
+ "gl2_source_node": true,
1312
+ "highlight": true,
1313
+ "host_name": true,
1314
+ "id": true,
1315
+ "location": true,
1316
+ "log_file_path": true,
1317
+ "log_offset": true,
1318
+ "manager_name": true,
1319
+ "message": true,
1320
+ "previous_output": true,
1321
+ "rule_description": true,
1322
+ "rule_firedtimes": true,
1323
+ "rule_frequency": true,
1324
+ "rule_gdpr": true,
1325
+ "rule_gpg13": true,
1326
+ "rule_group1": true,
1327
+ "rule_group2": true,
1328
+ "rule_groups": true,
1329
+ "rule_hipaa": true,
1330
+ "rule_id": true,
1331
+ "rule_level": true,
1332
+ "rule_mail": true,
1333
+ "rule_mitre_id": true,
1334
+ "rule_mitre_tactic": true,
1335
+ "rule_mitre_technique": true,
1336
+ "rule_nist_800_53": true,
1337
+ "rule_pci_dss": true,
1338
+ "rule_tsc": true,
1339
+ "sort": true,
1340
+ "source": true,
1341
+ "src_ip": true,
1342
+ "src_ip_city_name": true,
1343
+ "src_ip_country_code": true,
1344
+ "src_ip_geolocation": true,
1345
+ "streams": true,
1346
+ "syslog_level": true,
1347
+ "syslog_tag": true,
1348
+ "syslog_type": true,
1349
+ "timestamp": true,
1350
+ "timestamp_utc": true,
1351
+ "true": true,
1352
+ "user_name": true,
1353
+ "win_system_eventID": true,
1354
+ "windows_event_id": true,
1355
+ "windows_event_severity": false
1356
+ },
1357
+ "indexByName": {
1358
+ "_id": 1,
1359
+ "_index": 2,
1360
+ "_type": 3,
1361
+ "agent_id": 4,
1362
+ "agent_ip": 5,
1363
+ "agent_labels_customer": 29,
1364
+ "agent_name": 0,
1365
+ "data_inventory_module": 30,
1366
+ "data_processor_cores": 33,
1367
+ "data_processor_logical_nbr": 34,
1368
+ "data_processor_name": 31,
1369
+ "data_processor_status": 32,
1370
+ "date": 35,
1371
+ "decoder_name": 6,
1372
+ "gl2_accounted_message_size": 7,
1373
+ "gl2_message_id": 8,
1374
+ "gl2_processing_error": 36,
1375
+ "gl2_remote_ip": 9,
1376
+ "gl2_remote_port": 10,
1377
+ "gl2_source_input": 11,
1378
+ "gl2_source_node": 12,
1379
+ "highlight": 13,
1380
+ "id": 14,
1381
+ "location": 15,
1382
+ "manager_name": 16,
1383
+ "message": 17,
1384
+ "rule_description": 18,
1385
+ "rule_firedtimes": 19,
1386
+ "rule_groups": 20,
1387
+ "rule_id": 21,
1388
+ "rule_level": 22,
1389
+ "rule_mail": 23,
1390
+ "sort": 24,
1391
+ "source": 25,
1392
+ "streams": 26,
1393
+ "syslog_type": 27,
1394
+ "timestamp": 28
1395
+ },
1396
+ "renameByName": {
1397
+ "agent_ip": "SRC IP",
1398
+ "agent_name": "AGENT",
1399
+ "data_base_indicator_access_type": "",
1400
+ "data_base_indicator_id": "OTX IoC ID",
1401
+ "data_base_indicator_indicator": "IoC",
1402
+ "data_base_indicator_indicator_country_code": "",
1403
+ "data_base_indicator_type": "IoC TYPE",
1404
+ "data_bios_sn": "BIOS S/N",
1405
+ "data_processor_cores": "CORES",
1406
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
1407
+ "data_processor_name": "PROCESSOR",
1408
+ "data_processor_status": "STATUS",
1409
+ "data_sections": "OTX SECTIONS",
1410
+ "data_system_manufacturer": "VENDOR",
1411
+ "data_system_model": "MODEL",
1412
+ "data_system_sys_manufacturer": "VENDOR",
1413
+ "data_system_sys_model": "MODEL",
1414
+ "data_system_sys_os_name": "OS",
1415
+ "data_system_sys_uptime": "UPTIME",
1416
+ "data_type": "",
1417
+ "data_win_system_message": "MESSAGE",
1418
+ "data_win_system_providerGuid": "",
1419
+ "rule_level": "RULE LEVEL",
1420
+ "timestamp": "DATE/TIME",
1421
+ "windows_event_severity": "EVENT LOG SEVERITY"
1422
+ }
1423
+ }
1424
+ }
1425
+ ],
1426
+ "type": "table"
1427
+ },
1428
+ {
1429
+ "datasource": {
1430
+ "type": "elasticsearch",
1431
+ "uid": "wazuh_datasource_uid"
1432
+ },
1433
+ "fieldConfig": {
1434
+ "defaults": {
1435
+ "color": {
1436
+ "mode": "palette-classic"
1437
+ },
1438
+ "custom": {
1439
+ "hideFrom": {
1440
+ "legend": false,
1441
+ "tooltip": false,
1442
+ "viz": false
1443
+ }
1444
+ },
1445
+ "decimals": 0,
1446
+ "mappings": [],
1447
+ "unit": "short"
1448
+ },
1449
+ "overrides": [
1450
+ {
1451
+ "matcher": {
1452
+ "id": "byName",
1453
+ "options": "1"
1454
+ },
1455
+ "properties": [
1456
+ {
1457
+ "id": "color",
1458
+ "value": {
1459
+ "fixedColor": "#FF9830",
1460
+ "mode": "fixed"
1461
+ }
1462
+ }
1463
+ ]
1464
+ },
1465
+ {
1466
+ "matcher": {
1467
+ "id": "byName",
1468
+ "options": "Alert"
1469
+ },
1470
+ "properties": [
1471
+ {
1472
+ "id": "color",
1473
+ "value": {
1474
+ "fixedColor": "#F2495C",
1475
+ "mode": "fixed"
1476
+ }
1477
+ }
1478
+ ]
1479
+ },
1480
+ {
1481
+ "matcher": {
1482
+ "id": "byName",
1483
+ "options": "Error"
1484
+ },
1485
+ "properties": [
1486
+ {
1487
+ "id": "color",
1488
+ "value": {
1489
+ "fixedColor": "#F2495C",
1490
+ "mode": "fixed"
1491
+ }
1492
+ }
1493
+ ]
1494
+ },
1495
+ {
1496
+ "matcher": {
1497
+ "id": "byName",
1498
+ "options": "Info"
1499
+ },
1500
+ "properties": [
1501
+ {
1502
+ "id": "color",
1503
+ "value": {
1504
+ "fixedColor": "#73BF69",
1505
+ "mode": "fixed"
1506
+ }
1507
+ }
1508
+ ]
1509
+ },
1510
+ {
1511
+ "matcher": {
1512
+ "id": "byName",
1513
+ "options": "NOTICE"
1514
+ },
1515
+ "properties": [
1516
+ {
1517
+ "id": "color",
1518
+ "value": {
1519
+ "fixedColor": "#5794F2",
1520
+ "mode": "fixed"
1521
+ }
1522
+ }
1523
+ ]
1524
+ },
1525
+ {
1526
+ "matcher": {
1527
+ "id": "byName",
1528
+ "options": "Notice"
1529
+ },
1530
+ "properties": [
1531
+ {
1532
+ "id": "color",
1533
+ "value": {
1534
+ "fixedColor": "#5794F2",
1535
+ "mode": "fixed"
1536
+ }
1537
+ }
1538
+ ]
1539
+ },
1540
+ {
1541
+ "matcher": {
1542
+ "id": "byName",
1543
+ "options": "Result"
1544
+ },
1545
+ "properties": [
1546
+ {
1547
+ "id": "color",
1548
+ "value": {
1549
+ "fixedColor": "#B877D9",
1550
+ "mode": "fixed"
1551
+ }
1552
+ }
1553
+ ]
1554
+ },
1555
+ {
1556
+ "matcher": {
1557
+ "id": "byName",
1558
+ "options": "Warning"
1559
+ },
1560
+ "properties": [
1561
+ {
1562
+ "id": "color",
1563
+ "value": {
1564
+ "fixedColor": "#FF9830",
1565
+ "mode": "fixed"
1566
+ }
1567
+ }
1568
+ ]
1569
+ },
1570
+ {
1571
+ "matcher": {
1572
+ "id": "byName",
1573
+ "options": "INFORMATION"
1574
+ },
1575
+ "properties": [
1576
+ {
1577
+ "id": "color",
1578
+ "value": {
1579
+ "fixedColor": "green",
1580
+ "mode": "fixed"
1581
+ }
1582
+ }
1583
+ ]
1584
+ },
1585
+ {
1586
+ "matcher": {
1587
+ "id": "byName",
1588
+ "options": "WARNING"
1589
+ },
1590
+ "properties": [
1591
+ {
1592
+ "id": "color",
1593
+ "value": {
1594
+ "fixedColor": "orange",
1595
+ "mode": "fixed"
1596
+ }
1597
+ }
1598
+ ]
1599
+ },
1600
+ {
1601
+ "matcher": {
1602
+ "id": "byName",
1603
+ "options": "ERROR"
1604
+ },
1605
+ "properties": [
1606
+ {
1607
+ "id": "color",
1608
+ "value": {
1609
+ "fixedColor": "red",
1610
+ "mode": "fixed"
1611
+ }
1612
+ }
1613
+ ]
1614
+ }
1615
+ ]
1616
+ },
1617
+ "gridPos": {
1618
+ "h": 8,
1619
+ "w": 5,
1620
+ "x": 0,
1621
+ "y": 18
1622
+ },
1623
+ "id": 136,
1624
+ "links": [],
1625
+ "maxDataPoints": 3,
1626
+ "options": {
1627
+ "displayLabels": [],
1628
+ "legend": {
1629
+ "calcs": [],
1630
+ "displayMode": "table",
1631
+ "placement": "right",
1632
+ "showLegend": true,
1633
+ "values": ["value"]
1634
+ },
1635
+ "pieType": "donut",
1636
+ "reduceOptions": {
1637
+ "calcs": ["sum"],
1638
+ "fields": "",
1639
+ "values": false
1640
+ },
1641
+ "text": {},
1642
+ "tooltip": {
1643
+ "mode": "single",
1644
+ "sort": "none"
1645
+ }
1646
+ },
1647
+ "targets": [
1648
+ {
1649
+ "bucketAggs": [
1650
+ {
1651
+ "$$hashKey": "object:73",
1652
+ "fake": true,
1653
+ "field": "data_system_sys_processor_count",
1654
+ "id": "3",
1655
+ "settings": {
1656
+ "min_doc_count": 1,
1657
+ "order": "desc",
1658
+ "orderBy": "_count",
1659
+ "size": "0"
1660
+ },
1661
+ "type": "terms"
1662
+ },
1663
+ {
1664
+ "field": "agent_name",
1665
+ "id": "4",
1666
+ "settings": {
1667
+ "min_doc_count": "1",
1668
+ "order": "desc",
1669
+ "orderBy": "_term",
1670
+ "size": "10"
1671
+ },
1672
+ "type": "terms"
1673
+ },
1674
+ {
1675
+ "$$hashKey": "object:74",
1676
+ "field": "timestamp",
1677
+ "id": "2",
1678
+ "settings": {
1679
+ "interval": "auto",
1680
+ "min_doc_count": 0,
1681
+ "trimEdges": 0
1682
+ },
1683
+ "type": "date_histogram"
1684
+ }
1685
+ ],
1686
+ "datasource": {
1687
+ "type": "elasticsearch",
1688
+ "uid": "wazuh_datasource_uid"
1689
+ },
1690
+ "metrics": [
1691
+ {
1692
+ "$$hashKey": "object:71",
1693
+ "field": "select field",
1694
+ "id": "1",
1695
+ "type": "count"
1696
+ }
1697
+ ],
1698
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
1699
+ "refId": "A",
1700
+ "timeField": "timestamp"
1701
+ }
1702
+ ],
1703
+ "title": "AGENTS BY NBR OF PROCESSORS",
1704
+ "type": "piechart"
1705
+ },
1706
+ {
1707
+ "datasource": {
1708
+ "type": "elasticsearch",
1709
+ "uid": "wazuh_datasource_uid"
1710
+ },
1711
+ "fieldConfig": {
1712
+ "defaults": {
1713
+ "color": {
1714
+ "mode": "thresholds"
1715
+ },
1716
+ "custom": {
1717
+ "align": "auto",
1718
+ "cellOptions": {
1719
+ "type": "auto"
1720
+ },
1721
+ "inspect": false
1722
+ },
1723
+ "mappings": [],
1724
+ "thresholds": {
1725
+ "mode": "absolute",
1726
+ "steps": [
1727
+ {
1728
+ "color": "green"
1729
+ },
1730
+ {
1731
+ "color": "red",
1732
+ "value": 80
1733
+ }
1734
+ ]
1735
+ }
1736
+ },
1737
+ "overrides": [
1738
+ {
1739
+ "matcher": {
1740
+ "id": "byName",
1741
+ "options": "rule_level"
1742
+ },
1743
+ "properties": [
1744
+ {
1745
+ "id": "custom.width",
1746
+ "value": 93
1747
+ }
1748
+ ]
1749
+ },
1750
+ {
1751
+ "matcher": {
1752
+ "id": "byName",
1753
+ "options": "windows_event_id"
1754
+ },
1755
+ "properties": [
1756
+ {
1757
+ "id": "custom.width",
1758
+ "value": 186
1759
+ }
1760
+ ]
1761
+ },
1762
+ {
1763
+ "matcher": {
1764
+ "id": "byName",
1765
+ "options": "DATE/TIME"
1766
+ },
1767
+ "properties": [
1768
+ {
1769
+ "id": "custom.width",
1770
+ "value": 202
1771
+ }
1772
+ ]
1773
+ },
1774
+ {
1775
+ "matcher": {
1776
+ "id": "byName",
1777
+ "options": "AGENT"
1778
+ },
1779
+ "properties": [
1780
+ {
1781
+ "id": "custom.width",
1782
+ "value": 171
1783
+ }
1784
+ ]
1785
+ },
1786
+ {
1787
+ "matcher": {
1788
+ "id": "byName",
1789
+ "options": "SRC IP"
1790
+ },
1791
+ "properties": [
1792
+ {
1793
+ "id": "custom.width",
1794
+ "value": 167
1795
+ }
1796
+ ]
1797
+ },
1798
+ {
1799
+ "matcher": {
1800
+ "id": "byName",
1801
+ "options": "MESSAGE"
1802
+ },
1803
+ "properties": [
1804
+ {
1805
+ "id": "custom.width",
1806
+ "value": 1519
1807
+ }
1808
+ ]
1809
+ },
1810
+ {
1811
+ "matcher": {
1812
+ "id": "byName",
1813
+ "options": "rule_description"
1814
+ },
1815
+ "properties": [
1816
+ {
1817
+ "id": "custom.width",
1818
+ "value": 524
1819
+ }
1820
+ ]
1821
+ },
1822
+ {
1823
+ "matcher": {
1824
+ "id": "byName",
1825
+ "options": "PROCESSOR"
1826
+ },
1827
+ "properties": [
1828
+ {
1829
+ "id": "custom.width",
1830
+ "value": 418
1831
+ }
1832
+ ]
1833
+ }
1834
+ ]
1835
+ },
1836
+ "gridPos": {
1837
+ "h": 8,
1838
+ "w": 19,
1839
+ "x": 5,
1840
+ "y": 18
1841
+ },
1842
+ "id": 116,
1843
+ "options": {
1844
+ "cellHeight": "sm",
1845
+ "footer": {
1846
+ "countRows": false,
1847
+ "fields": "",
1848
+ "reducer": ["sum"],
1849
+ "show": false
1850
+ },
1851
+ "showHeader": true,
1852
+ "sortBy": []
1853
+ },
1854
+ "pluginVersion": "10.0.2",
1855
+ "targets": [
1856
+ {
1857
+ "alias": "",
1858
+ "bucketAggs": [],
1859
+ "datasource": {
1860
+ "type": "elasticsearch",
1861
+ "uid": "wazuh_datasource_uid"
1862
+ },
1863
+ "metrics": [
1864
+ {
1865
+ "id": "1",
1866
+ "settings": {
1867
+ "size": "500"
1868
+ },
1869
+ "type": "raw_data"
1870
+ }
1871
+ ],
1872
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
1873
+ "queryType": "lucene",
1874
+ "refId": "A",
1875
+ "timeField": "timestamp"
1876
+ }
1877
+ ],
1878
+ "title": "PROCESSORS INFO",
1879
+ "transformations": [
1880
+ {
1881
+ "id": "organize",
1882
+ "options": {
1883
+ "excludeByName": {
1884
+ "@metadata_beat": true,
1885
+ "@metadata_type": true,
1886
+ "@metadata_version": true,
1887
+ "_id": true,
1888
+ "_index": true,
1889
+ "_type": true,
1890
+ "agent_ephemeral_id": true,
1891
+ "agent_hostname": true,
1892
+ "agent_id": true,
1893
+ "agent_ip": false,
1894
+ "agent_ip_city_name": true,
1895
+ "agent_ip_country_code": true,
1896
+ "agent_ip_geolocation": true,
1897
+ "agent_labels_customer": true,
1898
+ "agent_name": false,
1899
+ "agent_type": true,
1900
+ "agent_version": true,
1901
+ "beats_type": true,
1902
+ "collector_node_id": true,
1903
+ "data_base_indicator_access_type": true,
1904
+ "data_base_indicator_id": false,
1905
+ "data_base_indicator_indicator_city_name": true,
1906
+ "data_base_indicator_indicator_country_code": true,
1907
+ "data_base_indicator_indicator_geolocation": true,
1908
+ "data_inventory_module": true,
1909
+ "data_system_sys_domain": true,
1910
+ "data_system_sys_form_factor": true,
1911
+ "data_system_sys_hostname": true,
1912
+ "data_system_sys_icon": true,
1913
+ "data_system_sys_ip": true,
1914
+ "data_system_sys_ip_city_name": true,
1915
+ "data_system_sys_ip_country_code": true,
1916
+ "data_system_sys_ip_geolocation": true,
1917
+ "data_system_sys_last_seen_by": true,
1918
+ "data_system_sys_manufacturer": true,
1919
+ "data_system_sys_memory_count": true,
1920
+ "data_system_sys_model": true,
1921
+ "data_system_sys_os_family": true,
1922
+ "data_system_sys_os_group": true,
1923
+ "data_system_sys_os_installation_date": true,
1924
+ "data_system_sys_os_name": true,
1925
+ "data_system_sys_os_version": true,
1926
+ "data_system_sys_script_version": true,
1927
+ "data_system_sys_type": true,
1928
+ "data_system_sys_uptime": true,
1929
+ "data_system_sys_uuid": true,
1930
+ "data_type": true,
1931
+ "data_win_eventdata_domain": true,
1932
+ "data_win_eventdata_imagePath": true,
1933
+ "data_win_eventdata_sID": true,
1934
+ "data_win_eventdata_serviceName": true,
1935
+ "data_win_eventdata_serviceType": true,
1936
+ "data_win_eventdata_startType": true,
1937
+ "data_win_eventdata_timestamp": true,
1938
+ "data_win_eventdata_user": true,
1939
+ "data_win_system_channel": true,
1940
+ "data_win_system_computer": true,
1941
+ "data_win_system_eventID": true,
1942
+ "data_win_system_eventRecordID": true,
1943
+ "data_win_system_eventSourceName": true,
1944
+ "data_win_system_keywords": true,
1945
+ "data_win_system_level": true,
1946
+ "data_win_system_opcode": true,
1947
+ "data_win_system_processID": true,
1948
+ "data_win_system_providerGuid": true,
1949
+ "data_win_system_providerName": true,
1950
+ "data_win_system_severityValue": true,
1951
+ "data_win_system_systemTime": true,
1952
+ "data_win_system_task": true,
1953
+ "data_win_system_threadID": true,
1954
+ "data_win_system_version": true,
1955
+ "date": true,
1956
+ "decoder_name": true,
1957
+ "ecs_version": true,
1958
+ "gl2_accounted_message_size": true,
1959
+ "gl2_message_id": true,
1960
+ "gl2_processing_error": true,
1961
+ "gl2_remote_ip": true,
1962
+ "gl2_remote_port": true,
1963
+ "gl2_source_collector": true,
1964
+ "gl2_source_input": true,
1965
+ "gl2_source_node": true,
1966
+ "highlight": true,
1967
+ "host_name": true,
1968
+ "id": true,
1969
+ "location": true,
1970
+ "log_file_path": true,
1971
+ "log_offset": true,
1972
+ "manager_name": true,
1973
+ "message": true,
1974
+ "previous_output": true,
1975
+ "rule_description": true,
1976
+ "rule_firedtimes": true,
1977
+ "rule_frequency": true,
1978
+ "rule_gdpr": true,
1979
+ "rule_gpg13": true,
1980
+ "rule_group1": true,
1981
+ "rule_group2": true,
1982
+ "rule_groups": true,
1983
+ "rule_hipaa": true,
1984
+ "rule_id": true,
1985
+ "rule_level": true,
1986
+ "rule_mail": true,
1987
+ "rule_mitre_id": true,
1988
+ "rule_mitre_tactic": true,
1989
+ "rule_mitre_technique": true,
1990
+ "rule_nist_800_53": true,
1991
+ "rule_pci_dss": true,
1992
+ "rule_tsc": true,
1993
+ "sort": true,
1994
+ "source": true,
1995
+ "src_ip": true,
1996
+ "src_ip_city_name": true,
1997
+ "src_ip_country_code": true,
1998
+ "src_ip_geolocation": true,
1999
+ "streams": true,
2000
+ "syslog_level": true,
2001
+ "syslog_tag": true,
2002
+ "syslog_type": true,
2003
+ "timestamp": false,
2004
+ "timestamp_utc": true,
2005
+ "true": true,
2006
+ "user_name": true,
2007
+ "win_system_eventID": true,
2008
+ "windows_event_id": true,
2009
+ "windows_event_severity": false
2010
+ },
2011
+ "indexByName": {
2012
+ "_id": 2,
2013
+ "_index": 3,
2014
+ "_type": 4,
2015
+ "agent_id": 5,
2016
+ "agent_ip": 6,
2017
+ "agent_ip_city_name": 31,
2018
+ "agent_ip_country_code": 32,
2019
+ "agent_ip_geolocation": 33,
2020
+ "agent_labels_customer": 29,
2021
+ "agent_name": 1,
2022
+ "data_system_sys_domain": 34,
2023
+ "data_system_sys_form_factor": 35,
2024
+ "data_system_sys_hostname": 36,
2025
+ "data_system_sys_icon": 37,
2026
+ "data_system_sys_ip": 38,
2027
+ "data_system_sys_ip_city_name": 39,
2028
+ "data_system_sys_ip_country_code": 40,
2029
+ "data_system_sys_ip_geolocation": 41,
2030
+ "data_system_sys_last_seen_by": 42,
2031
+ "data_system_sys_manufacturer": 43,
2032
+ "data_system_sys_memory_count": 44,
2033
+ "data_system_sys_model": 45,
2034
+ "data_system_sys_os_arch": 46,
2035
+ "data_system_sys_os_bit": 47,
2036
+ "data_system_sys_os_family": 48,
2037
+ "data_system_sys_os_group": 49,
2038
+ "data_system_sys_os_installation_date": 50,
2039
+ "data_system_sys_os_name": 51,
2040
+ "data_system_sys_os_version": 52,
2041
+ "data_system_sys_processor_count": 53,
2042
+ "data_system_sys_script_version": 54,
2043
+ "data_system_sys_serial": 55,
2044
+ "data_system_sys_type": 56,
2045
+ "data_system_sys_uptime": 57,
2046
+ "data_system_sys_uuid": 58,
2047
+ "decoder_name": 7,
2048
+ "gl2_accounted_message_size": 8,
2049
+ "gl2_message_id": 9,
2050
+ "gl2_processing_error": 30,
2051
+ "gl2_remote_ip": 10,
2052
+ "gl2_remote_port": 11,
2053
+ "gl2_source_input": 12,
2054
+ "gl2_source_node": 13,
2055
+ "highlight": 14,
2056
+ "id": 15,
2057
+ "location": 16,
2058
+ "manager_name": 17,
2059
+ "message": 18,
2060
+ "rule_description": 19,
2061
+ "rule_firedtimes": 20,
2062
+ "rule_group1": 59,
2063
+ "rule_groups": 21,
2064
+ "rule_id": 22,
2065
+ "rule_level": 23,
2066
+ "rule_mail": 24,
2067
+ "sort": 25,
2068
+ "source": 26,
2069
+ "streams": 27,
2070
+ "syslog_level": 60,
2071
+ "syslog_type": 28,
2072
+ "timestamp": 0,
2073
+ "timestamp_utc": 61,
2074
+ "true": 62
2075
+ },
2076
+ "renameByName": {
2077
+ "agent_ip": "SRC IP",
2078
+ "agent_name": "AGENT",
2079
+ "data_base_indicator_access_type": "",
2080
+ "data_base_indicator_id": "OTX IoC ID",
2081
+ "data_base_indicator_indicator": "IoC",
2082
+ "data_base_indicator_indicator_country_code": "",
2083
+ "data_base_indicator_type": "IoC TYPE",
2084
+ "data_processor_cores": "CORES",
2085
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
2086
+ "data_processor_name": "PROCESSOR",
2087
+ "data_processor_status": "STATUS",
2088
+ "data_sections": "OTX SECTIONS",
2089
+ "data_system_sys_os_arch": "ARCH",
2090
+ "data_system_sys_os_bit": "BITS",
2091
+ "data_system_sys_processor_count": "PROCESSORS",
2092
+ "data_system_sys_serial": "S/N",
2093
+ "data_type": "",
2094
+ "data_win_system_message": "MESSAGE",
2095
+ "data_win_system_providerGuid": "",
2096
+ "rule_level": "RULE LEVEL",
2097
+ "timestamp": "DATE/TIME",
2098
+ "windows_event_severity": "EVENT LOG SEVERITY"
2099
+ }
2100
+ }
2101
+ }
2102
+ ],
2103
+ "type": "table"
2104
+ },
2105
+ {
2106
+ "datasource": {
2107
+ "type": "elasticsearch",
2108
+ "uid": "wazuh_datasource_uid"
2109
+ },
2110
+ "fieldConfig": {
2111
+ "defaults": {
2112
+ "color": {
2113
+ "mode": "palette-classic"
2114
+ },
2115
+ "custom": {
2116
+ "hideFrom": {
2117
+ "legend": false,
2118
+ "tooltip": false,
2119
+ "viz": false
2120
+ }
2121
+ },
2122
+ "decimals": 0,
2123
+ "mappings": [],
2124
+ "unit": "short"
2125
+ },
2126
+ "overrides": [
2127
+ {
2128
+ "matcher": {
2129
+ "id": "byName",
2130
+ "options": "1"
2131
+ },
2132
+ "properties": [
2133
+ {
2134
+ "id": "color",
2135
+ "value": {
2136
+ "fixedColor": "#FF9830",
2137
+ "mode": "fixed"
2138
+ }
2139
+ }
2140
+ ]
2141
+ },
2142
+ {
2143
+ "matcher": {
2144
+ "id": "byName",
2145
+ "options": "Alert"
2146
+ },
2147
+ "properties": [
2148
+ {
2149
+ "id": "color",
2150
+ "value": {
2151
+ "fixedColor": "#F2495C",
2152
+ "mode": "fixed"
2153
+ }
2154
+ }
2155
+ ]
2156
+ },
2157
+ {
2158
+ "matcher": {
2159
+ "id": "byName",
2160
+ "options": "Error"
2161
+ },
2162
+ "properties": [
2163
+ {
2164
+ "id": "color",
2165
+ "value": {
2166
+ "fixedColor": "#F2495C",
2167
+ "mode": "fixed"
2168
+ }
2169
+ }
2170
+ ]
2171
+ },
2172
+ {
2173
+ "matcher": {
2174
+ "id": "byName",
2175
+ "options": "Info"
2176
+ },
2177
+ "properties": [
2178
+ {
2179
+ "id": "color",
2180
+ "value": {
2181
+ "fixedColor": "#73BF69",
2182
+ "mode": "fixed"
2183
+ }
2184
+ }
2185
+ ]
2186
+ },
2187
+ {
2188
+ "matcher": {
2189
+ "id": "byName",
2190
+ "options": "NOTICE"
2191
+ },
2192
+ "properties": [
2193
+ {
2194
+ "id": "color",
2195
+ "value": {
2196
+ "fixedColor": "#5794F2",
2197
+ "mode": "fixed"
2198
+ }
2199
+ }
2200
+ ]
2201
+ },
2202
+ {
2203
+ "matcher": {
2204
+ "id": "byName",
2205
+ "options": "Notice"
2206
+ },
2207
+ "properties": [
2208
+ {
2209
+ "id": "color",
2210
+ "value": {
2211
+ "fixedColor": "#5794F2",
2212
+ "mode": "fixed"
2213
+ }
2214
+ }
2215
+ ]
2216
+ },
2217
+ {
2218
+ "matcher": {
2219
+ "id": "byName",
2220
+ "options": "Result"
2221
+ },
2222
+ "properties": [
2223
+ {
2224
+ "id": "color",
2225
+ "value": {
2226
+ "fixedColor": "#B877D9",
2227
+ "mode": "fixed"
2228
+ }
2229
+ }
2230
+ ]
2231
+ },
2232
+ {
2233
+ "matcher": {
2234
+ "id": "byName",
2235
+ "options": "Warning"
2236
+ },
2237
+ "properties": [
2238
+ {
2239
+ "id": "color",
2240
+ "value": {
2241
+ "fixedColor": "#FF9830",
2242
+ "mode": "fixed"
2243
+ }
2244
+ }
2245
+ ]
2246
+ },
2247
+ {
2248
+ "matcher": {
2249
+ "id": "byName",
2250
+ "options": "INFORMATION"
2251
+ },
2252
+ "properties": [
2253
+ {
2254
+ "id": "color",
2255
+ "value": {
2256
+ "fixedColor": "green",
2257
+ "mode": "fixed"
2258
+ }
2259
+ }
2260
+ ]
2261
+ },
2262
+ {
2263
+ "matcher": {
2264
+ "id": "byName",
2265
+ "options": "WARNING"
2266
+ },
2267
+ "properties": [
2268
+ {
2269
+ "id": "color",
2270
+ "value": {
2271
+ "fixedColor": "orange",
2272
+ "mode": "fixed"
2273
+ }
2274
+ }
2275
+ ]
2276
+ },
2277
+ {
2278
+ "matcher": {
2279
+ "id": "byName",
2280
+ "options": "ERROR"
2281
+ },
2282
+ "properties": [
2283
+ {
2284
+ "id": "color",
2285
+ "value": {
2286
+ "fixedColor": "red",
2287
+ "mode": "fixed"
2288
+ }
2289
+ }
2290
+ ]
2291
+ }
2292
+ ]
2293
+ },
2294
+ "gridPos": {
2295
+ "h": 8,
2296
+ "w": 5,
2297
+ "x": 0,
2298
+ "y": 26
2299
+ },
2300
+ "id": 146,
2301
+ "links": [],
2302
+ "maxDataPoints": 3,
2303
+ "options": {
2304
+ "displayLabels": [],
2305
+ "legend": {
2306
+ "calcs": [],
2307
+ "displayMode": "table",
2308
+ "placement": "right",
2309
+ "showLegend": true,
2310
+ "values": ["value"]
2311
+ },
2312
+ "pieType": "donut",
2313
+ "reduceOptions": {
2314
+ "calcs": ["sum"],
2315
+ "fields": "",
2316
+ "values": false
2317
+ },
2318
+ "text": {},
2319
+ "tooltip": {
2320
+ "mode": "single",
2321
+ "sort": "none"
2322
+ }
2323
+ },
2324
+ "targets": [
2325
+ {
2326
+ "bucketAggs": [
2327
+ {
2328
+ "$$hashKey": "object:73",
2329
+ "fake": true,
2330
+ "field": "data_system_memory_item_size",
2331
+ "id": "3",
2332
+ "settings": {
2333
+ "min_doc_count": 1,
2334
+ "order": "desc",
2335
+ "orderBy": "_count",
2336
+ "size": "0"
2337
+ },
2338
+ "type": "terms"
2339
+ },
2340
+ {
2341
+ "field": "agent_name",
2342
+ "id": "4",
2343
+ "settings": {
2344
+ "min_doc_count": "1",
2345
+ "order": "desc",
2346
+ "orderBy": "_term",
2347
+ "size": "10"
2348
+ },
2349
+ "type": "terms"
2350
+ },
2351
+ {
2352
+ "$$hashKey": "object:74",
2353
+ "field": "timestamp",
2354
+ "id": "2",
2355
+ "settings": {
2356
+ "interval": "auto",
2357
+ "min_doc_count": 0,
2358
+ "trimEdges": 0
2359
+ },
2360
+ "type": "date_histogram"
2361
+ }
2362
+ ],
2363
+ "datasource": {
2364
+ "type": "elasticsearch",
2365
+ "uid": "wazuh_datasource_uid"
2366
+ },
2367
+ "metrics": [
2368
+ {
2369
+ "$$hashKey": "object:71",
2370
+ "field": "select field",
2371
+ "id": "1",
2372
+ "type": "count"
2373
+ }
2374
+ ],
2375
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit Memory\"",
2376
+ "refId": "A",
2377
+ "timeField": "timestamp"
2378
+ }
2379
+ ],
2380
+ "title": "AGENTS BY MEMORY",
2381
+ "type": "piechart"
2382
+ },
2383
+ {
2384
+ "datasource": {
2385
+ "type": "elasticsearch",
2386
+ "uid": "wazuh_datasource_uid"
2387
+ },
2388
+ "fieldConfig": {
2389
+ "defaults": {
2390
+ "color": {
2391
+ "mode": "thresholds"
2392
+ },
2393
+ "custom": {
2394
+ "align": "auto",
2395
+ "cellOptions": {
2396
+ "type": "auto"
2397
+ },
2398
+ "inspect": false
2399
+ },
2400
+ "mappings": [],
2401
+ "thresholds": {
2402
+ "mode": "absolute",
2403
+ "steps": [
2404
+ {
2405
+ "color": "green"
2406
+ },
2407
+ {
2408
+ "color": "red",
2409
+ "value": 80
2410
+ }
2411
+ ]
2412
+ }
2413
+ },
2414
+ "overrides": [
2415
+ {
2416
+ "matcher": {
2417
+ "id": "byName",
2418
+ "options": "rule_level"
2419
+ },
2420
+ "properties": [
2421
+ {
2422
+ "id": "custom.width",
2423
+ "value": 93
2424
+ }
2425
+ ]
2426
+ },
2427
+ {
2428
+ "matcher": {
2429
+ "id": "byName",
2430
+ "options": "windows_event_id"
2431
+ },
2432
+ "properties": [
2433
+ {
2434
+ "id": "custom.width",
2435
+ "value": 186
2436
+ }
2437
+ ]
2438
+ },
2439
+ {
2440
+ "matcher": {
2441
+ "id": "byName",
2442
+ "options": "DATE/TIME"
2443
+ },
2444
+ "properties": [
2445
+ {
2446
+ "id": "custom.width",
2447
+ "value": 202
2448
+ }
2449
+ ]
2450
+ },
2451
+ {
2452
+ "matcher": {
2453
+ "id": "byName",
2454
+ "options": "AGENT"
2455
+ },
2456
+ "properties": [
2457
+ {
2458
+ "id": "custom.width",
2459
+ "value": 171
2460
+ }
2461
+ ]
2462
+ },
2463
+ {
2464
+ "matcher": {
2465
+ "id": "byName",
2466
+ "options": "SRC IP"
2467
+ },
2468
+ "properties": [
2469
+ {
2470
+ "id": "custom.width",
2471
+ "value": 167
2472
+ }
2473
+ ]
2474
+ },
2475
+ {
2476
+ "matcher": {
2477
+ "id": "byName",
2478
+ "options": "MESSAGE"
2479
+ },
2480
+ "properties": [
2481
+ {
2482
+ "id": "custom.width",
2483
+ "value": 1519
2484
+ }
2485
+ ]
2486
+ },
2487
+ {
2488
+ "matcher": {
2489
+ "id": "byName",
2490
+ "options": "rule_description"
2491
+ },
2492
+ "properties": [
2493
+ {
2494
+ "id": "custom.width",
2495
+ "value": 524
2496
+ }
2497
+ ]
2498
+ },
2499
+ {
2500
+ "matcher": {
2501
+ "id": "byName",
2502
+ "options": "PROCESSOR"
2503
+ },
2504
+ "properties": [
2505
+ {
2506
+ "id": "custom.width",
2507
+ "value": 418
2508
+ }
2509
+ ]
2510
+ }
2511
+ ]
2512
+ },
2513
+ "gridPos": {
2514
+ "h": 8,
2515
+ "w": 19,
2516
+ "x": 5,
2517
+ "y": 26
2518
+ },
2519
+ "id": 147,
2520
+ "options": {
2521
+ "cellHeight": "sm",
2522
+ "footer": {
2523
+ "countRows": false,
2524
+ "fields": "",
2525
+ "reducer": ["sum"],
2526
+ "show": false
2527
+ },
2528
+ "showHeader": true,
2529
+ "sortBy": []
2530
+ },
2531
+ "pluginVersion": "10.0.2",
2532
+ "targets": [
2533
+ {
2534
+ "alias": "",
2535
+ "bucketAggs": [],
2536
+ "datasource": {
2537
+ "type": "elasticsearch",
2538
+ "uid": "wazuh_datasource_uid"
2539
+ },
2540
+ "metrics": [
2541
+ {
2542
+ "id": "1",
2543
+ "settings": {
2544
+ "size": "500"
2545
+ },
2546
+ "type": "raw_data"
2547
+ }
2548
+ ],
2549
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit Memory\"",
2550
+ "queryType": "lucene",
2551
+ "refId": "A",
2552
+ "timeField": "timestamp"
2553
+ }
2554
+ ],
2555
+ "title": "MEMORY INFO",
2556
+ "transformations": [
2557
+ {
2558
+ "id": "organize",
2559
+ "options": {
2560
+ "excludeByName": {
2561
+ "@metadata_beat": true,
2562
+ "@metadata_type": true,
2563
+ "@metadata_version": true,
2564
+ "_id": true,
2565
+ "_index": true,
2566
+ "_type": true,
2567
+ "agent_ephemeral_id": true,
2568
+ "agent_hostname": true,
2569
+ "agent_id": true,
2570
+ "agent_ip": false,
2571
+ "agent_ip_city_name": true,
2572
+ "agent_ip_country_code": true,
2573
+ "agent_ip_geolocation": true,
2574
+ "agent_ip_reserved_ip": true,
2575
+ "agent_labels_customer": true,
2576
+ "agent_name": false,
2577
+ "agent_type": true,
2578
+ "agent_version": true,
2579
+ "beats_type": true,
2580
+ "cluster_name": true,
2581
+ "cluster_node": true,
2582
+ "collector_node_id": true,
2583
+ "data_base_indicator_access_type": true,
2584
+ "data_base_indicator_id": false,
2585
+ "data_base_indicator_indicator_city_name": true,
2586
+ "data_base_indicator_indicator_country_code": true,
2587
+ "data_base_indicator_indicator_geolocation": true,
2588
+ "data_inventory_module": true,
2589
+ "data_system_memory_item_manufacturer": true,
2590
+ "data_system_memory_item_speed": true,
2591
+ "data_system_sys_domain": true,
2592
+ "data_system_sys_form_factor": true,
2593
+ "data_system_sys_hostname": true,
2594
+ "data_system_sys_icon": true,
2595
+ "data_system_sys_ip": true,
2596
+ "data_system_sys_ip_city_name": true,
2597
+ "data_system_sys_ip_country_code": true,
2598
+ "data_system_sys_ip_geolocation": true,
2599
+ "data_system_sys_last_seen_by": true,
2600
+ "data_system_sys_manufacturer": true,
2601
+ "data_system_sys_memory_count": true,
2602
+ "data_system_sys_model": true,
2603
+ "data_system_sys_os_family": true,
2604
+ "data_system_sys_os_group": true,
2605
+ "data_system_sys_os_installation_date": true,
2606
+ "data_system_sys_os_name": true,
2607
+ "data_system_sys_os_version": true,
2608
+ "data_system_sys_script_version": true,
2609
+ "data_system_sys_type": true,
2610
+ "data_system_sys_uptime": true,
2611
+ "data_system_sys_uuid": true,
2612
+ "data_type": true,
2613
+ "data_win_eventdata_domain": true,
2614
+ "data_win_eventdata_imagePath": true,
2615
+ "data_win_eventdata_sID": true,
2616
+ "data_win_eventdata_serviceName": true,
2617
+ "data_win_eventdata_serviceType": true,
2618
+ "data_win_eventdata_startType": true,
2619
+ "data_win_eventdata_timestamp": true,
2620
+ "data_win_eventdata_user": true,
2621
+ "data_win_system_channel": true,
2622
+ "data_win_system_computer": true,
2623
+ "data_win_system_eventID": true,
2624
+ "data_win_system_eventRecordID": true,
2625
+ "data_win_system_eventSourceName": true,
2626
+ "data_win_system_keywords": true,
2627
+ "data_win_system_level": true,
2628
+ "data_win_system_opcode": true,
2629
+ "data_win_system_processID": true,
2630
+ "data_win_system_providerGuid": true,
2631
+ "data_win_system_providerName": true,
2632
+ "data_win_system_severityValue": true,
2633
+ "data_win_system_systemTime": true,
2634
+ "data_win_system_task": true,
2635
+ "data_win_system_threadID": true,
2636
+ "data_win_system_version": true,
2637
+ "date": true,
2638
+ "decoder_name": true,
2639
+ "ecs_version": true,
2640
+ "gl2_accounted_message_size": true,
2641
+ "gl2_message_id": true,
2642
+ "gl2_processing_error": true,
2643
+ "gl2_remote_ip": true,
2644
+ "gl2_remote_port": true,
2645
+ "gl2_source_collector": true,
2646
+ "gl2_source_input": true,
2647
+ "gl2_source_node": true,
2648
+ "highlight": true,
2649
+ "host_name": true,
2650
+ "id": true,
2651
+ "location": true,
2652
+ "log_file_path": true,
2653
+ "log_offset": true,
2654
+ "manager_name": true,
2655
+ "message": true,
2656
+ "previous_output": true,
2657
+ "rule_description": true,
2658
+ "rule_firedtimes": true,
2659
+ "rule_frequency": true,
2660
+ "rule_gdpr": true,
2661
+ "rule_gpg13": true,
2662
+ "rule_group1": true,
2663
+ "rule_group2": true,
2664
+ "rule_groups": true,
2665
+ "rule_hipaa": true,
2666
+ "rule_id": true,
2667
+ "rule_level": true,
2668
+ "rule_mail": true,
2669
+ "rule_mitre_id": true,
2670
+ "rule_mitre_tactic": true,
2671
+ "rule_mitre_technique": true,
2672
+ "rule_nist_800_53": true,
2673
+ "rule_pci_dss": true,
2674
+ "rule_tsc": true,
2675
+ "sort": true,
2676
+ "source": true,
2677
+ "source_reserved_ip": true,
2678
+ "src_ip": true,
2679
+ "src_ip_city_name": true,
2680
+ "src_ip_country_code": true,
2681
+ "src_ip_geolocation": true,
2682
+ "streams": true,
2683
+ "syslog_level": true,
2684
+ "syslog_tag": true,
2685
+ "syslog_type": true,
2686
+ "timestamp": false,
2687
+ "timestamp_utc": true,
2688
+ "true": true,
2689
+ "user_name": true,
2690
+ "win_system_eventID": true,
2691
+ "windows_event_id": true,
2692
+ "windows_event_severity": false
2693
+ },
2694
+ "indexByName": {
2695
+ "_id": 2,
2696
+ "_index": 3,
2697
+ "_type": 4,
2698
+ "agent_id": 5,
2699
+ "agent_ip": 6,
2700
+ "agent_ip_city_name": 31,
2701
+ "agent_ip_country_code": 32,
2702
+ "agent_ip_geolocation": 33,
2703
+ "agent_labels_customer": 29,
2704
+ "agent_name": 1,
2705
+ "data_system_sys_domain": 34,
2706
+ "data_system_sys_form_factor": 35,
2707
+ "data_system_sys_hostname": 36,
2708
+ "data_system_sys_icon": 37,
2709
+ "data_system_sys_ip": 38,
2710
+ "data_system_sys_ip_city_name": 39,
2711
+ "data_system_sys_ip_country_code": 40,
2712
+ "data_system_sys_ip_geolocation": 41,
2713
+ "data_system_sys_last_seen_by": 42,
2714
+ "data_system_sys_manufacturer": 43,
2715
+ "data_system_sys_memory_count": 44,
2716
+ "data_system_sys_model": 45,
2717
+ "data_system_sys_os_arch": 46,
2718
+ "data_system_sys_os_bit": 47,
2719
+ "data_system_sys_os_family": 48,
2720
+ "data_system_sys_os_group": 49,
2721
+ "data_system_sys_os_installation_date": 50,
2722
+ "data_system_sys_os_name": 51,
2723
+ "data_system_sys_os_version": 52,
2724
+ "data_system_sys_processor_count": 53,
2725
+ "data_system_sys_script_version": 54,
2726
+ "data_system_sys_serial": 55,
2727
+ "data_system_sys_type": 56,
2728
+ "data_system_sys_uptime": 57,
2729
+ "data_system_sys_uuid": 58,
2730
+ "decoder_name": 7,
2731
+ "gl2_accounted_message_size": 8,
2732
+ "gl2_message_id": 9,
2733
+ "gl2_processing_error": 30,
2734
+ "gl2_remote_ip": 10,
2735
+ "gl2_remote_port": 11,
2736
+ "gl2_source_input": 12,
2737
+ "gl2_source_node": 13,
2738
+ "highlight": 14,
2739
+ "id": 15,
2740
+ "location": 16,
2741
+ "manager_name": 17,
2742
+ "message": 18,
2743
+ "rule_description": 19,
2744
+ "rule_firedtimes": 20,
2745
+ "rule_group1": 59,
2746
+ "rule_groups": 21,
2747
+ "rule_id": 22,
2748
+ "rule_level": 23,
2749
+ "rule_mail": 24,
2750
+ "sort": 25,
2751
+ "source": 26,
2752
+ "streams": 27,
2753
+ "syslog_level": 60,
2754
+ "syslog_type": 28,
2755
+ "timestamp": 0,
2756
+ "timestamp_utc": 61,
2757
+ "true": 62
2758
+ },
2759
+ "renameByName": {
2760
+ "agent_ip": "SRC IP",
2761
+ "agent_name": "AGENT",
2762
+ "data_base_indicator_access_type": "",
2763
+ "data_base_indicator_id": "OTX IoC ID",
2764
+ "data_base_indicator_indicator": "IoC",
2765
+ "data_base_indicator_indicator_country_code": "",
2766
+ "data_base_indicator_type": "IoC TYPE",
2767
+ "data_processor_cores": "CORES",
2768
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
2769
+ "data_processor_name": "PROCESSOR",
2770
+ "data_processor_status": "STATUS",
2771
+ "data_sections": "OTX SECTIONS",
2772
+ "data_system_memory_item_bank": "BANK",
2773
+ "data_system_memory_item_detail": "DETAIL",
2774
+ "data_system_memory_item_form_factor": "FACTOR",
2775
+ "data_system_memory_item_size": "SIZE",
2776
+ "data_system_memory_item_tag": "TAG",
2777
+ "data_system_memory_item_type": "TYPE",
2778
+ "data_system_sys_os_arch": "ARCH",
2779
+ "data_system_sys_os_bit": "BITS",
2780
+ "data_system_sys_processor_count": "PROCESSORS",
2781
+ "data_system_sys_serial": "S/N",
2782
+ "data_type": "",
2783
+ "data_win_system_message": "MESSAGE",
2784
+ "data_win_system_providerGuid": "",
2785
+ "rule_level": "RULE LEVEL",
2786
+ "timestamp": "DATE/TIME",
2787
+ "windows_event_severity": "EVENT LOG SEVERITY"
2788
+ }
2789
+ }
2790
+ }
2791
+ ],
2792
+ "type": "table"
2793
+ },
2794
+ {
2795
+ "datasource": {
2796
+ "type": "elasticsearch",
2797
+ "uid": "wazuh_datasource_uid"
2798
+ },
2799
+ "fieldConfig": {
2800
+ "defaults": {
2801
+ "color": {
2802
+ "mode": "palette-classic"
2803
+ },
2804
+ "custom": {
2805
+ "hideFrom": {
2806
+ "legend": false,
2807
+ "tooltip": false,
2808
+ "viz": false
2809
+ }
2810
+ },
2811
+ "decimals": 0,
2812
+ "mappings": [],
2813
+ "unit": "short"
2814
+ },
2815
+ "overrides": [
2816
+ {
2817
+ "matcher": {
2818
+ "id": "byName",
2819
+ "options": "1"
2820
+ },
2821
+ "properties": [
2822
+ {
2823
+ "id": "color",
2824
+ "value": {
2825
+ "fixedColor": "#FF9830",
2826
+ "mode": "fixed"
2827
+ }
2828
+ }
2829
+ ]
2830
+ },
2831
+ {
2832
+ "matcher": {
2833
+ "id": "byName",
2834
+ "options": "Alert"
2835
+ },
2836
+ "properties": [
2837
+ {
2838
+ "id": "color",
2839
+ "value": {
2840
+ "fixedColor": "#F2495C",
2841
+ "mode": "fixed"
2842
+ }
2843
+ }
2844
+ ]
2845
+ },
2846
+ {
2847
+ "matcher": {
2848
+ "id": "byName",
2849
+ "options": "Error"
2850
+ },
2851
+ "properties": [
2852
+ {
2853
+ "id": "color",
2854
+ "value": {
2855
+ "fixedColor": "#F2495C",
2856
+ "mode": "fixed"
2857
+ }
2858
+ }
2859
+ ]
2860
+ },
2861
+ {
2862
+ "matcher": {
2863
+ "id": "byName",
2864
+ "options": "Info"
2865
+ },
2866
+ "properties": [
2867
+ {
2868
+ "id": "color",
2869
+ "value": {
2870
+ "fixedColor": "#73BF69",
2871
+ "mode": "fixed"
2872
+ }
2873
+ }
2874
+ ]
2875
+ },
2876
+ {
2877
+ "matcher": {
2878
+ "id": "byName",
2879
+ "options": "NOTICE"
2880
+ },
2881
+ "properties": [
2882
+ {
2883
+ "id": "color",
2884
+ "value": {
2885
+ "fixedColor": "#5794F2",
2886
+ "mode": "fixed"
2887
+ }
2888
+ }
2889
+ ]
2890
+ },
2891
+ {
2892
+ "matcher": {
2893
+ "id": "byName",
2894
+ "options": "Notice"
2895
+ },
2896
+ "properties": [
2897
+ {
2898
+ "id": "color",
2899
+ "value": {
2900
+ "fixedColor": "#5794F2",
2901
+ "mode": "fixed"
2902
+ }
2903
+ }
2904
+ ]
2905
+ },
2906
+ {
2907
+ "matcher": {
2908
+ "id": "byName",
2909
+ "options": "Result"
2910
+ },
2911
+ "properties": [
2912
+ {
2913
+ "id": "color",
2914
+ "value": {
2915
+ "fixedColor": "#B877D9",
2916
+ "mode": "fixed"
2917
+ }
2918
+ }
2919
+ ]
2920
+ },
2921
+ {
2922
+ "matcher": {
2923
+ "id": "byName",
2924
+ "options": "Warning"
2925
+ },
2926
+ "properties": [
2927
+ {
2928
+ "id": "color",
2929
+ "value": {
2930
+ "fixedColor": "#FF9830",
2931
+ "mode": "fixed"
2932
+ }
2933
+ }
2934
+ ]
2935
+ },
2936
+ {
2937
+ "matcher": {
2938
+ "id": "byName",
2939
+ "options": "INFORMATION"
2940
+ },
2941
+ "properties": [
2942
+ {
2943
+ "id": "color",
2944
+ "value": {
2945
+ "fixedColor": "green",
2946
+ "mode": "fixed"
2947
+ }
2948
+ }
2949
+ ]
2950
+ },
2951
+ {
2952
+ "matcher": {
2953
+ "id": "byName",
2954
+ "options": "WARNING"
2955
+ },
2956
+ "properties": [
2957
+ {
2958
+ "id": "color",
2959
+ "value": {
2960
+ "fixedColor": "orange",
2961
+ "mode": "fixed"
2962
+ }
2963
+ }
2964
+ ]
2965
+ },
2966
+ {
2967
+ "matcher": {
2968
+ "id": "byName",
2969
+ "options": "ERROR"
2970
+ },
2971
+ "properties": [
2972
+ {
2973
+ "id": "color",
2974
+ "value": {
2975
+ "fixedColor": "red",
2976
+ "mode": "fixed"
2977
+ }
2978
+ }
2979
+ ]
2980
+ }
2981
+ ]
2982
+ },
2983
+ "gridPos": {
2984
+ "h": 8,
2985
+ "w": 5,
2986
+ "x": 0,
2987
+ "y": 34
2988
+ },
2989
+ "id": 148,
2990
+ "links": [],
2991
+ "maxDataPoints": 3,
2992
+ "options": {
2993
+ "displayLabels": [],
2994
+ "legend": {
2995
+ "calcs": [],
2996
+ "displayMode": "table",
2997
+ "placement": "right",
2998
+ "showLegend": true,
2999
+ "values": ["value"]
3000
+ },
3001
+ "pieType": "donut",
3002
+ "reduceOptions": {
3003
+ "calcs": ["sum"],
3004
+ "fields": "",
3005
+ "values": false
3006
+ },
3007
+ "text": {},
3008
+ "tooltip": {
3009
+ "mode": "single",
3010
+ "sort": "none"
3011
+ }
3012
+ },
3013
+ "targets": [
3014
+ {
3015
+ "bucketAggs": [
3016
+ {
3017
+ "$$hashKey": "object:73",
3018
+ "fake": true,
3019
+ "field": "data_system_bios_item_manufacturer",
3020
+ "id": "3",
3021
+ "settings": {
3022
+ "min_doc_count": 1,
3023
+ "order": "desc",
3024
+ "orderBy": "_count",
3025
+ "size": "0"
3026
+ },
3027
+ "type": "terms"
3028
+ },
3029
+ {
3030
+ "field": "agent_name",
3031
+ "id": "4",
3032
+ "settings": {
3033
+ "min_doc_count": "1",
3034
+ "order": "desc",
3035
+ "orderBy": "_term",
3036
+ "size": "10"
3037
+ },
3038
+ "type": "terms"
3039
+ },
3040
+ {
3041
+ "$$hashKey": "object:74",
3042
+ "field": "timestamp",
3043
+ "id": "2",
3044
+ "settings": {
3045
+ "interval": "auto",
3046
+ "min_doc_count": 0,
3047
+ "trimEdges": 0
3048
+ },
3049
+ "type": "date_histogram"
3050
+ }
3051
+ ],
3052
+ "datasource": {
3053
+ "type": "elasticsearch",
3054
+ "uid": "wazuh_datasource_uid"
3055
+ },
3056
+ "metrics": [
3057
+ {
3058
+ "$$hashKey": "object:71",
3059
+ "field": "select field",
3060
+ "id": "1",
3061
+ "type": "count"
3062
+ }
3063
+ ],
3064
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit BIOS\"",
3065
+ "refId": "A",
3066
+ "timeField": "timestamp"
3067
+ }
3068
+ ],
3069
+ "title": "AGENTS BY BIOS",
3070
+ "type": "piechart"
3071
+ },
3072
+ {
3073
+ "datasource": {
3074
+ "type": "elasticsearch",
3075
+ "uid": "wazuh_datasource_uid"
3076
+ },
3077
+ "fieldConfig": {
3078
+ "defaults": {
3079
+ "color": {
3080
+ "mode": "thresholds"
3081
+ },
3082
+ "custom": {
3083
+ "align": "auto",
3084
+ "cellOptions": {
3085
+ "type": "auto"
3086
+ },
3087
+ "inspect": false
3088
+ },
3089
+ "mappings": [],
3090
+ "thresholds": {
3091
+ "mode": "absolute",
3092
+ "steps": [
3093
+ {
3094
+ "color": "green"
3095
+ },
3096
+ {
3097
+ "color": "red",
3098
+ "value": 80
3099
+ }
3100
+ ]
3101
+ }
3102
+ },
3103
+ "overrides": [
3104
+ {
3105
+ "matcher": {
3106
+ "id": "byName",
3107
+ "options": "rule_level"
3108
+ },
3109
+ "properties": [
3110
+ {
3111
+ "id": "custom.width",
3112
+ "value": 93
3113
+ }
3114
+ ]
3115
+ },
3116
+ {
3117
+ "matcher": {
3118
+ "id": "byName",
3119
+ "options": "windows_event_id"
3120
+ },
3121
+ "properties": [
3122
+ {
3123
+ "id": "custom.width",
3124
+ "value": 186
3125
+ }
3126
+ ]
3127
+ },
3128
+ {
3129
+ "matcher": {
3130
+ "id": "byName",
3131
+ "options": "DATE/TIME"
3132
+ },
3133
+ "properties": [
3134
+ {
3135
+ "id": "custom.width",
3136
+ "value": 202
3137
+ }
3138
+ ]
3139
+ },
3140
+ {
3141
+ "matcher": {
3142
+ "id": "byName",
3143
+ "options": "AGENT"
3144
+ },
3145
+ "properties": [
3146
+ {
3147
+ "id": "custom.width",
3148
+ "value": 171
3149
+ }
3150
+ ]
3151
+ },
3152
+ {
3153
+ "matcher": {
3154
+ "id": "byName",
3155
+ "options": "SRC IP"
3156
+ },
3157
+ "properties": [
3158
+ {
3159
+ "id": "custom.width",
3160
+ "value": 167
3161
+ }
3162
+ ]
3163
+ },
3164
+ {
3165
+ "matcher": {
3166
+ "id": "byName",
3167
+ "options": "MESSAGE"
3168
+ },
3169
+ "properties": [
3170
+ {
3171
+ "id": "custom.width",
3172
+ "value": 1519
3173
+ }
3174
+ ]
3175
+ },
3176
+ {
3177
+ "matcher": {
3178
+ "id": "byName",
3179
+ "options": "rule_description"
3180
+ },
3181
+ "properties": [
3182
+ {
3183
+ "id": "custom.width",
3184
+ "value": 524
3185
+ }
3186
+ ]
3187
+ }
3188
+ ]
3189
+ },
3190
+ "gridPos": {
3191
+ "h": 8,
3192
+ "w": 19,
3193
+ "x": 5,
3194
+ "y": 34
3195
+ },
3196
+ "id": 137,
3197
+ "options": {
3198
+ "cellHeight": "sm",
3199
+ "footer": {
3200
+ "countRows": false,
3201
+ "fields": "",
3202
+ "reducer": ["sum"],
3203
+ "show": false
3204
+ },
3205
+ "showHeader": true,
3206
+ "sortBy": []
3207
+ },
3208
+ "pluginVersion": "10.0.2",
3209
+ "targets": [
3210
+ {
3211
+ "alias": "",
3212
+ "bucketAggs": [],
3213
+ "datasource": {
3214
+ "type": "elasticsearch",
3215
+ "uid": "wazuh_datasource_uid"
3216
+ },
3217
+ "metrics": [
3218
+ {
3219
+ "id": "1",
3220
+ "settings": {
3221
+ "size": "500"
3222
+ },
3223
+ "type": "raw_data"
3224
+ }
3225
+ ],
3226
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit BIOS\"",
3227
+ "queryType": "lucene",
3228
+ "refId": "A",
3229
+ "timeField": "timestamp"
3230
+ }
3231
+ ],
3232
+ "title": "BIOS INFO",
3233
+ "transformations": [
3234
+ {
3235
+ "id": "organize",
3236
+ "options": {
3237
+ "excludeByName": {
3238
+ "@metadata_beat": true,
3239
+ "@metadata_type": true,
3240
+ "@metadata_version": true,
3241
+ "_id": true,
3242
+ "_index": true,
3243
+ "_type": true,
3244
+ "agent_ephemeral_id": true,
3245
+ "agent_hostname": true,
3246
+ "agent_id": true,
3247
+ "agent_ip": false,
3248
+ "agent_ip_city_name": true,
3249
+ "agent_ip_country_code": true,
3250
+ "agent_ip_geolocation": true,
3251
+ "agent_ip_reserved_ip": true,
3252
+ "agent_labels_customer": true,
3253
+ "agent_name": false,
3254
+ "agent_type": true,
3255
+ "agent_version": true,
3256
+ "beats_type": true,
3257
+ "cluster_name": true,
3258
+ "cluster_node": true,
3259
+ "collector_node_id": true,
3260
+ "data_base_indicator_access_type": true,
3261
+ "data_base_indicator_id": false,
3262
+ "data_base_indicator_indicator_city_name": true,
3263
+ "data_base_indicator_indicator_country_code": true,
3264
+ "data_base_indicator_indicator_geolocation": true,
3265
+ "data_inventory_module": true,
3266
+ "data_system_bios_item_date": true,
3267
+ "data_system_bios_item_revision": true,
3268
+ "data_system_bios_item_smversion": true,
3269
+ "data_type": true,
3270
+ "data_win_eventdata_domain": true,
3271
+ "data_win_eventdata_imagePath": true,
3272
+ "data_win_eventdata_sID": true,
3273
+ "data_win_eventdata_serviceName": true,
3274
+ "data_win_eventdata_serviceType": true,
3275
+ "data_win_eventdata_startType": true,
3276
+ "data_win_eventdata_timestamp": true,
3277
+ "data_win_eventdata_user": true,
3278
+ "data_win_system_channel": true,
3279
+ "data_win_system_computer": true,
3280
+ "data_win_system_eventID": true,
3281
+ "data_win_system_eventRecordID": true,
3282
+ "data_win_system_eventSourceName": true,
3283
+ "data_win_system_keywords": true,
3284
+ "data_win_system_level": true,
3285
+ "data_win_system_opcode": true,
3286
+ "data_win_system_processID": true,
3287
+ "data_win_system_providerGuid": true,
3288
+ "data_win_system_providerName": true,
3289
+ "data_win_system_severityValue": true,
3290
+ "data_win_system_systemTime": true,
3291
+ "data_win_system_task": true,
3292
+ "data_win_system_threadID": true,
3293
+ "data_win_system_version": true,
3294
+ "date": true,
3295
+ "decoder_name": true,
3296
+ "ecs_version": true,
3297
+ "gl2_accounted_message_size": true,
3298
+ "gl2_message_id": true,
3299
+ "gl2_processing_error": true,
3300
+ "gl2_remote_ip": true,
3301
+ "gl2_remote_port": true,
3302
+ "gl2_source_collector": true,
3303
+ "gl2_source_input": true,
3304
+ "gl2_source_node": true,
3305
+ "highlight": true,
3306
+ "host_name": true,
3307
+ "id": true,
3308
+ "location": true,
3309
+ "log_file_path": true,
3310
+ "log_offset": true,
3311
+ "manager_name": true,
3312
+ "message": true,
3313
+ "previous_output": true,
3314
+ "rule_description": true,
3315
+ "rule_firedtimes": true,
3316
+ "rule_frequency": true,
3317
+ "rule_gdpr": true,
3318
+ "rule_gpg13": true,
3319
+ "rule_group1": true,
3320
+ "rule_group2": true,
3321
+ "rule_groups": true,
3322
+ "rule_hipaa": true,
3323
+ "rule_id": true,
3324
+ "rule_level": true,
3325
+ "rule_mail": true,
3326
+ "rule_mitre_id": true,
3327
+ "rule_mitre_tactic": true,
3328
+ "rule_mitre_technique": true,
3329
+ "rule_nist_800_53": true,
3330
+ "rule_pci_dss": true,
3331
+ "rule_tsc": true,
3332
+ "sort": true,
3333
+ "source": true,
3334
+ "source_reserved_ip": true,
3335
+ "src_ip": true,
3336
+ "src_ip_city_name": true,
3337
+ "src_ip_country_code": true,
3338
+ "src_ip_geolocation": true,
3339
+ "streams": true,
3340
+ "syslog_level": true,
3341
+ "syslog_tag": true,
3342
+ "syslog_type": true,
3343
+ "timestamp": true,
3344
+ "timestamp_utc": true,
3345
+ "true": true,
3346
+ "user_name": true,
3347
+ "win_system_eventID": true,
3348
+ "windows_event_id": true,
3349
+ "windows_event_severity": false
3350
+ },
3351
+ "indexByName": {
3352
+ "_id": 1,
3353
+ "_index": 2,
3354
+ "_type": 3,
3355
+ "agent_id": 4,
3356
+ "agent_ip": 5,
3357
+ "agent_labels_customer": 29,
3358
+ "agent_name": 0,
3359
+ "data_inventory_module": 30,
3360
+ "data_processor_cores": 33,
3361
+ "data_processor_logical_nbr": 34,
3362
+ "data_processor_name": 31,
3363
+ "data_processor_status": 32,
3364
+ "date": 35,
3365
+ "decoder_name": 6,
3366
+ "gl2_accounted_message_size": 7,
3367
+ "gl2_message_id": 8,
3368
+ "gl2_processing_error": 36,
3369
+ "gl2_remote_ip": 9,
3370
+ "gl2_remote_port": 10,
3371
+ "gl2_source_input": 11,
3372
+ "gl2_source_node": 12,
3373
+ "highlight": 13,
3374
+ "id": 14,
3375
+ "location": 15,
3376
+ "manager_name": 16,
3377
+ "message": 17,
3378
+ "rule_description": 18,
3379
+ "rule_firedtimes": 19,
3380
+ "rule_groups": 20,
3381
+ "rule_id": 21,
3382
+ "rule_level": 22,
3383
+ "rule_mail": 23,
3384
+ "sort": 24,
3385
+ "source": 25,
3386
+ "streams": 26,
3387
+ "syslog_type": 27,
3388
+ "timestamp": 28
3389
+ },
3390
+ "renameByName": {
3391
+ "agent_ip": "SRC IP",
3392
+ "agent_name": "AGENT",
3393
+ "data_base_indicator_access_type": "",
3394
+ "data_base_indicator_id": "OTX IoC ID",
3395
+ "data_base_indicator_indicator": "IoC",
3396
+ "data_base_indicator_indicator_country_code": "",
3397
+ "data_base_indicator_type": "IoC TYPE",
3398
+ "data_bios_sn": "BIOS S/N",
3399
+ "data_processor_cores": "CORES",
3400
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
3401
+ "data_processor_name": "PROCESSOR",
3402
+ "data_processor_status": "STATUS",
3403
+ "data_sections": "OTX SECTIONS",
3404
+ "data_system_bios_item_description": "DESCRIPTION",
3405
+ "data_system_bios_item_manufacturer": "VENDOR",
3406
+ "data_system_bios_item_serial": "S/N",
3407
+ "data_system_bios_item_version": "VERSION",
3408
+ "data_type": "",
3409
+ "data_win_system_message": "MESSAGE",
3410
+ "data_win_system_providerGuid": "",
3411
+ "rule_level": "RULE LEVEL",
3412
+ "timestamp": "DATE/TIME",
3413
+ "windows_event_severity": "EVENT LOG SEVERITY"
3414
+ }
3415
+ }
3416
+ }
3417
+ ],
3418
+ "type": "table"
3419
+ },
3420
+ {
3421
+ "datasource": {
3422
+ "type": "elasticsearch",
3423
+ "uid": "wazuh_datasource_uid"
3424
+ },
3425
+ "fieldConfig": {
3426
+ "defaults": {
3427
+ "color": {
3428
+ "mode": "thresholds"
3429
+ },
3430
+ "custom": {
3431
+ "align": "auto",
3432
+ "cellOptions": {
3433
+ "type": "auto"
3434
+ },
3435
+ "filterable": true,
3436
+ "inspect": false
3437
+ },
3438
+ "mappings": [],
3439
+ "thresholds": {
3440
+ "mode": "absolute",
3441
+ "steps": [
3442
+ {
3443
+ "color": "green"
3444
+ },
3445
+ {
3446
+ "color": "red",
3447
+ "value": 80
3448
+ }
3449
+ ]
3450
+ }
3451
+ },
3452
+ "overrides": [
3453
+ {
3454
+ "matcher": {
3455
+ "id": "byName",
3456
+ "options": "rule_level"
3457
+ },
3458
+ "properties": [
3459
+ {
3460
+ "id": "custom.width",
3461
+ "value": 93
3462
+ }
3463
+ ]
3464
+ },
3465
+ {
3466
+ "matcher": {
3467
+ "id": "byName",
3468
+ "options": "windows_event_id"
3469
+ },
3470
+ "properties": [
3471
+ {
3472
+ "id": "custom.width",
3473
+ "value": 186
3474
+ }
3475
+ ]
3476
+ },
3477
+ {
3478
+ "matcher": {
3479
+ "id": "byName",
3480
+ "options": "DATE/TIME"
3481
+ },
3482
+ "properties": [
3483
+ {
3484
+ "id": "custom.width",
3485
+ "value": 202
3486
+ }
3487
+ ]
3488
+ },
3489
+ {
3490
+ "matcher": {
3491
+ "id": "byName",
3492
+ "options": "AGENT"
3493
+ },
3494
+ "properties": [
3495
+ {
3496
+ "id": "custom.width",
3497
+ "value": 171
3498
+ }
3499
+ ]
3500
+ },
3501
+ {
3502
+ "matcher": {
3503
+ "id": "byName",
3504
+ "options": "SRC IP"
3505
+ },
3506
+ "properties": [
3507
+ {
3508
+ "id": "custom.width",
3509
+ "value": 167
3510
+ }
3511
+ ]
3512
+ },
3513
+ {
3514
+ "matcher": {
3515
+ "id": "byName",
3516
+ "options": "MESSAGE"
3517
+ },
3518
+ "properties": [
3519
+ {
3520
+ "id": "custom.width",
3521
+ "value": 1519
3522
+ }
3523
+ ]
3524
+ },
3525
+ {
3526
+ "matcher": {
3527
+ "id": "byName",
3528
+ "options": "rule_description"
3529
+ },
3530
+ "properties": [
3531
+ {
3532
+ "id": "custom.width",
3533
+ "value": 524
3534
+ }
3535
+ ]
3536
+ },
3537
+ {
3538
+ "matcher": {
3539
+ "id": "byName",
3540
+ "options": "PROCESSOR"
3541
+ },
3542
+ "properties": [
3543
+ {
3544
+ "id": "custom.width",
3545
+ "value": 418
3546
+ }
3547
+ ]
3548
+ },
3549
+ {
3550
+ "matcher": {
3551
+ "id": "byName",
3552
+ "options": "SIZE"
3553
+ },
3554
+ "properties": [
3555
+ {
3556
+ "id": "custom.width",
3557
+ "value": 114
3558
+ }
3559
+ ]
3560
+ },
3561
+ {
3562
+ "matcher": {
3563
+ "id": "byName",
3564
+ "options": "FREE SPACE"
3565
+ },
3566
+ "properties": [
3567
+ {
3568
+ "id": "custom.width",
3569
+ "value": 119
3570
+ }
3571
+ ]
3572
+ },
3573
+ {
3574
+ "matcher": {
3575
+ "id": "byName",
3576
+ "options": "UNIT"
3577
+ },
3578
+ "properties": [
3579
+ {
3580
+ "id": "custom.width",
3581
+ "value": 114
3582
+ }
3583
+ ]
3584
+ }
3585
+ ]
3586
+ },
3587
+ "gridPos": {
3588
+ "h": 9,
3589
+ "w": 24,
3590
+ "x": 0,
3591
+ "y": 42
3592
+ },
3593
+ "id": 144,
3594
+ "options": {
3595
+ "cellHeight": "sm",
3596
+ "footer": {
3597
+ "countRows": false,
3598
+ "enablePagination": true,
3599
+ "fields": "",
3600
+ "reducer": ["sum"],
3601
+ "show": false
3602
+ },
3603
+ "showHeader": true,
3604
+ "sortBy": []
3605
+ },
3606
+ "pluginVersion": "10.0.2",
3607
+ "targets": [
3608
+ {
3609
+ "alias": "",
3610
+ "bucketAggs": [],
3611
+ "datasource": {
3612
+ "type": "elasticsearch",
3613
+ "uid": "wazuh_datasource_uid"
3614
+ },
3615
+ "metrics": [
3616
+ {
3617
+ "id": "1",
3618
+ "settings": {
3619
+ "size": "500"
3620
+ },
3621
+ "type": "raw_data"
3622
+ }
3623
+ ],
3624
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit Disk\"",
3625
+ "queryType": "lucene",
3626
+ "refId": "A",
3627
+ "timeField": "timestamp"
3628
+ }
3629
+ ],
3630
+ "title": "SYSTEM DRIVES",
3631
+ "transformations": [
3632
+ {
3633
+ "id": "organize",
3634
+ "options": {
3635
+ "excludeByName": {
3636
+ "@metadata_beat": true,
3637
+ "@metadata_type": true,
3638
+ "@metadata_version": true,
3639
+ "_id": true,
3640
+ "_index": true,
3641
+ "_type": true,
3642
+ "agent_ephemeral_id": true,
3643
+ "agent_hostname": true,
3644
+ "agent_id": true,
3645
+ "agent_ip": false,
3646
+ "agent_ip_city_name": true,
3647
+ "agent_ip_country_code": true,
3648
+ "agent_ip_geolocation": true,
3649
+ "agent_ip_reserved_ip": true,
3650
+ "agent_labels_customer": true,
3651
+ "agent_name": false,
3652
+ "agent_type": true,
3653
+ "agent_version": true,
3654
+ "beats_type": true,
3655
+ "cluster_name": true,
3656
+ "cluster_node": true,
3657
+ "collector_node_id": true,
3658
+ "data_base_indicator_access_type": true,
3659
+ "data_base_indicator_id": false,
3660
+ "data_base_indicator_indicator_city_name": true,
3661
+ "data_base_indicator_indicator_country_code": true,
3662
+ "data_base_indicator_indicator_geolocation": true,
3663
+ "data_inventory_module": true,
3664
+ "data_system_disk_item_hard_drive_index": true,
3665
+ "data_system_disk_item_serial": true,
3666
+ "data_type": true,
3667
+ "data_win_eventdata_domain": true,
3668
+ "data_win_eventdata_imagePath": true,
3669
+ "data_win_eventdata_sID": true,
3670
+ "data_win_eventdata_serviceName": true,
3671
+ "data_win_eventdata_serviceType": true,
3672
+ "data_win_eventdata_startType": true,
3673
+ "data_win_eventdata_timestamp": true,
3674
+ "data_win_eventdata_user": true,
3675
+ "data_win_system_channel": true,
3676
+ "data_win_system_computer": true,
3677
+ "data_win_system_eventID": true,
3678
+ "data_win_system_eventRecordID": true,
3679
+ "data_win_system_eventSourceName": true,
3680
+ "data_win_system_keywords": true,
3681
+ "data_win_system_level": true,
3682
+ "data_win_system_opcode": true,
3683
+ "data_win_system_processID": true,
3684
+ "data_win_system_providerGuid": true,
3685
+ "data_win_system_providerName": true,
3686
+ "data_win_system_severityValue": true,
3687
+ "data_win_system_systemTime": true,
3688
+ "data_win_system_task": true,
3689
+ "data_win_system_threadID": true,
3690
+ "data_win_system_version": true,
3691
+ "date": true,
3692
+ "decoder_name": true,
3693
+ "ecs_version": true,
3694
+ "gl2_accounted_message_size": true,
3695
+ "gl2_message_id": true,
3696
+ "gl2_processing_error": true,
3697
+ "gl2_remote_ip": true,
3698
+ "gl2_remote_port": true,
3699
+ "gl2_source_collector": true,
3700
+ "gl2_source_input": true,
3701
+ "gl2_source_node": true,
3702
+ "highlight": true,
3703
+ "host_name": true,
3704
+ "id": true,
3705
+ "location": true,
3706
+ "log_file_path": true,
3707
+ "log_offset": true,
3708
+ "manager_name": true,
3709
+ "message": true,
3710
+ "previous_output": true,
3711
+ "rule_description": true,
3712
+ "rule_firedtimes": true,
3713
+ "rule_frequency": true,
3714
+ "rule_gdpr": true,
3715
+ "rule_gpg13": true,
3716
+ "rule_group1": true,
3717
+ "rule_group2": true,
3718
+ "rule_groups": true,
3719
+ "rule_hipaa": true,
3720
+ "rule_id": true,
3721
+ "rule_level": true,
3722
+ "rule_mail": true,
3723
+ "rule_mitre_id": true,
3724
+ "rule_mitre_tactic": true,
3725
+ "rule_mitre_technique": true,
3726
+ "rule_nist_800_53": true,
3727
+ "rule_pci_dss": true,
3728
+ "rule_tsc": true,
3729
+ "sort": true,
3730
+ "source": true,
3731
+ "source_reserved_ip": true,
3732
+ "src_ip": true,
3733
+ "src_ip_city_name": true,
3734
+ "src_ip_country_code": true,
3735
+ "src_ip_geolocation": true,
3736
+ "streams": true,
3737
+ "syslog_level": true,
3738
+ "syslog_tag": true,
3739
+ "syslog_type": true,
3740
+ "timestamp": false,
3741
+ "timestamp_utc": true,
3742
+ "true": true,
3743
+ "user_name": true,
3744
+ "win_system_eventID": true,
3745
+ "windows_event_id": true,
3746
+ "windows_event_severity": false
3747
+ },
3748
+ "indexByName": {
3749
+ "_id": 2,
3750
+ "_index": 3,
3751
+ "_type": 4,
3752
+ "agent_id": 5,
3753
+ "agent_ip": 6,
3754
+ "agent_labels_customer": 29,
3755
+ "agent_name": 1,
3756
+ "data_drive_caption": 33,
3757
+ "data_drive_description": 34,
3758
+ "data_drive_filesystem": 37,
3759
+ "data_drive_free_space": 38,
3760
+ "data_drive_size": 36,
3761
+ "data_drive_type": 35,
3762
+ "data_drive_volume_name": 39,
3763
+ "data_inventory_module": 30,
3764
+ "date": 31,
3765
+ "decoder_name": 7,
3766
+ "gl2_accounted_message_size": 8,
3767
+ "gl2_message_id": 9,
3768
+ "gl2_processing_error": 32,
3769
+ "gl2_remote_ip": 10,
3770
+ "gl2_remote_port": 11,
3771
+ "gl2_source_input": 12,
3772
+ "gl2_source_node": 13,
3773
+ "highlight": 14,
3774
+ "id": 15,
3775
+ "location": 16,
3776
+ "manager_name": 17,
3777
+ "message": 18,
3778
+ "rule_description": 19,
3779
+ "rule_firedtimes": 20,
3780
+ "rule_groups": 21,
3781
+ "rule_id": 22,
3782
+ "rule_level": 23,
3783
+ "rule_mail": 24,
3784
+ "sort": 25,
3785
+ "source": 26,
3786
+ "streams": 27,
3787
+ "syslog_type": 28,
3788
+ "timestamp": 0
3789
+ },
3790
+ "renameByName": {
3791
+ "agent_ip": "SRC IP",
3792
+ "agent_name": "AGENT",
3793
+ "data_base_indicator_access_type": "",
3794
+ "data_base_indicator_id": "OTX IoC ID",
3795
+ "data_base_indicator_indicator": "IoC",
3796
+ "data_base_indicator_indicator_country_code": "",
3797
+ "data_base_indicator_type": "IoC TYPE",
3798
+ "data_drive_caption": "UNIT",
3799
+ "data_drive_description": "DESCRIPTION",
3800
+ "data_drive_filesystem": "FILESYSTEM",
3801
+ "data_drive_free_space": "FREE SPACE",
3802
+ "data_drive_size": "SIZE",
3803
+ "data_drive_type": "TYPE",
3804
+ "data_drive_volume_name": "VOLUME NAME",
3805
+ "data_processor_cores": "CORES",
3806
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
3807
+ "data_processor_name": "PROCESSOR",
3808
+ "data_processor_status": "STATUS",
3809
+ "data_sections": "OTX SECTIONS",
3810
+ "data_system_disk_item_caption": "CAPTION",
3811
+ "data_system_disk_item_device": "DEVICE",
3812
+ "data_system_disk_item_firmware": "FIRMWARE",
3813
+ "data_system_disk_item_hard_drive_index": "",
3814
+ "data_system_disk_item_interface_type": "TYPE",
3815
+ "data_system_disk_item_manufacturer": "VENDOR",
3816
+ "data_system_disk_item_model": "MODEL",
3817
+ "data_system_disk_item_partition_count": "PARTITIONS",
3818
+ "data_system_disk_item_scsi_logical_unit": "UNIT",
3819
+ "data_system_disk_item_size": "SIZE",
3820
+ "data_system_disk_item_status": "STATUS",
3821
+ "data_type": "",
3822
+ "data_win_system_message": "MESSAGE",
3823
+ "data_win_system_providerGuid": "",
3824
+ "rule_level": "RULE LEVEL",
3825
+ "timestamp": "DATE/TIME",
3826
+ "windows_event_severity": "EVENT LOG SEVERITY"
3827
+ }
3828
+ }
3829
+ }
3830
+ ],
3831
+ "type": "table"
3832
+ },
3833
+ {
3834
+ "datasource": {
3835
+ "type": "elasticsearch",
3836
+ "uid": "wazuh_datasource_uid"
3837
+ },
3838
+ "fieldConfig": {
3839
+ "defaults": {
3840
+ "color": {
3841
+ "mode": "thresholds"
3842
+ },
3843
+ "custom": {
3844
+ "align": "auto",
3845
+ "cellOptions": {
3846
+ "type": "auto"
3847
+ },
3848
+ "inspect": false
3849
+ },
3850
+ "mappings": [],
3851
+ "thresholds": {
3852
+ "mode": "absolute",
3853
+ "steps": [
3854
+ {
3855
+ "color": "green"
3856
+ },
3857
+ {
3858
+ "color": "red",
3859
+ "value": 80
3860
+ }
3861
+ ]
3862
+ }
3863
+ },
3864
+ "overrides": [
3865
+ {
3866
+ "matcher": {
3867
+ "id": "byName",
3868
+ "options": "rule_level"
3869
+ },
3870
+ "properties": [
3871
+ {
3872
+ "id": "custom.width",
3873
+ "value": 93
3874
+ }
3875
+ ]
3876
+ },
3877
+ {
3878
+ "matcher": {
3879
+ "id": "byName",
3880
+ "options": "windows_event_id"
3881
+ },
3882
+ "properties": [
3883
+ {
3884
+ "id": "custom.width",
3885
+ "value": 186
3886
+ }
3887
+ ]
3888
+ },
3889
+ {
3890
+ "matcher": {
3891
+ "id": "byName",
3892
+ "options": "DATE/TIME"
3893
+ },
3894
+ "properties": [
3895
+ {
3896
+ "id": "custom.width",
3897
+ "value": 202
3898
+ }
3899
+ ]
3900
+ },
3901
+ {
3902
+ "matcher": {
3903
+ "id": "byName",
3904
+ "options": "AGENT"
3905
+ },
3906
+ "properties": [
3907
+ {
3908
+ "id": "custom.width",
3909
+ "value": 171
3910
+ }
3911
+ ]
3912
+ },
3913
+ {
3914
+ "matcher": {
3915
+ "id": "byName",
3916
+ "options": "SRC IP"
3917
+ },
3918
+ "properties": [
3919
+ {
3920
+ "id": "custom.width",
3921
+ "value": 167
3922
+ }
3923
+ ]
3924
+ },
3925
+ {
3926
+ "matcher": {
3927
+ "id": "byName",
3928
+ "options": "MESSAGE"
3929
+ },
3930
+ "properties": [
3931
+ {
3932
+ "id": "custom.width",
3933
+ "value": 1519
3934
+ }
3935
+ ]
3936
+ },
3937
+ {
3938
+ "matcher": {
3939
+ "id": "byName",
3940
+ "options": "rule_description"
3941
+ },
3942
+ "properties": [
3943
+ {
3944
+ "id": "custom.width",
3945
+ "value": 524
3946
+ }
3947
+ ]
3948
+ },
3949
+ {
3950
+ "matcher": {
3951
+ "id": "byName",
3952
+ "options": "PROCESSOR"
3953
+ },
3954
+ "properties": [
3955
+ {
3956
+ "id": "custom.width",
3957
+ "value": 418
3958
+ }
3959
+ ]
3960
+ },
3961
+ {
3962
+ "matcher": {
3963
+ "id": "byName",
3964
+ "options": "SIZE"
3965
+ },
3966
+ "properties": [
3967
+ {
3968
+ "id": "custom.width",
3969
+ "value": 114
3970
+ }
3971
+ ]
3972
+ },
3973
+ {
3974
+ "matcher": {
3975
+ "id": "byName",
3976
+ "options": "FREE SPACE"
3977
+ },
3978
+ "properties": [
3979
+ {
3980
+ "id": "custom.width",
3981
+ "value": 119
3982
+ }
3983
+ ]
3984
+ },
3985
+ {
3986
+ "matcher": {
3987
+ "id": "byName",
3988
+ "options": "UNIT"
3989
+ },
3990
+ "properties": [
3991
+ {
3992
+ "id": "custom.width",
3993
+ "value": 114
3994
+ }
3995
+ ]
3996
+ }
3997
+ ]
3998
+ },
3999
+ "gridPos": {
4000
+ "h": 9,
4001
+ "w": 24,
4002
+ "x": 0,
4003
+ "y": 51
4004
+ },
4005
+ "id": 149,
4006
+ "options": {
4007
+ "cellHeight": "sm",
4008
+ "footer": {
4009
+ "countRows": false,
4010
+ "fields": "",
4011
+ "reducer": ["sum"],
4012
+ "show": false
4013
+ },
4014
+ "showHeader": true,
4015
+ "sortBy": []
4016
+ },
4017
+ "pluginVersion": "10.0.2",
4018
+ "targets": [
4019
+ {
4020
+ "alias": "",
4021
+ "bucketAggs": [],
4022
+ "datasource": {
4023
+ "type": "elasticsearch",
4024
+ "uid": "wazuh_datasource_uid"
4025
+ },
4026
+ "metrics": [
4027
+ {
4028
+ "id": "1",
4029
+ "settings": {
4030
+ "size": "500"
4031
+ },
4032
+ "type": "raw_data"
4033
+ }
4034
+ ],
4035
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit Partition\"",
4036
+ "queryType": "lucene",
4037
+ "refId": "A",
4038
+ "timeField": "timestamp"
4039
+ }
4040
+ ],
4041
+ "title": "DISKS PARTITIONS",
4042
+ "transformations": [
4043
+ {
4044
+ "id": "organize",
4045
+ "options": {
4046
+ "excludeByName": {
4047
+ "@metadata_beat": true,
4048
+ "@metadata_type": true,
4049
+ "@metadata_version": true,
4050
+ "_id": true,
4051
+ "_index": true,
4052
+ "_type": true,
4053
+ "agent_ephemeral_id": true,
4054
+ "agent_hostname": true,
4055
+ "agent_id": true,
4056
+ "agent_ip": false,
4057
+ "agent_ip_city_name": true,
4058
+ "agent_ip_country_code": true,
4059
+ "agent_ip_geolocation": true,
4060
+ "agent_ip_reserved_ip": true,
4061
+ "agent_labels_customer": true,
4062
+ "agent_name": false,
4063
+ "agent_type": true,
4064
+ "agent_version": true,
4065
+ "beats_type": true,
4066
+ "cluster_name": true,
4067
+ "cluster_node": true,
4068
+ "collector_node_id": true,
4069
+ "data_base_indicator_access_type": true,
4070
+ "data_base_indicator_id": false,
4071
+ "data_base_indicator_indicator_city_name": true,
4072
+ "data_base_indicator_indicator_country_code": true,
4073
+ "data_base_indicator_indicator_geolocation": true,
4074
+ "data_inventory_module": true,
4075
+ "data_system_disk_item_hard_drive_index": true,
4076
+ "data_system_partition_item_device": false,
4077
+ "data_system_partition_item_hard_drive_index": true,
4078
+ "data_system_partition_item_partition_disk_index": true,
4079
+ "data_type": true,
4080
+ "data_win_eventdata_domain": true,
4081
+ "data_win_eventdata_imagePath": true,
4082
+ "data_win_eventdata_sID": true,
4083
+ "data_win_eventdata_serviceName": true,
4084
+ "data_win_eventdata_serviceType": true,
4085
+ "data_win_eventdata_startType": true,
4086
+ "data_win_eventdata_timestamp": true,
4087
+ "data_win_eventdata_user": true,
4088
+ "data_win_system_channel": true,
4089
+ "data_win_system_computer": true,
4090
+ "data_win_system_eventID": true,
4091
+ "data_win_system_eventRecordID": true,
4092
+ "data_win_system_eventSourceName": true,
4093
+ "data_win_system_keywords": true,
4094
+ "data_win_system_level": true,
4095
+ "data_win_system_opcode": true,
4096
+ "data_win_system_processID": true,
4097
+ "data_win_system_providerGuid": true,
4098
+ "data_win_system_providerName": true,
4099
+ "data_win_system_severityValue": true,
4100
+ "data_win_system_systemTime": true,
4101
+ "data_win_system_task": true,
4102
+ "data_win_system_threadID": true,
4103
+ "data_win_system_version": true,
4104
+ "date": true,
4105
+ "decoder_name": true,
4106
+ "ecs_version": true,
4107
+ "gl2_accounted_message_size": true,
4108
+ "gl2_message_id": true,
4109
+ "gl2_processing_error": true,
4110
+ "gl2_remote_ip": true,
4111
+ "gl2_remote_port": true,
4112
+ "gl2_source_collector": true,
4113
+ "gl2_source_input": true,
4114
+ "gl2_source_node": true,
4115
+ "highlight": true,
4116
+ "host_name": true,
4117
+ "id": true,
4118
+ "location": true,
4119
+ "log_file_path": true,
4120
+ "log_offset": true,
4121
+ "manager_name": true,
4122
+ "message": true,
4123
+ "previous_output": true,
4124
+ "rule_description": true,
4125
+ "rule_firedtimes": true,
4126
+ "rule_frequency": true,
4127
+ "rule_gdpr": true,
4128
+ "rule_gpg13": true,
4129
+ "rule_group1": true,
4130
+ "rule_group2": true,
4131
+ "rule_groups": true,
4132
+ "rule_hipaa": true,
4133
+ "rule_id": true,
4134
+ "rule_level": true,
4135
+ "rule_mail": true,
4136
+ "rule_mitre_id": true,
4137
+ "rule_mitre_tactic": true,
4138
+ "rule_mitre_technique": true,
4139
+ "rule_nist_800_53": true,
4140
+ "rule_pci_dss": true,
4141
+ "rule_tsc": true,
4142
+ "sort": true,
4143
+ "source": true,
4144
+ "source_reserved_ip": true,
4145
+ "src_ip": true,
4146
+ "src_ip_city_name": true,
4147
+ "src_ip_country_code": true,
4148
+ "src_ip_geolocation": true,
4149
+ "streams": true,
4150
+ "syslog_level": true,
4151
+ "syslog_tag": true,
4152
+ "syslog_type": true,
4153
+ "timestamp": false,
4154
+ "timestamp_utc": true,
4155
+ "true": true,
4156
+ "user_name": true,
4157
+ "win_system_eventID": true,
4158
+ "windows_event_id": true,
4159
+ "windows_event_severity": false
4160
+ },
4161
+ "indexByName": {
4162
+ "_id": 2,
4163
+ "_index": 3,
4164
+ "_type": 4,
4165
+ "agent_id": 5,
4166
+ "agent_ip": 6,
4167
+ "agent_labels_customer": 29,
4168
+ "agent_name": 1,
4169
+ "data_drive_caption": 33,
4170
+ "data_drive_description": 34,
4171
+ "data_drive_filesystem": 37,
4172
+ "data_drive_free_space": 38,
4173
+ "data_drive_size": 36,
4174
+ "data_drive_type": 35,
4175
+ "data_drive_volume_name": 39,
4176
+ "data_inventory_module": 30,
4177
+ "date": 31,
4178
+ "decoder_name": 7,
4179
+ "gl2_accounted_message_size": 8,
4180
+ "gl2_message_id": 9,
4181
+ "gl2_processing_error": 32,
4182
+ "gl2_remote_ip": 10,
4183
+ "gl2_remote_port": 11,
4184
+ "gl2_source_input": 12,
4185
+ "gl2_source_node": 13,
4186
+ "highlight": 14,
4187
+ "id": 15,
4188
+ "location": 16,
4189
+ "manager_name": 17,
4190
+ "message": 18,
4191
+ "rule_description": 19,
4192
+ "rule_firedtimes": 20,
4193
+ "rule_groups": 21,
4194
+ "rule_id": 22,
4195
+ "rule_level": 23,
4196
+ "rule_mail": 24,
4197
+ "sort": 25,
4198
+ "source": 26,
4199
+ "streams": 27,
4200
+ "syslog_type": 28,
4201
+ "timestamp": 0
4202
+ },
4203
+ "renameByName": {
4204
+ "agent_ip": "SRC IP",
4205
+ "agent_name": "AGENT",
4206
+ "data_base_indicator_access_type": "",
4207
+ "data_base_indicator_id": "OTX IoC ID",
4208
+ "data_base_indicator_indicator": "IoC",
4209
+ "data_base_indicator_indicator_country_code": "",
4210
+ "data_base_indicator_type": "IoC TYPE",
4211
+ "data_drive_caption": "UNIT",
4212
+ "data_drive_description": "DESCRIPTION",
4213
+ "data_drive_filesystem": "FILESYSTEM",
4214
+ "data_drive_free_space": "FREE SPACE",
4215
+ "data_drive_size": "SIZE",
4216
+ "data_drive_type": "TYPE",
4217
+ "data_drive_volume_name": "VOLUME NAME",
4218
+ "data_processor_cores": "CORES",
4219
+ "data_processor_logical_nbr": "CORES (LOGICAL)",
4220
+ "data_processor_name": "PROCESSOR",
4221
+ "data_processor_status": "STATUS",
4222
+ "data_sections": "OTX SECTIONS",
4223
+ "data_system_disk_item_caption": "CAPTION",
4224
+ "data_system_disk_item_device": "DEVICE",
4225
+ "data_system_disk_item_firmware": "FIRMWARE",
4226
+ "data_system_disk_item_hard_drive_index": "",
4227
+ "data_system_disk_item_interface_type": "TYPE",
4228
+ "data_system_disk_item_manufacturer": "VENDOR",
4229
+ "data_system_disk_item_model": "MODEL",
4230
+ "data_system_disk_item_partition_count": "PARTITIONS",
4231
+ "data_system_disk_item_scsi_logical_unit": "UNIT",
4232
+ "data_system_disk_item_size": "SIZE",
4233
+ "data_system_disk_item_status": "STATUS",
4234
+ "data_system_partition_item_description": "DESCRIPTION",
4235
+ "data_system_partition_item_device": "DEVICE",
4236
+ "data_system_partition_item_format": "FORMAT",
4237
+ "data_system_partition_item_free": "FREE SPACE",
4238
+ "data_system_partition_item_hard_drive_index": "",
4239
+ "data_system_partition_item_mount_point": "MOUNT POINT",
4240
+ "data_system_partition_item_mount_type": "TYPE",
4241
+ "data_system_partition_item_serial": "S/N",
4242
+ "data_system_partition_item_size": "SIZE",
4243
+ "data_system_partition_item_type": "TYPE",
4244
+ "data_system_partition_item_used": "USED",
4245
+ "data_type": "",
4246
+ "data_win_system_message": "MESSAGE",
4247
+ "data_win_system_providerGuid": "",
4248
+ "rule_level": "RULE LEVEL",
4249
+ "timestamp": "DATE/TIME",
4250
+ "windows_event_severity": "EVENT LOG SEVERITY"
4251
+ }
4252
+ }
4253
+ }
4254
+ ],
4255
+ "type": "table"
4256
+ }
4257
+ ],
4258
+ "title": "AGENTS INVENTORY - SYSTEM INFO",
4259
+ "type": "row"
4260
+ },
4261
+ {
4262
+ "collapsed": true,
4263
+ "datasource": {
4264
+ "type": "elasticsearch",
4265
+ "uid": "wazuh_datasource_uid"
4266
+ },
4267
+ "gridPos": {
4268
+ "h": 1,
4269
+ "w": 24,
4270
+ "x": 0,
4271
+ "y": 10
4272
+ },
4273
+ "id": 128,
4274
+ "panels": [
4275
+ {
4276
+ "datasource": {
4277
+ "type": "elasticsearch",
4278
+ "uid": "wazuh_datasource_uid"
4279
+ },
4280
+ "fieldConfig": {
4281
+ "defaults": {
4282
+ "color": {
4283
+ "mode": "palette-classic"
4284
+ },
4285
+ "custom": {
4286
+ "hideFrom": {
4287
+ "legend": false,
4288
+ "tooltip": false,
4289
+ "viz": false
4290
+ }
4291
+ },
4292
+ "decimals": 0,
4293
+ "mappings": [],
4294
+ "unit": "short"
4295
+ },
4296
+ "overrides": [
4297
+ {
4298
+ "matcher": {
4299
+ "id": "byName",
4300
+ "options": "1"
4301
+ },
4302
+ "properties": [
4303
+ {
4304
+ "id": "color",
4305
+ "value": {
4306
+ "fixedColor": "#FF9830",
4307
+ "mode": "fixed"
4308
+ }
4309
+ }
4310
+ ]
4311
+ },
4312
+ {
4313
+ "matcher": {
4314
+ "id": "byName",
4315
+ "options": "Alert"
4316
+ },
4317
+ "properties": [
4318
+ {
4319
+ "id": "color",
4320
+ "value": {
4321
+ "fixedColor": "#F2495C",
4322
+ "mode": "fixed"
4323
+ }
4324
+ }
4325
+ ]
4326
+ },
4327
+ {
4328
+ "matcher": {
4329
+ "id": "byName",
4330
+ "options": "Error"
4331
+ },
4332
+ "properties": [
4333
+ {
4334
+ "id": "color",
4335
+ "value": {
4336
+ "fixedColor": "#F2495C",
4337
+ "mode": "fixed"
4338
+ }
4339
+ }
4340
+ ]
4341
+ },
4342
+ {
4343
+ "matcher": {
4344
+ "id": "byName",
4345
+ "options": "Info"
4346
+ },
4347
+ "properties": [
4348
+ {
4349
+ "id": "color",
4350
+ "value": {
4351
+ "fixedColor": "#73BF69",
4352
+ "mode": "fixed"
4353
+ }
4354
+ }
4355
+ ]
4356
+ },
4357
+ {
4358
+ "matcher": {
4359
+ "id": "byName",
4360
+ "options": "NOTICE"
4361
+ },
4362
+ "properties": [
4363
+ {
4364
+ "id": "color",
4365
+ "value": {
4366
+ "fixedColor": "#5794F2",
4367
+ "mode": "fixed"
4368
+ }
4369
+ }
4370
+ ]
4371
+ },
4372
+ {
4373
+ "matcher": {
4374
+ "id": "byName",
4375
+ "options": "Notice"
4376
+ },
4377
+ "properties": [
4378
+ {
4379
+ "id": "color",
4380
+ "value": {
4381
+ "fixedColor": "#5794F2",
4382
+ "mode": "fixed"
4383
+ }
4384
+ }
4385
+ ]
4386
+ },
4387
+ {
4388
+ "matcher": {
4389
+ "id": "byName",
4390
+ "options": "Result"
4391
+ },
4392
+ "properties": [
4393
+ {
4394
+ "id": "color",
4395
+ "value": {
4396
+ "fixedColor": "#B877D9",
4397
+ "mode": "fixed"
4398
+ }
4399
+ }
4400
+ ]
4401
+ },
4402
+ {
4403
+ "matcher": {
4404
+ "id": "byName",
4405
+ "options": "Warning"
4406
+ },
4407
+ "properties": [
4408
+ {
4409
+ "id": "color",
4410
+ "value": {
4411
+ "fixedColor": "#FF9830",
4412
+ "mode": "fixed"
4413
+ }
4414
+ }
4415
+ ]
4416
+ },
4417
+ {
4418
+ "matcher": {
4419
+ "id": "byName",
4420
+ "options": "INFORMATION"
4421
+ },
4422
+ "properties": [
4423
+ {
4424
+ "id": "color",
4425
+ "value": {
4426
+ "fixedColor": "green",
4427
+ "mode": "fixed"
4428
+ }
4429
+ }
4430
+ ]
4431
+ },
4432
+ {
4433
+ "matcher": {
4434
+ "id": "byName",
4435
+ "options": "WARNING"
4436
+ },
4437
+ "properties": [
4438
+ {
4439
+ "id": "color",
4440
+ "value": {
4441
+ "fixedColor": "orange",
4442
+ "mode": "fixed"
4443
+ }
4444
+ }
4445
+ ]
4446
+ },
4447
+ {
4448
+ "matcher": {
4449
+ "id": "byName",
4450
+ "options": "ERROR"
4451
+ },
4452
+ "properties": [
4453
+ {
4454
+ "id": "color",
4455
+ "value": {
4456
+ "fixedColor": "red",
4457
+ "mode": "fixed"
4458
+ }
4459
+ }
4460
+ ]
4461
+ }
4462
+ ]
4463
+ },
4464
+ "gridPos": {
4465
+ "h": 8,
4466
+ "w": 5,
4467
+ "x": 0,
4468
+ "y": 11
4469
+ },
4470
+ "id": 130,
4471
+ "links": [],
4472
+ "maxDataPoints": 3,
4473
+ "options": {
4474
+ "displayLabels": [],
4475
+ "legend": {
4476
+ "calcs": [],
4477
+ "displayMode": "list",
4478
+ "placement": "bottom",
4479
+ "showLegend": false,
4480
+ "values": ["value"]
4481
+ },
4482
+ "pieType": "donut",
4483
+ "reduceOptions": {
4484
+ "calcs": ["sum"],
4485
+ "fields": "",
4486
+ "values": false
4487
+ },
4488
+ "text": {},
4489
+ "tooltip": {
4490
+ "mode": "single",
4491
+ "sort": "none"
4492
+ }
4493
+ },
4494
+ "targets": [
4495
+ {
4496
+ "bucketAggs": [
4497
+ {
4498
+ "$$hashKey": "object:73",
4499
+ "fake": true,
4500
+ "field": "data_system_sys_os_group",
4501
+ "id": "3",
4502
+ "settings": {
4503
+ "min_doc_count": 1,
4504
+ "order": "desc",
4505
+ "orderBy": "_count",
4506
+ "size": "0"
4507
+ },
4508
+ "type": "terms"
4509
+ },
4510
+ {
4511
+ "$$hashKey": "object:74",
4512
+ "field": "timestamp",
4513
+ "id": "2",
4514
+ "settings": {
4515
+ "interval": "auto",
4516
+ "min_doc_count": 0,
4517
+ "trimEdges": 0
4518
+ },
4519
+ "type": "date_histogram"
4520
+ }
4521
+ ],
4522
+ "datasource": {
4523
+ "type": "elasticsearch",
4524
+ "uid": "wazuh_datasource_uid"
4525
+ },
4526
+ "metrics": [
4527
+ {
4528
+ "$$hashKey": "object:71",
4529
+ "field": "select field",
4530
+ "id": "1",
4531
+ "type": "count"
4532
+ }
4533
+ ],
4534
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
4535
+ "refId": "A",
4536
+ "timeField": "timestamp"
4537
+ }
4538
+ ],
4539
+ "title": "AGENTS BY OS FAMILY",
4540
+ "type": "piechart"
4541
+ },
4542
+ {
4543
+ "datasource": {
4544
+ "type": "elasticsearch",
4545
+ "uid": "wazuh_datasource_uid"
4546
+ },
4547
+ "fieldConfig": {
4548
+ "defaults": {
4549
+ "custom": {
4550
+ "align": "auto",
4551
+ "cellOptions": {
4552
+ "type": "auto"
4553
+ },
4554
+ "filterable": false,
4555
+ "inspect": false
4556
+ },
4557
+ "mappings": [],
4558
+ "thresholds": {
4559
+ "mode": "absolute",
4560
+ "steps": [
4561
+ {
4562
+ "color": "green"
4563
+ },
4564
+ {
4565
+ "color": "red",
4566
+ "value": 80
4567
+ }
4568
+ ]
4569
+ }
4570
+ },
4571
+ "overrides": [
4572
+ {
4573
+ "matcher": {
4574
+ "id": "byName",
4575
+ "options": "agent_name"
4576
+ },
4577
+ "properties": [
4578
+ {
4579
+ "id": "custom.width",
4580
+ "value": 348
4581
+ }
4582
+ ]
4583
+ },
4584
+ {
4585
+ "matcher": {
4586
+ "id": "byName",
4587
+ "options": "data_os_type"
4588
+ },
4589
+ "properties": [
4590
+ {
4591
+ "id": "custom.width",
4592
+ "value": 504
4593
+ }
4594
+ ]
4595
+ }
4596
+ ]
4597
+ },
4598
+ "gridPos": {
4599
+ "h": 8,
4600
+ "w": 10,
4601
+ "x": 5,
4602
+ "y": 11
4603
+ },
4604
+ "id": 114,
4605
+ "links": [],
4606
+ "maxDataPoints": 3,
4607
+ "options": {
4608
+ "cellHeight": "sm",
4609
+ "footer": {
4610
+ "countRows": false,
4611
+ "fields": "",
4612
+ "reducer": ["sum"],
4613
+ "show": false
4614
+ },
4615
+ "showHeader": true,
4616
+ "sortBy": []
4617
+ },
4618
+ "pluginVersion": "10.0.2",
4619
+ "targets": [
4620
+ {
4621
+ "bucketAggs": [
4622
+ {
4623
+ "$$hashKey": "object:73",
4624
+ "fake": true,
4625
+ "field": "data_system_sys_os_group",
4626
+ "id": "3",
4627
+ "settings": {
4628
+ "min_doc_count": 1,
4629
+ "order": "desc",
4630
+ "orderBy": "_count",
4631
+ "size": "0"
4632
+ },
4633
+ "type": "terms"
4634
+ }
4635
+ ],
4636
+ "datasource": {
4637
+ "type": "elasticsearch",
4638
+ "uid": "wazuh_datasource_uid"
4639
+ },
4640
+ "metrics": [
4641
+ {
4642
+ "$$hashKey": "object:71",
4643
+ "field": "select field",
4644
+ "id": "1",
4645
+ "type": "count"
4646
+ }
4647
+ ],
4648
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
4649
+ "refId": "A",
4650
+ "timeField": "timestamp"
4651
+ }
4652
+ ],
4653
+ "title": "AGENTS BY OS FAMILY",
4654
+ "transformations": [
4655
+ {
4656
+ "id": "organize",
4657
+ "options": {
4658
+ "excludeByName": {},
4659
+ "indexByName": {},
4660
+ "renameByName": {
4661
+ "data_system_sys_os_group": "OS GROUP"
4662
+ }
4663
+ }
4664
+ }
4665
+ ],
4666
+ "type": "table"
4667
+ },
4668
+ {
4669
+ "datasource": {
4670
+ "type": "elasticsearch",
4671
+ "uid": "wazuh_datasource_uid"
4672
+ },
4673
+ "fieldConfig": {
4674
+ "defaults": {
4675
+ "custom": {
4676
+ "align": "auto",
4677
+ "cellOptions": {
4678
+ "type": "auto"
4679
+ },
4680
+ "filterable": false,
4681
+ "inspect": false
4682
+ },
4683
+ "mappings": [],
4684
+ "thresholds": {
4685
+ "mode": "absolute",
4686
+ "steps": [
4687
+ {
4688
+ "color": "green"
4689
+ },
4690
+ {
4691
+ "color": "red",
4692
+ "value": 80
4693
+ }
4694
+ ]
4695
+ }
4696
+ },
4697
+ "overrides": [
4698
+ {
4699
+ "matcher": {
4700
+ "id": "byName",
4701
+ "options": "agent_name"
4702
+ },
4703
+ "properties": [
4704
+ {
4705
+ "id": "custom.width",
4706
+ "value": 348
4707
+ }
4708
+ ]
4709
+ },
4710
+ {
4711
+ "matcher": {
4712
+ "id": "byName",
4713
+ "options": "data_os_type"
4714
+ },
4715
+ "properties": [
4716
+ {
4717
+ "id": "custom.width",
4718
+ "value": 504
4719
+ }
4720
+ ]
4721
+ }
4722
+ ]
4723
+ },
4724
+ "gridPos": {
4725
+ "h": 8,
4726
+ "w": 9,
4727
+ "x": 15,
4728
+ "y": 11
4729
+ },
4730
+ "id": 141,
4731
+ "links": [],
4732
+ "maxDataPoints": 3,
4733
+ "options": {
4734
+ "cellHeight": "sm",
4735
+ "footer": {
4736
+ "countRows": false,
4737
+ "fields": "",
4738
+ "reducer": ["sum"],
4739
+ "show": false
4740
+ },
4741
+ "showHeader": true,
4742
+ "sortBy": []
4743
+ },
4744
+ "pluginVersion": "10.0.2",
4745
+ "targets": [
4746
+ {
4747
+ "bucketAggs": [
4748
+ {
4749
+ "$$hashKey": "object:73",
4750
+ "fake": true,
4751
+ "field": "agent_name",
4752
+ "id": "3",
4753
+ "settings": {
4754
+ "min_doc_count": 1,
4755
+ "order": "desc",
4756
+ "orderBy": "_count",
4757
+ "size": "0"
4758
+ },
4759
+ "type": "terms"
4760
+ },
4761
+ {
4762
+ "field": "data_os_boot_time",
4763
+ "id": "4",
4764
+ "settings": {
4765
+ "min_doc_count": "1",
4766
+ "order": "desc",
4767
+ "orderBy": "_term",
4768
+ "size": "10"
4769
+ },
4770
+ "type": "terms"
4771
+ }
4772
+ ],
4773
+ "datasource": {
4774
+ "type": "elasticsearch",
4775
+ "uid": "wazuh_datasource_uid"
4776
+ },
4777
+ "metrics": [
4778
+ {
4779
+ "$$hashKey": "object:71",
4780
+ "field": "select field",
4781
+ "id": "1",
4782
+ "type": "count"
4783
+ }
4784
+ ],
4785
+ "query": "agent_name:$agent_name AND rule_groups:*inventory",
4786
+ "refId": "A",
4787
+ "timeField": "timestamp"
4788
+ }
4789
+ ],
4790
+ "title": "BOOT TIME",
4791
+ "type": "table"
4792
+ },
4793
+ {
4794
+ "datasource": {
4795
+ "type": "elasticsearch",
4796
+ "uid": "wazuh_datasource_uid"
4797
+ },
4798
+ "fieldConfig": {
4799
+ "defaults": {
4800
+ "color": {
4801
+ "mode": "thresholds"
4802
+ },
4803
+ "custom": {
4804
+ "align": "auto",
4805
+ "cellOptions": {
4806
+ "type": "auto"
4807
+ },
4808
+ "inspect": false
4809
+ },
4810
+ "mappings": [],
4811
+ "thresholds": {
4812
+ "mode": "absolute",
4813
+ "steps": [
4814
+ {
4815
+ "color": "green"
4816
+ },
4817
+ {
4818
+ "color": "red",
4819
+ "value": 80
4820
+ }
4821
+ ]
4822
+ }
4823
+ },
4824
+ "overrides": [
4825
+ {
4826
+ "matcher": {
4827
+ "id": "byName",
4828
+ "options": "AGENT"
4829
+ },
4830
+ "properties": [
4831
+ {
4832
+ "id": "custom.width",
4833
+ "value": 171
4834
+ }
4835
+ ]
4836
+ },
4837
+ {
4838
+ "matcher": {
4839
+ "id": "byName",
4840
+ "options": "SRC IP"
4841
+ },
4842
+ "properties": [
4843
+ {
4844
+ "id": "custom.width",
4845
+ "value": 167
4846
+ }
4847
+ ]
4848
+ },
4849
+ {
4850
+ "matcher": {
4851
+ "id": "byName",
4852
+ "options": "MESSAGE"
4853
+ },
4854
+ "properties": [
4855
+ {
4856
+ "id": "custom.width",
4857
+ "value": 1519
4858
+ }
4859
+ ]
4860
+ },
4861
+ {
4862
+ "matcher": {
4863
+ "id": "byName",
4864
+ "options": "rule_description"
4865
+ },
4866
+ "properties": [
4867
+ {
4868
+ "id": "custom.width",
4869
+ "value": 524
4870
+ }
4871
+ ]
4872
+ },
4873
+ {
4874
+ "matcher": {
4875
+ "id": "byName",
4876
+ "options": "OS TYPE"
4877
+ },
4878
+ "properties": [
4879
+ {
4880
+ "id": "custom.width",
4881
+ "value": 431
4882
+ }
4883
+ ]
4884
+ }
4885
+ ]
4886
+ },
4887
+ "gridPos": {
4888
+ "h": 10,
4889
+ "w": 24,
4890
+ "x": 0,
4891
+ "y": 19
4892
+ },
4893
+ "id": 142,
4894
+ "options": {
4895
+ "cellHeight": "sm",
4896
+ "footer": {
4897
+ "countRows": false,
4898
+ "fields": "",
4899
+ "reducer": ["sum"],
4900
+ "show": false
4901
+ },
4902
+ "showHeader": true,
4903
+ "sortBy": []
4904
+ },
4905
+ "pluginVersion": "10.0.2",
4906
+ "targets": [
4907
+ {
4908
+ "alias": "",
4909
+ "bucketAggs": [],
4910
+ "datasource": {
4911
+ "type": "elasticsearch",
4912
+ "uid": "wazuh_datasource_uid"
4913
+ },
4914
+ "metrics": [
4915
+ {
4916
+ "id": "1",
4917
+ "settings": {
4918
+ "size": "500"
4919
+ },
4920
+ "type": "raw_data"
4921
+ }
4922
+ ],
4923
+ "query": "agent_name:$agent_name AND rule_description:\"Open-Audit System\"",
4924
+ "queryType": "lucene",
4925
+ "refId": "A",
4926
+ "timeField": "timestamp"
4927
+ }
4928
+ ],
4929
+ "title": "OS INVENTORY",
4930
+ "transformations": [
4931
+ {
4932
+ "id": "organize",
4933
+ "options": {
4934
+ "excludeByName": {
4935
+ "@metadata_beat": true,
4936
+ "@metadata_type": true,
4937
+ "@metadata_version": true,
4938
+ "_id": true,
4939
+ "_index": true,
4940
+ "_type": true,
4941
+ "agent_ephemeral_id": true,
4942
+ "agent_hostname": true,
4943
+ "agent_id": true,
4944
+ "agent_ip": false,
4945
+ "agent_ip_city_name": true,
4946
+ "agent_ip_country_code": true,
4947
+ "agent_ip_geolocation": true,
4948
+ "agent_labels_customer": true,
4949
+ "agent_name": false,
4950
+ "agent_type": true,
4951
+ "agent_version": true,
4952
+ "beats_type": true,
4953
+ "collector_node_id": true,
4954
+ "data_inventory_module": true,
4955
+ "data_os_architecture": true,
4956
+ "data_os_boot_time": true,
4957
+ "data_os_install_date": false,
4958
+ "data_os_lang": false,
4959
+ "data_os_locale": false,
4960
+ "data_os_sku": false,
4961
+ "data_os_sn": false,
4962
+ "data_os_system_memory": false,
4963
+ "data_os_system_name": true,
4964
+ "data_system_sys_form_factor": true,
4965
+ "data_system_sys_hostname": true,
4966
+ "data_system_sys_icon": true,
4967
+ "data_system_sys_ip": true,
4968
+ "data_system_sys_ip_city_name": true,
4969
+ "data_system_sys_ip_country_code": true,
4970
+ "data_system_sys_ip_geolocation": true,
4971
+ "data_system_sys_last_seen_by": true,
4972
+ "data_system_sys_manufacturer": true,
4973
+ "data_system_sys_memory_count": true,
4974
+ "data_system_sys_model": true,
4975
+ "data_system_sys_os_arch": true,
4976
+ "data_system_sys_os_bit": true,
4977
+ "data_system_sys_processor_count": true,
4978
+ "data_system_sys_script_version": true,
4979
+ "data_system_sys_serial": true,
4980
+ "data_system_sys_uptime": true,
4981
+ "data_system_sys_uuid": true,
4982
+ "data_win_eventdata_domain": true,
4983
+ "data_win_eventdata_imagePath": true,
4984
+ "data_win_eventdata_sID": true,
4985
+ "data_win_eventdata_serviceName": true,
4986
+ "data_win_eventdata_serviceType": true,
4987
+ "data_win_eventdata_startType": true,
4988
+ "data_win_eventdata_timestamp": true,
4989
+ "data_win_eventdata_user": true,
4990
+ "data_win_system_channel": true,
4991
+ "data_win_system_computer": true,
4992
+ "data_win_system_eventID": true,
4993
+ "data_win_system_eventRecordID": true,
4994
+ "data_win_system_eventSourceName": true,
4995
+ "data_win_system_keywords": true,
4996
+ "data_win_system_level": true,
4997
+ "data_win_system_opcode": true,
4998
+ "data_win_system_processID": true,
4999
+ "data_win_system_providerGuid": true,
This file is too large to show in full.
backend/app/connectors/grafana/dashboards/Wazuh/edr_process_injection.json
new
+1174
@@ -0,0 +1,1174 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194317131,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "datasource": {
45
+ "type": "elasticsearch",
46
+ "uid": "wazuh_datasource_uid"
47
+ },
48
+ "fieldConfig": {
49
+ "defaults": {
50
+ "mappings": [
51
+ {
52
+ "options": {
53
+ "match": "null",
54
+ "result": {
55
+ "text": "N/A"
56
+ }
57
+ },
58
+ "type": "special"
59
+ }
60
+ ],
61
+ "thresholds": {
62
+ "mode": "absolute",
63
+ "steps": [
64
+ {
65
+ "color": "blue",
66
+ "value": null
67
+ }
68
+ ]
69
+ },
70
+ "unit": "short"
71
+ },
72
+ "overrides": []
73
+ },
74
+ "gridPos": {
75
+ "h": 7,
76
+ "w": 4,
77
+ "x": 0,
78
+ "y": 0
79
+ },
80
+ "id": 43,
81
+ "links": [],
82
+ "options": {
83
+ "colorMode": "value",
84
+ "graphMode": "area",
85
+ "justifyMode": "auto",
86
+ "orientation": "horizontal",
87
+ "reduceOptions": {
88
+ "calcs": ["sum"],
89
+ "fields": "",
90
+ "values": false
91
+ },
92
+ "text": {},
93
+ "textMode": "auto"
94
+ },
95
+ "pluginVersion": "9.0.0",
96
+ "targets": [
97
+ {
98
+ "bucketAggs": [
99
+ {
100
+ "$$hashKey": "object:118",
101
+ "field": "timestamp",
102
+ "id": "2",
103
+ "settings": {
104
+ "interval": "auto",
105
+ "min_doc_count": 0,
106
+ "trimEdges": 0
107
+ },
108
+ "type": "date_histogram"
109
+ }
110
+ ],
111
+ "metrics": [
112
+ {
113
+ "$$hashKey": "object:116",
114
+ "field": "select field",
115
+ "id": "1",
116
+ "type": "count"
117
+ }
118
+ ],
119
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
120
+ "refId": "A",
121
+ "timeField": "timestamp"
122
+ }
123
+ ],
124
+ "title": "PROCESS INJECTION EVENTS",
125
+ "type": "stat"
126
+ },
127
+ {
128
+ "datasource": {
129
+ "type": "elasticsearch",
130
+ "uid": "wazuh_datasource_uid"
131
+ },
132
+ "fieldConfig": {
133
+ "defaults": {
134
+ "color": {
135
+ "mode": "thresholds"
136
+ },
137
+ "custom": {
138
+ "align": "auto",
139
+ "displayMode": "auto",
140
+ "inspect": false
141
+ },
142
+ "mappings": [],
143
+ "thresholds": {
144
+ "mode": "absolute",
145
+ "steps": [
146
+ {
147
+ "color": "green",
148
+ "value": null
149
+ },
150
+ {
151
+ "color": "red",
152
+ "value": 80
153
+ }
154
+ ]
155
+ }
156
+ },
157
+ "overrides": []
158
+ },
159
+ "gridPos": {
160
+ "h": 7,
161
+ "w": 6,
162
+ "x": 4,
163
+ "y": 0
164
+ },
165
+ "id": 59,
166
+ "links": [],
167
+ "options": {
168
+ "footer": {
169
+ "fields": "",
170
+ "reducer": ["sum"],
171
+ "show": false
172
+ },
173
+ "showHeader": true
174
+ },
175
+ "pluginVersion": "9.0.0",
176
+ "targets": [
177
+ {
178
+ "bucketAggs": [
179
+ {
180
+ "$$hashKey": "object:73",
181
+ "fake": true,
182
+ "field": "agent_name",
183
+ "id": "3",
184
+ "settings": {
185
+ "min_doc_count": "1",
186
+ "order": "desc",
187
+ "orderBy": "_count",
188
+ "size": "10"
189
+ },
190
+ "type": "terms"
191
+ }
192
+ ],
193
+ "metrics": [
194
+ {
195
+ "$$hashKey": "object:71",
196
+ "field": "select field",
197
+ "id": "1",
198
+ "type": "count"
199
+ }
200
+ ],
201
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
202
+ "queryType": "lucene",
203
+ "refId": "A",
204
+ "timeField": "timestamp"
205
+ }
206
+ ],
207
+ "title": "PROCESS INJECTION EVENTS / AGENT",
208
+ "type": "table"
209
+ },
210
+ {
211
+ "datasource": {
212
+ "type": "elasticsearch",
213
+ "uid": "wazuh_datasource_uid"
214
+ },
215
+ "fieldConfig": {
216
+ "defaults": {
217
+ "color": {
218
+ "mode": "palette-classic"
219
+ },
220
+ "custom": {
221
+ "axisLabel": "",
222
+ "axisPlacement": "auto",
223
+ "barAlignment": 0,
224
+ "drawStyle": "bars",
225
+ "fillOpacity": 0,
226
+ "gradientMode": "none",
227
+ "hideFrom": {
228
+ "legend": false,
229
+ "tooltip": false,
230
+ "viz": false
231
+ },
232
+ "lineInterpolation": "linear",
233
+ "lineWidth": 1,
234
+ "pointSize": 5,
235
+ "scaleDistribution": {
236
+ "type": "linear"
237
+ },
238
+ "showPoints": "auto",
239
+ "spanNulls": false,
240
+ "stacking": {
241
+ "group": "A",
242
+ "mode": "normal"
243
+ },
244
+ "thresholdsStyle": {
245
+ "mode": "off"
246
+ }
247
+ },
248
+ "mappings": [],
249
+ "thresholds": {
250
+ "mode": "absolute",
251
+ "steps": [
252
+ {
253
+ "color": "green",
254
+ "value": null
255
+ },
256
+ {
257
+ "color": "red",
258
+ "value": 80
259
+ }
260
+ ]
261
+ }
262
+ },
263
+ "overrides": []
264
+ },
265
+ "gridPos": {
266
+ "h": 7,
267
+ "w": 14,
268
+ "x": 10,
269
+ "y": 0
270
+ },
271
+ "id": 75,
272
+ "options": {
273
+ "legend": {
274
+ "calcs": [],
275
+ "displayMode": "table",
276
+ "placement": "right"
277
+ },
278
+ "tooltip": {
279
+ "mode": "single",
280
+ "sort": "none"
281
+ }
282
+ },
283
+ "targets": [
284
+ {
285
+ "alias": "",
286
+ "bucketAggs": [
287
+ {
288
+ "field": "agent_name",
289
+ "id": "3",
290
+ "settings": {
291
+ "min_doc_count": "1",
292
+ "order": "desc",
293
+ "orderBy": "_term",
294
+ "size": "10"
295
+ },
296
+ "type": "terms"
297
+ },
298
+ {
299
+ "field": "timestamp",
300
+ "id": "2",
301
+ "settings": {
302
+ "interval": "auto"
303
+ },
304
+ "type": "date_histogram"
305
+ }
306
+ ],
307
+ "datasource": {
308
+ "type": "elasticsearch",
309
+ "uid": "wazuh_datasource_uid"
310
+ },
311
+ "metrics": [
312
+ {
313
+ "id": "1",
314
+ "type": "count"
315
+ }
316
+ ],
317
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
318
+ "refId": "A",
319
+ "timeField": "timestamp"
320
+ }
321
+ ],
322
+ "title": "TOP 10 AGENTS - HISTOGRAM",
323
+ "transparent": true,
324
+ "type": "timeseries"
325
+ },
326
+ {
327
+ "datasource": {
328
+ "type": "elasticsearch",
329
+ "uid": "wazuh_datasource_uid"
330
+ },
331
+ "fieldConfig": {
332
+ "defaults": {
333
+ "mappings": [],
334
+ "thresholds": {
335
+ "mode": "absolute",
336
+ "steps": [
337
+ {
338
+ "color": "green",
339
+ "value": null
340
+ },
341
+ {
342
+ "color": "red",
343
+ "value": 80
344
+ }
345
+ ]
346
+ }
347
+ },
348
+ "overrides": []
349
+ },
350
+ "gridPos": {
351
+ "h": 13,
352
+ "w": 24,
353
+ "x": 0,
354
+ "y": 7
355
+ },
356
+ "id": 73,
357
+ "options": {
358
+ "color": "blue",
359
+ "iteration": 20,
360
+ "monochrome": false,
361
+ "nodeColor": "grey",
362
+ "nodePadding": 20,
363
+ "nodeWidth": 30
364
+ },
365
+ "targets": [
366
+ {
367
+ "alias": "",
368
+ "bucketAggs": [
369
+ {
370
+ "field": "source_image",
371
+ "id": "3",
372
+ "settings": {
373
+ "min_doc_count": "1",
374
+ "order": "desc",
375
+ "orderBy": "_term",
376
+ "size": "10"
377
+ },
378
+ "type": "terms"
379
+ },
380
+ {
381
+ "field": "target_image",
382
+ "id": "4",
383
+ "settings": {
384
+ "min_doc_count": "1",
385
+ "order": "desc",
386
+ "orderBy": "_term",
387
+ "size": "10"
388
+ },
389
+ "type": "terms"
390
+ },
391
+ {
392
+ "field": "granted_access",
393
+ "id": "5",
394
+ "settings": {
395
+ "min_doc_count": "1",
396
+ "order": "desc",
397
+ "orderBy": "_term",
398
+ "size": "10"
399
+ },
400
+ "type": "terms"
401
+ }
402
+ ],
403
+ "datasource": {
404
+ "type": "elasticsearch",
405
+ "uid": "wazuh_datasource_uid"
406
+ },
407
+ "metrics": [
408
+ {
409
+ "id": "1",
410
+ "type": "count"
411
+ }
412
+ ],
413
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
414
+ "refId": "A",
415
+ "timeField": "timestamp"
416
+ }
417
+ ],
418
+ "title": "PROCESS INJECTION - MAP",
419
+ "type": "netsage-sankey-panel"
420
+ },
421
+ {
422
+ "datasource": {
423
+ "type": "elasticsearch",
424
+ "uid": "wazuh_datasource_uid"
425
+ },
426
+ "fieldConfig": {
427
+ "defaults": {
428
+ "mappings": [],
429
+ "thresholds": {
430
+ "mode": "absolute",
431
+ "steps": [
432
+ {
433
+ "color": "green",
434
+ "value": null
435
+ },
436
+ {
437
+ "color": "red",
438
+ "value": 80
439
+ }
440
+ ]
441
+ }
442
+ },
443
+ "overrides": []
444
+ },
445
+ "gridPos": {
446
+ "h": 8,
447
+ "w": 12,
448
+ "x": 0,
449
+ "y": 20
450
+ },
451
+ "id": 67,
452
+ "links": [],
453
+ "options": {
454
+ "displayMode": "gradient",
455
+ "minVizHeight": 10,
456
+ "minVizWidth": 0,
457
+ "orientation": "horizontal",
458
+ "reduceOptions": {
459
+ "calcs": ["sum"],
460
+ "fields": "",
461
+ "values": false
462
+ },
463
+ "showUnfilled": true,
464
+ "text": {}
465
+ },
466
+ "pluginVersion": "9.0.0",
467
+ "targets": [
468
+ {
469
+ "bucketAggs": [
470
+ {
471
+ "$$hashKey": "object:73",
472
+ "fake": true,
473
+ "field": "source_image",
474
+ "id": "3",
475
+ "settings": {
476
+ "min_doc_count": "1",
477
+ "order": "desc",
478
+ "orderBy": "_count",
479
+ "size": "10"
480
+ },
481
+ "type": "terms"
482
+ },
483
+ {
484
+ "$$hashKey": "object:74",
485
+ "field": "timestamp",
486
+ "id": "2",
487
+ "settings": {
488
+ "interval": "auto",
489
+ "min_doc_count": 0,
490
+ "trimEdges": 0
491
+ },
492
+ "type": "date_histogram"
493
+ }
494
+ ],
495
+ "datasource": {
496
+ "type": "elasticsearch",
497
+ "uid": "wazuh_datasource_uid"
498
+ },
499
+ "metrics": [
500
+ {
501
+ "$$hashKey": "object:71",
502
+ "field": "select field",
503
+ "id": "1",
504
+ "type": "count"
505
+ }
506
+ ],
507
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
508
+ "queryType": "lucene",
509
+ "refId": "A",
510
+ "timeField": "timestamp"
511
+ }
512
+ ],
513
+ "title": "PROCESS INJECTION EVENTS / TOP 10 PROCESS",
514
+ "type": "bargauge"
515
+ },
516
+ {
517
+ "datasource": {
518
+ "type": "elasticsearch",
519
+ "uid": "wazuh_datasource_uid"
520
+ },
521
+ "fieldConfig": {
522
+ "defaults": {
523
+ "custom": {
524
+ "align": "auto",
525
+ "displayMode": "auto",
526
+ "filterable": false,
527
+ "inspect": false
528
+ },
529
+ "mappings": [],
530
+ "thresholds": {
531
+ "mode": "absolute",
532
+ "steps": [
533
+ {
534
+ "color": "green",
535
+ "value": null
536
+ },
537
+ {
538
+ "color": "red",
539
+ "value": 80
540
+ }
541
+ ]
542
+ }
543
+ },
544
+ "overrides": [
545
+ {
546
+ "matcher": {
547
+ "id": "byName",
548
+ "options": "process_image"
549
+ },
550
+ "properties": [
551
+ {
552
+ "id": "custom.width",
553
+ "value": 699
554
+ }
555
+ ]
556
+ }
557
+ ]
558
+ },
559
+ "gridPos": {
560
+ "h": 16,
561
+ "w": 12,
562
+ "x": 12,
563
+ "y": 20
564
+ },
565
+ "id": 69,
566
+ "links": [],
567
+ "options": {
568
+ "footer": {
569
+ "fields": "",
570
+ "reducer": ["sum"],
571
+ "show": false
572
+ },
573
+ "showHeader": true,
574
+ "sortBy": [
575
+ {
576
+ "desc": true,
577
+ "displayName": "Count"
578
+ }
579
+ ]
580
+ },
581
+ "pluginVersion": "9.0.0",
582
+ "targets": [
583
+ {
584
+ "bucketAggs": [
585
+ {
586
+ "$$hashKey": "object:42",
587
+ "fake": true,
588
+ "field": "source_image",
589
+ "id": "3",
590
+ "settings": {
591
+ "min_doc_count": "1",
592
+ "order": "desc",
593
+ "orderBy": "_count",
594
+ "size": "0"
595
+ },
596
+ "type": "terms"
597
+ }
598
+ ],
599
+ "datasource": {
600
+ "type": "elasticsearch",
601
+ "uid": "wazuh_datasource_uid"
602
+ },
603
+ "metrics": [
604
+ {
605
+ "$$hashKey": "object:40",
606
+ "field": "select field",
607
+ "id": "1",
608
+ "type": "count"
609
+ }
610
+ ],
611
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
612
+ "queryType": "lucene",
613
+ "refId": "A",
614
+ "timeField": "timestamp"
615
+ }
616
+ ],
617
+ "title": "PROCESS INJECTION EVENTS / PROCESS",
618
+ "type": "table"
619
+ },
620
+ {
621
+ "datasource": {
622
+ "type": "elasticsearch",
623
+ "uid": "wazuh_datasource_uid"
624
+ },
625
+ "fieldConfig": {
626
+ "defaults": {
627
+ "mappings": [],
628
+ "thresholds": {
629
+ "mode": "absolute",
630
+ "steps": [
631
+ {
632
+ "color": "green"
633
+ },
634
+ {
635
+ "color": "red",
636
+ "value": 80
637
+ }
638
+ ]
639
+ }
640
+ },
641
+ "overrides": []
642
+ },
643
+ "gridPos": {
644
+ "h": 8,
645
+ "w": 12,
646
+ "x": 0,
647
+ "y": 28
648
+ },
649
+ "id": 68,
650
+ "links": [],
651
+ "options": {
652
+ "displayMode": "gradient",
653
+ "minVizHeight": 10,
654
+ "minVizWidth": 0,
655
+ "orientation": "horizontal",
656
+ "reduceOptions": {
657
+ "calcs": ["sum"],
658
+ "fields": "",
659
+ "values": false
660
+ },
661
+ "showUnfilled": true,
662
+ "text": {}
663
+ },
664
+ "pluginVersion": "9.0.0",
665
+ "targets": [
666
+ {
667
+ "bucketAggs": [
668
+ {
669
+ "$$hashKey": "object:73",
670
+ "fake": true,
671
+ "field": "source_image",
672
+ "id": "3",
673
+ "settings": {
674
+ "min_doc_count": "1",
675
+ "order": "asc",
676
+ "orderBy": "_count",
677
+ "size": "10"
678
+ },
679
+ "type": "terms"
680
+ },
681
+ {
682
+ "$$hashKey": "object:74",
683
+ "field": "timestamp",
684
+ "id": "2",
685
+ "settings": {
686
+ "interval": "auto",
687
+ "min_doc_count": 0,
688
+ "trimEdges": 0
689
+ },
690
+ "type": "date_histogram"
691
+ }
692
+ ],
693
+ "datasource": {
694
+ "type": "elasticsearch",
695
+ "uid": "wazuh_datasource_uid"
696
+ },
697
+ "metrics": [
698
+ {
699
+ "$$hashKey": "object:71",
700
+ "field": "select field",
701
+ "id": "1",
702
+ "type": "count"
703
+ }
704
+ ],
705
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
706
+ "queryType": "lucene",
707
+ "refId": "A",
708
+ "timeField": "timestamp"
709
+ }
710
+ ],
711
+ "title": "PROCESS INJECTION EVENTS / LEAST SEEN PROCESS",
712
+ "type": "bargauge"
713
+ },
714
+ {
715
+ "datasource": {
716
+ "type": "elasticsearch",
717
+ "uid": "wazuh_datasource_uid"
718
+ },
719
+ "fieldConfig": {
720
+ "defaults": {
721
+ "custom": {
722
+ "align": "auto",
723
+ "displayMode": "auto",
724
+ "filterable": false,
725
+ "inspect": false
726
+ },
727
+ "mappings": [],
728
+ "thresholds": {
729
+ "mode": "absolute",
730
+ "steps": [
731
+ {
732
+ "color": "green"
733
+ },
734
+ {
735
+ "color": "red",
736
+ "value": 80
737
+ }
738
+ ]
739
+ }
740
+ },
741
+ "overrides": [
742
+ {
743
+ "matcher": {
744
+ "id": "byName",
745
+ "options": "DATE/TIME"
746
+ },
747
+ "properties": [
748
+ {
749
+ "id": "custom.width",
750
+ "value": 255
751
+ }
752
+ ]
753
+ },
754
+ {
755
+ "matcher": {
756
+ "id": "byName",
757
+ "options": "AGENT"
758
+ },
759
+ "properties": [
760
+ {
761
+ "id": "custom.width",
762
+ "value": 205
763
+ }
764
+ ]
765
+ },
766
+ {
767
+ "matcher": {
768
+ "id": "byName",
769
+ "options": "AGENT IP"
770
+ },
771
+ "properties": [
772
+ {
773
+ "id": "custom.width",
774
+ "value": 184
775
+ }
776
+ ]
777
+ },
778
+ {
779
+ "matcher": {
780
+ "id": "byName",
781
+ "options": "GRANTED ACCESS"
782
+ },
783
+ "properties": [
784
+ {
785
+ "id": "custom.width",
786
+ "value": 220
787
+ }
788
+ ]
789
+ },
790
+ {
791
+ "matcher": {
792
+ "id": "byName",
793
+ "options": "TARGET IMAGE"
794
+ },
795
+ "properties": [
796
+ {
797
+ "id": "custom.width",
798
+ "value": 512
799
+ }
800
+ ]
801
+ },
802
+ {
803
+ "matcher": {
804
+ "id": "byName",
805
+ "options": "SOURCE IMAGE"
806
+ },
807
+ "properties": [
808
+ {
809
+ "id": "custom.width",
810
+ "value": 460
811
+ }
812
+ ]
813
+ },
814
+ {
815
+ "matcher": {
816
+ "id": "byName",
817
+ "options": "EVENT ID"
818
+ },
819
+ "properties": [
820
+ {
821
+ "id": "links",
822
+ "value": [
823
+ {
824
+ "targetBlank": true,
825
+ "title": "VIEW EVENT DETAILS",
826
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
827
+ }
828
+ ]
829
+ }
830
+ ]
831
+ }
832
+ ]
833
+ },
834
+ "gridPos": {
835
+ "h": 10,
836
+ "w": 24,
837
+ "x": 0,
838
+ "y": 36
839
+ },
840
+ "id": 71,
841
+ "options": {
842
+ "footer": {
843
+ "fields": "",
844
+ "reducer": ["sum"],
845
+ "show": false
846
+ },
847
+ "showHeader": true,
848
+ "sortBy": [
849
+ {
850
+ "desc": false,
851
+ "displayName": "GRANTED ACCESS"
852
+ }
853
+ ]
854
+ },
855
+ "pluginVersion": "9.0.0",
856
+ "targets": [
857
+ {
858
+ "bucketAggs": [],
859
+ "datasource": {
860
+ "type": "elasticsearch",
861
+ "uid": "wazuh_datasource_uid"
862
+ },
863
+ "metrics": [
864
+ {
865
+ "$$hashKey": "object:823",
866
+ "field": "select field",
867
+ "id": "1",
868
+ "meta": {},
869
+ "settings": {
870
+ "size": "250"
871
+ },
872
+ "type": "raw_data"
873
+ }
874
+ ],
875
+ "query": "rule_group3:sysmon_event_10 AND agent_name:$agent_name",
876
+ "queryType": "lucene",
877
+ "refId": "A",
878
+ "timeField": "timestamp"
879
+ }
880
+ ],
881
+ "title": "PROCESS INJECTION - EVENTS",
882
+ "transformations": [
883
+ {
884
+ "id": "organize",
885
+ "options": {
886
+ "excludeByName": {
887
+ "@metadata_beat": true,
888
+ "@metadata_type": true,
889
+ "@metadata_version": true,
890
+ "IMPHASH": true,
891
+ "MD5": true,
892
+ "SHA1": true,
893
+ "_id": false,
894
+ "_index": true,
895
+ "_type": true,
896
+ "agent_ephemeral_id": true,
897
+ "agent_hostname": true,
898
+ "agent_id": true,
899
+ "agent_ip": false,
900
+ "agent_ip_city_name": true,
901
+ "agent_ip_country_code": true,
902
+ "agent_ip_geolocation": true,
903
+ "agent_labels_customer": true,
904
+ "agent_name": false,
905
+ "agent_type": true,
906
+ "agent_version": true,
907
+ "beats_type": true,
908
+ "call_trace": true,
909
+ "collector_node_id": true,
910
+ "data_win_eventdata_callTrace": true,
911
+ "data_win_eventdata_description": true,
912
+ "data_win_eventdata_fileVersion": true,
913
+ "data_win_eventdata_fileVersion_city_name": true,
914
+ "data_win_eventdata_fileVersion_country_code": true,
915
+ "data_win_eventdata_fileVersion_geolocation": true,
916
+ "data_win_eventdata_grantedAccess": true,
917
+ "data_win_eventdata_hashes": true,
918
+ "data_win_eventdata_image": false,
919
+ "data_win_eventdata_originalFileName": true,
920
+ "data_win_eventdata_processGuid": true,
921
+ "data_win_eventdata_processId": true,
922
+ "data_win_eventdata_product": true,
923
+ "data_win_eventdata_ruleName": true,
924
+ "data_win_eventdata_signature": true,
925
+ "data_win_eventdata_sourceImage": true,
926
+ "data_win_eventdata_sourceProcessGUID": true,
927
+ "data_win_eventdata_sourceProcessId": true,
928
+ "data_win_eventdata_sourceThreadId": true,
929
+ "data_win_eventdata_sourceUser": true,
930
+ "data_win_eventdata_targetImage": true,
931
+ "data_win_eventdata_targetProcessGUID": true,
932
+ "data_win_eventdata_targetProcessId": true,
933
+ "data_win_eventdata_targetUser": true,
934
+ "data_win_eventdata_user": true,
935
+ "data_win_eventdata_utcTime": true,
936
+ "data_win_system_channel": true,
937
+ "data_win_system_computer": true,
938
+ "data_win_system_eventID": true,
939
+ "data_win_system_eventRecordID": true,
940
+ "data_win_system_keywords": true,
941
+ "data_win_system_level": true,
942
+ "data_win_system_message": true,
943
+ "data_win_system_opcode": true,
944
+ "data_win_system_processID": true,
945
+ "data_win_system_providerGuid": true,
946
+ "data_win_system_providerName": true,
947
+ "data_win_system_severityValue": true,
948
+ "data_win_system_systemTime": true,
949
+ "data_win_system_task": true,
950
+ "data_win_system_threadID": true,
951
+ "data_win_system_version": true,
952
+ "date": true,
953
+ "decoder_name": true,
954
+ "dll_hashes": true,
955
+ "dll_name": true,
956
+ "dll_signature": true,
957
+ "dll_signature_status": true,
958
+ "dll_signed": true,
959
+ "ecs_version": true,
960
+ "firewall_rule_name": true,
961
+ "gl2_accounted_message_size": true,
962
+ "gl2_message_id": true,
963
+ "gl2_processing_error": true,
964
+ "gl2_remote_ip": true,
965
+ "gl2_remote_port": true,
966
+ "gl2_source_collector": true,
967
+ "gl2_source_input": true,
968
+ "gl2_source_node": true,
969
+ "hash_md5": true,
970
+ "hash_sha1": true,
971
+ "hash_sha256": true,
972
+ "highlight": true,
973
+ "host_name": true,
974
+ "id": true,
975
+ "image_loaded": true,
976
+ "location": true,
977
+ "log_file_path": true,
978
+ "log_offset": true,
979
+ "manager_name": true,
980
+ "message": true,
981
+ "process_id": true,
982
+ "process_image": true,
983
+ "rule_description": true,
984
+ "rule_firedtimes": true,
985
+ "rule_group1": true,
986
+ "rule_group2": true,
987
+ "rule_group3": true,
988
+ "rule_groups": true,
989
+ "rule_id": true,
990
+ "rule_level": true,
991
+ "rule_mail": true,
992
+ "rule_mitre_id": true,
993
+ "rule_mitre_tactic": true,
994
+ "rule_mitre_technique": true,
995
+ "software_package": false,
996
+ "sort": true,
997
+ "source": true,
998
+ "source_image": false,
999
+ "src_ip": true,
1000
+ "src_ip_city_name": true,
1001
+ "src_ip_country_code": true,
1002
+ "src_ip_geolocation": true,
1003
+ "streams": true,
1004
+ "syslog_tag": true,
1005
+ "syslog_type": true,
1006
+ "sysmon_event_description": true,
1007
+ "timestamp": false,
1008
+ "win_system_eventID": true,
1009
+ "windows_event_id": true,
1010
+ "windows_event_severity": true
1011
+ },
1012
+ "indexByName": {
1013
+ "_id": 1,
1014
+ "_index": 3,
1015
+ "_type": 4,
1016
+ "agent_id": 5,
1017
+ "agent_ip": 6,
1018
+ "agent_ip_city_name": 70,
1019
+ "agent_ip_country_code": 71,
1020
+ "agent_ip_geolocation": 72,
1021
+ "agent_labels_customer": 47,
1022
+ "agent_name": 2,
1023
+ "call_trace": 55,
1024
+ "data_win_eventdata_callTrace": 56,
1025
+ "data_win_eventdata_grantedAccess": 57,
1026
+ "data_win_eventdata_ruleName": 46,
1027
+ "data_win_eventdata_sourceImage": 58,
1028
+ "data_win_eventdata_sourceProcessGUID": 59,
1029
+ "data_win_eventdata_sourceProcessId": 60,
1030
+ "data_win_eventdata_sourceThreadId": 61,
1031
+ "data_win_eventdata_sourceUser": 62,
1032
+ "data_win_eventdata_targetImage": 63,
1033
+ "data_win_eventdata_targetProcessGUID": 64,
1034
+ "data_win_eventdata_targetProcessId": 65,
1035
+ "data_win_eventdata_targetUser": 66,
1036
+ "data_win_eventdata_utcTime": 7,
1037
+ "data_win_system_channel": 8,
1038
+ "data_win_system_computer": 9,
1039
+ "data_win_system_eventID": 10,
1040
+ "data_win_system_eventRecordID": 11,
1041
+ "data_win_system_keywords": 12,
1042
+ "data_win_system_level": 13,
1043
+ "data_win_system_message": 14,
1044
+ "data_win_system_opcode": 15,
1045
+ "data_win_system_processID": 16,
1046
+ "data_win_system_providerGuid": 17,
1047
+ "data_win_system_providerName": 18,
1048
+ "data_win_system_severityValue": 19,
1049
+ "data_win_system_systemTime": 20,
1050
+ "data_win_system_task": 21,
1051
+ "data_win_system_threadID": 22,
1052
+ "data_win_system_version": 23,
1053
+ "decoder_name": 24,
1054
+ "gl2_accounted_message_size": 25,
1055
+ "gl2_message_id": 26,
1056
+ "gl2_processing_error": 48,
1057
+ "gl2_remote_ip": 27,
1058
+ "gl2_remote_port": 28,
1059
+ "gl2_source_input": 29,
1060
+ "gl2_source_node": 30,
1061
+ "granted_access": 69,
1062
+ "highlight": 44,
1063
+ "id": 31,
1064
+ "location": 32,
1065
+ "manager_name": 33,
1066
+ "message": 34,
1067
+ "rule_description": 35,
1068
+ "rule_firedtimes": 36,
1069
+ "rule_group1": 49,
1070
+ "rule_group2": 50,
1071
+ "rule_group3": 51,
1072
+ "rule_groups": 37,
1073
+ "rule_id": 38,
1074
+ "rule_level": 39,
1075
+ "rule_mail": 40,
1076
+ "rule_mitre_id": 52,
1077
+ "rule_mitre_tactic": 53,
1078
+ "rule_mitre_technique": 54,
1079
+ "sort": 45,
1080
+ "source": 41,
1081
+ "source_image": 67,
1082
+ "streams": 42,
1083
+ "syslog_level": 73,
1084
+ "syslog_type": 43,
1085
+ "target_image": 68,
1086
+ "timestamp": 0,
1087
+ "true": 74
1088
+ },
1089
+ "renameByName": {
1090
+ "SHA256": "DLL HASH (SHA256)",
1091
+ "_id": "EVENT ID",
1092
+ "agent_ip": "AGENT IP",
1093
+ "agent_name": "AGENT",
1094
+ "data_win_eventdata_company": "VENDOR",
1095
+ "data_win_eventdata_image": "PROCESS FILE",
1096
+ "data_win_eventdata_imageLoaded": "DLL LOCATION",
1097
+ "data_win_eventdata_signatureStatus": "CERT STATUS",
1098
+ "data_win_eventdata_signed": "DIGITAL SIGNATURE",
1099
+ "granted_access": "GRANTED ACCESS",
1100
+ "process_name": "DLL",
1101
+ "software_package": "SOFTWARE",
1102
+ "software_vendor": "VENDOR",
1103
+ "source": "",
1104
+ "source_image": "SOURCE IMAGE",
1105
+ "target_image": "TARGET IMAGE",
1106
+ "timestamp": "DATE/TIME"
1107
+ }
1108
+ }
1109
+ }
1110
+ ],
1111
+ "type": "table"
1112
+ }
1113
+ ],
1114
+ "refresh": false,
1115
+ "schemaVersion": 36,
1116
+ "style": "dark",
1117
+ "tags": ["EDR"],
1118
+ "templating": {
1119
+ "list": [
1120
+ {
1121
+ "datasource": {
1122
+ "type": "elasticsearch",
1123
+ "uid": "wazuh_datasource_uid"
1124
+ },
1125
+ "filters": [],
1126
+ "hide": 0,
1127
+ "label": "",
1128
+ "name": "Filters",
1129
+ "skipUrlSync": false,
1130
+ "type": "adhoc"
1131
+ },
1132
+ {
1133
+ "current": {
1134
+ "selected": false,
1135
+ "text": "All",
1136
+ "value": "$__all"
1137
+ },
1138
+ "datasource": {
1139
+ "type": "elasticsearch",
1140
+ "uid": "wazuh_datasource_uid"
1141
+ },
1142
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event_10\"}",
1143
+ "hide": 0,
1144
+ "includeAll": true,
1145
+ "label": "Agent",
1146
+ "multi": false,
1147
+ "name": "agent_name",
1148
+ "options": [],
1149
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event_10\"}",
1150
+ "refresh": 2,
1151
+ "regex": "",
1152
+ "skipUrlSync": false,
1153
+ "sort": 2,
1154
+ "tagValuesQuery": "",
1155
+ "tagsQuery": "",
1156
+ "type": "query",
1157
+ "useTags": false
1158
+ }
1159
+ ]
1160
+ },
1161
+ "time": {
1162
+ "from": "now-6h",
1163
+ "to": "now"
1164
+ },
1165
+ "timepicker": {
1166
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1167
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1168
+ },
1169
+ "timezone": "",
1170
+ "title": "EDR - PROCESS INJECTION",
1171
+ "uid": null,
1172
+ "version": 4,
1173
+ "weekStart": ""
1174
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_system_processes.json
new
+1982
@@ -0,0 +1,1982 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "datasource": {
44
+ "type": "elasticsearch",
45
+ "uid": "wazuh_datasource_uid"
46
+ },
47
+ "fieldConfig": {
48
+ "defaults": {
49
+ "mappings": [
50
+ {
51
+ "options": {
52
+ "match": "null",
53
+ "result": {
54
+ "text": "N/A"
55
+ }
56
+ },
57
+ "type": "special"
58
+ }
59
+ ],
60
+ "thresholds": {
61
+ "mode": "absolute",
62
+ "steps": [
63
+ {
64
+ "color": "blue",
65
+ "value": null
66
+ }
67
+ ]
68
+ },
69
+ "unit": "short"
70
+ },
71
+ "overrides": []
72
+ },
73
+ "gridPos": {
74
+ "h": 7,
75
+ "w": 4,
76
+ "x": 0,
77
+ "y": 0
78
+ },
79
+ "id": 43,
80
+ "links": [],
81
+ "options": {
82
+ "colorMode": "value",
83
+ "graphMode": "area",
84
+ "justifyMode": "auto",
85
+ "orientation": "horizontal",
86
+ "reduceOptions": {
87
+ "calcs": ["sum"],
88
+ "fields": "",
89
+ "values": false
90
+ },
91
+ "text": {},
92
+ "textMode": "auto"
93
+ },
94
+ "pluginVersion": "10.0.2",
95
+ "targets": [
96
+ {
97
+ "bucketAggs": [
98
+ {
99
+ "$$hashKey": "object:135",
100
+ "field": "timestamp",
101
+ "id": "2",
102
+ "settings": {
103
+ "interval": "auto",
104
+ "min_doc_count": 0,
105
+ "trimEdges": 0
106
+ },
107
+ "type": "date_histogram"
108
+ }
109
+ ],
110
+ "datasource": {
111
+ "type": "elasticsearch",
112
+ "uid": "wazuh_datasource_uid"
113
+ },
114
+ "metrics": [
115
+ {
116
+ "$$hashKey": "object:133",
117
+ "field": "select field",
118
+ "id": "1",
119
+ "type": "count"
120
+ }
121
+ ],
122
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
123
+ "refId": "A",
124
+ "timeField": "timestamp"
125
+ }
126
+ ],
127
+ "title": "PROCESS EVENTS",
128
+ "type": "stat"
129
+ },
130
+ {
131
+ "datasource": {
132
+ "type": "elasticsearch",
133
+ "uid": "wazuh_datasource_uid"
134
+ },
135
+ "fieldConfig": {
136
+ "defaults": {
137
+ "color": {
138
+ "mode": "thresholds"
139
+ },
140
+ "custom": {
141
+ "align": "auto",
142
+ "cellOptions": {
143
+ "type": "auto"
144
+ },
145
+ "inspect": false
146
+ },
147
+ "mappings": [],
148
+ "thresholds": {
149
+ "mode": "absolute",
150
+ "steps": [
151
+ {
152
+ "color": "green",
153
+ "value": null
154
+ },
155
+ {
156
+ "color": "red",
157
+ "value": 80
158
+ }
159
+ ]
160
+ }
161
+ },
162
+ "overrides": [
163
+ {
164
+ "matcher": {
165
+ "id": "byName",
166
+ "options": "Time"
167
+ },
168
+ "properties": [
169
+ {
170
+ "id": "displayName",
171
+ "value": "Time"
172
+ },
173
+ {
174
+ "id": "unit",
175
+ "value": "time: YYYY-MM-DD HH:mm:ss"
176
+ },
177
+ {
178
+ "id": "custom.align"
179
+ }
180
+ ]
181
+ },
182
+ {
183
+ "matcher": {
184
+ "id": "byName",
185
+ "options": ""
186
+ },
187
+ "properties": [
188
+ {
189
+ "id": "unit",
190
+ "value": "short"
191
+ },
192
+ {
193
+ "id": "decimals",
194
+ "value": 2
195
+ },
196
+ {
197
+ "id": "custom.align"
198
+ }
199
+ ]
200
+ },
201
+ {
202
+ "matcher": {
203
+ "id": "byName",
204
+ "options": "agent_name"
205
+ },
206
+ "properties": [
207
+ {
208
+ "id": "displayName",
209
+ "value": "AGENT"
210
+ },
211
+ {
212
+ "id": "unit",
213
+ "value": "short"
214
+ },
215
+ {
216
+ "id": "decimals",
217
+ "value": 2
218
+ },
219
+ {
220
+ "id": "custom.align"
221
+ }
222
+ ]
223
+ },
224
+ {
225
+ "matcher": {
226
+ "id": "byName",
227
+ "options": "AGENT"
228
+ },
229
+ "properties": [
230
+ {
231
+ "id": "custom.width",
232
+ "value": 299
233
+ }
234
+ ]
235
+ }
236
+ ]
237
+ },
238
+ "gridPos": {
239
+ "h": 7,
240
+ "w": 8,
241
+ "x": 4,
242
+ "y": 0
243
+ },
244
+ "id": 31,
245
+ "options": {
246
+ "cellHeight": "sm",
247
+ "footer": {
248
+ "countRows": false,
249
+ "fields": "",
250
+ "reducer": ["sum"],
251
+ "show": false
252
+ },
253
+ "showHeader": true,
254
+ "sortBy": []
255
+ },
256
+ "pluginVersion": "10.0.2",
257
+ "targets": [
258
+ {
259
+ "bucketAggs": [
260
+ {
261
+ "$$hashKey": "object:89",
262
+ "fake": true,
263
+ "field": "agent_name",
264
+ "id": "4",
265
+ "settings": {
266
+ "min_doc_count": 1,
267
+ "order": "desc",
268
+ "orderBy": "_count",
269
+ "size": "0"
270
+ },
271
+ "type": "terms"
272
+ }
273
+ ],
274
+ "datasource": {
275
+ "type": "elasticsearch",
276
+ "uid": "wazuh_datasource_uid"
277
+ },
278
+ "metrics": [
279
+ {
280
+ "$$hashKey": "object:87",
281
+ "field": "select field",
282
+ "id": "1",
283
+ "type": "count"
284
+ }
285
+ ],
286
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
287
+ "refId": "A",
288
+ "timeField": "timestamp"
289
+ }
290
+ ],
291
+ "title": "AGENTS",
292
+ "transformations": [
293
+ {
294
+ "id": "merge",
295
+ "options": {
296
+ "reducers": []
297
+ }
298
+ }
299
+ ],
300
+ "type": "table"
301
+ },
302
+ {
303
+ "datasource": {
304
+ "type": "elasticsearch",
305
+ "uid": "wazuh_datasource_uid"
306
+ },
307
+ "fieldConfig": {
308
+ "defaults": {
309
+ "color": {
310
+ "mode": "palette-classic"
311
+ },
312
+ "custom": {
313
+ "hideFrom": {
314
+ "legend": false,
315
+ "tooltip": false,
316
+ "viz": false
317
+ }
318
+ },
319
+ "decimals": 0,
320
+ "mappings": [],
321
+ "unit": "short"
322
+ },
323
+ "overrides": []
324
+ },
325
+ "gridPos": {
326
+ "h": 7,
327
+ "w": 5,
328
+ "x": 12,
329
+ "y": 0
330
+ },
331
+ "id": 59,
332
+ "links": [],
333
+ "options": {
334
+ "displayLabels": [],
335
+ "legend": {
336
+ "calcs": [],
337
+ "displayMode": "list",
338
+ "placement": "bottom",
339
+ "showLegend": false,
340
+ "values": ["value"]
341
+ },
342
+ "pieType": "pie",
343
+ "reduceOptions": {
344
+ "calcs": ["sum"],
345
+ "fields": "",
346
+ "values": false
347
+ },
348
+ "text": {},
349
+ "tooltip": {
350
+ "mode": "single",
351
+ "sort": "none"
352
+ }
353
+ },
354
+ "pluginVersion": "7.3.4",
355
+ "targets": [
356
+ {
357
+ "bucketAggs": [
358
+ {
359
+ "$$hashKey": "object:211",
360
+ "fake": true,
361
+ "field": "software_vendor",
362
+ "id": "3",
363
+ "settings": {
364
+ "min_doc_count": "1",
365
+ "order": "desc",
366
+ "orderBy": "_count",
367
+ "size": "10"
368
+ },
369
+ "type": "terms"
370
+ },
371
+ {
372
+ "$$hashKey": "object:117",
373
+ "field": "timestamp",
374
+ "id": "2",
375
+ "settings": {
376
+ "interval": "auto",
377
+ "min_doc_count": 0,
378
+ "trimEdges": 0
379
+ },
380
+ "type": "date_histogram"
381
+ }
382
+ ],
383
+ "datasource": {
384
+ "type": "elasticsearch",
385
+ "uid": "wazuh_datasource_uid"
386
+ },
387
+ "metrics": [
388
+ {
389
+ "$$hashKey": "object:115",
390
+ "field": "select field",
391
+ "id": "1",
392
+ "type": "count"
393
+ }
394
+ ],
395
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
396
+ "queryType": "randomWalk",
397
+ "refId": "A",
398
+ "timeField": "timestamp"
399
+ }
400
+ ],
401
+ "title": "PROCESSES STARTED / SOFTWARE VENDOR",
402
+ "type": "piechart"
403
+ },
404
+ {
405
+ "datasource": {
406
+ "type": "elasticsearch",
407
+ "uid": "wazuh_datasource_uid"
408
+ },
409
+ "fieldConfig": {
410
+ "defaults": {
411
+ "custom": {
412
+ "align": "auto",
413
+ "cellOptions": {
414
+ "type": "auto"
415
+ },
416
+ "filterable": false,
417
+ "inspect": false
418
+ },
419
+ "mappings": [],
420
+ "thresholds": {
421
+ "mode": "absolute",
422
+ "steps": [
423
+ {
424
+ "color": "green",
425
+ "value": null
426
+ },
427
+ {
428
+ "color": "red",
429
+ "value": 80
430
+ }
431
+ ]
432
+ }
433
+ },
434
+ "overrides": []
435
+ },
436
+ "gridPos": {
437
+ "h": 7,
438
+ "w": 7,
439
+ "x": 17,
440
+ "y": 0
441
+ },
442
+ "id": 61,
443
+ "links": [],
444
+ "options": {
445
+ "cellHeight": "sm",
446
+ "footer": {
447
+ "countRows": false,
448
+ "fields": "",
449
+ "reducer": ["sum"],
450
+ "show": false
451
+ },
452
+ "showHeader": true
453
+ },
454
+ "pluginVersion": "10.0.2",
455
+ "targets": [
456
+ {
457
+ "bucketAggs": [
458
+ {
459
+ "$$hashKey": "object:211",
460
+ "fake": true,
461
+ "field": "software_vendor",
462
+ "id": "3",
463
+ "settings": {
464
+ "min_doc_count": "1",
465
+ "order": "desc",
466
+ "orderBy": "_count",
467
+ "size": "10"
468
+ },
469
+ "type": "terms"
470
+ }
471
+ ],
472
+ "datasource": {
473
+ "type": "elasticsearch",
474
+ "uid": "wazuh_datasource_uid"
475
+ },
476
+ "metrics": [
477
+ {
478
+ "$$hashKey": "object:115",
479
+ "field": "select field",
480
+ "id": "1",
481
+ "type": "count"
482
+ }
483
+ ],
484
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
485
+ "queryType": "randomWalk",
486
+ "refId": "A",
487
+ "timeField": "timestamp"
488
+ }
489
+ ],
490
+ "title": "PROCESSES STARTED / SOFTWARE VENDOR",
491
+ "type": "table"
492
+ },
493
+ {
494
+ "datasource": {
495
+ "type": "elasticsearch",
496
+ "uid": "wazuh_datasource_uid"
497
+ },
498
+ "fieldConfig": {
499
+ "defaults": {
500
+ "color": {
501
+ "mode": "continuous-GrYlRd"
502
+ },
503
+ "mappings": [],
504
+ "thresholds": {
505
+ "mode": "absolute",
506
+ "steps": [
507
+ {
508
+ "color": "green",
509
+ "value": null
510
+ }
511
+ ]
512
+ },
513
+ "unit": "short"
514
+ },
515
+ "overrides": []
516
+ },
517
+ "gridPos": {
518
+ "h": 19,
519
+ "w": 24,
520
+ "x": 0,
521
+ "y": 7
522
+ },
523
+ "id": 66,
524
+ "options": {
525
+ "color": "blue",
526
+ "iteration": 20,
527
+ "monochrome": false,
528
+ "nodeColor": "super-light-purple",
529
+ "nodePadding": 20,
530
+ "nodeWidth": 30
531
+ },
532
+ "targets": [
533
+ {
534
+ "alias": "",
535
+ "bucketAggs": [
536
+ {
537
+ "field": "parent_process_image",
538
+ "id": "2",
539
+ "settings": {
540
+ "min_doc_count": "1",
541
+ "order": "desc",
542
+ "orderBy": "_term",
543
+ "size": "10"
544
+ },
545
+ "type": "terms"
546
+ },
547
+ {
548
+ "field": "process_image",
549
+ "id": "3",
550
+ "settings": {
551
+ "min_doc_count": "1",
552
+ "order": "desc",
553
+ "orderBy": "_term",
554
+ "size": "1"
555
+ },
556
+ "type": "terms"
557
+ }
558
+ ],
559
+ "datasource": {
560
+ "type": "elasticsearch",
561
+ "uid": "wazuh_datasource_uid"
562
+ },
563
+ "metrics": [
564
+ {
565
+ "id": "1",
566
+ "type": "count"
567
+ }
568
+ ],
569
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
570
+ "refId": "A",
571
+ "timeField": "timestamp"
572
+ }
573
+ ],
574
+ "title": "PROCESS SPAWNS",
575
+ "transformations": [
576
+ {
577
+ "id": "organize",
578
+ "options": {
579
+ "excludeByName": {},
580
+ "indexByName": {},
581
+ "renameByName": {
582
+ "Count": "Count",
583
+ "parent_process_image": "PARENT PROCESS",
584
+ "process_image": "PROCESS"
585
+ }
586
+ }
587
+ }
588
+ ],
589
+ "transparent": true,
590
+ "type": "netsage-sankey-panel"
591
+ },
592
+ {
593
+ "datasource": {
594
+ "type": "elasticsearch",
595
+ "uid": "wazuh_datasource_uid"
596
+ },
597
+ "fieldConfig": {
598
+ "defaults": {
599
+ "color": {
600
+ "mode": "palette-classic"
601
+ },
602
+ "custom": {
603
+ "hideFrom": {
604
+ "legend": false,
605
+ "tooltip": false,
606
+ "viz": false
607
+ }
608
+ },
609
+ "decimals": 0,
610
+ "mappings": [],
611
+ "unit": "short"
612
+ },
613
+ "overrides": []
614
+ },
615
+ "gridPos": {
616
+ "h": 8,
617
+ "w": 4,
618
+ "x": 0,
619
+ "y": 26
620
+ },
621
+ "id": 60,
622
+ "links": [],
623
+ "options": {
624
+ "displayLabels": [],
625
+ "legend": {
626
+ "calcs": [],
627
+ "displayMode": "list",
628
+ "placement": "bottom",
629
+ "showLegend": false,
630
+ "values": ["value"]
631
+ },
632
+ "pieType": "donut",
633
+ "reduceOptions": {
634
+ "calcs": ["sum"],
635
+ "fields": "",
636
+ "values": false
637
+ },
638
+ "text": {},
639
+ "tooltip": {
640
+ "mode": "single",
641
+ "sort": "none"
642
+ }
643
+ },
644
+ "pluginVersion": "7.3.4",
645
+ "targets": [
646
+ {
647
+ "bucketAggs": [
648
+ {
649
+ "$$hashKey": "object:211",
650
+ "fake": true,
651
+ "field": "software_product",
652
+ "id": "3",
653
+ "settings": {
654
+ "min_doc_count": "1",
655
+ "order": "desc",
656
+ "orderBy": "_count",
657
+ "size": "10"
658
+ },
659
+ "type": "terms"
660
+ },
661
+ {
662
+ "$$hashKey": "object:117",
663
+ "field": "timestamp",
664
+ "id": "2",
665
+ "settings": {
666
+ "interval": "auto",
667
+ "min_doc_count": 0,
668
+ "trimEdges": 0
669
+ },
670
+ "type": "date_histogram"
671
+ }
672
+ ],
673
+ "datasource": {
674
+ "type": "elasticsearch",
675
+ "uid": "wazuh_datasource_uid"
676
+ },
677
+ "metrics": [
678
+ {
679
+ "$$hashKey": "object:115",
680
+ "field": "select field",
681
+ "id": "1",
682
+ "type": "count"
683
+ }
684
+ ],
685
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
686
+ "queryType": "randomWalk",
687
+ "refId": "A",
688
+ "timeField": "timestamp"
689
+ }
690
+ ],
691
+ "title": "PROCESSES STARTED / SOFTWARE PACKAGE",
692
+ "type": "piechart"
693
+ },
694
+ {
695
+ "datasource": {
696
+ "type": "elasticsearch",
697
+ "uid": "wazuh_datasource_uid"
698
+ },
699
+ "fieldConfig": {
700
+ "defaults": {
701
+ "custom": {
702
+ "align": "auto",
703
+ "cellOptions": {
704
+ "type": "auto"
705
+ },
706
+ "filterable": false,
707
+ "inspect": false
708
+ },
709
+ "mappings": [],
710
+ "thresholds": {
711
+ "mode": "absolute",
712
+ "steps": [
713
+ {
714
+ "color": "green",
715
+ "value": null
716
+ },
717
+ {
718
+ "color": "red",
719
+ "value": 80
720
+ }
721
+ ]
722
+ }
723
+ },
724
+ "overrides": [
725
+ {
726
+ "matcher": {
727
+ "id": "byName",
728
+ "options": "software_package"
729
+ },
730
+ "properties": [
731
+ {
732
+ "id": "custom.width",
733
+ "value": 444
734
+ }
735
+ ]
736
+ }
737
+ ]
738
+ },
739
+ "gridPos": {
740
+ "h": 8,
741
+ "w": 8,
742
+ "x": 4,
743
+ "y": 26
744
+ },
745
+ "id": 62,
746
+ "links": [],
747
+ "options": {
748
+ "cellHeight": "sm",
749
+ "footer": {
750
+ "countRows": false,
751
+ "fields": "",
752
+ "reducer": ["sum"],
753
+ "show": false
754
+ },
755
+ "showHeader": true,
756
+ "sortBy": []
757
+ },
758
+ "pluginVersion": "10.0.2",
759
+ "targets": [
760
+ {
761
+ "bucketAggs": [
762
+ {
763
+ "$$hashKey": "object:211",
764
+ "fake": true,
765
+ "field": "software_product",
766
+ "id": "3",
767
+ "settings": {
768
+ "min_doc_count": "1",
769
+ "order": "desc",
770
+ "orderBy": "_count",
771
+ "size": "0"
772
+ },
773
+ "type": "terms"
774
+ }
775
+ ],
776
+ "datasource": {
777
+ "type": "elasticsearch",
778
+ "uid": "wazuh_datasource_uid"
779
+ },
780
+ "metrics": [
781
+ {
782
+ "$$hashKey": "object:115",
783
+ "field": "select field",
784
+ "id": "1",
785
+ "type": "count"
786
+ }
787
+ ],
788
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
789
+ "queryType": "randomWalk",
790
+ "refId": "A",
791
+ "timeField": "timestamp"
792
+ }
793
+ ],
794
+ "title": "PROCESSES STARTED / SOFTWARE PACKAGE",
795
+ "type": "table"
796
+ },
797
+ {
798
+ "datasource": {
799
+ "type": "elasticsearch",
800
+ "uid": "wazuh_datasource_uid"
801
+ },
802
+ "fieldConfig": {
803
+ "defaults": {
804
+ "color": {
805
+ "mode": "palette-classic"
806
+ },
807
+ "custom": {
808
+ "axisCenteredZero": false,
809
+ "axisColorMode": "text",
810
+ "axisLabel": "",
811
+ "axisPlacement": "auto",
812
+ "barAlignment": 0,
813
+ "drawStyle": "bars",
814
+ "fillOpacity": 0,
815
+ "gradientMode": "none",
816
+ "hideFrom": {
817
+ "legend": false,
818
+ "tooltip": false,
819
+ "viz": false
820
+ },
821
+ "lineInterpolation": "linear",
822
+ "lineWidth": 1,
823
+ "pointSize": 5,
824
+ "scaleDistribution": {
825
+ "type": "linear"
826
+ },
827
+ "showPoints": "auto",
828
+ "spanNulls": false,
829
+ "stacking": {
830
+ "group": "A",
831
+ "mode": "normal"
832
+ },
833
+ "thresholdsStyle": {
834
+ "mode": "off"
835
+ }
836
+ },
837
+ "mappings": [],
838
+ "thresholds": {
839
+ "mode": "absolute",
840
+ "steps": [
841
+ {
842
+ "color": "green",
843
+ "value": null
844
+ },
845
+ {
846
+ "color": "red",
847
+ "value": 80
848
+ }
849
+ ]
850
+ }
851
+ },
852
+ "overrides": []
853
+ },
854
+ "gridPos": {
855
+ "h": 15,
856
+ "w": 12,
857
+ "x": 12,
858
+ "y": 26
859
+ },
860
+ "id": 68,
861
+ "options": {
862
+ "legend": {
863
+ "calcs": [],
864
+ "displayMode": "table",
865
+ "placement": "right",
866
+ "showLegend": true
867
+ },
868
+ "tooltip": {
869
+ "mode": "single",
870
+ "sort": "none"
871
+ }
872
+ },
873
+ "targets": [
874
+ {
875
+ "alias": "",
876
+ "bucketAggs": [
877
+ {
878
+ "field": "agent_name",
879
+ "id": "3",
880
+ "settings": {
881
+ "min_doc_count": "1",
882
+ "order": "desc",
883
+ "orderBy": "_term",
884
+ "size": "10"
885
+ },
886
+ "type": "terms"
887
+ },
888
+ {
889
+ "field": "timestamp",
890
+ "id": "2",
891
+ "settings": {
892
+ "interval": "auto"
893
+ },
894
+ "type": "date_histogram"
895
+ }
896
+ ],
897
+ "datasource": {
898
+ "type": "elasticsearch",
899
+ "uid": "wazuh_datasource_uid"
900
+ },
901
+ "metrics": [
902
+ {
903
+ "id": "1",
904
+ "type": "count"
905
+ }
906
+ ],
907
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
908
+ "refId": "A",
909
+ "timeField": "timestamp"
910
+ }
911
+ ],
912
+ "title": "TOP 10 AGENTS - HISTOGRAM",
913
+ "transparent": true,
914
+ "type": "timeseries"
915
+ },
916
+ {
917
+ "datasource": {
918
+ "type": "elasticsearch",
919
+ "uid": "wazuh_datasource_uid"
920
+ },
921
+ "fieldConfig": {
922
+ "defaults": {
923
+ "color": {
924
+ "mode": "palette-classic"
925
+ },
926
+ "custom": {
927
+ "hideFrom": {
928
+ "legend": false,
929
+ "tooltip": false,
930
+ "viz": false
931
+ }
932
+ },
933
+ "decimals": 0,
934
+ "mappings": [],
935
+ "unit": "short"
936
+ },
937
+ "overrides": []
938
+ },
939
+ "gridPos": {
940
+ "h": 7,
941
+ "w": 4,
942
+ "x": 0,
943
+ "y": 34
944
+ },
945
+ "id": 54,
946
+ "links": [],
947
+ "maxDataPoints": 3,
948
+ "options": {
949
+ "legend": {
950
+ "calcs": [],
951
+ "displayMode": "list",
952
+ "placement": "right",
953
+ "showLegend": false,
954
+ "values": ["value"]
955
+ },
956
+ "pieType": "donut",
957
+ "reduceOptions": {
958
+ "calcs": ["sum"],
959
+ "fields": "",
960
+ "values": false
961
+ },
962
+ "tooltip": {
963
+ "mode": "single",
964
+ "sort": "none"
965
+ }
966
+ },
967
+ "targets": [
968
+ {
969
+ "bucketAggs": [
970
+ {
971
+ "$$hashKey": "object:99",
972
+ "fake": true,
973
+ "field": "user_name",
974
+ "id": "3",
975
+ "settings": {
976
+ "min_doc_count": 1,
977
+ "order": "desc",
978
+ "orderBy": "_count",
979
+ "size": "10"
980
+ },
981
+ "type": "terms"
982
+ },
983
+ {
984
+ "$$hashKey": "object:100",
985
+ "field": "timestamp",
986
+ "id": "2",
987
+ "settings": {
988
+ "interval": "auto",
989
+ "min_doc_count": 0,
990
+ "trimEdges": 0
991
+ },
992
+ "type": "date_histogram"
993
+ }
994
+ ],
995
+ "datasource": {
996
+ "type": "elasticsearch",
997
+ "uid": "wazuh_datasource_uid"
998
+ },
999
+ "metrics": [
1000
+ {
1001
+ "$$hashKey": "object:97",
1002
+ "field": "select field",
1003
+ "id": "1",
1004
+ "type": "count"
1005
+ }
1006
+ ],
1007
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\") AND agent_name:$agent_name",
1008
+ "refId": "A",
1009
+ "timeField": "timestamp"
1010
+ }
1011
+ ],
1012
+ "title": "USER/ACCOUNTS",
1013
+ "type": "piechart"
1014
+ },
1015
+ {
1016
+ "datasource": {
1017
+ "type": "elasticsearch",
1018
+ "uid": "wazuh_datasource_uid"
1019
+ },
1020
+ "fieldConfig": {
1021
+ "defaults": {
1022
+ "color": {
1023
+ "mode": "thresholds"
1024
+ },
1025
+ "custom": {
1026
+ "align": "auto",
1027
+ "cellOptions": {
1028
+ "type": "auto"
1029
+ },
1030
+ "inspect": false
1031
+ },
1032
+ "decimals": 0,
1033
+ "mappings": [],
1034
+ "thresholds": {
1035
+ "mode": "absolute",
1036
+ "steps": [
1037
+ {
1038
+ "color": "green",
1039
+ "value": null
1040
+ },
1041
+ {
1042
+ "color": "red",
1043
+ "value": 80
1044
+ }
1045
+ ]
1046
+ },
1047
+ "unit": "short"
1048
+ },
1049
+ "overrides": [
1050
+ {
1051
+ "matcher": {
1052
+ "id": "byName",
1053
+ "options": "user_name"
1054
+ },
1055
+ "properties": [
1056
+ {
1057
+ "id": "custom.width",
1058
+ "value": 445
1059
+ }
1060
+ ]
1061
+ }
1062
+ ]
1063
+ },
1064
+ "gridPos": {
1065
+ "h": 7,
1066
+ "w": 8,
1067
+ "x": 4,
1068
+ "y": 34
1069
+ },
1070
+ "id": 63,
1071
+ "links": [],
1072
+ "maxDataPoints": 3,
1073
+ "options": {
1074
+ "cellHeight": "sm",
1075
+ "footer": {
1076
+ "countRows": false,
1077
+ "fields": "",
1078
+ "reducer": ["sum"],
1079
+ "show": false
1080
+ },
1081
+ "showHeader": true,
1082
+ "sortBy": []
1083
+ },
1084
+ "pluginVersion": "10.0.2",
1085
+ "targets": [
1086
+ {
1087
+ "bucketAggs": [
1088
+ {
1089
+ "$$hashKey": "object:99",
1090
+ "fake": true,
1091
+ "field": "user_name",
1092
+ "id": "3",
1093
+ "settings": {
1094
+ "min_doc_count": 1,
1095
+ "order": "desc",
1096
+ "orderBy": "_count",
1097
+ "size": "0"
1098
+ },
1099
+ "type": "terms"
1100
+ }
1101
+ ],
1102
+ "datasource": {
1103
+ "type": "elasticsearch",
1104
+ "uid": "wazuh_datasource_uid"
1105
+ },
1106
+ "metrics": [
1107
+ {
1108
+ "$$hashKey": "object:97",
1109
+ "field": "select field",
1110
+ "id": "1",
1111
+ "type": "count"
1112
+ }
1113
+ ],
1114
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\") AND agent_name:$agent_name",
1115
+ "refId": "A",
1116
+ "timeField": "timestamp"
1117
+ }
1118
+ ],
1119
+ "title": "USER/ACCOUNTS",
1120
+ "type": "table"
1121
+ },
1122
+ {
1123
+ "datasource": {
1124
+ "type": "elasticsearch",
1125
+ "uid": "wazuh_datasource_uid"
1126
+ },
1127
+ "fieldConfig": {
1128
+ "defaults": {
1129
+ "mappings": [],
1130
+ "thresholds": {
1131
+ "mode": "absolute",
1132
+ "steps": [
1133
+ {
1134
+ "color": "green",
1135
+ "value": null
1136
+ },
1137
+ {
1138
+ "color": "red",
1139
+ "value": 80
1140
+ }
1141
+ ]
1142
+ }
1143
+ },
1144
+ "overrides": []
1145
+ },
1146
+ "gridPos": {
1147
+ "h": 8,
1148
+ "w": 12,
1149
+ "x": 0,
1150
+ "y": 41
1151
+ },
1152
+ "id": 37,
1153
+ "options": {
1154
+ "displayMode": "gradient",
1155
+ "minVizHeight": 10,
1156
+ "minVizWidth": 0,
1157
+ "orientation": "horizontal",
1158
+ "reduceOptions": {
1159
+ "calcs": ["sum"],
1160
+ "fields": "",
1161
+ "values": false
1162
+ },
1163
+ "showUnfilled": true,
1164
+ "text": {},
1165
+ "valueMode": "color"
1166
+ },
1167
+ "pluginVersion": "10.0.2",
1168
+ "targets": [
1169
+ {
1170
+ "bucketAggs": [
1171
+ {
1172
+ "fake": true,
1173
+ "field": "process_image",
1174
+ "id": "6",
1175
+ "settings": {
1176
+ "min_doc_count": 1,
1177
+ "order": "desc",
1178
+ "orderBy": "_count",
1179
+ "size": "10"
1180
+ },
1181
+ "type": "terms"
1182
+ },
1183
+ {
1184
+ "fake": true,
1185
+ "field": "timestamp",
1186
+ "id": "5",
1187
+ "settings": {
1188
+ "interval": "auto",
1189
+ "min_doc_count": 0,
1190
+ "trimEdges": 0
1191
+ },
1192
+ "type": "date_histogram"
1193
+ }
1194
+ ],
1195
+ "datasource": {
1196
+ "type": "elasticsearch",
1197
+ "uid": "wazuh_datasource_uid"
1198
+ },
1199
+ "metrics": [
1200
+ {
1201
+ "field": "type",
1202
+ "id": "1",
1203
+ "meta": {},
1204
+ "settings": {},
1205
+ "type": "count"
1206
+ }
1207
+ ],
1208
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
1209
+ "refId": "A",
1210
+ "timeField": "timestamp"
1211
+ }
1212
+ ],
1213
+ "title": "TOP 10 PROCESSES (PROCESS FILE PATH)",
1214
+ "type": "bargauge"
1215
+ },
1216
+ {
1217
+ "datasource": {
1218
+ "type": "elasticsearch",
1219
+ "uid": "wazuh_datasource_uid"
1220
+ },
1221
+ "fieldConfig": {
1222
+ "defaults": {
1223
+ "color": {
1224
+ "mode": "thresholds"
1225
+ },
1226
+ "custom": {
1227
+ "align": "auto",
1228
+ "cellOptions": {
1229
+ "type": "auto"
1230
+ },
1231
+ "inspect": false
1232
+ },
1233
+ "mappings": [],
1234
+ "thresholds": {
1235
+ "mode": "absolute",
1236
+ "steps": [
1237
+ {
1238
+ "color": "green",
1239
+ "value": null
1240
+ },
1241
+ {
1242
+ "color": "red",
1243
+ "value": 80
1244
+ }
1245
+ ]
1246
+ }
1247
+ },
1248
+ "overrides": [
1249
+ {
1250
+ "matcher": {
1251
+ "id": "byName",
1252
+ "options": "process_image"
1253
+ },
1254
+ "properties": [
1255
+ {
1256
+ "id": "custom.width",
1257
+ "value": 657
1258
+ }
1259
+ ]
1260
+ }
1261
+ ]
1262
+ },
1263
+ "gridPos": {
1264
+ "h": 16,
1265
+ "w": 12,
1266
+ "x": 12,
1267
+ "y": 41
1268
+ },
1269
+ "id": 64,
1270
+ "options": {
1271
+ "cellHeight": "sm",
1272
+ "footer": {
1273
+ "countRows": false,
1274
+ "fields": "",
1275
+ "reducer": ["sum"],
1276
+ "show": false
1277
+ },
1278
+ "showHeader": true,
1279
+ "sortBy": []
1280
+ },
1281
+ "pluginVersion": "10.0.2",
1282
+ "targets": [
1283
+ {
1284
+ "bucketAggs": [
1285
+ {
1286
+ "fake": true,
1287
+ "field": "process_image",
1288
+ "id": "6",
1289
+ "settings": {
1290
+ "min_doc_count": 1,
1291
+ "order": "desc",
1292
+ "orderBy": "_count",
1293
+ "size": "0"
1294
+ },
1295
+ "type": "terms"
1296
+ }
1297
+ ],
1298
+ "datasource": {
1299
+ "type": "elasticsearch",
1300
+ "uid": "wazuh_datasource_uid"
1301
+ },
1302
+ "metrics": [
1303
+ {
1304
+ "field": "type",
1305
+ "id": "1",
1306
+ "meta": {},
1307
+ "settings": {},
1308
+ "type": "count"
1309
+ }
1310
+ ],
1311
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
1312
+ "refId": "A",
1313
+ "timeField": "timestamp"
1314
+ }
1315
+ ],
1316
+ "title": "PROCESS FILE PATH (ALL)",
1317
+ "type": "table"
1318
+ },
1319
+ {
1320
+ "datasource": {
1321
+ "type": "elasticsearch",
1322
+ "uid": "wazuh_datasource_uid"
1323
+ },
1324
+ "fieldConfig": {
1325
+ "defaults": {
1326
+ "mappings": [],
1327
+ "thresholds": {
1328
+ "mode": "absolute",
1329
+ "steps": [
1330
+ {
1331
+ "color": "green",
1332
+ "value": null
1333
+ },
1334
+ {
1335
+ "color": "red",
1336
+ "value": 80
1337
+ }
1338
+ ]
1339
+ }
1340
+ },
1341
+ "overrides": []
1342
+ },
1343
+ "gridPos": {
1344
+ "h": 8,
1345
+ "w": 12,
1346
+ "x": 0,
1347
+ "y": 49
1348
+ },
1349
+ "id": 55,
1350
+ "options": {
1351
+ "displayMode": "gradient",
1352
+ "minVizHeight": 10,
1353
+ "minVizWidth": 0,
1354
+ "orientation": "horizontal",
1355
+ "reduceOptions": {
1356
+ "calcs": ["sum"],
1357
+ "fields": "",
1358
+ "values": false
1359
+ },
1360
+ "showUnfilled": true,
1361
+ "text": {},
1362
+ "valueMode": "color"
1363
+ },
1364
+ "pluginVersion": "10.0.2",
1365
+ "targets": [
1366
+ {
1367
+ "bucketAggs": [
1368
+ {
1369
+ "fake": true,
1370
+ "field": "process_image",
1371
+ "id": "6",
1372
+ "settings": {
1373
+ "min_doc_count": 1,
1374
+ "order": "asc",
1375
+ "orderBy": "_count",
1376
+ "size": "10"
1377
+ },
1378
+ "type": "terms"
1379
+ },
1380
+ {
1381
+ "fake": true,
1382
+ "field": "timestamp",
1383
+ "id": "5",
1384
+ "settings": {
1385
+ "interval": "auto",
1386
+ "min_doc_count": 0,
1387
+ "trimEdges": 0
1388
+ },
1389
+ "type": "date_histogram"
1390
+ }
1391
+ ],
1392
+ "datasource": {
1393
+ "type": "elasticsearch",
1394
+ "uid": "wazuh_datasource_uid"
1395
+ },
1396
+ "metrics": [
1397
+ {
1398
+ "field": "type",
1399
+ "id": "1",
1400
+ "meta": {},
1401
+ "settings": {},
1402
+ "type": "count"
1403
+ }
1404
+ ],
1405
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\") AND agent_name:$agent_name",
1406
+ "refId": "A",
1407
+ "timeField": "timestamp"
1408
+ }
1409
+ ],
1410
+ "title": "LEAST SEEN PROCESSES",
1411
+ "type": "bargauge"
1412
+ },
1413
+ {
1414
+ "datasource": {
1415
+ "type": "elasticsearch",
1416
+ "uid": "wazuh_datasource_uid"
1417
+ },
1418
+ "fieldConfig": {
1419
+ "defaults": {
1420
+ "color": {
1421
+ "mode": "thresholds"
1422
+ },
1423
+ "custom": {
1424
+ "align": "auto",
1425
+ "cellOptions": {
1426
+ "type": "auto"
1427
+ },
1428
+ "inspect": false
1429
+ },
1430
+ "mappings": [],
1431
+ "thresholds": {
1432
+ "mode": "absolute",
1433
+ "steps": [
1434
+ {
1435
+ "color": "green",
1436
+ "value": null
1437
+ },
1438
+ {
1439
+ "color": "red",
1440
+ "value": 80
1441
+ }
1442
+ ]
1443
+ },
1444
+ "unit": "none"
1445
+ },
1446
+ "overrides": [
1447
+ {
1448
+ "matcher": {
1449
+ "id": "byName",
1450
+ "options": "timestamp"
1451
+ },
1452
+ "properties": [
1453
+ {
1454
+ "id": "displayName",
1455
+ "value": "DATE/TIME"
1456
+ },
1457
+ {
1458
+ "id": "unit",
1459
+ "value": "time: YYYY-MM-DD HH:mm:ss"
1460
+ },
1461
+ {
1462
+ "id": "custom.align"
1463
+ }
1464
+ ]
1465
+ },
1466
+ {
1467
+ "matcher": {
1468
+ "id": "byName",
1469
+ "options": "process_name"
1470
+ },
1471
+ "properties": [
1472
+ {
1473
+ "id": "displayName",
1474
+ "value": "PROCESS"
1475
+ },
1476
+ {
1477
+ "id": "unit",
1478
+ "value": "short"
1479
+ },
1480
+ {
1481
+ "id": "decimals",
1482
+ "value": -1
1483
+ },
1484
+ {
1485
+ "id": "custom.align"
1486
+ }
1487
+ ]
1488
+ },
1489
+ {
1490
+ "matcher": {
1491
+ "id": "byName",
1492
+ "options": "process_id"
1493
+ },
1494
+ "properties": [
1495
+ {
1496
+ "id": "displayName",
1497
+ "value": "PID"
1498
+ },
1499
+ {
1500
+ "id": "unit",
1501
+ "value": "none"
1502
+ },
1503
+ {
1504
+ "id": "decimals",
1505
+ "value": -2
1506
+ },
1507
+ {
1508
+ "id": "custom.align"
1509
+ }
1510
+ ]
1511
+ },
1512
+ {
1513
+ "matcher": {
1514
+ "id": "byName",
1515
+ "options": "process_image"
1516
+ },
1517
+ "properties": [
1518
+ {
1519
+ "id": "displayName",
1520
+ "value": "PROCESS IMAGE"
1521
+ },
1522
+ {
1523
+ "id": "unit",
1524
+ "value": "short"
1525
+ },
1526
+ {
1527
+ "id": "decimals",
1528
+ "value": 2
1529
+ },
1530
+ {
1531
+ "id": "custom.align"
1532
+ }
1533
+ ]
1534
+ },
1535
+ {
1536
+ "matcher": {
1537
+ "id": "byName",
1538
+ "options": "user_name"
1539
+ },
1540
+ "properties": [
1541
+ {
1542
+ "id": "displayName",
1543
+ "value": "USER/ACCOUNT"
1544
+ },
1545
+ {
1546
+ "id": "unit",
1547
+ "value": "short"
1548
+ },
1549
+ {
1550
+ "id": "decimals",
1551
+ "value": 2
1552
+ },
1553
+ {
1554
+ "id": "custom.align"
1555
+ }
1556
+ ]
1557
+ },
1558
+ {
1559
+ "matcher": {
1560
+ "id": "byName",
1561
+ "options": "agent_name"
1562
+ },
1563
+ "properties": [
1564
+ {
1565
+ "id": "displayName",
1566
+ "value": "AGENT"
1567
+ },
1568
+ {
1569
+ "id": "unit",
1570
+ "value": "short"
1571
+ },
1572
+ {
1573
+ "id": "decimals",
1574
+ "value": 2
1575
+ },
1576
+ {
1577
+ "id": "custom.align"
1578
+ }
1579
+ ]
1580
+ },
1581
+ {
1582
+ "matcher": {
1583
+ "id": "byName",
1584
+ "options": "parent_process_image"
1585
+ },
1586
+ "properties": [
1587
+ {
1588
+ "id": "displayName",
1589
+ "value": "PARENT PROCESS"
1590
+ },
1591
+ {
1592
+ "id": "unit",
1593
+ "value": "none"
1594
+ },
1595
+ {
1596
+ "id": "decimals",
1597
+ "value": 0
1598
+ },
1599
+ {
1600
+ "id": "custom.align"
1601
+ }
1602
+ ]
1603
+ },
1604
+ {
1605
+ "matcher": {
1606
+ "id": "byName",
1607
+ "options": "process_cmd_line"
1608
+ },
1609
+ "properties": [
1610
+ {
1611
+ "id": "displayName",
1612
+ "value": "PROCESS CMD LINE"
1613
+ },
1614
+ {
1615
+ "id": "unit",
1616
+ "value": "short"
1617
+ },
1618
+ {
1619
+ "id": "decimals",
1620
+ "value": 2
1621
+ },
1622
+ {
1623
+ "id": "custom.align"
1624
+ }
1625
+ ]
1626
+ },
1627
+ {
1628
+ "matcher": {
1629
+ "id": "byName",
1630
+ "options": "EVENT ID"
1631
+ },
1632
+ "properties": [
1633
+ {
1634
+ "id": "links",
1635
+ "value": [
1636
+ {
1637
+ "targetBlank": true,
1638
+ "title": "VIEW EVENT DETAILS",
1639
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
1640
+ }
1641
+ ]
1642
+ }
1643
+ ]
1644
+ }
1645
+ ]
1646
+ },
1647
+ "gridPos": {
1648
+ "h": 18,
1649
+ "w": 24,
1650
+ "x": 0,
1651
+ "y": 57
1652
+ },
1653
+ "id": 51,
1654
+ "options": {
1655
+ "cellHeight": "sm",
1656
+ "footer": {
1657
+ "countRows": false,
1658
+ "fields": "",
1659
+ "reducer": ["sum"],
1660
+ "show": false
1661
+ },
1662
+ "showHeader": true
1663
+ },
1664
+ "pluginVersion": "10.0.2",
1665
+ "targets": [
1666
+ {
1667
+ "bucketAggs": [],
1668
+ "datasource": {
1669
+ "type": "elasticsearch",
1670
+ "uid": "wazuh_datasource_uid"
1671
+ },
1672
+ "metrics": [
1673
+ {
1674
+ "id": "1",
1675
+ "settings": {
1676
+ "size": "250"
1677
+ },
1678
+ "type": "raw_data"
1679
+ }
1680
+ ],
1681
+ "query": "(rule_group3:sysmon_event1 OR rule_group2:\"list_processes\" OR rule_group2:\"process_events\") AND agent_name:$agent_name",
1682
+ "refId": "A",
1683
+ "timeField": "timestamp"
1684
+ }
1685
+ ],
1686
+ "title": "PROCESS ACTIVITY",
1687
+ "transformations": [
1688
+ {
1689
+ "id": "filterFieldsByName",
1690
+ "options": {
1691
+ "include": {
1692
+ "names": [
1693
+ "timestamp",
1694
+ "_id",
1695
+ "agent_name",
1696
+ "parent_cmd_line",
1697
+ "parent_process_id",
1698
+ "parent_process_image",
1699
+ "parent_process_user",
1700
+ "process_cmd_line",
1701
+ "process_id",
1702
+ "process_image",
1703
+ "user_name",
1704
+ "syslog_level"
1705
+ ]
1706
+ }
1707
+ }
1708
+ },
1709
+ {
1710
+ "id": "organize",
1711
+ "options": {
1712
+ "excludeByName": {},
1713
+ "indexByName": {
1714
+ "_id": 1,
1715
+ "agent_name": 2,
1716
+ "parent_cmd_line": 9,
1717
+ "parent_process_id": 8,
1718
+ "parent_process_image": 7,
1719
+ "parent_process_user": 10,
1720
+ "process_cmd_line": 5,
1721
+ "process_id": 4,
1722
+ "process_image": 3,
1723
+ "timestamp": 0,
1724
+ "user_name": 6
1725
+ },
1726
+ "renameByName": {
1727
+ "_id": "EVENT ID",
1728
+ "agent_name": "",
1729
+ "parent_cmd_line": "PARENT CMD",
1730
+ "parent_process_id": "PARENT PID",
1731
+ "parent_process_user": "PARENT USER",
1732
+ "syslog_level": "LEVEL"
1733
+ }
1734
+ }
1735
+ }
1736
+ ],
1737
+ "type": "table"
1738
+ }
1739
+ ],
1740
+ "refresh": "",
1741
+ "schemaVersion": 38,
1742
+ "style": "dark",
1743
+ "tags": ["EDR"],
1744
+ "templating": {
1745
+ "list": [
1746
+ {
1747
+ "datasource": {
1748
+ "type": "elasticsearch",
1749
+ "uid": "wazuh_datasource_uid"
1750
+ },
1751
+ "filters": [],
1752
+ "hide": 0,
1753
+ "label": "",
1754
+ "name": "Filters",
1755
+ "skipUrlSync": false,
1756
+ "type": "adhoc"
1757
+ },
1758
+ {
1759
+ "current": {
1760
+ "selected": false,
1761
+ "text": "All",
1762
+ "value": "$__all"
1763
+ },
1764
+ "datasource": {
1765
+ "type": "elasticsearch",
1766
+ "uid": "wazuh_datasource_uid"
1767
+ },
1768
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event1 OR rule_group2:\\\"list_processes\\\" OR rule_group2:\\\"process_events\\\"\"}",
1769
+ "hide": 0,
1770
+ "includeAll": true,
1771
+ "label": "Agent",
1772
+ "multi": false,
1773
+ "name": "agent_name",
1774
+ "options": [],
1775
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_group3:sysmon_event1 OR rule_group2:\\\"list_processes\\\" OR rule_group2:\\\"process_events\\\"\"}",
1776
+ "refresh": 2,
1777
+ "regex": "",
1778
+ "skipUrlSync": false,
1779
+ "sort": 2,
1780
+ "tagValuesQuery": "",
1781
+ "tagsQuery": "",
1782
+ "type": "query",
1783
+ "useTags": false
1784
+ },
1785
+ {
1786
+ "current": {
1787
+ "selected": false,
1788
+ "text": "ATBroker.exe",
1789
+ "value": "ATBroker.exe"
1790
+ },
1791
+ "datasource": {
1792
+ "type": "elasticsearch",
1793
+ "uid": "wazuh_datasource_uid"
1794
+ },
1795
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_name\", \"query\": \"rule_group3:sysmon_event1\"}",
1796
+ "hide": 2,
1797
+ "includeAll": false,
1798
+ "multi": false,
1799
+ "name": "process_name",
1800
+ "options": [],
1801
+ "query": "{ \"find\": \"terms\", \"field\": \"process_name\", \"query\": \"rule_group3:sysmon_event1\"}",
1802
+ "refresh": 1,
1803
+ "regex": "",
1804
+ "skipUrlSync": false,
1805
+ "sort": 0,
1806
+ "tagValuesQuery": "",
1807
+ "tagsQuery": "",
1808
+ "type": "query",
1809
+ "useTags": false
1810
+ },
1811
+ {
1812
+ "current": {
1813
+ "isNone": true,
1814
+ "selected": false,
1815
+ "text": "None",
1816
+ "value": ""
1817
+ },
1818
+ "datasource": {
1819
+ "type": "elasticsearch",
1820
+ "uid": "wazuh_datasource_uid"
1821
+ },
1822
+ "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1823
+ "hide": 2,
1824
+ "includeAll": false,
1825
+ "multi": false,
1826
+ "name": "parent_process_cmd_line",
1827
+ "options": [],
1828
+ "query": "{ \"find\": \"terms\", \"field\": \"parent_process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1829
+ "refresh": 1,
1830
+ "regex": "",
1831
+ "skipUrlSync": false,
1832
+ "sort": 0,
1833
+ "tagValuesQuery": "",
1834
+ "tagsQuery": "",
1835
+ "type": "query",
1836
+ "useTags": false
1837
+ },
1838
+ {
1839
+ "current": {
1840
+ "selected": false,
1841
+ "text": "1116",
1842
+ "value": "1116"
1843
+ },
1844
+ "datasource": {
1845
+ "type": "elasticsearch",
1846
+ "uid": "wazuh_datasource_uid"
1847
+ },
1848
+ "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1849
+ "hide": 2,
1850
+ "includeAll": false,
1851
+ "multi": false,
1852
+ "name": "parent_process_id",
1853
+ "options": [],
1854
+ "query": "{ \"find\": \"terms\", \"field\": \"parent_process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1855
+ "refresh": 1,
1856
+ "regex": "",
1857
+ "skipUrlSync": false,
1858
+ "sort": 0,
1859
+ "tagValuesQuery": "",
1860
+ "tagsQuery": "",
1861
+ "type": "query",
1862
+ "useTags": false
1863
+ },
1864
+ {
1865
+ "current": {
1866
+ "selected": false,
1867
+ "text": "C:\\\\Program Files\\\\Windows Defender\\\\MsMpEng.exe",
1868
+ "value": "C:\\\\Program Files\\\\Windows Defender\\\\MsMpEng.exe"
1869
+ },
1870
+ "datasource": {
1871
+ "type": "elasticsearch",
1872
+ "uid": "wazuh_datasource_uid"
1873
+ },
1874
+ "definition": "{ \"find\": \"terms\", \"field\": \"parent_process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1875
+ "hide": 2,
1876
+ "includeAll": false,
1877
+ "multi": false,
1878
+ "name": "parent_process_image",
1879
+ "options": [],
1880
+ "query": "{ \"find\": \"terms\", \"field\": \"parent_process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1881
+ "refresh": 1,
1882
+ "regex": "",
1883
+ "skipUrlSync": false,
1884
+ "sort": 0,
1885
+ "tagValuesQuery": "",
1886
+ "tagsQuery": "",
1887
+ "type": "query",
1888
+ "useTags": false
1889
+ },
1890
+ {
1891
+ "current": {
1892
+ "selected": false,
1893
+ "text": "C:\\\\Program Files (x86)\\\\ossec-agent\\\\win32ui.exe",
1894
+ "value": "C:\\\\Program Files (x86)\\\\ossec-agent\\\\win32ui.exe"
1895
+ },
1896
+ "datasource": {
1897
+ "type": "elasticsearch",
1898
+ "uid": "wazuh_datasource_uid"
1899
+ },
1900
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1901
+ "hide": 2,
1902
+ "includeAll": false,
1903
+ "multi": false,
1904
+ "name": "process_image",
1905
+ "options": [],
1906
+ "query": "{ \"find\": \"terms\", \"field\": \"process_image\", \"query\": \"rule_group3:sysmon_event1\"}",
1907
+ "refresh": 1,
1908
+ "regex": "",
1909
+ "skipUrlSync": false,
1910
+ "sort": 0,
1911
+ "tagValuesQuery": "",
1912
+ "tagsQuery": "",
1913
+ "type": "query",
1914
+ "useTags": false
1915
+ },
1916
+ {
1917
+ "current": {
1918
+ "selected": false,
1919
+ "text": "C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\22E50B25-5610-443E-8B86-5C4B68534EDB\\\\dismhost.exe {DBDD6140-3B52-4E05-AB44-5FF8625E4742}",
1920
+ "value": "C:\\\\Users\\\\ADMINI~1\\\\AppData\\\\Local\\\\Temp\\\\22E50B25-5610-443E-8B86-5C4B68534EDB\\\\dismhost.exe {DBDD6140-3B52-4E05-AB44-5FF8625E4742}"
1921
+ },
1922
+ "datasource": {
1923
+ "type": "elasticsearch",
1924
+ "uid": "wazuh_datasource_uid"
1925
+ },
1926
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1927
+ "hide": 2,
1928
+ "includeAll": false,
1929
+ "multi": false,
1930
+ "name": "process_cmd_line",
1931
+ "options": [],
1932
+ "query": "{ \"find\": \"terms\", \"field\": \"process_cmd_line\", \"query\": \"rule_group3:sysmon_event1\"}",
1933
+ "refresh": 1,
1934
+ "regex": "",
1935
+ "skipUrlSync": false,
1936
+ "sort": 0,
1937
+ "tagValuesQuery": "",
1938
+ "tagsQuery": "",
1939
+ "type": "query",
1940
+ "useTags": false
1941
+ },
1942
+ {
1943
+ "current": {
1944
+ "selected": false,
1945
+ "text": "1108",
1946
+ "value": "1108"
1947
+ },
1948
+ "datasource": {
1949
+ "type": "elasticsearch",
1950
+ "uid": "wazuh_datasource_uid"
1951
+ },
1952
+ "definition": "{ \"find\": \"terms\", \"field\": \"process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1953
+ "hide": 2,
1954
+ "includeAll": false,
1955
+ "multi": false,
1956
+ "name": "process_id",
1957
+ "options": [],
1958
+ "query": "{ \"find\": \"terms\", \"field\": \"process_id\", \"query\": \"rule_group3:sysmon_event1\"}",
1959
+ "refresh": 1,
1960
+ "regex": "",
1961
+ "skipUrlSync": false,
1962
+ "sort": 0,
1963
+ "tagValuesQuery": "",
1964
+ "tagsQuery": "",
1965
+ "type": "query",
1966
+ "useTags": false
1967
+ }
1968
+ ]
1969
+ },
1970
+ "time": {
1971
+ "from": "now-6h",
1972
+ "to": "now"
1973
+ },
1974
+ "timepicker": {
1975
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1976
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1977
+ },
1978
+ "timezone": "",
1979
+ "title": "EDR - SYSTEM PROCESSES",
1980
+ "version": 2,
1981
+ "weekStart": ""
1982
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_system_security_audit.json
new
+1922
@@ -0,0 +1,1922 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194363330,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "datasource": {
45
+ "type": "elasticsearch",
46
+ "uid": "wazuh_datasource_uid"
47
+ },
48
+ "fieldConfig": {
49
+ "defaults": {
50
+ "mappings": [
51
+ {
52
+ "options": {
53
+ "match": "null",
54
+ "result": {
55
+ "text": "N/A"
56
+ }
57
+ },
58
+ "type": "special"
59
+ }
60
+ ],
61
+ "thresholds": {
62
+ "mode": "absolute",
63
+ "steps": [
64
+ {
65
+ "color": "blue",
66
+ "value": null
67
+ }
68
+ ]
69
+ },
70
+ "unit": "none"
71
+ },
72
+ "overrides": []
73
+ },
74
+ "gridPos": {
75
+ "h": 7,
76
+ "w": 4,
77
+ "x": 0,
78
+ "y": 0
79
+ },
80
+ "id": 43,
81
+ "links": [],
82
+ "options": {
83
+ "colorMode": "value",
84
+ "graphMode": "area",
85
+ "justifyMode": "auto",
86
+ "orientation": "horizontal",
87
+ "reduceOptions": {
88
+ "calcs": ["sum"],
89
+ "fields": "",
90
+ "values": false
91
+ },
92
+ "text": {},
93
+ "textMode": "auto"
94
+ },
95
+ "pluginVersion": "9.0.0",
96
+ "targets": [
97
+ {
98
+ "bucketAggs": [
99
+ {
100
+ "$$hashKey": "object:183",
101
+ "field": "timestamp",
102
+ "id": "2",
103
+ "settings": {
104
+ "interval": "auto",
105
+ "min_doc_count": 0,
106
+ "trimEdges": 0
107
+ },
108
+ "type": "date_histogram"
109
+ }
110
+ ],
111
+ "metrics": [
112
+ {
113
+ "$$hashKey": "object:181",
114
+ "field": "select field",
115
+ "id": "1",
116
+ "type": "count"
117
+ }
118
+ ],
119
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
120
+ "refId": "A",
121
+ "timeField": "timestamp"
122
+ }
123
+ ],
124
+ "title": "EVENTS",
125
+ "type": "stat"
126
+ },
127
+ {
128
+ "datasource": {
129
+ "type": "elasticsearch",
130
+ "uid": "wazuh_datasource_uid"
131
+ },
132
+ "fieldConfig": {
133
+ "defaults": {
134
+ "color": {
135
+ "mode": "thresholds"
136
+ },
137
+ "custom": {
138
+ "align": "auto",
139
+ "displayMode": "auto",
140
+ "inspect": false
141
+ },
142
+ "mappings": [],
143
+ "thresholds": {
144
+ "mode": "absolute",
145
+ "steps": [
146
+ {
147
+ "color": "blue",
148
+ "value": null
149
+ }
150
+ ]
151
+ }
152
+ },
153
+ "overrides": [
154
+ {
155
+ "matcher": {
156
+ "id": "byName",
157
+ "options": "Time"
158
+ },
159
+ "properties": [
160
+ {
161
+ "id": "displayName",
162
+ "value": "Time"
163
+ },
164
+ {
165
+ "id": "unit",
166
+ "value": "time: YYYY-MM-DD HH:mm:ss"
167
+ },
168
+ {
169
+ "id": "custom.align"
170
+ }
171
+ ]
172
+ },
173
+ {
174
+ "matcher": {
175
+ "id": "byName",
176
+ "options": "Count"
177
+ },
178
+ "properties": [
179
+ {
180
+ "id": "displayName",
181
+ "value": "EVENTS"
182
+ },
183
+ {
184
+ "id": "unit",
185
+ "value": "short"
186
+ },
187
+ {
188
+ "id": "decimals",
189
+ "value": -1
190
+ },
191
+ {
192
+ "id": "custom.align"
193
+ }
194
+ ]
195
+ },
196
+ {
197
+ "matcher": {
198
+ "id": "byName",
199
+ "options": "agent_name"
200
+ },
201
+ "properties": [
202
+ {
203
+ "id": "custom.width",
204
+ "value": 388
205
+ }
206
+ ]
207
+ }
208
+ ]
209
+ },
210
+ "gridPos": {
211
+ "h": 7,
212
+ "w": 8,
213
+ "x": 4,
214
+ "y": 0
215
+ },
216
+ "id": 31,
217
+ "options": {
218
+ "footer": {
219
+ "fields": "",
220
+ "reducer": ["sum"],
221
+ "show": false
222
+ },
223
+ "showHeader": true,
224
+ "sortBy": []
225
+ },
226
+ "pluginVersion": "9.0.0",
227
+ "targets": [
228
+ {
229
+ "bucketAggs": [
230
+ {
231
+ "$$hashKey": "object:65",
232
+ "fake": true,
233
+ "field": "agent_name",
234
+ "id": "4",
235
+ "settings": {
236
+ "min_doc_count": 1,
237
+ "order": "desc",
238
+ "orderBy": "_count",
239
+ "size": "0"
240
+ },
241
+ "type": "terms"
242
+ }
243
+ ],
244
+ "metrics": [
245
+ {
246
+ "$$hashKey": "object:63",
247
+ "field": "select field",
248
+ "id": "1",
249
+ "type": "count"
250
+ }
251
+ ],
252
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
253
+ "refId": "A",
254
+ "timeField": "timestamp"
255
+ }
256
+ ],
257
+ "title": "EVENTS BY AGENT",
258
+ "transformations": [
259
+ {
260
+ "id": "merge",
261
+ "options": {
262
+ "reducers": []
263
+ }
264
+ }
265
+ ],
266
+ "type": "table"
267
+ },
268
+ {
269
+ "datasource": {
270
+ "type": "elasticsearch",
271
+ "uid": "wazuh_datasource_uid"
272
+ },
273
+ "fieldConfig": {
274
+ "defaults": {
275
+ "color": {
276
+ "mode": "thresholds"
277
+ },
278
+ "custom": {
279
+ "align": "auto",
280
+ "displayMode": "auto",
281
+ "inspect": false
282
+ },
283
+ "mappings": [],
284
+ "thresholds": {
285
+ "mode": "absolute",
286
+ "steps": [
287
+ {
288
+ "color": "dark-orange",
289
+ "value": null
290
+ }
291
+ ]
292
+ }
293
+ },
294
+ "overrides": [
295
+ {
296
+ "matcher": {
297
+ "id": "byName",
298
+ "options": "Count"
299
+ },
300
+ "properties": [
301
+ {
302
+ "id": "displayName",
303
+ "value": "EVENTS"
304
+ },
305
+ {
306
+ "id": "unit",
307
+ "value": "short"
308
+ },
309
+ {
310
+ "id": "decimals",
311
+ "value": -1
312
+ },
313
+ {
314
+ "id": "custom.align"
315
+ },
316
+ {
317
+ "id": "thresholds",
318
+ "value": {
319
+ "mode": "absolute",
320
+ "steps": [
321
+ {
322
+ "color": "rgba(50, 172, 45, 0.97)",
323
+ "value": null
324
+ },
325
+ {
326
+ "color": "rgba(237, 129, 40, 0.89)",
327
+ "value": 0
328
+ },
329
+ {
330
+ "color": "#FA6400",
331
+ "value": 1
332
+ }
333
+ ]
334
+ }
335
+ }
336
+ ]
337
+ },
338
+ {
339
+ "matcher": {
340
+ "id": "byName",
341
+ "options": "rule_description"
342
+ },
343
+ "properties": [
344
+ {
345
+ "id": "displayName",
346
+ "value": "ALERTS BY TYPE"
347
+ },
348
+ {
349
+ "id": "unit",
350
+ "value": "short"
351
+ },
352
+ {
353
+ "id": "decimals",
354
+ "value": -1
355
+ },
356
+ {
357
+ "id": "custom.align"
358
+ }
359
+ ]
360
+ },
361
+ {
362
+ "matcher": {
363
+ "id": "byName",
364
+ "options": "ALERTS BY TYPE"
365
+ },
366
+ "properties": [
367
+ {
368
+ "id": "custom.width",
369
+ "value": 717
370
+ }
371
+ ]
372
+ }
373
+ ]
374
+ },
375
+ "gridPos": {
376
+ "h": 7,
377
+ "w": 12,
378
+ "x": 12,
379
+ "y": 0
380
+ },
381
+ "id": 44,
382
+ "options": {
383
+ "footer": {
384
+ "fields": "",
385
+ "reducer": ["sum"],
386
+ "show": false
387
+ },
388
+ "showHeader": true,
389
+ "sortBy": []
390
+ },
391
+ "pluginVersion": "9.0.0",
392
+ "targets": [
393
+ {
394
+ "bucketAggs": [
395
+ {
396
+ "$$hashKey": "object:206",
397
+ "fake": true,
398
+ "field": "rule_description",
399
+ "id": "4",
400
+ "settings": {
401
+ "min_doc_count": 1,
402
+ "order": "desc",
403
+ "orderBy": "_term",
404
+ "size": "0"
405
+ },
406
+ "type": "terms"
407
+ }
408
+ ],
409
+ "metrics": [
410
+ {
411
+ "$$hashKey": "object:204",
412
+ "field": "select field",
413
+ "id": "1",
414
+ "type": "count"
415
+ }
416
+ ],
417
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
418
+ "refId": "A",
419
+ "timeField": "timestamp"
420
+ }
421
+ ],
422
+ "title": "ALERTS BY TYPE",
423
+ "transformations": [
424
+ {
425
+ "id": "merge",
426
+ "options": {
427
+ "reducers": []
428
+ }
429
+ }
430
+ ],
431
+ "type": "table"
432
+ },
433
+ {
434
+ "datasource": {
435
+ "type": "elasticsearch",
436
+ "uid": "wazuh_datasource_uid"
437
+ },
438
+ "fieldConfig": {
439
+ "defaults": {
440
+ "color": {
441
+ "mode": "palette-classic"
442
+ },
443
+ "custom": {
444
+ "hideFrom": {
445
+ "legend": false,
446
+ "tooltip": false,
447
+ "viz": false
448
+ }
449
+ },
450
+ "decimals": 0,
451
+ "mappings": [],
452
+ "unit": "short"
453
+ },
454
+ "overrides": [
455
+ {
456
+ "matcher": {
457
+ "id": "byName",
458
+ "options": "1"
459
+ },
460
+ "properties": [
461
+ {
462
+ "id": "color",
463
+ "value": {
464
+ "fixedColor": "#C8F2C2",
465
+ "mode": "fixed"
466
+ }
467
+ }
468
+ ]
469
+ },
470
+ {
471
+ "matcher": {
472
+ "id": "byName",
473
+ "options": "2"
474
+ },
475
+ "properties": [
476
+ {
477
+ "id": "color",
478
+ "value": {
479
+ "fixedColor": "#96D98D",
480
+ "mode": "fixed"
481
+ }
482
+ }
483
+ ]
484
+ },
485
+ {
486
+ "matcher": {
487
+ "id": "byName",
488
+ "options": "3"
489
+ },
490
+ "properties": [
491
+ {
492
+ "id": "color",
493
+ "value": {
494
+ "fixedColor": "#56A64B",
495
+ "mode": "fixed"
496
+ }
497
+ }
498
+ ]
499
+ },
500
+ {
501
+ "matcher": {
502
+ "id": "byName",
503
+ "options": "4"
504
+ },
505
+ "properties": [
506
+ {
507
+ "id": "color",
508
+ "value": {
509
+ "fixedColor": "#37872D",
510
+ "mode": "fixed"
511
+ }
512
+ }
513
+ ]
514
+ },
515
+ {
516
+ "matcher": {
517
+ "id": "byName",
518
+ "options": "5"
519
+ },
520
+ "properties": [
521
+ {
522
+ "id": "color",
523
+ "value": {
524
+ "fixedColor": "#FFF899",
525
+ "mode": "fixed"
526
+ }
527
+ }
528
+ ]
529
+ },
530
+ {
531
+ "matcher": {
532
+ "id": "byName",
533
+ "options": "7"
534
+ },
535
+ "properties": [
536
+ {
537
+ "id": "color",
538
+ "value": {
539
+ "fixedColor": "#F2CC0C",
540
+ "mode": "fixed"
541
+ }
542
+ }
543
+ ]
544
+ },
545
+ {
546
+ "matcher": {
547
+ "id": "byName",
548
+ "options": "9"
549
+ },
550
+ "properties": [
551
+ {
552
+ "id": "color",
553
+ "value": {
554
+ "fixedColor": "#E0B400",
555
+ "mode": "fixed"
556
+ }
557
+ }
558
+ ]
559
+ },
560
+ {
561
+ "matcher": {
562
+ "id": "byName",
563
+ "options": "10"
564
+ },
565
+ "properties": [
566
+ {
567
+ "id": "color",
568
+ "value": {
569
+ "fixedColor": "#FFCB7D",
570
+ "mode": "fixed"
571
+ }
572
+ }
573
+ ]
574
+ },
575
+ {
576
+ "matcher": {
577
+ "id": "byName",
578
+ "options": "12"
579
+ },
580
+ "properties": [
581
+ {
582
+ "id": "color",
583
+ "value": {
584
+ "fixedColor": "#FFA6B0",
585
+ "mode": "fixed"
586
+ }
587
+ }
588
+ ]
589
+ },
590
+ {
591
+ "matcher": {
592
+ "id": "byName",
593
+ "options": "13"
594
+ },
595
+ "properties": [
596
+ {
597
+ "id": "color",
598
+ "value": {
599
+ "fixedColor": "#FF7383",
600
+ "mode": "fixed"
601
+ }
602
+ }
603
+ ]
604
+ }
605
+ ]
606
+ },
607
+ "gridPos": {
608
+ "h": 12,
609
+ "w": 6,
610
+ "x": 0,
611
+ "y": 7
612
+ },
613
+ "id": 23,
614
+ "links": [],
615
+ "maxDataPoints": 3,
616
+ "options": {
617
+ "legend": {
618
+ "calcs": [],
619
+ "displayMode": "table",
620
+ "placement": "right",
621
+ "values": ["value"]
622
+ },
623
+ "pieType": "pie",
624
+ "reduceOptions": {
625
+ "calcs": ["sum"],
626
+ "fields": "",
627
+ "values": false
628
+ },
629
+ "tooltip": {
630
+ "mode": "single",
631
+ "sort": "none"
632
+ }
633
+ },
634
+ "targets": [
635
+ {
636
+ "bucketAggs": [
637
+ {
638
+ "$$hashKey": "object:493",
639
+ "fake": true,
640
+ "field": "rule_level",
641
+ "id": "3",
642
+ "settings": {
643
+ "min_doc_count": 1,
644
+ "order": "desc",
645
+ "orderBy": "_term",
646
+ "size": "10"
647
+ },
648
+ "type": "terms"
649
+ },
650
+ {
651
+ "$$hashKey": "object:494",
652
+ "field": "timestamp",
653
+ "id": "2",
654
+ "settings": {
655
+ "interval": "auto",
656
+ "min_doc_count": 0,
657
+ "trimEdges": 0
658
+ },
659
+ "type": "date_histogram"
660
+ }
661
+ ],
662
+ "metrics": [
663
+ {
664
+ "$$hashKey": "object:491",
665
+ "field": "select field",
666
+ "id": "1",
667
+ "meta": {},
668
+ "settings": {},
669
+ "type": "count"
670
+ }
671
+ ],
672
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
673
+ "refId": "A",
674
+ "timeField": "timestamp"
675
+ }
676
+ ],
677
+ "title": "SECURITY EVENTS BY ALERT LEVEL",
678
+ "type": "piechart"
679
+ },
680
+ {
681
+ "aliasColors": {},
682
+ "bars": true,
683
+ "dashLength": 10,
684
+ "dashes": false,
685
+ "datasource": {
686
+ "type": "elasticsearch",
687
+ "uid": "wazuh_datasource_uid"
688
+ },
689
+ "fieldConfig": {
690
+ "defaults": {
691
+ "links": []
692
+ },
693
+ "overrides": []
694
+ },
695
+ "fill": 1,
696
+ "fillGradient": 0,
697
+ "gridPos": {
698
+ "h": 12,
699
+ "w": 18,
700
+ "x": 6,
701
+ "y": 7
702
+ },
703
+ "hiddenSeries": false,
704
+ "id": 10,
705
+ "legend": {
706
+ "alignAsTable": true,
707
+ "avg": false,
708
+ "current": false,
709
+ "max": false,
710
+ "min": false,
711
+ "rightSide": true,
712
+ "show": true,
713
+ "total": false,
714
+ "values": false
715
+ },
716
+ "lines": false,
717
+ "linewidth": 1,
718
+ "links": [],
719
+ "nullPointMode": "null",
720
+ "options": {
721
+ "alertThreshold": true
722
+ },
723
+ "percentage": false,
724
+ "pluginVersion": "9.0.0",
725
+ "pointradius": 5,
726
+ "points": false,
727
+ "renderer": "flot",
728
+ "seriesOverrides": [],
729
+ "spaceLength": 10,
730
+ "stack": true,
731
+ "steppedLine": false,
732
+ "targets": [
733
+ {
734
+ "bucketAggs": [
735
+ {
736
+ "$$hashKey": "object:543",
737
+ "fake": true,
738
+ "field": "agent_name",
739
+ "id": "3",
740
+ "settings": {
741
+ "min_doc_count": 1,
742
+ "order": "desc",
743
+ "orderBy": "_count",
744
+ "size": "10"
745
+ },
746
+ "type": "terms"
747
+ },
748
+ {
749
+ "$$hashKey": "object:544",
750
+ "field": "timestamp",
751
+ "id": "2",
752
+ "settings": {
753
+ "interval": "5m",
754
+ "min_doc_count": 0,
755
+ "trimEdges": 0
756
+ },
757
+ "type": "date_histogram"
758
+ }
759
+ ],
760
+ "metrics": [
761
+ {
762
+ "$$hashKey": "object:541",
763
+ "field": "select field",
764
+ "id": "1",
765
+ "type": "count"
766
+ }
767
+ ],
768
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
769
+ "refId": "A",
770
+ "timeField": "timestamp"
771
+ }
772
+ ],
773
+ "thresholds": [],
774
+ "timeRegions": [],
775
+ "title": "TOP 10 AGENTS - HISTOGRAM",
776
+ "tooltip": {
777
+ "shared": true,
778
+ "sort": 0,
779
+ "value_type": "individual"
780
+ },
781
+ "type": "graph",
782
+ "xaxis": {
783
+ "mode": "time",
784
+ "show": true,
785
+ "values": []
786
+ },
787
+ "yaxes": [
788
+ {
789
+ "decimals": -1,
790
+ "format": "short",
791
+ "logBase": 1,
792
+ "show": true
793
+ },
794
+ {
795
+ "decimals": -1,
796
+ "format": "short",
797
+ "logBase": 1,
798
+ "show": true
799
+ }
800
+ ],
801
+ "yaxis": {
802
+ "align": false
803
+ }
804
+ },
805
+ {
806
+ "datasource": {
807
+ "type": "elasticsearch",
808
+ "uid": "wazuh_datasource_uid"
809
+ },
810
+ "fieldConfig": {
811
+ "defaults": {
812
+ "color": {
813
+ "mode": "palette-classic"
814
+ },
815
+ "custom": {
816
+ "hideFrom": {
817
+ "legend": false,
818
+ "tooltip": false,
819
+ "viz": false
820
+ }
821
+ },
822
+ "decimals": 0,
823
+ "mappings": [],
824
+ "unit": "short"
825
+ },
826
+ "overrides": [
827
+ {
828
+ "matcher": {
829
+ "id": "byName",
830
+ "options": "1"
831
+ },
832
+ "properties": [
833
+ {
834
+ "id": "color",
835
+ "value": {
836
+ "fixedColor": "#C8F2C2",
837
+ "mode": "fixed"
838
+ }
839
+ }
840
+ ]
841
+ },
842
+ {
843
+ "matcher": {
844
+ "id": "byName",
845
+ "options": "2"
846
+ },
847
+ "properties": [
848
+ {
849
+ "id": "color",
850
+ "value": {
851
+ "fixedColor": "#96D98D",
852
+ "mode": "fixed"
853
+ }
854
+ }
855
+ ]
856
+ },
857
+ {
858
+ "matcher": {
859
+ "id": "byName",
860
+ "options": "3"
861
+ },
862
+ "properties": [
863
+ {
864
+ "id": "color",
865
+ "value": {
866
+ "fixedColor": "#56A64B",
867
+ "mode": "fixed"
868
+ }
869
+ }
870
+ ]
871
+ },
872
+ {
873
+ "matcher": {
874
+ "id": "byName",
875
+ "options": "4"
876
+ },
877
+ "properties": [
878
+ {
879
+ "id": "color",
880
+ "value": {
881
+ "fixedColor": "#37872D",
882
+ "mode": "fixed"
883
+ }
884
+ }
885
+ ]
886
+ },
887
+ {
888
+ "matcher": {
889
+ "id": "byName",
890
+ "options": "5"
891
+ },
892
+ "properties": [
893
+ {
894
+ "id": "color",
895
+ "value": {
896
+ "fixedColor": "#FFF899",
897
+ "mode": "fixed"
898
+ }
899
+ }
900
+ ]
901
+ },
902
+ {
903
+ "matcher": {
904
+ "id": "byName",
905
+ "options": "7"
906
+ },
907
+ "properties": [
908
+ {
909
+ "id": "color",
910
+ "value": {
911
+ "fixedColor": "#F2CC0C",
912
+ "mode": "fixed"
913
+ }
914
+ }
915
+ ]
916
+ },
917
+ {
918
+ "matcher": {
919
+ "id": "byName",
920
+ "options": "9"
921
+ },
922
+ "properties": [
923
+ {
924
+ "id": "color",
925
+ "value": {
926
+ "fixedColor": "#E0B400",
927
+ "mode": "fixed"
928
+ }
929
+ }
930
+ ]
931
+ },
932
+ {
933
+ "matcher": {
934
+ "id": "byName",
935
+ "options": "10"
936
+ },
937
+ "properties": [
938
+ {
939
+ "id": "color",
940
+ "value": {
941
+ "fixedColor": "#FFCB7D",
942
+ "mode": "fixed"
943
+ }
944
+ }
945
+ ]
946
+ },
947
+ {
948
+ "matcher": {
949
+ "id": "byName",
950
+ "options": "12"
951
+ },
952
+ "properties": [
953
+ {
954
+ "id": "color",
955
+ "value": {
956
+ "fixedColor": "#FFA6B0",
957
+ "mode": "fixed"
958
+ }
959
+ }
960
+ ]
961
+ },
962
+ {
963
+ "matcher": {
964
+ "id": "byName",
965
+ "options": "13"
966
+ },
967
+ "properties": [
968
+ {
969
+ "id": "color",
970
+ "value": {
971
+ "fixedColor": "#FF7383",
972
+ "mode": "fixed"
973
+ }
974
+ }
975
+ ]
976
+ }
977
+ ]
978
+ },
979
+ "gridPos": {
980
+ "h": 12,
981
+ "w": 6,
982
+ "x": 0,
983
+ "y": 19
984
+ },
985
+ "id": 45,
986
+ "links": [],
987
+ "maxDataPoints": 3,
988
+ "options": {
989
+ "legend": {
990
+ "calcs": [],
991
+ "displayMode": "hidden",
992
+ "placement": "right",
993
+ "values": ["value"]
994
+ },
995
+ "pieType": "donut",
996
+ "reduceOptions": {
997
+ "calcs": ["sum"],
998
+ "fields": "",
999
+ "values": false
1000
+ },
1001
+ "tooltip": {
1002
+ "mode": "single",
1003
+ "sort": "none"
1004
+ }
1005
+ },
1006
+ "targets": [
1007
+ {
1008
+ "bucketAggs": [
1009
+ {
1010
+ "$$hashKey": "object:493",
1011
+ "fake": true,
1012
+ "field": "data_sca_policy",
1013
+ "id": "3",
1014
+ "settings": {
1015
+ "min_doc_count": 1,
1016
+ "order": "desc",
1017
+ "orderBy": "_term",
1018
+ "size": "10"
1019
+ },
1020
+ "type": "terms"
1021
+ },
1022
+ {
1023
+ "$$hashKey": "object:494",
1024
+ "field": "timestamp",
1025
+ "id": "2",
1026
+ "settings": {
1027
+ "interval": "auto",
1028
+ "min_doc_count": 0,
1029
+ "trimEdges": 0
1030
+ },
1031
+ "type": "date_histogram"
1032
+ }
1033
+ ],
1034
+ "datasource": {
1035
+ "type": "elasticsearch",
1036
+ "uid": "wazuh_datasource_uid"
1037
+ },
1038
+ "metrics": [
1039
+ {
1040
+ "$$hashKey": "object:491",
1041
+ "field": "select field",
1042
+ "id": "1",
1043
+ "meta": {},
1044
+ "settings": {},
1045
+ "type": "count"
1046
+ }
1047
+ ],
1048
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
1049
+ "refId": "A",
1050
+ "timeField": "timestamp"
1051
+ }
1052
+ ],
1053
+ "title": "SECURITY CONTROLS BY POLICY",
1054
+ "type": "piechart"
1055
+ },
1056
+ {
1057
+ "datasource": {
1058
+ "type": "elasticsearch",
1059
+ "uid": "wazuh_datasource_uid"
1060
+ },
1061
+ "fieldConfig": {
1062
+ "defaults": {
1063
+ "color": {
1064
+ "mode": "thresholds"
1065
+ },
1066
+ "custom": {
1067
+ "align": "auto",
1068
+ "displayMode": "auto",
1069
+ "inspect": false
1070
+ },
1071
+ "decimals": 0,
1072
+ "mappings": [],
1073
+ "thresholds": {
1074
+ "mode": "absolute",
1075
+ "steps": [
1076
+ {
1077
+ "color": "green",
1078
+ "value": null
1079
+ },
1080
+ {
1081
+ "color": "red",
1082
+ "value": 80
1083
+ }
1084
+ ]
1085
+ },
1086
+ "unit": "short"
1087
+ },
1088
+ "overrides": [
1089
+ {
1090
+ "matcher": {
1091
+ "id": "byName",
1092
+ "options": "1"
1093
+ },
1094
+ "properties": [
1095
+ {
1096
+ "id": "color",
1097
+ "value": {
1098
+ "fixedColor": "#C8F2C2",
1099
+ "mode": "fixed"
1100
+ }
1101
+ }
1102
+ ]
1103
+ },
1104
+ {
1105
+ "matcher": {
1106
+ "id": "byName",
1107
+ "options": "2"
1108
+ },
1109
+ "properties": [
1110
+ {
1111
+ "id": "color",
1112
+ "value": {
1113
+ "fixedColor": "#96D98D",
1114
+ "mode": "fixed"
1115
+ }
1116
+ }
1117
+ ]
1118
+ },
1119
+ {
1120
+ "matcher": {
1121
+ "id": "byName",
1122
+ "options": "3"
1123
+ },
1124
+ "properties": [
1125
+ {
1126
+ "id": "color",
1127
+ "value": {
1128
+ "fixedColor": "#56A64B",
1129
+ "mode": "fixed"
1130
+ }
1131
+ }
1132
+ ]
1133
+ },
1134
+ {
1135
+ "matcher": {
1136
+ "id": "byName",
1137
+ "options": "4"
1138
+ },
1139
+ "properties": [
1140
+ {
1141
+ "id": "color",
1142
+ "value": {
1143
+ "fixedColor": "#37872D",
1144
+ "mode": "fixed"
1145
+ }
1146
+ }
1147
+ ]
1148
+ },
1149
+ {
1150
+ "matcher": {
1151
+ "id": "byName",
1152
+ "options": "5"
1153
+ },
1154
+ "properties": [
1155
+ {
1156
+ "id": "color",
1157
+ "value": {
1158
+ "fixedColor": "#FFF899",
1159
+ "mode": "fixed"
1160
+ }
1161
+ }
1162
+ ]
1163
+ },
1164
+ {
1165
+ "matcher": {
1166
+ "id": "byName",
1167
+ "options": "7"
1168
+ },
1169
+ "properties": [
1170
+ {
1171
+ "id": "color",
1172
+ "value": {
1173
+ "fixedColor": "#F2CC0C",
1174
+ "mode": "fixed"
1175
+ }
1176
+ }
1177
+ ]
1178
+ },
1179
+ {
1180
+ "matcher": {
1181
+ "id": "byName",
1182
+ "options": "9"
1183
+ },
1184
+ "properties": [
1185
+ {
1186
+ "id": "color",
1187
+ "value": {
1188
+ "fixedColor": "#E0B400",
1189
+ "mode": "fixed"
1190
+ }
1191
+ }
1192
+ ]
1193
+ },
1194
+ {
1195
+ "matcher": {
1196
+ "id": "byName",
1197
+ "options": "10"
1198
+ },
1199
+ "properties": [
1200
+ {
1201
+ "id": "color",
1202
+ "value": {
1203
+ "fixedColor": "#FFCB7D",
1204
+ "mode": "fixed"
1205
+ }
1206
+ }
1207
+ ]
1208
+ },
1209
+ {
1210
+ "matcher": {
1211
+ "id": "byName",
1212
+ "options": "12"
1213
+ },
1214
+ "properties": [
1215
+ {
1216
+ "id": "color",
1217
+ "value": {
1218
+ "fixedColor": "#FFA6B0",
1219
+ "mode": "fixed"
1220
+ }
1221
+ }
1222
+ ]
1223
+ },
1224
+ {
1225
+ "matcher": {
1226
+ "id": "byName",
1227
+ "options": "13"
1228
+ },
1229
+ "properties": [
1230
+ {
1231
+ "id": "color",
1232
+ "value": {
1233
+ "fixedColor": "#FF7383",
1234
+ "mode": "fixed"
1235
+ }
1236
+ }
1237
+ ]
1238
+ },
1239
+ {
1240
+ "matcher": {
1241
+ "id": "byName",
1242
+ "options": "POLICY"
1243
+ },
1244
+ "properties": [
1245
+ {
1246
+ "id": "custom.width",
1247
+ "value": 665
1248
+ }
1249
+ ]
1250
+ }
1251
+ ]
1252
+ },
1253
+ "gridPos": {
1254
+ "h": 12,
1255
+ "w": 12,
1256
+ "x": 6,
1257
+ "y": 19
1258
+ },
1259
+ "id": 46,
1260
+ "links": [],
1261
+ "maxDataPoints": 3,
1262
+ "options": {
1263
+ "footer": {
1264
+ "fields": "",
1265
+ "reducer": ["sum"],
1266
+ "show": false
1267
+ },
1268
+ "showHeader": true,
1269
+ "sortBy": []
1270
+ },
1271
+ "pluginVersion": "9.0.0",
1272
+ "targets": [
1273
+ {
1274
+ "bucketAggs": [
1275
+ {
1276
+ "$$hashKey": "object:493",
1277
+ "fake": true,
1278
+ "field": "data_sca_policy",
1279
+ "id": "3",
1280
+ "settings": {
1281
+ "min_doc_count": 1,
1282
+ "order": "desc",
1283
+ "orderBy": "_term",
1284
+ "size": "10"
1285
+ },
1286
+ "type": "terms"
1287
+ }
1288
+ ],
1289
+ "datasource": {
1290
+ "type": "elasticsearch",
1291
+ "uid": "wazuh_datasource_uid"
1292
+ },
1293
+ "metrics": [
1294
+ {
1295
+ "$$hashKey": "object:491",
1296
+ "field": "select field",
1297
+ "id": "1",
1298
+ "meta": {},
1299
+ "settings": {},
1300
+ "type": "count"
1301
+ }
1302
+ ],
1303
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
1304
+ "refId": "A",
1305
+ "timeField": "timestamp"
1306
+ }
1307
+ ],
1308
+ "title": "SECURITY CONTROLS BY POLICY",
1309
+ "transformations": [
1310
+ {
1311
+ "id": "organize",
1312
+ "options": {
1313
+ "excludeByName": {},
1314
+ "indexByName": {},
1315
+ "renameByName": {
1316
+ "data_sca_policy": "POLICY"
1317
+ }
1318
+ }
1319
+ }
1320
+ ],
1321
+ "type": "table"
1322
+ },
1323
+ {
1324
+ "datasource": {
1325
+ "type": "elasticsearch",
1326
+ "uid": "wazuh_datasource_uid"
1327
+ },
1328
+ "fieldConfig": {
1329
+ "defaults": {
1330
+ "color": {
1331
+ "mode": "palette-classic"
1332
+ },
1333
+ "custom": {
1334
+ "hideFrom": {
1335
+ "legend": false,
1336
+ "tooltip": false,
1337
+ "viz": false
1338
+ }
1339
+ },
1340
+ "decimals": 0,
1341
+ "mappings": [],
1342
+ "unit": "short"
1343
+ },
1344
+ "overrides": [
1345
+ {
1346
+ "matcher": {
1347
+ "id": "byName",
1348
+ "options": "1"
1349
+ },
1350
+ "properties": [
1351
+ {
1352
+ "id": "color",
1353
+ "value": {
1354
+ "fixedColor": "#C8F2C2",
1355
+ "mode": "fixed"
1356
+ }
1357
+ }
1358
+ ]
1359
+ },
1360
+ {
1361
+ "matcher": {
1362
+ "id": "byName",
1363
+ "options": "2"
1364
+ },
1365
+ "properties": [
1366
+ {
1367
+ "id": "color",
1368
+ "value": {
1369
+ "fixedColor": "#96D98D",
1370
+ "mode": "fixed"
1371
+ }
1372
+ }
1373
+ ]
1374
+ },
1375
+ {
1376
+ "matcher": {
1377
+ "id": "byName",
1378
+ "options": "3"
1379
+ },
1380
+ "properties": [
1381
+ {
1382
+ "id": "color",
1383
+ "value": {
1384
+ "fixedColor": "#56A64B",
1385
+ "mode": "fixed"
1386
+ }
1387
+ }
1388
+ ]
1389
+ },
1390
+ {
1391
+ "matcher": {
1392
+ "id": "byName",
1393
+ "options": "4"
1394
+ },
1395
+ "properties": [
1396
+ {
1397
+ "id": "color",
1398
+ "value": {
1399
+ "fixedColor": "#37872D",
1400
+ "mode": "fixed"
1401
+ }
1402
+ }
1403
+ ]
1404
+ },
1405
+ {
1406
+ "matcher": {
1407
+ "id": "byName",
1408
+ "options": "5"
1409
+ },
1410
+ "properties": [
1411
+ {
1412
+ "id": "color",
1413
+ "value": {
1414
+ "fixedColor": "#FFF899",
1415
+ "mode": "fixed"
1416
+ }
1417
+ }
1418
+ ]
1419
+ },
1420
+ {
1421
+ "matcher": {
1422
+ "id": "byName",
1423
+ "options": "7"
1424
+ },
1425
+ "properties": [
1426
+ {
1427
+ "id": "color",
1428
+ "value": {
1429
+ "fixedColor": "#F2CC0C",
1430
+ "mode": "fixed"
1431
+ }
1432
+ }
1433
+ ]
1434
+ },
1435
+ {
1436
+ "matcher": {
1437
+ "id": "byName",
1438
+ "options": "9"
1439
+ },
1440
+ "properties": [
1441
+ {
1442
+ "id": "color",
1443
+ "value": {
1444
+ "fixedColor": "#E0B400",
1445
+ "mode": "fixed"
1446
+ }
1447
+ }
1448
+ ]
1449
+ },
1450
+ {
1451
+ "matcher": {
1452
+ "id": "byName",
1453
+ "options": "10"
1454
+ },
1455
+ "properties": [
1456
+ {
1457
+ "id": "color",
1458
+ "value": {
1459
+ "fixedColor": "#FFCB7D",
1460
+ "mode": "fixed"
1461
+ }
1462
+ }
1463
+ ]
1464
+ },
1465
+ {
1466
+ "matcher": {
1467
+ "id": "byName",
1468
+ "options": "12"
1469
+ },
1470
+ "properties": [
1471
+ {
1472
+ "id": "color",
1473
+ "value": {
1474
+ "fixedColor": "#FFA6B0",
1475
+ "mode": "fixed"
1476
+ }
1477
+ }
1478
+ ]
1479
+ },
1480
+ {
1481
+ "matcher": {
1482
+ "id": "byName",
1483
+ "options": "13"
1484
+ },
1485
+ "properties": [
1486
+ {
1487
+ "id": "color",
1488
+ "value": {
1489
+ "fixedColor": "#FF7383",
1490
+ "mode": "fixed"
1491
+ }
1492
+ }
1493
+ ]
1494
+ },
1495
+ {
1496
+ "matcher": {
1497
+ "id": "byName",
1498
+ "options": "N/A"
1499
+ },
1500
+ "properties": [
1501
+ {
1502
+ "id": "color",
1503
+ "value": {
1504
+ "fixedColor": "semi-dark-orange",
1505
+ "mode": "fixed"
1506
+ }
1507
+ }
1508
+ ]
1509
+ },
1510
+ {
1511
+ "matcher": {
1512
+ "id": "byName",
1513
+ "options": "failed"
1514
+ },
1515
+ "properties": [
1516
+ {
1517
+ "id": "color",
1518
+ "value": {
1519
+ "fixedColor": "semi-dark-red",
1520
+ "mode": "fixed"
1521
+ }
1522
+ }
1523
+ ]
1524
+ }
1525
+ ]
1526
+ },
1527
+ "gridPos": {
1528
+ "h": 12,
1529
+ "w": 6,
1530
+ "x": 18,
1531
+ "y": 19
1532
+ },
1533
+ "id": 47,
1534
+ "links": [],
1535
+ "maxDataPoints": 3,
1536
+ "options": {
1537
+ "legend": {
1538
+ "calcs": [],
1539
+ "displayMode": "table",
1540
+ "placement": "right",
1541
+ "values": ["value"]
1542
+ },
1543
+ "pieType": "donut",
1544
+ "reduceOptions": {
1545
+ "calcs": ["sum"],
1546
+ "fields": "",
1547
+ "values": false
1548
+ },
1549
+ "tooltip": {
1550
+ "mode": "single",
1551
+ "sort": "none"
1552
+ }
1553
+ },
1554
+ "targets": [
1555
+ {
1556
+ "bucketAggs": [
1557
+ {
1558
+ "$$hashKey": "object:493",
1559
+ "fake": true,
1560
+ "field": "data_sca_check_result",
1561
+ "id": "3",
1562
+ "settings": {
1563
+ "min_doc_count": 1,
1564
+ "missing": "N/A",
1565
+ "order": "desc",
1566
+ "orderBy": "_term",
1567
+ "size": "10"
1568
+ },
1569
+ "type": "terms"
1570
+ },
1571
+ {
1572
+ "$$hashKey": "object:494",
1573
+ "field": "timestamp",
1574
+ "id": "2",
1575
+ "settings": {
1576
+ "interval": "auto",
1577
+ "min_doc_count": 0,
1578
+ "trimEdges": 0
1579
+ },
1580
+ "type": "date_histogram"
1581
+ }
1582
+ ],
1583
+ "datasource": {
1584
+ "type": "elasticsearch",
1585
+ "uid": "wazuh_datasource_uid"
1586
+ },
1587
+ "metrics": [
1588
+ {
1589
+ "$$hashKey": "object:491",
1590
+ "field": "select field",
1591
+ "id": "1",
1592
+ "meta": {},
1593
+ "settings": {},
1594
+ "type": "count"
1595
+ }
1596
+ ],
1597
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
1598
+ "refId": "A",
1599
+ "timeField": "timestamp"
1600
+ }
1601
+ ],
1602
+ "title": "RESULTS",
1603
+ "type": "piechart"
1604
+ },
1605
+ {
1606
+ "datasource": {
1607
+ "type": "elasticsearch",
1608
+ "uid": "wazuh_datasource_uid"
1609
+ },
1610
+ "fieldConfig": {
1611
+ "defaults": {
1612
+ "color": {
1613
+ "mode": "thresholds"
1614
+ },
1615
+ "custom": {
1616
+ "align": "auto",
1617
+ "displayMode": "auto"
1618
+ },
1619
+ "mappings": [],
1620
+ "thresholds": {
1621
+ "mode": "absolute",
1622
+ "steps": [
1623
+ {
1624
+ "color": "semi-dark-orange"
1625
+ }
1626
+ ]
1627
+ }
1628
+ },
1629
+ "overrides": [
1630
+ {
1631
+ "matcher": {
1632
+ "id": "byName",
1633
+ "options": "timestamp"
1634
+ },
1635
+ "properties": [
1636
+ {
1637
+ "id": "displayName",
1638
+ "value": "DATE/TIME"
1639
+ },
1640
+ {
1641
+ "id": "unit",
1642
+ "value": "time: YYYY-MM-DD HH:mm:ss"
1643
+ },
1644
+ {
1645
+ "id": "custom.align"
1646
+ }
1647
+ ]
1648
+ },
1649
+ {
1650
+ "matcher": {
1651
+ "id": "byName",
1652
+ "options": "agent_name"
1653
+ },
1654
+ "properties": [
1655
+ {
1656
+ "id": "displayName",
1657
+ "value": "AGENT"
1658
+ },
1659
+ {
1660
+ "id": "unit",
1661
+ "value": "short"
1662
+ },
1663
+ {
1664
+ "id": "decimals",
1665
+ "value": 2
1666
+ },
1667
+ {
1668
+ "id": "custom.align"
1669
+ }
1670
+ ]
1671
+ },
1672
+ {
1673
+ "matcher": {
1674
+ "id": "byName",
1675
+ "options": "data_sca_check_remediation"
1676
+ },
1677
+ "properties": [
1678
+ {
1679
+ "id": "displayName",
1680
+ "value": "REMEDIATION"
1681
+ },
1682
+ {
1683
+ "id": "unit",
1684
+ "value": "short"
1685
+ },
1686
+ {
1687
+ "id": "decimals",
1688
+ "value": 2
1689
+ },
1690
+ {
1691
+ "id": "custom.align"
1692
+ }
1693
+ ]
1694
+ },
1695
+ {
1696
+ "matcher": {
1697
+ "id": "byName",
1698
+ "options": "data_sca_check_result"
1699
+ },
1700
+ "properties": [
1701
+ {
1702
+ "id": "noValue",
1703
+ "value": "Not Applicable"
1704
+ },
1705
+ {
1706
+ "id": "custom.displayMode",
1707
+ "value": "color-background-solid"
1708
+ },
1709
+ {
1710
+ "id": "mappings",
1711
+ "value": [
1712
+ {
1713
+ "options": {
1714
+ "Not Applicable": {
1715
+ "color": "orange",
1716
+ "index": 2
1717
+ },
1718
+ "failed": {
1719
+ "color": "red",
1720
+ "index": 1
1721
+ },
1722
+ "passed": {
1723
+ "color": "semi-dark-green",
1724
+ "index": 0
1725
+ }
1726
+ },
1727
+ "type": "value"
1728
+ }
1729
+ ]
1730
+ }
1731
+ ]
1732
+ },
1733
+ {
1734
+ "matcher": {
1735
+ "id": "byName",
1736
+ "options": "DATE/TIME"
1737
+ },
1738
+ "properties": [
1739
+ {
1740
+ "id": "custom.width",
1741
+ "value": 185
1742
+ }
1743
+ ]
1744
+ },
1745
+ {
1746
+ "matcher": {
1747
+ "id": "byName",
1748
+ "options": "AGENT"
1749
+ },
1750
+ "properties": [
1751
+ {
1752
+ "id": "custom.width",
1753
+ "value": 195
1754
+ }
1755
+ ]
1756
+ },
1757
+ {
1758
+ "matcher": {
1759
+ "id": "byName",
1760
+ "options": "AGENT IP"
1761
+ },
1762
+ "properties": [
1763
+ {
1764
+ "id": "custom.width",
1765
+ "value": 164
1766
+ }
1767
+ ]
1768
+ }
1769
+ ]
1770
+ },
1771
+ "gridPos": {
1772
+ "h": 16,
1773
+ "w": 24,
1774
+ "x": 0,
1775
+ "y": 31
1776
+ },
1777
+ "id": 27,
1778
+ "options": {
1779
+ "footer": {
1780
+ "fields": "",
1781
+ "reducer": ["sum"],
1782
+ "show": false
1783
+ },
1784
+ "showHeader": true,
1785
+ "sortBy": []
1786
+ },
1787
+ "pluginVersion": "8.4.3",
1788
+ "targets": [
1789
+ {
1790
+ "bucketAggs": [],
1791
+ "datasource": {
1792
+ "type": "elasticsearch",
1793
+ "uid": "wazuh_datasource_uid"
1794
+ },
1795
+ "metrics": [
1796
+ {
1797
+ "id": "1",
1798
+ "settings": {
1799
+ "size": "500"
1800
+ },
1801
+ "type": "raw_data"
1802
+ }
1803
+ ],
1804
+ "query": "agent_name:$agent_name AND (rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca OR rule_groups:lynis)",
1805
+ "refId": "A",
1806
+ "timeField": "timestamp"
1807
+ }
1808
+ ],
1809
+ "title": "EVENTS",
1810
+ "transformations": [
1811
+ {
1812
+ "id": "filterFieldsByName",
1813
+ "options": {
1814
+ "include": {
1815
+ "names": [
1816
+ "timestamp",
1817
+ "agent_name",
1818
+ "data_sca_check_reason",
1819
+ "data_sca_check_remediation",
1820
+ "data_sca_check_result",
1821
+ "data_sca_check_title",
1822
+ "data_sca_policy"
1823
+ ]
1824
+ }
1825
+ }
1826
+ },
1827
+ {
1828
+ "id": "organize",
1829
+ "options": {
1830
+ "excludeByName": {},
1831
+ "indexByName": {
1832
+ "_id": 1,
1833
+ "agent_ip": 3,
1834
+ "agent_name": 2,
1835
+ "data_sca_check_reason": 7,
1836
+ "data_sca_check_remediation": 8,
1837
+ "data_sca_check_result": 6,
1838
+ "data_sca_check_status": 9,
1839
+ "data_sca_check_title": 4,
1840
+ "data_sca_policy": 5,
1841
+ "rule_description": 10,
1842
+ "timestamp": 0
1843
+ },
1844
+ "renameByName": {
1845
+ "_id": "EVENT ID",
1846
+ "agent_ip": "AGENT IP",
1847
+ "agent_name": "AGENT",
1848
+ "data_sca_check_reason": "REASON",
1849
+ "data_sca_check_remediation": "REMEDIATION",
1850
+ "data_sca_check_result": "RESULT",
1851
+ "data_sca_check_title": "CONTROL",
1852
+ "data_sca_policy": "POLICY",
1853
+ "data_sca_type": "",
1854
+ "timestamp": "DATE/TIME"
1855
+ }
1856
+ }
1857
+ }
1858
+ ],
1859
+ "type": "table"
1860
+ }
1861
+ ],
1862
+ "refresh": false,
1863
+ "schemaVersion": 36,
1864
+ "style": "dark",
1865
+ "tags": ["EDR"],
1866
+ "templating": {
1867
+ "list": [
1868
+ {
1869
+ "datasource": {
1870
+ "type": "elasticsearch",
1871
+ "uid": "wazuh_datasource_uid"
1872
+ },
1873
+ "filters": [],
1874
+ "hide": 0,
1875
+ "label": "",
1876
+ "name": "Filters",
1877
+ "skipUrlSync": false,
1878
+ "type": "adhoc"
1879
+ },
1880
+ {
1881
+ "current": {
1882
+ "selected": false,
1883
+ "text": "All",
1884
+ "value": "$__all"
1885
+ },
1886
+ "datasource": {
1887
+ "type": "elasticsearch",
1888
+ "uid": "wazuh_datasource_uid"
1889
+ },
1890
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca\"}",
1891
+ "hide": 0,
1892
+ "includeAll": true,
1893
+ "label": "Agent",
1894
+ "multi": false,
1895
+ "name": "agent_name",
1896
+ "options": [],
1897
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_groups:rootcheck OR rule_groups:oscap OR rule_groups:sca\"}",
1898
+ "refresh": 2,
1899
+ "regex": "",
1900
+ "skipUrlSync": false,
1901
+ "sort": 2,
1902
+ "tagValuesQuery": "",
1903
+ "tagsQuery": "",
1904
+ "type": "query",
1905
+ "useTags": false
1906
+ }
1907
+ ]
1908
+ },
1909
+ "time": {
1910
+ "from": "now-6h",
1911
+ "to": "now"
1912
+ },
1913
+ "timepicker": {
1914
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
1915
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
1916
+ },
1917
+ "timezone": "",
1918
+ "title": "EDR - SYSTEM SECURITY AUDIT",
1919
+ "uid": null,
1920
+ "version": 2,
1921
+ "weekStart": ""
1922
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_system_vulnerabilities.json
new
+3128
@@ -0,0 +1,3128 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "datasource": {
44
+ "type": "elasticsearch",
45
+ "uid": "wazuh_datasource_uid"
46
+ },
47
+ "gridPos": {
48
+ "h": 1,
49
+ "w": 24,
50
+ "x": 0,
51
+ "y": 0
52
+ },
53
+ "id": 58,
54
+ "title": "SYSTEM OS AND SOFTWARE VULNERABILITIES - SUMMARY",
55
+ "type": "row"
56
+ },
57
+ {
58
+ "datasource": {
59
+ "type": "elasticsearch",
60
+ "uid": "wazuh_datasource_uid"
61
+ },
62
+ "fieldConfig": {
63
+ "defaults": {
64
+ "mappings": [
65
+ {
66
+ "options": {
67
+ "match": "null",
68
+ "result": {
69
+ "text": "N/A"
70
+ }
71
+ },
72
+ "type": "special"
73
+ }
74
+ ],
75
+ "thresholds": {
76
+ "mode": "absolute",
77
+ "steps": [
78
+ {
79
+ "color": "dark-orange",
80
+ "value": null
81
+ }
82
+ ]
83
+ },
84
+ "unit": "short"
85
+ },
86
+ "overrides": []
87
+ },
88
+ "gridPos": {
89
+ "h": 7,
90
+ "w": 4,
91
+ "x": 0,
92
+ "y": 1
93
+ },
94
+ "id": 43,
95
+ "links": [],
96
+ "options": {
97
+ "colorMode": "value",
98
+ "graphMode": "area",
99
+ "justifyMode": "auto",
100
+ "orientation": "horizontal",
101
+ "reduceOptions": {
102
+ "calcs": ["sum"],
103
+ "fields": "",
104
+ "values": false
105
+ },
106
+ "text": {},
107
+ "textMode": "auto"
108
+ },
109
+ "pluginVersion": "10.0.3",
110
+ "targets": [
111
+ {
112
+ "bucketAggs": [
113
+ {
114
+ "field": "timestamp",
115
+ "id": "2",
116
+ "settings": {
117
+ "interval": "auto",
118
+ "min_doc_count": 0,
119
+ "trimEdges": 0
120
+ },
121
+ "type": "date_histogram"
122
+ }
123
+ ],
124
+ "datasource": {
125
+ "type": "elasticsearch",
126
+ "uid": "wazuh_datasource_uid"
127
+ },
128
+ "metrics": [
129
+ {
130
+ "field": "select field",
131
+ "id": "1",
132
+ "type": "count"
133
+ }
134
+ ],
135
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
136
+ "refId": "A",
137
+ "timeField": "timestamp"
138
+ }
139
+ ],
140
+ "title": "VULNERABILITY EVENTS",
141
+ "type": "stat"
142
+ },
143
+ {
144
+ "columns": [],
145
+ "datasource": {
146
+ "type": "elasticsearch",
147
+ "uid": "wazuh_datasource_uid"
148
+ },
149
+ "fontSize": "100%",
150
+ "gridPos": {
151
+ "h": 7,
152
+ "w": 8,
153
+ "x": 4,
154
+ "y": 1
155
+ },
156
+ "id": 31,
157
+ "showHeader": true,
158
+ "sort": {
159
+ "col": 0,
160
+ "desc": true
161
+ },
162
+ "styles": [
163
+ {
164
+ "alias": "Time",
165
+ "align": "auto",
166
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
167
+ "pattern": "Time",
168
+ "type": "date"
169
+ },
170
+ {
171
+ "alias": "",
172
+ "align": "auto",
173
+ "colorMode": "row",
174
+ "colors": ["rgba(50, 172, 45, 0.97)", "rgba(237, 129, 40, 0.89)", "#FA6400"],
175
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
176
+ "decimals": -1,
177
+ "mappingType": 1,
178
+ "pattern": "Count",
179
+ "thresholds": ["0", "1"],
180
+ "type": "number",
181
+ "unit": "short"
182
+ },
183
+ {
184
+ "alias": "AGENT",
185
+ "align": "auto",
186
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
187
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
188
+ "decimals": 2,
189
+ "mappingType": 1,
190
+ "pattern": "agent_name",
191
+ "thresholds": [],
192
+ "type": "number",
193
+ "unit": "short"
194
+ }
195
+ ],
196
+ "targets": [
197
+ {
198
+ "bucketAggs": [
199
+ {
200
+ "fake": true,
201
+ "field": "agent_name",
202
+ "id": "4",
203
+ "settings": {
204
+ "min_doc_count": 1,
205
+ "order": "desc",
206
+ "orderBy": "_term",
207
+ "size": "0"
208
+ },
209
+ "type": "terms"
210
+ }
211
+ ],
212
+ "metrics": [
213
+ {
214
+ "field": "select field",
215
+ "id": "1",
216
+ "type": "count"
217
+ }
218
+ ],
219
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
220
+ "refId": "A",
221
+ "timeField": "@timestamp"
222
+ }
223
+ ],
224
+ "title": "AGENTS",
225
+ "transform": "table",
226
+ "type": "table-old"
227
+ },
228
+ {
229
+ "columns": [],
230
+ "datasource": {
231
+ "type": "elasticsearch",
232
+ "uid": "wazuh_datasource_uid"
233
+ },
234
+ "fontSize": "100%",
235
+ "gridPos": {
236
+ "h": 7,
237
+ "w": 6,
238
+ "x": 12,
239
+ "y": 1
240
+ },
241
+ "id": 54,
242
+ "showHeader": true,
243
+ "sort": {
244
+ "col": 0,
245
+ "desc": true
246
+ },
247
+ "styles": [
248
+ {
249
+ "alias": "Time",
250
+ "align": "auto",
251
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
252
+ "pattern": "Time",
253
+ "type": "date"
254
+ },
255
+ {
256
+ "alias": "",
257
+ "align": "auto",
258
+ "colorMode": "row",
259
+ "colors": ["rgba(50, 172, 45, 0.97)", "rgba(237, 129, 40, 0.89)", "#FA6400"],
260
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
261
+ "decimals": -1,
262
+ "mappingType": 1,
263
+ "pattern": "Count",
264
+ "thresholds": ["0", "1"],
265
+ "type": "number",
266
+ "unit": "short"
267
+ },
268
+ {
269
+ "alias": "CVSS2",
270
+ "align": "auto",
271
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
272
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
273
+ "decimals": 2,
274
+ "mappingType": 1,
275
+ "pattern": "data_vulnerability_cvss_cvss2_base_score",
276
+ "thresholds": [],
277
+ "type": "number",
278
+ "unit": "short"
279
+ }
280
+ ],
281
+ "targets": [
282
+ {
283
+ "bucketAggs": [
284
+ {
285
+ "fake": true,
286
+ "field": "data_vulnerability_cvss_cvss2_base_score",
287
+ "id": "4",
288
+ "settings": {
289
+ "min_doc_count": 1,
290
+ "order": "desc",
291
+ "orderBy": "_term",
292
+ "size": "0"
293
+ },
294
+ "type": "terms"
295
+ }
296
+ ],
297
+ "metrics": [
298
+ {
299
+ "field": "select field",
300
+ "id": "1",
301
+ "type": "count"
302
+ }
303
+ ],
304
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
305
+ "refId": "A",
306
+ "timeField": "@timestamp"
307
+ }
308
+ ],
309
+ "title": "CVSS2 BASE SCORE",
310
+ "transform": "table",
311
+ "type": "table-old"
312
+ },
313
+ {
314
+ "datasource": {
315
+ "type": "elasticsearch",
316
+ "uid": "wazuh_datasource_uid"
317
+ },
318
+ "fieldConfig": {
319
+ "defaults": {
320
+ "color": {
321
+ "mode": "thresholds"
322
+ },
323
+ "custom": {
324
+ "align": "auto",
325
+ "cellOptions": {
326
+ "type": "auto"
327
+ },
328
+ "inspect": false
329
+ },
330
+ "mappings": [],
331
+ "thresholds": {
332
+ "mode": "absolute",
333
+ "steps": [
334
+ {
335
+ "color": "green",
336
+ "value": null
337
+ },
338
+ {
339
+ "color": "red",
340
+ "value": 80
341
+ }
342
+ ]
343
+ }
344
+ },
345
+ "overrides": [
346
+ {
347
+ "matcher": {
348
+ "id": "byName",
349
+ "options": "Count"
350
+ },
351
+ "properties": [
352
+ {
353
+ "id": "unit",
354
+ "value": "short"
355
+ },
356
+ {
357
+ "id": "decimals",
358
+ "value": -1
359
+ },
360
+ {
361
+ "id": "custom.cellOptions",
362
+ "value": {
363
+ "type": "color-background"
364
+ }
365
+ },
366
+ {
367
+ "id": "custom.align"
368
+ },
369
+ {
370
+ "id": "thresholds",
371
+ "value": {
372
+ "mode": "absolute",
373
+ "steps": [
374
+ {
375
+ "color": "rgba(50, 172, 45, 0.97)",
376
+ "value": null
377
+ },
378
+ {
379
+ "color": "rgba(237, 129, 40, 0.89)",
380
+ "value": 0
381
+ },
382
+ {
383
+ "color": "#FA6400",
384
+ "value": 1
385
+ }
386
+ ]
387
+ }
388
+ }
389
+ ]
390
+ },
391
+ {
392
+ "matcher": {
393
+ "id": "byName",
394
+ "options": "EPSS"
395
+ },
396
+ "properties": [
397
+ {
398
+ "id": "displayName",
399
+ "value": "EPSS"
400
+ },
401
+ {
402
+ "id": "unit",
403
+ "value": "short"
404
+ },
405
+ {
406
+ "id": "decimals",
407
+ "value": 2
408
+ },
409
+ {
410
+ "id": "custom.align"
411
+ }
412
+ ]
413
+ }
414
+ ]
415
+ },
416
+ "gridPos": {
417
+ "h": 7,
418
+ "w": 6,
419
+ "x": 18,
420
+ "y": 1
421
+ },
422
+ "id": 55,
423
+ "options": {
424
+ "cellHeight": "sm",
425
+ "footer": {
426
+ "countRows": false,
427
+ "fields": "",
428
+ "reducer": ["sum"],
429
+ "show": false
430
+ },
431
+ "showHeader": true
432
+ },
433
+ "pluginVersion": "10.0.3",
434
+ "targets": [
435
+ {
436
+ "bucketAggs": [
437
+ {
438
+ "fake": true,
439
+ "field": "epss_epss",
440
+ "id": "4",
441
+ "settings": {
442
+ "min_doc_count": 1,
443
+ "order": "desc",
444
+ "orderBy": "_term",
445
+ "size": "0"
446
+ },
447
+ "type": "terms"
448
+ },
449
+ {
450
+ "field": "epss_percentile",
451
+ "id": "5",
452
+ "settings": {
453
+ "min_doc_count": "1",
454
+ "order": "desc",
455
+ "orderBy": "_term",
456
+ "size": "10"
457
+ },
458
+ "type": "terms"
459
+ }
460
+ ],
461
+ "datasource": {
462
+ "type": "elasticsearch",
463
+ "uid": "wazuh_datasource_uid"
464
+ },
465
+ "metrics": [
466
+ {
467
+ "field": "select field",
468
+ "id": "1",
469
+ "type": "count"
470
+ }
471
+ ],
472
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
473
+ "refId": "A",
474
+ "timeField": "timestamp"
475
+ }
476
+ ],
477
+ "title": "Exploit Prediction Scoring System",
478
+ "transformations": [
479
+ {
480
+ "id": "organize",
481
+ "options": {
482
+ "excludeByName": {},
483
+ "indexByName": {},
484
+ "renameByName": {
485
+ "epss_epss": "EPSS",
486
+ "epss_percentile": "PERCENTILE"
487
+ }
488
+ }
489
+ },
490
+ {
491
+ "id": "merge",
492
+ "options": {
493
+ "reducers": []
494
+ }
495
+ }
496
+ ],
497
+ "type": "table"
498
+ },
499
+ {
500
+ "datasource": {
501
+ "type": "elasticsearch",
502
+ "uid": "wazuh_datasource_uid"
503
+ },
504
+ "fieldConfig": {
505
+ "defaults": {
506
+ "mappings": [],
507
+ "thresholds": {
508
+ "mode": "absolute",
509
+ "steps": [
510
+ {
511
+ "color": "green",
512
+ "value": null
513
+ },
514
+ {
515
+ "color": "red",
516
+ "value": 80
517
+ }
518
+ ]
519
+ }
520
+ },
521
+ "overrides": []
522
+ },
523
+ "gridPos": {
524
+ "h": 9,
525
+ "w": 9,
526
+ "x": 0,
527
+ "y": 8
528
+ },
529
+ "id": 37,
530
+ "options": {
531
+ "displayMode": "gradient",
532
+ "minVizHeight": 10,
533
+ "minVizWidth": 0,
534
+ "orientation": "horizontal",
535
+ "reduceOptions": {
536
+ "calcs": ["sum"],
537
+ "fields": "",
538
+ "values": false
539
+ },
540
+ "showUnfilled": true,
541
+ "text": {},
542
+ "valueMode": "color"
543
+ },
544
+ "pluginVersion": "10.0.3",
545
+ "targets": [
546
+ {
547
+ "bucketAggs": [
548
+ {
549
+ "fake": true,
550
+ "field": "data_vulnerability_package_name",
551
+ "id": "6",
552
+ "settings": {
553
+ "min_doc_count": 1,
554
+ "order": "desc",
555
+ "orderBy": "_count",
556
+ "size": "15"
557
+ },
558
+ "type": "terms"
559
+ },
560
+ {
561
+ "fake": true,
562
+ "field": "timestamp",
563
+ "id": "5",
564
+ "settings": {
565
+ "interval": "auto",
566
+ "min_doc_count": 0,
567
+ "trimEdges": 0
568
+ },
569
+ "type": "date_histogram"
570
+ }
571
+ ],
572
+ "datasource": {
573
+ "type": "elasticsearch",
574
+ "uid": "wazuh_datasource_uid"
575
+ },
576
+ "metrics": [
577
+ {
578
+ "field": "type",
579
+ "id": "1",
580
+ "meta": {},
581
+ "settings": {},
582
+ "type": "count"
583
+ }
584
+ ],
585
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
586
+ "refId": "A",
587
+ "timeField": "timestamp"
588
+ }
589
+ ],
590
+ "title": "VULNERABLE SOFTWARE / PACKAGE",
591
+ "type": "bargauge"
592
+ },
593
+ {
594
+ "datasource": {
595
+ "type": "elasticsearch",
596
+ "uid": "wazuh_datasource_uid"
597
+ },
598
+ "fieldConfig": {
599
+ "defaults": {
600
+ "color": {
601
+ "mode": "palette-classic"
602
+ },
603
+ "custom": {
604
+ "hideFrom": {
605
+ "legend": false,
606
+ "tooltip": false,
607
+ "viz": false
608
+ }
609
+ },
610
+ "decimals": 0,
611
+ "mappings": [],
612
+ "unit": "short"
613
+ },
614
+ "overrides": [
615
+ {
616
+ "matcher": {
617
+ "id": "byName",
618
+ "options": "Critical"
619
+ },
620
+ "properties": [
621
+ {
622
+ "id": "color",
623
+ "value": {
624
+ "fixedColor": "#C4162A",
625
+ "mode": "fixed"
626
+ }
627
+ }
628
+ ]
629
+ },
630
+ {
631
+ "matcher": {
632
+ "id": "byName",
633
+ "options": "High"
634
+ },
635
+ "properties": [
636
+ {
637
+ "id": "color",
638
+ "value": {
639
+ "fixedColor": "#F2495C",
640
+ "mode": "fixed"
641
+ }
642
+ }
643
+ ]
644
+ },
645
+ {
646
+ "matcher": {
647
+ "id": "byName",
648
+ "options": "Low"
649
+ },
650
+ "properties": [
651
+ {
652
+ "id": "color",
653
+ "value": {
654
+ "fixedColor": "#5794F2",
655
+ "mode": "fixed"
656
+ }
657
+ }
658
+ ]
659
+ },
660
+ {
661
+ "matcher": {
662
+ "id": "byName",
663
+ "options": "Medium"
664
+ },
665
+ "properties": [
666
+ {
667
+ "id": "color",
668
+ "value": {
669
+ "fixedColor": "#FF9830",
670
+ "mode": "fixed"
671
+ }
672
+ }
673
+ ]
674
+ }
675
+ ]
676
+ },
677
+ "gridPos": {
678
+ "h": 9,
679
+ "w": 7,
680
+ "x": 9,
681
+ "y": 8
682
+ },
683
+ "id": 45,
684
+ "links": [],
685
+ "maxDataPoints": 3,
686
+ "options": {
687
+ "legend": {
688
+ "calcs": [],
689
+ "displayMode": "table",
690
+ "placement": "right",
691
+ "showLegend": true,
692
+ "values": ["value"]
693
+ },
694
+ "pieType": "donut",
695
+ "reduceOptions": {
696
+ "calcs": ["sum"],
697
+ "fields": "",
698
+ "values": false
699
+ },
700
+ "tooltip": {
701
+ "mode": "single",
702
+ "sort": "none"
703
+ }
704
+ },
705
+ "targets": [
706
+ {
707
+ "bucketAggs": [
708
+ {
709
+ "fake": true,
710
+ "field": "data_vulnerability_severity",
711
+ "id": "3",
712
+ "settings": {
713
+ "min_doc_count": 1,
714
+ "order": "desc",
715
+ "orderBy": "_count",
716
+ "size": "0"
717
+ },
718
+ "type": "terms"
719
+ },
720
+ {
721
+ "field": "timestamp",
722
+ "id": "2",
723
+ "settings": {
724
+ "interval": "auto",
725
+ "min_doc_count": 0,
726
+ "trimEdges": 0
727
+ },
728
+ "type": "date_histogram"
729
+ }
730
+ ],
731
+ "metrics": [
732
+ {
733
+ "field": "select field",
734
+ "id": "1",
735
+ "type": "count"
736
+ }
737
+ ],
738
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
739
+ "refId": "A",
740
+ "timeField": "timestamp"
741
+ }
742
+ ],
743
+ "title": "VULNERABILITY LEVELS",
744
+ "type": "piechart"
745
+ },
746
+ {
747
+ "datasource": {
748
+ "type": "elasticsearch",
749
+ "uid": "wazuh_datasource_uid"
750
+ },
751
+ "fieldConfig": {
752
+ "defaults": {
753
+ "color": {
754
+ "mode": "thresholds"
755
+ },
756
+ "custom": {
757
+ "align": "auto",
758
+ "cellOptions": {
759
+ "type": "auto"
760
+ },
761
+ "filterable": false,
762
+ "inspect": false
763
+ },
764
+ "mappings": [],
765
+ "thresholds": {
766
+ "mode": "absolute",
767
+ "steps": [
768
+ {
769
+ "color": "green",
770
+ "value": null
771
+ },
772
+ {
773
+ "color": "red",
774
+ "value": 80
775
+ }
776
+ ]
777
+ }
778
+ },
779
+ "overrides": [
780
+ {
781
+ "matcher": {
782
+ "id": "byName",
783
+ "options": "Time"
784
+ },
785
+ "properties": [
786
+ {
787
+ "id": "displayName",
788
+ "value": "Time"
789
+ },
790
+ {
791
+ "id": "unit",
792
+ "value": "time: YYYY-MM-DD HH:mm:ss"
793
+ },
794
+ {
795
+ "id": "custom.align"
796
+ }
797
+ ]
798
+ },
799
+ {
800
+ "matcher": {
801
+ "id": "byName",
802
+ "options": ""
803
+ },
804
+ "properties": [
805
+ {
806
+ "id": "unit",
807
+ "value": "short"
808
+ },
809
+ {
810
+ "id": "decimals",
811
+ "value": 2
812
+ },
813
+ {
814
+ "id": "custom.align"
815
+ }
816
+ ]
817
+ },
818
+ {
819
+ "matcher": {
820
+ "id": "byName",
821
+ "options": "data_vulnerability_cve"
822
+ },
823
+ "properties": [
824
+ {
825
+ "id": "displayName",
826
+ "value": "CVE"
827
+ },
828
+ {
829
+ "id": "unit",
830
+ "value": "short"
831
+ },
832
+ {
833
+ "id": "decimals",
834
+ "value": -1
835
+ },
836
+ {
837
+ "id": "links",
838
+ "value": [
839
+ {
840
+ "targetBlank": true,
841
+ "title": "NVD - NIST DATABASE",
842
+ "url": "https://nvd.nist.gov/vuln/detail/${__value.text}"
843
+ }
844
+ ]
845
+ },
846
+ {
847
+ "id": "custom.align",
848
+ "value": "left"
849
+ }
850
+ ]
851
+ },
852
+ {
853
+ "matcher": {
854
+ "id": "byName",
855
+ "options": "Unique Count"
856
+ },
857
+ "properties": [
858
+ {
859
+ "id": "displayName",
860
+ "value": "HITS"
861
+ },
862
+ {
863
+ "id": "unit",
864
+ "value": "short"
865
+ },
866
+ {
867
+ "id": "decimals",
868
+ "value": -1
869
+ },
870
+ {
871
+ "id": "custom.align"
872
+ }
873
+ ]
874
+ },
875
+ {
876
+ "matcher": {
877
+ "id": "byName",
878
+ "options": "EPSS"
879
+ },
880
+ "properties": [
881
+ {
882
+ "id": "links",
883
+ "value": [
884
+ {
885
+ "targetBlank": true,
886
+ "title": "Exploit Prediction Scoring System",
887
+ "url": "https://www.first.org/epss/"
888
+ }
889
+ ]
890
+ }
891
+ ]
892
+ }
893
+ ]
894
+ },
895
+ "gridPos": {
896
+ "h": 9,
897
+ "w": 8,
898
+ "x": 16,
899
+ "y": 8
900
+ },
901
+ "id": 47,
902
+ "options": {
903
+ "cellHeight": "sm",
904
+ "footer": {
905
+ "countRows": false,
906
+ "fields": "",
907
+ "reducer": ["sum"],
908
+ "show": false
909
+ },
910
+ "showHeader": true
911
+ },
912
+ "pluginVersion": "10.0.3",
913
+ "targets": [
914
+ {
915
+ "bucketAggs": [
916
+ {
917
+ "fake": true,
918
+ "field": "data_vulnerability_cve",
919
+ "id": "7",
920
+ "settings": {
921
+ "min_doc_count": 1,
922
+ "order": "desc",
923
+ "orderBy": "_term",
924
+ "size": "10"
925
+ },
926
+ "type": "terms"
927
+ },
928
+ {
929
+ "field": "epss_epss",
930
+ "id": "8",
931
+ "settings": {
932
+ "min_doc_count": "1",
933
+ "order": "desc",
934
+ "orderBy": "_term",
935
+ "size": "10"
936
+ },
937
+ "type": "terms"
938
+ }
939
+ ],
940
+ "datasource": {
941
+ "type": "elasticsearch",
942
+ "uid": "wazuh_datasource_uid"
943
+ },
944
+ "metrics": [
945
+ {
946
+ "field": "data_vulnerability_cve",
947
+ "id": "1",
948
+ "meta": {},
949
+ "settings": {},
950
+ "type": "cardinality"
951
+ }
952
+ ],
953
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
954
+ "refId": "A",
955
+ "timeField": "timestamp"
956
+ }
957
+ ],
958
+ "title": "CVEs",
959
+ "transformations": [
960
+ {
961
+ "id": "organize",
962
+ "options": {
963
+ "excludeByName": {},
964
+ "indexByName": {},
965
+ "renameByName": {
966
+ "data_vulnerability_cve": "CVE",
967
+ "epss_epss": "EPSS"
968
+ }
969
+ }
970
+ }
971
+ ],
972
+ "type": "table"
973
+ },
974
+ {
975
+ "collapsed": false,
976
+ "datasource": {
977
+ "type": "elasticsearch",
978
+ "uid": "wazuh_datasource_uid"
979
+ },
980
+ "gridPos": {
981
+ "h": 1,
982
+ "w": 24,
983
+ "x": 0,
984
+ "y": 17
985
+ },
986
+ "id": 60,
987
+ "panels": [],
988
+ "title": "SYSTEM OS AND SOFTWARE VULNERABILITIES - ENTRIES",
989
+ "type": "row"
990
+ },
991
+ {
992
+ "datasource": {
993
+ "type": "elasticsearch",
994
+ "uid": "wazuh_datasource_uid"
995
+ },
996
+ "fieldConfig": {
997
+ "defaults": {
998
+ "color": {
999
+ "mode": "thresholds"
1000
+ },
1001
+ "custom": {
1002
+ "align": "auto",
1003
+ "cellOptions": {
1004
+ "type": "auto"
1005
+ },
1006
+ "filterable": false,
1007
+ "inspect": false
1008
+ },
1009
+ "mappings": [],
1010
+ "thresholds": {
1011
+ "mode": "absolute",
1012
+ "steps": [
1013
+ {
1014
+ "color": "green",
1015
+ "value": null
1016
+ },
1017
+ {
1018
+ "color": "red",
1019
+ "value": 80
1020
+ }
1021
+ ]
1022
+ }
1023
+ },
1024
+ "overrides": [
1025
+ {
1026
+ "matcher": {
1027
+ "id": "byName",
1028
+ "options": "Time"
1029
+ },
1030
+ "properties": [
1031
+ {
1032
+ "id": "displayName",
1033
+ "value": "Time"
1034
+ },
1035
+ {
1036
+ "id": "unit",
1037
+ "value": "time: YYYY-MM-DD HH:mm:ss"
1038
+ },
1039
+ {
1040
+ "id": "custom.align"
1041
+ }
1042
+ ]
1043
+ },
1044
+ {
1045
+ "matcher": {
1046
+ "id": "byName",
1047
+ "options": ""
1048
+ },
1049
+ "properties": [
1050
+ {
1051
+ "id": "unit",
1052
+ "value": "short"
1053
+ },
1054
+ {
1055
+ "id": "decimals",
1056
+ "value": 2
1057
+ },
1058
+ {
1059
+ "id": "custom.align"
1060
+ }
1061
+ ]
1062
+ },
1063
+ {
1064
+ "matcher": {
1065
+ "id": "byName",
1066
+ "options": "data_vulnerability_package_name"
1067
+ },
1068
+ "properties": [
1069
+ {
1070
+ "id": "displayName",
1071
+ "value": "PACKAGE NAME"
1072
+ },
1073
+ {
1074
+ "id": "unit",
1075
+ "value": "short"
1076
+ },
1077
+ {
1078
+ "id": "decimals",
1079
+ "value": -1
1080
+ },
1081
+ {
1082
+ "id": "custom.align",
1083
+ "value": "left"
1084
+ }
1085
+ ]
1086
+ },
1087
+ {
1088
+ "matcher": {
1089
+ "id": "byName",
1090
+ "options": "Unique Count"
1091
+ },
1092
+ "properties": [
1093
+ {
1094
+ "id": "displayName",
1095
+ "value": "HITS"
1096
+ },
1097
+ {
1098
+ "id": "unit",
1099
+ "value": "short"
1100
+ },
1101
+ {
1102
+ "id": "decimals",
1103
+ "value": -1
1104
+ },
1105
+ {
1106
+ "id": "custom.align"
1107
+ }
1108
+ ]
1109
+ },
1110
+ {
1111
+ "matcher": {
1112
+ "id": "byName",
1113
+ "options": "data_vulnerability_package_condition"
1114
+ },
1115
+ "properties": [
1116
+ {
1117
+ "id": "displayName",
1118
+ "value": "CONDITION"
1119
+ },
1120
+ {
1121
+ "id": "unit",
1122
+ "value": "short"
1123
+ },
1124
+ {
1125
+ "id": "decimals",
1126
+ "value": 2
1127
+ },
1128
+ {
1129
+ "id": "custom.align"
1130
+ }
1131
+ ]
1132
+ },
1133
+ {
1134
+ "matcher": {
1135
+ "id": "byName",
1136
+ "options": "CONDITION"
1137
+ },
1138
+ "properties": [
1139
+ {
1140
+ "id": "custom.width",
1141
+ "value": 378
1142
+ }
1143
+ ]
1144
+ }
1145
+ ]
1146
+ },
1147
+ "gridPos": {
1148
+ "h": 11,
1149
+ "w": 9,
1150
+ "x": 0,
1151
+ "y": 18
1152
+ },
1153
+ "id": 53,
1154
+ "options": {
1155
+ "cellHeight": "sm",
1156
+ "footer": {
1157
+ "countRows": false,
1158
+ "fields": "",
1159
+ "reducer": ["sum"],
1160
+ "show": false
1161
+ },
1162
+ "showHeader": true,
1163
+ "sortBy": []
1164
+ },
1165
+ "pluginVersion": "10.0.3",
1166
+ "targets": [
1167
+ {
1168
+ "bucketAggs": [
1169
+ {
1170
+ "fake": true,
1171
+ "field": "data_vulnerability_package_name",
1172
+ "id": "8",
1173
+ "settings": {
1174
+ "min_doc_count": 1,
1175
+ "order": "desc",
1176
+ "orderBy": "_term",
1177
+ "size": "10"
1178
+ },
1179
+ "type": "terms"
1180
+ },
1181
+ {
1182
+ "fake": true,
1183
+ "field": "data_vulnerability_package_condition",
1184
+ "id": "7",
1185
+ "settings": {
1186
+ "min_doc_count": 1,
1187
+ "order": "desc",
1188
+ "orderBy": "_term",
1189
+ "size": "10"
1190
+ },
1191
+ "type": "terms"
1192
+ }
1193
+ ],
1194
+ "metrics": [
1195
+ {
1196
+ "field": "data_vulnerability_package_condition",
1197
+ "id": "1",
1198
+ "meta": {},
1199
+ "settings": {},
1200
+ "type": "cardinality"
1201
+ }
1202
+ ],
1203
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
1204
+ "refId": "A",
1205
+ "timeField": "@timestamp"
1206
+ }
1207
+ ],
1208
+ "title": "SOFTWARE / PACKAGE",
1209
+ "transformations": [
1210
+ {
1211
+ "id": "merge",
1212
+ "options": {
1213
+ "reducers": []
1214
+ }
1215
+ }
1216
+ ],
1217
+ "type": "table"
1218
+ },
1219
+ {
1220
+ "datasource": {
1221
+ "type": "elasticsearch",
1222
+ "uid": "wazuh_datasource_uid"
1223
+ },
1224
+ "fieldConfig": {
1225
+ "defaults": {
1226
+ "color": {
1227
+ "mode": "palette-classic"
1228
+ },
1229
+ "custom": {
1230
+ "axisCenteredZero": false,
1231
+ "axisColorMode": "text",
1232
+ "axisLabel": "",
1233
+ "axisPlacement": "auto",
1234
+ "barAlignment": 0,
1235
+ "drawStyle": "line",
1236
+ "fillOpacity": 0,
1237
+ "gradientMode": "none",
1238
+ "hideFrom": {
1239
+ "legend": false,
1240
+ "tooltip": false,
1241
+ "viz": false
1242
+ },
1243
+ "lineInterpolation": "linear",
1244
+ "lineWidth": 1,
1245
+ "pointSize": 5,
1246
+ "scaleDistribution": {
1247
+ "type": "linear"
1248
+ },
1249
+ "showPoints": "auto",
1250
+ "spanNulls": false,
1251
+ "stacking": {
1252
+ "group": "A",
1253
+ "mode": "none"
1254
+ },
1255
+ "thresholdsStyle": {
1256
+ "mode": "off"
1257
+ }
1258
+ },
1259
+ "mappings": [],
1260
+ "thresholds": {
1261
+ "mode": "absolute",
1262
+ "steps": [
1263
+ {
1264
+ "color": "green",
1265
+ "value": null
1266
+ },
1267
+ {
1268
+ "color": "red",
1269
+ "value": 80
1270
+ }
1271
+ ]
1272
+ }
1273
+ },
1274
+ "overrides": []
1275
+ },
1276
+ "gridPos": {
1277
+ "h": 11,
1278
+ "w": 15,
1279
+ "x": 9,
1280
+ "y": 18
1281
+ },
1282
+ "id": 72,
1283
+ "options": {
1284
+ "legend": {
1285
+ "calcs": [],
1286
+ "displayMode": "table",
1287
+ "placement": "right",
1288
+ "showLegend": true
1289
+ },
1290
+ "tooltip": {
1291
+ "mode": "single",
1292
+ "sort": "none"
1293
+ }
1294
+ },
1295
+ "targets": [
1296
+ {
1297
+ "alias": "",
1298
+ "bucketAggs": [
1299
+ {
1300
+ "field": "agent_name",
1301
+ "id": "3",
1302
+ "settings": {
1303
+ "min_doc_count": "1",
1304
+ "order": "desc",
1305
+ "orderBy": "_term",
1306
+ "size": "10"
1307
+ },
1308
+ "type": "terms"
1309
+ },
1310
+ {
1311
+ "field": "timestamp",
1312
+ "id": "2",
1313
+ "settings": {
1314
+ "interval": "auto"
1315
+ },
1316
+ "type": "date_histogram"
1317
+ }
1318
+ ],
1319
+ "datasource": {
1320
+ "type": "elasticsearch",
1321
+ "uid": "wazuh_datasource_uid"
1322
+ },
1323
+ "metrics": [
1324
+ {
1325
+ "id": "1",
1326
+ "type": "count"
1327
+ }
1328
+ ],
1329
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
1330
+ "refId": "A",
1331
+ "timeField": "timestamp"
1332
+ }
1333
+ ],
1334
+ "title": "VULNERABILITY EVENTS - HISTOGRAM",
1335
+ "type": "timeseries"
1336
+ },
1337
+ {
1338
+ "datasource": {
1339
+ "type": "elasticsearch",
1340
+ "uid": "wazuh_datasource_uid"
1341
+ },
1342
+ "fieldConfig": {
1343
+ "defaults": {
1344
+ "color": {
1345
+ "mode": "thresholds"
1346
+ },
1347
+ "custom": {
1348
+ "align": "auto",
1349
+ "cellOptions": {
1350
+ "type": "auto"
1351
+ },
1352
+ "inspect": false
1353
+ },
1354
+ "mappings": [],
1355
+ "thresholds": {
1356
+ "mode": "absolute",
1357
+ "steps": [
1358
+ {
1359
+ "color": "green",
1360
+ "value": null
1361
+ },
1362
+ {
1363
+ "color": "red",
1364
+ "value": 80
1365
+ }
1366
+ ]
1367
+ }
1368
+ },
1369
+ "overrides": [
1370
+ {
1371
+ "matcher": {
1372
+ "id": "byName",
1373
+ "options": "data_vulnerability_package_name"
1374
+ },
1375
+ "properties": [
1376
+ {
1377
+ "id": "displayName",
1378
+ "value": "PACKAGE"
1379
+ },
1380
+ {
1381
+ "id": "custom.align"
1382
+ }
1383
+ ]
1384
+ },
1385
+ {
1386
+ "matcher": {
1387
+ "id": "byName",
1388
+ "options": "data_vulnerability_package_condition"
1389
+ },
1390
+ "properties": [
1391
+ {
1392
+ "id": "displayName",
1393
+ "value": "STATUS"
1394
+ },
1395
+ {
1396
+ "id": "unit",
1397
+ "value": "short"
1398
+ },
1399
+ {
1400
+ "id": "decimals",
1401
+ "value": -1
1402
+ },
1403
+ {
1404
+ "id": "custom.align"
1405
+ }
1406
+ ]
1407
+ },
1408
+ {
1409
+ "matcher": {
1410
+ "id": "byName",
1411
+ "options": "data_vulnerability_cve"
1412
+ },
1413
+ "properties": [
1414
+ {
1415
+ "id": "displayName",
1416
+ "value": "CVE"
1417
+ },
1418
+ {
1419
+ "id": "unit",
1420
+ "value": "kbytes"
1421
+ },
1422
+ {
1423
+ "id": "decimals",
1424
+ "value": -1
1425
+ },
1426
+ {
1427
+ "id": "custom.align"
1428
+ }
1429
+ ]
1430
+ },
1431
+ {
1432
+ "matcher": {
1433
+ "id": "byName",
1434
+ "options": "agent_name"
1435
+ },
1436
+ "properties": [
1437
+ {
1438
+ "id": "displayName",
1439
+ "value": "AGENT"
1440
+ },
1441
+ {
1442
+ "id": "unit",
1443
+ "value": "short"
1444
+ },
1445
+ {
1446
+ "id": "decimals",
1447
+ "value": 2
1448
+ },
1449
+ {
1450
+ "id": "custom.align"
1451
+ }
1452
+ ]
1453
+ },
1454
+ {
1455
+ "matcher": {
1456
+ "id": "byName",
1457
+ "options": "data_vulnerability_title"
1458
+ },
1459
+ "properties": [
1460
+ {
1461
+ "id": "displayName",
1462
+ "value": "CVE TITLE"
1463
+ },
1464
+ {
1465
+ "id": "unit",
1466
+ "value": "short"
1467
+ },
1468
+ {
1469
+ "id": "decimals",
1470
+ "value": 2
1471
+ },
1472
+ {
1473
+ "id": "custom.align"
1474
+ }
1475
+ ]
1476
+ },
1477
+ {
1478
+ "matcher": {
1479
+ "id": "byName",
1480
+ "options": "data_vulnerability_severity"
1481
+ },
1482
+ "properties": [
1483
+ {
1484
+ "id": "displayName",
1485
+ "value": "SEVERITY"
1486
+ },
1487
+ {
1488
+ "id": "unit",
1489
+ "value": "short"
1490
+ },
1491
+ {
1492
+ "id": "decimals",
1493
+ "value": 2
1494
+ },
1495
+ {
1496
+ "id": "custom.align"
1497
+ }
1498
+ ]
1499
+ },
1500
+ {
1501
+ "matcher": {
1502
+ "id": "byName",
1503
+ "options": "epss_epss"
1504
+ },
1505
+ "properties": [
1506
+ {
1507
+ "id": "displayName",
1508
+ "value": "EPSS"
1509
+ }
1510
+ ]
1511
+ },
1512
+ {
1513
+ "matcher": {
1514
+ "id": "byName",
1515
+ "options": "AGENT"
1516
+ },
1517
+ "properties": [
1518
+ {
1519
+ "id": "custom.width",
1520
+ "value": 183
1521
+ }
1522
+ ]
1523
+ },
1524
+ {
1525
+ "matcher": {
1526
+ "id": "byName",
1527
+ "options": "CVE"
1528
+ },
1529
+ "properties": [
1530
+ {
1531
+ "id": "custom.width",
1532
+ "value": 183
1533
+ }
1534
+ ]
1535
+ },
1536
+ {
1537
+ "matcher": {
1538
+ "id": "byName",
1539
+ "options": "timestamp"
1540
+ },
1541
+ "properties": [
1542
+ {
1543
+ "id": "custom.width",
1544
+ "value": 200
1545
+ }
1546
+ ]
1547
+ },
1548
+ {
1549
+ "matcher": {
1550
+ "id": "byName",
1551
+ "options": "SEVERITY"
1552
+ },
1553
+ "properties": [
1554
+ {
1555
+ "id": "custom.width",
1556
+ "value": 174
1557
+ }
1558
+ ]
1559
+ },
1560
+ {
1561
+ "matcher": {
1562
+ "id": "byName",
1563
+ "options": "CVE TITLE"
1564
+ },
1565
+ "properties": [
1566
+ {
1567
+ "id": "custom.width",
1568
+ "value": 736
1569
+ }
1570
+ ]
1571
+ }
1572
+ ]
1573
+ },
1574
+ "gridPos": {
1575
+ "h": 12,
1576
+ "w": 24,
1577
+ "x": 0,
1578
+ "y": 29
1579
+ },
1580
+ "id": 48,
1581
+ "options": {
1582
+ "cellHeight": "sm",
1583
+ "footer": {
1584
+ "countRows": false,
1585
+ "fields": "",
1586
+ "reducer": ["sum"],
1587
+ "show": false
1588
+ },
1589
+ "showHeader": true,
1590
+ "sortBy": []
1591
+ },
1592
+ "pluginVersion": "10.0.3",
1593
+ "targets": [
1594
+ {
1595
+ "bucketAggs": [],
1596
+ "datasource": {
1597
+ "type": "elasticsearch",
1598
+ "uid": "wazuh_datasource_uid"
1599
+ },
1600
+ "metrics": [
1601
+ {
1602
+ "id": "1",
1603
+ "settings": {
1604
+ "size": "500"
1605
+ },
1606
+ "type": "raw_data"
1607
+ }
1608
+ ],
1609
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
1610
+ "refId": "A",
1611
+ "timeField": "timestamp"
1612
+ }
1613
+ ],
1614
+ "title": "SYSTEM VULNERABILITIES - DETAILS",
1615
+ "transformations": [
1616
+ {
1617
+ "id": "filterFieldsByName",
1618
+ "options": {
1619
+ "include": {
1620
+ "names": [
1621
+ "timestamp",
1622
+ "agent_name",
1623
+ "data_vulnerability_cve",
1624
+ "data_vulnerability_package_name",
1625
+ "data_vulnerability_severity",
1626
+ "data_vulnerability_title",
1627
+ "epss_epss"
1628
+ ]
1629
+ }
1630
+ }
1631
+ }
1632
+ ],
1633
+ "type": "table"
1634
+ },
1635
+ {
1636
+ "datasource": {
1637
+ "type": "elasticsearch",
1638
+ "uid": "wazuh_datasource_uid"
1639
+ },
1640
+ "fieldConfig": {
1641
+ "defaults": {
1642
+ "color": {
1643
+ "mode": "thresholds"
1644
+ },
1645
+ "custom": {
1646
+ "align": "auto",
1647
+ "cellOptions": {
1648
+ "type": "auto"
1649
+ },
1650
+ "inspect": false
1651
+ },
1652
+ "mappings": [],
1653
+ "thresholds": {
1654
+ "mode": "absolute",
1655
+ "steps": [
1656
+ {
1657
+ "color": "green",
1658
+ "value": null
1659
+ },
1660
+ {
1661
+ "color": "red",
1662
+ "value": 80
1663
+ }
1664
+ ]
1665
+ }
1666
+ },
1667
+ "overrides": [
1668
+ {
1669
+ "matcher": {
1670
+ "id": "byName",
1671
+ "options": "data_vulnerability_package_name"
1672
+ },
1673
+ "properties": [
1674
+ {
1675
+ "id": "displayName",
1676
+ "value": "PACKAGE"
1677
+ },
1678
+ {
1679
+ "id": "custom.align"
1680
+ }
1681
+ ]
1682
+ },
1683
+ {
1684
+ "matcher": {
1685
+ "id": "byName",
1686
+ "options": "data_vulnerability_package_condition"
1687
+ },
1688
+ "properties": [
1689
+ {
1690
+ "id": "displayName",
1691
+ "value": "STATUS"
1692
+ },
1693
+ {
1694
+ "id": "unit",
1695
+ "value": "short"
1696
+ },
1697
+ {
1698
+ "id": "decimals",
1699
+ "value": -1
1700
+ },
1701
+ {
1702
+ "id": "custom.align"
1703
+ }
1704
+ ]
1705
+ },
1706
+ {
1707
+ "matcher": {
1708
+ "id": "byName",
1709
+ "options": "data_vulnerability_cve"
1710
+ },
1711
+ "properties": [
1712
+ {
1713
+ "id": "displayName",
1714
+ "value": "CVE"
1715
+ },
1716
+ {
1717
+ "id": "unit",
1718
+ "value": "kbytes"
1719
+ },
1720
+ {
1721
+ "id": "decimals",
1722
+ "value": -1
1723
+ },
1724
+ {
1725
+ "id": "custom.align"
1726
+ }
1727
+ ]
1728
+ },
1729
+ {
1730
+ "matcher": {
1731
+ "id": "byName",
1732
+ "options": "agent_name"
1733
+ },
1734
+ "properties": [
1735
+ {
1736
+ "id": "displayName",
1737
+ "value": "AGENT"
1738
+ },
1739
+ {
1740
+ "id": "unit",
1741
+ "value": "short"
1742
+ },
1743
+ {
1744
+ "id": "decimals",
1745
+ "value": 2
1746
+ },
1747
+ {
1748
+ "id": "custom.align"
1749
+ }
1750
+ ]
1751
+ },
1752
+ {
1753
+ "matcher": {
1754
+ "id": "byName",
1755
+ "options": "data_vulnerability_title"
1756
+ },
1757
+ "properties": [
1758
+ {
1759
+ "id": "displayName",
1760
+ "value": "CVE TITLE"
1761
+ },
1762
+ {
1763
+ "id": "unit",
1764
+ "value": "short"
1765
+ },
1766
+ {
1767
+ "id": "decimals",
1768
+ "value": 2
1769
+ },
1770
+ {
1771
+ "id": "custom.align"
1772
+ }
1773
+ ]
1774
+ },
1775
+ {
1776
+ "matcher": {
1777
+ "id": "byName",
1778
+ "options": "data_vulnerability_severity"
1779
+ },
1780
+ "properties": [
1781
+ {
1782
+ "id": "displayName",
1783
+ "value": "SEVERITY"
1784
+ },
1785
+ {
1786
+ "id": "unit",
1787
+ "value": "short"
1788
+ },
1789
+ {
1790
+ "id": "decimals",
1791
+ "value": 2
1792
+ },
1793
+ {
1794
+ "id": "custom.align"
1795
+ }
1796
+ ]
1797
+ },
1798
+ {
1799
+ "matcher": {
1800
+ "id": "byName",
1801
+ "options": "data_vulnerability_updated"
1802
+ },
1803
+ "properties": [
1804
+ {
1805
+ "id": "displayName",
1806
+ "value": "CVE LAST UPDATE"
1807
+ },
1808
+ {
1809
+ "id": "unit",
1810
+ "value": "short"
1811
+ },
1812
+ {
1813
+ "id": "decimals",
1814
+ "value": 2
1815
+ },
1816
+ {
1817
+ "id": "custom.align"
1818
+ }
1819
+ ]
1820
+ },
1821
+ {
1822
+ "matcher": {
1823
+ "id": "byName",
1824
+ "options": "data_vulnerability_references"
1825
+ },
1826
+ "properties": [
1827
+ {
1828
+ "id": "displayName",
1829
+ "value": "REFERENCES"
1830
+ },
1831
+ {
1832
+ "id": "unit",
1833
+ "value": "short"
1834
+ },
1835
+ {
1836
+ "id": "decimals",
1837
+ "value": 2
1838
+ },
1839
+ {
1840
+ "id": "custom.align"
1841
+ }
1842
+ ]
1843
+ },
1844
+ {
1845
+ "matcher": {
1846
+ "id": "byName",
1847
+ "options": "data_vulnerability_rationale"
1848
+ },
1849
+ "properties": [
1850
+ {
1851
+ "id": "displayName",
1852
+ "value": "VULNERABILITY INFO"
1853
+ },
1854
+ {
1855
+ "id": "unit",
1856
+ "value": "short"
1857
+ },
1858
+ {
1859
+ "id": "decimals",
1860
+ "value": 2
1861
+ },
1862
+ {
1863
+ "id": "custom.align"
1864
+ }
1865
+ ]
1866
+ }
1867
+ ]
1868
+ },
1869
+ "gridPos": {
1870
+ "h": 12,
1871
+ "w": 24,
1872
+ "x": 0,
1873
+ "y": 41
1874
+ },
1875
+ "id": 56,
1876
+ "options": {
1877
+ "cellHeight": "sm",
1878
+ "footer": {
1879
+ "countRows": false,
1880
+ "fields": "",
1881
+ "reducer": ["sum"],
1882
+ "show": false
1883
+ },
1884
+ "showHeader": true
1885
+ },
1886
+ "pluginVersion": "10.0.3",
1887
+ "targets": [
1888
+ {
1889
+ "bucketAggs": [],
1890
+ "datasource": {
1891
+ "type": "elasticsearch",
1892
+ "uid": "wazuh_datasource_uid"
1893
+ },
1894
+ "metrics": [
1895
+ {
1896
+ "id": "1",
1897
+ "settings": {
1898
+ "size": "500"
1899
+ },
1900
+ "type": "raw_data"
1901
+ }
1902
+ ],
1903
+ "query": "rule_groups:vulnerability-detector AND agent_name:$agent_name",
1904
+ "refId": "A",
1905
+ "timeField": "timestamp"
1906
+ }
1907
+ ],
1908
+ "title": "VULNERABILITIES INFO",
1909
+ "transformations": [
1910
+ {
1911
+ "id": "filterFieldsByName",
1912
+ "options": {
1913
+ "include": {
1914
+ "names": [
1915
+ "timestamp",
1916
+ "agent_name",
1917
+ "data_vulnerability_package_name",
1918
+ "data_vulnerability_rationale",
1919
+ "data_vulnerability_references",
1920
+ "data_vulnerability_severity",
1921
+ "data_vulnerability_title",
1922
+ "data_vulnerability_updated",
1923
+ "data_vulnerability_package_condition"
1924
+ ]
1925
+ }
1926
+ }
1927
+ }
1928
+ ],
1929
+ "type": "table"
1930
+ },
1931
+ {
1932
+ "collapsed": true,
1933
+ "datasource": {
1934
+ "type": "elasticsearch",
1935
+ "uid": "wazuh_datasource_uid"
1936
+ },
1937
+ "gridPos": {
1938
+ "h": 1,
1939
+ "w": 24,
1940
+ "x": 0,
1941
+ "y": 53
1942
+ },
1943
+ "id": 62,
1944
+ "panels": [
1945
+ {
1946
+ "datasource": {
1947
+ "type": "elasticsearch",
1948
+ "uid": "wazuh_datasource_uid"
1949
+ },
1950
+ "fieldConfig": {
1951
+ "defaults": {
1952
+ "mappings": [
1953
+ {
1954
+ "options": {
1955
+ "match": "null",
1956
+ "result": {
1957
+ "text": "N/A"
1958
+ }
1959
+ },
1960
+ "type": "special"
1961
+ }
1962
+ ],
1963
+ "thresholds": {
1964
+ "mode": "absolute",
1965
+ "steps": [
1966
+ {
1967
+ "color": "dark-orange",
1968
+ "value": null
1969
+ }
1970
+ ]
1971
+ },
1972
+ "unit": "short"
1973
+ },
1974
+ "overrides": []
1975
+ },
1976
+ "gridPos": {
1977
+ "h": 7,
1978
+ "w": 4,
1979
+ "x": 0,
1980
+ "y": 27
1981
+ },
1982
+ "id": 63,
1983
+ "links": [],
1984
+ "options": {
1985
+ "colorMode": "value",
1986
+ "graphMode": "area",
1987
+ "justifyMode": "auto",
1988
+ "orientation": "horizontal",
1989
+ "reduceOptions": {
1990
+ "calcs": ["sum"],
1991
+ "fields": "",
1992
+ "values": false
1993
+ },
1994
+ "text": {},
1995
+ "textMode": "auto"
1996
+ },
1997
+ "pluginVersion": "10.0.3",
1998
+ "targets": [
1999
+ {
2000
+ "bucketAggs": [
2001
+ {
2002
+ "field": "timestamp",
2003
+ "id": "2",
2004
+ "settings": {
2005
+ "interval": "auto",
2006
+ "min_doc_count": 0,
2007
+ "trimEdges": 0
2008
+ },
2009
+ "type": "date_histogram"
2010
+ }
2011
+ ],
2012
+ "datasource": {
2013
+ "type": "elasticsearch",
2014
+ "uid": "wazuh_datasource_uid"
2015
+ },
2016
+ "metrics": [
2017
+ {
2018
+ "field": "select field",
2019
+ "id": "1",
2020
+ "type": "count"
2021
+ }
2022
+ ],
2023
+ "query": "rule_group2:snyk AND agent_name:$agent_name",
2024
+ "refId": "A",
2025
+ "timeField": "timestamp"
2026
+ }
2027
+ ],
2028
+ "title": "VULNERABILITY EVENTS",
2029
+ "type": "stat"
2030
+ },
2031
+ {
2032
+ "columns": [],
2033
+ "datasource": {
2034
+ "type": "elasticsearch",
2035
+ "uid": "wazuh_datasource_uid"
2036
+ },
2037
+ "fontSize": "100%",
2038
+ "gridPos": {
2039
+ "h": 7,
2040
+ "w": 8,
2041
+ "x": 4,
2042
+ "y": 27
2043
+ },
2044
+ "id": 64,
2045
+ "showHeader": true,
2046
+ "sort": {
2047
+ "col": 0,
2048
+ "desc": true
2049
+ },
2050
+ "styles": [
2051
+ {
2052
+ "$$hashKey": "object:108",
2053
+ "alias": "Time",
2054
+ "align": "auto",
2055
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
2056
+ "pattern": "Time",
2057
+ "type": "date"
2058
+ },
2059
+ {
2060
+ "$$hashKey": "object:109",
2061
+ "alias": "",
2062
+ "align": "auto",
2063
+ "colorMode": "row",
2064
+ "colors": ["rgba(50, 172, 45, 0.97)", "rgba(237, 129, 40, 0.89)", "#FA6400"],
2065
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
2066
+ "decimals": -1,
2067
+ "mappingType": 1,
2068
+ "pattern": "Count",
2069
+ "thresholds": ["0", "1"],
2070
+ "type": "number",
2071
+ "unit": "short"
2072
+ },
2073
+ {
2074
+ "$$hashKey": "object:110",
2075
+ "alias": "AGENT",
2076
+ "align": "auto",
2077
+ "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
2078
+ "dateFormat": "YYYY-MM-DD HH:mm:ss",
2079
+ "decimals": 2,
2080
+ "mappingType": 1,
2081
+ "pattern": "agent_name",
2082
+ "thresholds": [],
2083
+ "type": "number",
2084
+ "unit": "short"
2085
+ }
2086
+ ],
2087
+ "targets": [
2088
+ {
2089
+ "bucketAggs": [
2090
+ {
2091
+ "fake": true,
2092
+ "field": "agent_name",
2093
+ "id": "4",
2094
+ "settings": {
2095
+ "min_doc_count": 1,
2096
+ "order": "desc",
2097
+ "orderBy": "_term",
2098
+ "size": "0"
2099
+ },
2100
+ "type": "terms"
2101
+ }
2102
+ ],
2103
+ "datasource": {
2104
+ "type": "elasticsearch",
2105
+ "uid": "wazuh_datasource_uid"
2106
+ },
2107
+ "metrics": [
2108
+ {
2109
+ "field": "select field",
2110
+ "id": "1",
2111
+ "type": "count"
2112
+ }
2113
+ ],
2114
+ "query": "rule_group2:snyk AND agent_name:$agent_name",
2115
+ "refId": "A",
2116
+ "timeField": "timestamp"
2117
+ }
2118
+ ],
2119
+ "title": "DOCKER HOST",
2120
+ "transform": "table",
2121
+ "type": "table-old"
2122
+ },
2123
+ {
2124
+ "datasource": {
2125
+ "type": "elasticsearch",
2126
+ "uid": "wazuh_datasource_uid"
2127
+ },
2128
+ "fieldConfig": {
2129
+ "defaults": {
2130
+ "color": {
2131
+ "mode": "thresholds"
2132
+ },
2133
+ "custom": {
2134
+ "align": "auto",
2135
+ "cellOptions": {
2136
+ "type": "auto"
2137
+ },
2138
+ "filterable": false,
2139
+ "inspect": false
2140
+ },
2141
+ "mappings": [],
2142
+ "thresholds": {
2143
+ "mode": "absolute",
2144
+ "steps": [
2145
+ {
2146
+ "color": "green",
2147
+ "value": null
2148
+ },
2149
+ {
2150
+ "color": "red",
2151
+ "value": 80
2152
+ }
2153
+ ]
2154
+ }
2155
+ },
2156
+ "overrides": [
2157
+ {
2158
+ "matcher": {
2159
+ "id": "byName",
2160
+ "options": "Time"
2161
+ },
2162
+ "properties": [
2163
+ {
2164
+ "id": "displayName",
2165
+ "value": "Time"
2166
+ },
2167
+ {
2168
+ "id": "unit",
2169
+ "value": "time: YYYY-MM-DD HH:mm:ss"
2170
+ },
2171
+ {
2172
+ "id": "custom.align"
2173
+ }
2174
+ ]
2175
+ },
2176
+ {
2177
+ "matcher": {
2178
+ "id": "byName",
2179
+ "options": ""
2180
+ },
2181
+ "properties": [
2182
+ {
2183
+ "id": "unit",
2184
+ "value": "short"
2185
+ },
2186
+ {
2187
+ "id": "decimals",
2188
+ "value": 2
2189
+ },
2190
+ {
2191
+ "id": "custom.align"
2192
+ }
2193
+ ]
2194
+ },
2195
+ {
2196
+ "matcher": {
2197
+ "id": "byName",
2198
+ "options": "data_vulnerability_cve"
2199
+ },
2200
+ "properties": [
2201
+ {
2202
+ "id": "displayName",
2203
+ "value": "CVE"
2204
+ },
2205
+ {
2206
+ "id": "unit",
2207
+ "value": "short"
2208
+ },
2209
+ {
2210
+ "id": "decimals",
2211
+ "value": -1
2212
+ },
2213
+ {
2214
+ "id": "links",
2215
+ "value": [
2216
+ {
2217
+ "targetBlank": true,
2218
+ "title": "NVD - NIST DATABASE",
2219
+ "url": "https://nvd.nist.gov/vuln/detail/$__cell"
2220
+ }
2221
+ ]
2222
+ },
2223
+ {
2224
+ "id": "custom.align",
2225
+ "value": "left"
2226
+ }
2227
+ ]
2228
+ },
2229
+ {
2230
+ "matcher": {
2231
+ "id": "byName",
2232
+ "options": "Unique Count"
2233
+ },
2234
+ "properties": [
2235
+ {
2236
+ "id": "displayName",
2237
+ "value": "HITS"
2238
+ },
2239
+ {
2240
+ "id": "unit",
2241
+ "value": "short"
2242
+ },
2243
+ {
2244
+ "id": "decimals",
2245
+ "value": -1
2246
+ },
2247
+ {
2248
+ "id": "custom.align"
2249
+ }
2250
+ ]
2251
+ }
2252
+ ]
2253
+ },
2254
+ "gridPos": {
2255
+ "h": 7,
2256
+ "w": 6,
2257
+ "x": 12,
2258
+ "y": 27
2259
+ },
2260
+ "id": 71,
2261
+ "options": {
2262
+ "cellHeight": "sm",
2263
+ "footer": {
2264
+ "countRows": false,
2265
+ "fields": "",
2266
+ "reducer": ["sum"],
2267
+ "show": false
2268
+ },
2269
+ "showHeader": true
2270
+ },
2271
+ "pluginVersion": "10.0.3",
2272
+ "targets": [
2273
+ {
2274
+ "bucketAggs": [
2275
+ {
2276
+ "fake": true,
2277
+ "field": "data_dockerBaseImage",
2278
+ "id": "7",
2279
+ "settings": {
2280
+ "min_doc_count": 1,
2281
+ "order": "desc",
2282
+ "orderBy": "_term",
2283
+ "size": "10"
2284
+ },
2285
+ "type": "terms"
2286
+ }
2287
+ ],
2288
+ "datasource": {
2289
+ "type": "elasticsearch",
2290
+ "uid": "wazuh_datasource_uid"
2291
+ },
2292
+ "metrics": [
2293
+ {
2294
+ "field": "data_dockerBaseImage",
2295
+ "id": "1",
2296
+ "meta": {},
2297
+ "settings": {},
2298
+ "type": "cardinality"
2299
+ }
2300
+ ],
2301
+ "query": "rule_group2:snyk AND agent_name:$agent_name",
2302
+ "refId": "A",
2303
+ "timeField": "timestamp"
2304
+ }
2305
+ ],
2306
+ "title": "DOCKER BASE IMAGE",
2307
+ "transformations": [
2308
+ {
2309
+ "id": "merge",
2310
+ "options": {
2311
+ "reducers": []
2312
+ }
2313
+ }
2314
+ ],
2315
+ "type": "table"
2316
+ },
2317
+ {
2318
+ "datasource": {
2319
+ "type": "elasticsearch",
2320
+ "uid": "wazuh_datasource_uid"
2321
+ },
2322
+ "fieldConfig": {
2323
+ "defaults": {
2324
+ "color": {
2325
+ "mode": "thresholds"
2326
+ },
2327
+ "custom": {
2328
+ "align": "auto",
2329
+ "cellOptions": {
2330
+ "type": "auto"
2331
+ },
2332
+ "filterable": false,
2333
+ "inspect": false
2334
+ },
2335
+ "mappings": [],
2336
+ "thresholds": {
2337
+ "mode": "absolute",
2338
+ "steps": [
2339
+ {
2340
+ "color": "green",
2341
+ "value": null
2342
+ },
2343
+ {
2344
+ "color": "red",
2345
+ "value": 80
2346
+ }
2347
+ ]
2348
+ }
2349
+ },
2350
+ "overrides": [
2351
+ {
2352
+ "matcher": {
2353
+ "id": "byName",
2354
+ "options": "Time"
2355
+ },
2356
+ "properties": [
2357
+ {
2358
+ "id": "displayName",
2359
+ "value": "Time"
2360
+ },
2361
+ {
2362
+ "id": "unit",
2363
+ "value": "time: YYYY-MM-DD HH:mm:ss"
2364
+ },
2365
+ {
2366
+ "id": "custom.align"
2367
+ }
2368
+ ]
2369
+ },
2370
+ {
2371
+ "matcher": {
2372
+ "id": "byName",
2373
+ "options": ""
2374
+ },
2375
+ "properties": [
2376
+ {
2377
+ "id": "unit",
2378
+ "value": "short"
2379
+ },
2380
+ {
2381
+ "id": "decimals",
2382
+ "value": 2
2383
+ },
2384
+ {
2385
+ "id": "custom.align"
2386
+ }
2387
+ ]
2388
+ },
2389
+ {
2390
+ "matcher": {
2391
+ "id": "byName",
2392
+ "options": "data_vulnerability_cve"
2393
+ },
2394
+ "properties": [
2395
+ {
2396
+ "id": "displayName",
2397
+ "value": "CVE"
2398
+ },
2399
+ {
2400
+ "id": "unit",
2401
+ "value": "short"
2402
+ },
2403
+ {
2404
+ "id": "decimals",
2405
+ "value": -1
2406
+ },
2407
+ {
2408
+ "id": "links",
2409
+ "value": [
2410
+ {
2411
+ "targetBlank": true,
2412
+ "title": "NVD - NIST DATABASE",
2413
+ "url": "https://nvd.nist.gov/vuln/detail/$__cell"
2414
+ }
2415
+ ]
2416
+ },
2417
+ {
2418
+ "id": "custom.align",
2419
+ "value": "left"
2420
+ }
2421
+ ]
2422
+ },
2423
+ {
2424
+ "matcher": {
2425
+ "id": "byName",
2426
+ "options": "Unique Count"
2427
+ },
2428
+ "properties": [
2429
+ {
2430
+ "id": "displayName",
2431
+ "value": "HITS"
2432
+ },
2433
+ {
2434
+ "id": "unit",
2435
+ "value": "short"
2436
+ },
2437
+ {
2438
+ "id": "decimals",
2439
+ "value": -1
2440
+ },
2441
+ {
2442
+ "id": "custom.align"
2443
+ }
2444
+ ]
2445
+ }
2446
+ ]
2447
+ },
2448
+ "gridPos": {
2449
+ "h": 7,
2450
+ "w": 6,
2451
+ "x": 18,
2452
+ "y": 27
2453
+ },
2454
+ "id": 65,
2455
+ "options": {
2456
+ "cellHeight": "sm",
2457
+ "footer": {
2458
+ "countRows": false,
2459
+ "fields": "",
2460
+ "reducer": ["sum"],
2461
+ "show": false
2462
+ },
2463
+ "showHeader": true
2464
+ },
2465
+ "pluginVersion": "10.0.3",
2466
+ "targets": [
2467
+ {
2468
+ "bucketAggs": [
2469
+ {
2470
+ "fake": true,
2471
+ "field": "data_identifiers_CVE",
2472
+ "id": "7",
2473
+ "settings": {
2474
+ "min_doc_count": 1,
2475
+ "order": "desc",
2476
+ "orderBy": "_term",
2477
+ "size": "10"
2478
+ },
2479
+ "type": "terms"
2480
+ }
2481
+ ],
2482
+ "datasource": {
2483
+ "type": "elasticsearch",
2484
+ "uid": "wazuh_datasource_uid"
2485
+ },
2486
+ "metrics": [
2487
+ {
2488
+ "field": "data_identifiers_CVE",
2489
+ "id": "1",
2490
+ "meta": {},
2491
+ "settings": {},
2492
+ "type": "cardinality"
2493
+ }
2494
+ ],
2495
+ "query": "rule_group2:snyk AND agent_name:$agent_name",
2496
+ "refId": "A",
2497
+ "timeField": "timestamp"
2498
+ }
2499
+ ],
2500
+ "title": "CVEs",
2501
+ "transformations": [
2502
+ {
2503
+ "id": "merge",
2504
+ "options": {
2505
+ "reducers": []
2506
+ }
2507
+ }
2508
+ ],
2509
+ "type": "table"
2510
+ },
2511
+ {
2512
+ "datasource": {
2513
+ "type": "elasticsearch",
2514
+ "uid": "wazuh_datasource_uid"
2515
+ },
2516
+ "fieldConfig": {
2517
+ "defaults": {
2518
+ "mappings": [],
2519
+ "thresholds": {
2520
+ "mode": "absolute",
2521
+ "steps": [
2522
+ {
2523
+ "color": "green",
2524
+ "value": null
2525
+ },
2526
+ {
2527
+ "color": "red",
2528
+ "value": 80
2529
+ }
2530
+ ]
2531
+ }
2532
+ },
2533
+ "overrides": []
2534
+ },
2535
+ "gridPos": {
2536
+ "h": 11,
2537
+ "w": 17,
2538
+ "x": 0,
2539
+ "y": 34
2540
+ },
2541
+ "id": 67,
2542
+ "options": {
2543
+ "displayMode": "gradient",
2544
+ "minVizHeight": 10,
2545
+ "minVizWidth": 0,
2546
+ "orientation": "vertical",
2547
+ "reduceOptions": {
2548
+ "calcs": ["sum"],
2549
+ "fields": "",
2550
+ "values": false
2551
+ },
2552
+ "showUnfilled": true,
2553
+ "text": {},
2554
+ "valueMode": "color"
2555
+ },
2556
+ "pluginVersion": "10.0.3",
2557
+ "targets": [
2558
+ {
2559
+ "bucketAggs": [
2560
+ {
2561
+ "fake": true,
2562
+ "field": "data_packageName",
2563
+ "id": "6",
2564
+ "settings": {
2565
+ "min_doc_count": 1,
2566
+ "order": "desc",
2567
+ "orderBy": "_count",
2568
+ "size": "15"
2569
+ },
2570
+ "type": "terms"
2571
+ },
2572
+ {
2573
+ "fake": true,
2574
+ "field": "timestamp",
2575
+ "id": "5",
2576
+ "settings": {
2577
+ "interval": "auto",
2578
+ "min_doc_count": 0,
2579
+ "trimEdges": 0
2580
+ },
2581
+ "type": "date_histogram"
2582
+ }
2583
+ ],
2584
+ "datasource": {
2585
+ "type": "elasticsearch",
2586
+ "uid": "wazuh_datasource_uid"
2587
+ },
2588
+ "metrics": [
2589
+ {
2590
+ "field": "type",
2591
+ "id": "1",
2592
+ "meta": {},
2593
+ "settings": {},
2594
+ "type": "count"
2595
+ }
2596
+ ],
2597
+ "query": "rule_group2:snyk AND agent_name:$agent_name",
2598
+ "refId": "A",
2599
+ "timeField": "timestamp"
2600
+ }
2601
+ ],
2602
+ "title": "VULNERABLE SOFTWARE / PACKAGE",
2603
+ "type": "bargauge"
2604
+ },
2605
+ {
2606
+ "datasource": {
2607
+ "type": "elasticsearch",
2608
+ "uid": "wazuh_datasource_uid"
2609
+ },
2610
+ "fieldConfig": {
2611
+ "defaults": {
2612
+ "color": {
2613
+ "mode": "palette-classic"
2614
+ },
2615
+ "custom": {
2616
+ "hideFrom": {
2617
+ "legend": false,
2618
+ "tooltip": false,
2619
+ "viz": false
2620
+ }
2621
+ },
2622
+ "decimals": 0,
2623
+ "mappings": [],
2624
+ "unit": "short"
2625
+ },
2626
+ "overrides": [
2627
+ {
2628
+ "matcher": {
2629
+ "id": "byName",
2630
+ "options": "Critical"
2631
+ },
2632
+ "properties": [
2633
+ {
2634
+ "id": "color",
2635
+ "value": {
2636
+ "fixedColor": "#C4162A",
2637
+ "mode": "fixed"
2638
+ }
2639
+ }
2640
+ ]
2641
+ },
2642
+ {
2643
+ "matcher": {
2644
+ "id": "byName",
2645
+ "options": "High"
2646
+ },
2647
+ "properties": [
2648
+ {
2649
+ "id": "color",
2650
+ "value": {
2651
+ "fixedColor": "#F2495C",
2652
+ "mode": "fixed"
2653
+ }
2654
+ }
2655
+ ]
2656
+ },
2657
+ {
2658
+ "matcher": {
2659
+ "id": "byName",
2660
+ "options": "Low"
2661
+ },
2662
+ "properties": [
2663
+ {
2664
+ "id": "color",
2665
+ "value": {
2666
+ "fixedColor": "#5794F2",
2667
+ "mode": "fixed"
2668
+ }
2669
+ }
2670
+ ]
2671
+ },
2672
+ {
2673
+ "matcher": {
2674
+ "id": "byName",
2675
+ "options": "Medium"
2676
+ },
2677
+ "properties": [
2678
+ {
2679
+ "id": "color",
2680
+ "value": {
2681
+ "fixedColor": "#FF9830",
2682
+ "mode": "fixed"
2683
+ }
2684
+ }
2685
+ ]
2686
+ },
2687
+ {
2688
+ "matcher": {
2689
+ "id": "byName",
2690
+ "options": "high"
2691
+ },
2692
+ "properties": [
2693
+ {
2694
+ "id": "color",
2695
+ "value": {
2696
+ "fixedColor": "red",
2697
+ "mode": "fixed"
2698
+ }
2699
+ }
2700
+ ]
2701
+ },
2702
+ {
2703
+ "matcher": {
2704
+ "id": "byName",
2705
+ "options": "medium"
2706
+ },
2707
+ "properties": [
2708
+ {
2709
+ "id": "color",
2710
+ "value": {
2711
+ "fixedColor": "orange",
2712
+ "mode": "fixed"
2713
+ }
2714
+ }
2715
+ ]
2716
+ }
2717
+ ]
2718
+ },
2719
+ "gridPos": {
2720
+ "h": 11,
2721
+ "w": 7,
2722
+ "x": 17,
2723
+ "y": 34
2724
+ },
2725
+ "id": 66,
2726
+ "links": [],
2727
+ "maxDataPoints": 3,
2728
+ "options": {
2729
+ "legend": {
2730
+ "calcs": [],
2731
+ "displayMode": "table",
2732
+ "placement": "right",
2733
+ "showLegend": true,
2734
+ "values": ["value"]
2735
+ },
2736
+ "pieType": "donut",
2737
+ "reduceOptions": {
2738
+ "calcs": ["sum"],
2739
+ "fields": "",
2740
+ "values": false
2741
+ },
2742
+ "tooltip": {
2743
+ "mode": "single",
2744
+ "sort": "none"
2745
+ }
2746
+ },
2747
+ "targets": [
2748
+ {
2749
+ "bucketAggs": [
2750
+ {
2751
+ "fake": true,
2752
+ "field": "data_nvdSeverity",
2753
+ "id": "3",
2754
+ "settings": {
2755
+ "min_doc_count": 1,
2756
+ "order": "desc",
2757
+ "orderBy": "_count",
2758
+ "size": "0"
2759
+ },
2760
+ "type": "terms"
2761
+ },
2762
+ {
2763
+ "field": "timestamp",
2764
+ "id": "2",
2765
+ "settings": {
2766
+ "interval": "auto",
2767
+ "min_doc_count": 0,
2768
+ "trimEdges": 0
2769
+ },
2770
+ "type": "date_histogram"
2771
+ }
2772
+ ],
2773
+ "datasource": {
2774
+ "type": "elasticsearch",
2775
+ "uid": "wazuh_datasource_uid"
2776
+ },
2777
+ "metrics": [
2778
+ {
2779
+ "field": "select field",
2780
+ "id": "1",
2781
+ "type": "count"
2782
+ }
2783
+ ],
2784
+ "query": "rule_group2:snyk AND agent_name:$agent_name",
2785
+ "refId": "A",
2786
+ "timeField": "timestamp"
2787
+ }
2788
+ ],
2789
+ "title": "VULNERABILITY LEVELS",
2790
+ "type": "piechart"
2791
+ }
2792
+ ],
2793
+ "title": "DOCKER IMAGES VULNERABILITIES - SUMMARY",
2794
+ "type": "row"
2795
+ },
2796
+ {
2797
+ "collapsed": true,
2798
+ "datasource": {
2799
+ "type": "elasticsearch",
2800
+ "uid": "wazuh_datasource_uid"
2801
+ },
2802
+ "gridPos": {
2803
+ "h": 1,
2804
+ "w": 24,
2805
+ "x": 0,
2806
+ "y": 54
2807
+ },
2808
+ "id": 70,
2809
+ "panels": [
2810
+ {
2811
+ "datasource": {
2812
+ "type": "elasticsearch",
2813
+ "uid": "wazuh_datasource_uid"
2814
+ },
2815
+ "fieldConfig": {
2816
+ "defaults": {
2817
+ "color": {
2818
+ "mode": "thresholds"
2819
+ },
2820
+ "custom": {
2821
+ "align": "auto",
2822
+ "cellOptions": {
2823
+ "type": "auto"
2824
+ }
2825
+ },
2826
+ "mappings": [],
2827
+ "thresholds": {
2828
+ "mode": "absolute",
2829
+ "steps": [
2830
+ {
2831
+ "color": "green"
2832
+ },
2833
+ {
2834
+ "color": "red",
2835
+ "value": 80
2836
+ }
2837
+ ]
2838
+ }
2839
+ },
2840
+ "overrides": [
2841
+ {
2842
+ "matcher": {
2843
+ "id": "byName",
2844
+ "options": "data_vulnerability_package_name"
2845
+ },
2846
+ "properties": [
2847
+ {
2848
+ "id": "displayName",
2849
+ "value": "PACKAGE"
2850
+ },
2851
+ {
2852
+ "id": "custom.align"
2853
+ }
2854
+ ]
2855
+ },
2856
+ {
2857
+ "matcher": {
2858
+ "id": "byName",
2859
+ "options": "data_vulnerability_package_condition"
2860
+ },
2861
+ "properties": [
2862
+ {
2863
+ "id": "displayName",
2864
+ "value": "STATUS"
2865
+ },
2866
+ {
2867
+ "id": "unit",
2868
+ "value": "short"
2869
+ },
2870
+ {
2871
+ "id": "decimals",
2872
+ "value": -1
2873
+ },
2874
+ {
2875
+ "id": "custom.align"
2876
+ }
2877
+ ]
2878
+ },
2879
+ {
2880
+ "matcher": {
2881
+ "id": "byName",
2882
+ "options": "data_vulnerability_cve"
2883
+ },
2884
+ "properties": [
2885
+ {
2886
+ "id": "displayName",
2887
+ "value": "CVE"
2888
+ },
2889
+ {
2890
+ "id": "unit",
2891
+ "value": "kbytes"
2892
+ },
2893
+ {
2894
+ "id": "decimals",
2895
+ "value": -1
2896
+ },
2897
+ {
2898
+ "id": "custom.align"
2899
+ }
2900
+ ]
2901
+ },
2902
+ {
2903
+ "matcher": {
2904
+ "id": "byName",
2905
+ "options": "agent_name"
2906
+ },
2907
+ "properties": [
2908
+ {
2909
+ "id": "displayName",
2910
+ "value": "AGENT"
2911
+ },
2912
+ {
2913
+ "id": "unit",
2914
+ "value": "short"
2915
+ },
2916
+ {
2917
+ "id": "decimals",
2918
+ "value": 2
2919
+ },
2920
+ {
2921
+ "id": "custom.align"
2922
+ }
2923
+ ]
2924
+ },
2925
+ {
2926
+ "matcher": {
2927
+ "id": "byName",
2928
+ "options": "data_vulnerability_title"
2929
+ },
2930
+ "properties": [
2931
+ {
2932
+ "id": "displayName",
2933
+ "value": "CVE TITLE"
2934
+ },
2935
+ {
2936
+ "id": "unit",
2937
+ "value": "short"
2938
+ },
2939
+ {
2940
+ "id": "decimals",
2941
+ "value": 2
2942
+ },
2943
+ {
2944
+ "id": "custom.align"
2945
+ }
2946
+ ]
2947
+ },
2948
+ {
2949
+ "matcher": {
2950
+ "id": "byName",
2951
+ "options": "data_vulnerability_severity"
2952
+ },
2953
+ "properties": [
2954
+ {
2955
+ "id": "displayName",
2956
+ "value": "SEVERITY"
2957
+ },
2958
+ {
2959
+ "id": "unit",
2960
+ "value": "short"
2961
+ },
2962
+ {
2963
+ "id": "decimals",
2964
+ "value": 2
2965
+ },
2966
+ {
2967
+ "id": "custom.align"
2968
+ }
2969
+ ]
2970
+ }
2971
+ ]
2972
+ },
2973
+ "gridPos": {
2974
+ "h": 12,
2975
+ "w": 24,
2976
+ "x": 0,
2977
+ "y": 46
2978
+ },
2979
+ "id": 68,
2980
+ "options": {
2981
+ "footer": {
2982
+ "fields": "",
2983
+ "reducer": ["sum"],
2984
+ "show": false
2985
+ },
2986
+ "showHeader": true
2987
+ },
2988
+ "pluginVersion": "8.3.3",
2989
+ "targets": [
2990
+ {
2991
+ "bucketAggs": [],
2992
+ "datasource": {
2993
+ "type": "elasticsearch",
2994
+ "uid": "wazuh_datasource_uid"
2995
+ },
2996
+ "metrics": [
2997
+ {
2998
+ "id": "1",
2999
+ "settings": {
3000
+ "size": "500"
3001
+ },
3002
+ "type": "raw_data"
3003
+ }
3004
+ ],
3005
+ "query": "rule_group2:snyk AND agent_name:$agent_name",
3006
+ "refId": "A",
3007
+ "timeField": "timestamp"
3008
+ }
3009
+ ],
3010
+ "title": "SYSTEM VULNERABILITIES - DETAILS",
3011
+ "transformations": [
3012
+ {
3013
+ "id": "filterFieldsByName",
3014
+ "options": {
3015
+ "include": {
3016
+ "names": [
3017
+ "timestamp",
3018
+ "agent_name",
3019
+ "data_dockerBaseImage",
3020
+ "data_name",
3021
+ "data_nearestFixedInVersion",
3022
+ "data_nvdSeverity",
3023
+ "data_malicious",
3024
+ "data_identifiers_CWE",
3025
+ "data_identifiers_CVE",
3026
+ "data_cvssScore"
3027
+ ]
3028
+ }
3029
+ }
3030
+ },
3031
+ {
3032
+ "id": "organize",
3033
+ "options": {
3034
+ "excludeByName": {},
3035
+ "indexByName": {
3036
+ "agent_name": 1,
3037
+ "data_cvssScore": 7,
3038
+ "data_dockerBaseImage": 2,
3039
+ "data_identifiers_CVE": 4,
3040
+ "data_identifiers_CWE": 5,
3041
+ "data_malicious": 8,
3042
+ "data_name": 3,
3043
+ "data_nearestFixedInVersion": 9,
3044
+ "data_nvdSeverity": 6,
3045
+ "timestamp": 0
3046
+ },
3047
+ "renameByName": {
3048
+ "agent_name": "DOCKER HOST",
3049
+ "data_cvssScore": "SCORE",
3050
+ "data_dockerBaseImage": "CONTAINER BASE IMAGE",
3051
+ "data_identifiers_CVE": "CVE",
3052
+ "data_identifiers_CWE": "CWE",
3053
+ "data_malicious": "MALICIOUS",
3054
+ "data_name": "IMAGE",
3055
+ "data_nearestFixedInVersion": "FIXED IN",
3056
+ "data_nvdSeverity": "NVD SEVERITY",
3057
+ "timestamp": "DATE/TIME"
3058
+ }
3059
+ }
3060
+ }
3061
+ ],
3062
+ "transparent": true,
3063
+ "type": "table"
3064
+ }
3065
+ ],
3066
+ "title": "DOCKER IMAGES VULNERABILITIES - ENTRIES",
3067
+ "type": "row"
3068
+ }
3069
+ ],
3070
+ "refresh": "",
3071
+ "schemaVersion": 38,
3072
+ "style": "dark",
3073
+ "tags": ["EDR"],
3074
+ "templating": {
3075
+ "list": [
3076
+ {
3077
+ "datasource": {
3078
+ "type": "elasticsearch",
3079
+ "uid": "wazuh_datasource_uid"
3080
+ },
3081
+ "filters": [],
3082
+ "hide": 0,
3083
+ "label": "",
3084
+ "name": "Filters",
3085
+ "skipUrlSync": false,
3086
+ "type": "adhoc"
3087
+ },
3088
+ {
3089
+ "current": {
3090
+ "selected": false,
3091
+ "text": "All",
3092
+ "value": "$__all"
3093
+ },
3094
+ "datasource": {
3095
+ "type": "elasticsearch",
3096
+ "uid": "wazuh_datasource_uid"
3097
+ },
3098
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_groups:vulnerability-detector\"}",
3099
+ "hide": 0,
3100
+ "includeAll": true,
3101
+ "label": "Agent",
3102
+ "multi": false,
3103
+ "name": "agent_name",
3104
+ "options": [],
3105
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"rule_groups:vulnerability-detector\"}",
3106
+ "refresh": 2,
3107
+ "regex": "",
3108
+ "skipUrlSync": false,
3109
+ "sort": 2,
3110
+ "tagValuesQuery": "",
3111
+ "tagsQuery": "",
3112
+ "type": "query",
3113
+ "useTags": false
3114
+ }
3115
+ ]
3116
+ },
3117
+ "time": {
3118
+ "from": "now-24h",
3119
+ "to": "now"
3120
+ },
3121
+ "timepicker": {
3122
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
3123
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
3124
+ },
3125
+ "timezone": "",
3126
+ "title": "EDR - SYSTEM VULNERABILITIES",
3127
+ "weekStart": ""
3128
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_users_and_groups.json
new
+2526
@@ -0,0 +1,2526 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194437162,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "gridPos": {
45
+ "h": 1,
46
+ "w": 24,
47
+ "x": 0,
48
+ "y": 0
49
+ },
50
+ "id": 135,
51
+ "title": "USER ACCOUNTS",
52
+ "type": "row"
53
+ },
54
+ {
55
+ "datasource": {
56
+ "type": "elasticsearch",
57
+ "uid": "wazuh_datasource_uid"
58
+ },
59
+ "fieldConfig": {
60
+ "defaults": {
61
+ "color": {
62
+ "mode": "thresholds"
63
+ },
64
+ "links": [],
65
+ "mappings": [],
66
+ "thresholds": {
67
+ "mode": "absolute",
68
+ "steps": [
69
+ {
70
+ "color": "blue",
71
+ "value": null
72
+ }
73
+ ]
74
+ }
75
+ },
76
+ "overrides": []
77
+ },
78
+ "gridPos": {
79
+ "h": 5,
80
+ "w": 3,
81
+ "x": 0,
82
+ "y": 1
83
+ },
84
+ "id": 121,
85
+ "options": {
86
+ "colorMode": "value",
87
+ "graphMode": "none",
88
+ "justifyMode": "auto",
89
+ "orientation": "auto",
90
+ "reduceOptions": {
91
+ "calcs": ["sum"],
92
+ "fields": "",
93
+ "values": false
94
+ },
95
+ "textMode": "auto"
96
+ },
97
+ "pluginVersion": "9.0.0",
98
+ "targets": [
99
+ {
100
+ "alias": "",
101
+ "bucketAggs": [
102
+ {
103
+ "field": "timestamp",
104
+ "id": "2",
105
+ "settings": {
106
+ "interval": "auto"
107
+ },
108
+ "type": "date_histogram"
109
+ }
110
+ ],
111
+ "datasource": {
112
+ "type": "elasticsearch",
113
+ "uid": "wazuh_datasource_uid"
114
+ },
115
+ "metrics": [
116
+ {
117
+ "id": "1",
118
+ "type": "count"
119
+ }
120
+ ],
121
+ "query": "data_win_system_eventID:4720",
122
+ "refId": "A",
123
+ "timeField": "timestamp"
124
+ }
125
+ ],
126
+ "title": "ACCOUNTS CREATED",
127
+ "transparent": true,
128
+ "type": "stat"
129
+ },
130
+ {
131
+ "datasource": {
132
+ "type": "elasticsearch",
133
+ "uid": "wazuh_datasource_uid"
134
+ },
135
+ "fieldConfig": {
136
+ "defaults": {
137
+ "color": {
138
+ "mode": "thresholds"
139
+ },
140
+ "custom": {
141
+ "align": "auto",
142
+ "displayMode": "auto",
143
+ "inspect": false
144
+ },
145
+ "links": [],
146
+ "mappings": [],
147
+ "thresholds": {
148
+ "mode": "absolute",
149
+ "steps": [
150
+ {
151
+ "color": "blue",
152
+ "value": null
153
+ }
154
+ ]
155
+ }
156
+ },
157
+ "overrides": [
158
+ {
159
+ "matcher": {
160
+ "id": "byName",
161
+ "options": "ACCOUNT"
162
+ },
163
+ "properties": [
164
+ {
165
+ "id": "custom.displayMode",
166
+ "value": "color-text"
167
+ }
168
+ ]
169
+ },
170
+ {
171
+ "matcher": {
172
+ "id": "byName",
173
+ "options": "Count"
174
+ },
175
+ "properties": [
176
+ {
177
+ "id": "custom.displayMode",
178
+ "value": "color-text"
179
+ }
180
+ ]
181
+ }
182
+ ]
183
+ },
184
+ "gridPos": {
185
+ "h": 5,
186
+ "w": 5,
187
+ "x": 3,
188
+ "y": 1
189
+ },
190
+ "id": 125,
191
+ "options": {
192
+ "footer": {
193
+ "fields": "",
194
+ "reducer": ["sum"],
195
+ "show": false
196
+ },
197
+ "showHeader": true
198
+ },
199
+ "pluginVersion": "9.0.0",
200
+ "targets": [
201
+ {
202
+ "alias": "",
203
+ "bucketAggs": [
204
+ {
205
+ "field": "data_win_eventdata_targetUserName",
206
+ "id": "2",
207
+ "settings": {
208
+ "min_doc_count": "1",
209
+ "order": "desc",
210
+ "orderBy": "_count",
211
+ "size": "10"
212
+ },
213
+ "type": "terms"
214
+ }
215
+ ],
216
+ "datasource": {
217
+ "type": "elasticsearch",
218
+ "uid": "wazuh_datasource_uid"
219
+ },
220
+ "metrics": [
221
+ {
222
+ "id": "1",
223
+ "type": "count"
224
+ }
225
+ ],
226
+ "query": "data_win_system_eventID:4720",
227
+ "refId": "A",
228
+ "timeField": "timestamp"
229
+ }
230
+ ],
231
+ "title": "ACCOUNTS CREATED",
232
+ "transformations": [
233
+ {
234
+ "id": "organize",
235
+ "options": {
236
+ "excludeByName": {},
237
+ "indexByName": {},
238
+ "renameByName": {
239
+ "data_win_eventdata_subjectUserName": "ACCOUNT",
240
+ "data_win_eventdata_targetUserName": "ACCOUNT"
241
+ }
242
+ }
243
+ }
244
+ ],
245
+ "type": "table"
246
+ },
247
+ {
248
+ "datasource": {
249
+ "type": "elasticsearch",
250
+ "uid": "wazuh_datasource_uid"
251
+ },
252
+ "fieldConfig": {
253
+ "defaults": {
254
+ "color": {
255
+ "mode": "thresholds"
256
+ },
257
+ "links": [],
258
+ "mappings": [],
259
+ "thresholds": {
260
+ "mode": "absolute",
261
+ "steps": [
262
+ {
263
+ "color": "orange",
264
+ "value": null
265
+ }
266
+ ]
267
+ }
268
+ },
269
+ "overrides": []
270
+ },
271
+ "gridPos": {
272
+ "h": 5,
273
+ "w": 3,
274
+ "x": 8,
275
+ "y": 1
276
+ },
277
+ "id": 132,
278
+ "options": {
279
+ "colorMode": "value",
280
+ "graphMode": "none",
281
+ "justifyMode": "auto",
282
+ "orientation": "auto",
283
+ "reduceOptions": {
284
+ "calcs": ["sum"],
285
+ "fields": "",
286
+ "values": false
287
+ },
288
+ "textMode": "auto"
289
+ },
290
+ "pluginVersion": "9.0.0",
291
+ "targets": [
292
+ {
293
+ "alias": "",
294
+ "bucketAggs": [
295
+ {
296
+ "field": "timestamp",
297
+ "id": "2",
298
+ "settings": {
299
+ "interval": "auto"
300
+ },
301
+ "type": "date_histogram"
302
+ }
303
+ ],
304
+ "datasource": {
305
+ "type": "elasticsearch",
306
+ "uid": "wazuh_datasource_uid"
307
+ },
308
+ "metrics": [
309
+ {
310
+ "id": "1",
311
+ "type": "count"
312
+ }
313
+ ],
314
+ "query": "data_win_system_eventID:4740",
315
+ "refId": "A",
316
+ "timeField": "timestamp"
317
+ }
318
+ ],
319
+ "title": "ACCOUNTS LOCKED OUT",
320
+ "transparent": true,
321
+ "type": "stat"
322
+ },
323
+ {
324
+ "datasource": {
325
+ "type": "elasticsearch",
326
+ "uid": "wazuh_datasource_uid"
327
+ },
328
+ "fieldConfig": {
329
+ "defaults": {
330
+ "color": {
331
+ "mode": "thresholds"
332
+ },
333
+ "custom": {
334
+ "align": "auto",
335
+ "displayMode": "auto",
336
+ "inspect": false
337
+ },
338
+ "links": [],
339
+ "mappings": [],
340
+ "thresholds": {
341
+ "mode": "absolute",
342
+ "steps": [
343
+ {
344
+ "color": "orange",
345
+ "value": null
346
+ }
347
+ ]
348
+ }
349
+ },
350
+ "overrides": [
351
+ {
352
+ "matcher": {
353
+ "id": "byName",
354
+ "options": "ACCOUNT"
355
+ },
356
+ "properties": [
357
+ {
358
+ "id": "custom.displayMode",
359
+ "value": "color-text"
360
+ }
361
+ ]
362
+ },
363
+ {
364
+ "matcher": {
365
+ "id": "byName",
366
+ "options": "Count"
367
+ },
368
+ "properties": [
369
+ {
370
+ "id": "custom.displayMode",
371
+ "value": "color-text"
372
+ }
373
+ ]
374
+ }
375
+ ]
376
+ },
377
+ "gridPos": {
378
+ "h": 5,
379
+ "w": 5,
380
+ "x": 11,
381
+ "y": 1
382
+ },
383
+ "id": 133,
384
+ "options": {
385
+ "footer": {
386
+ "fields": "",
387
+ "reducer": ["sum"],
388
+ "show": false
389
+ },
390
+ "showHeader": true
391
+ },
392
+ "pluginVersion": "9.0.0",
393
+ "targets": [
394
+ {
395
+ "alias": "",
396
+ "bucketAggs": [
397
+ {
398
+ "field": "data_win_eventdata_targetUserName",
399
+ "id": "2",
400
+ "settings": {
401
+ "min_doc_count": "1",
402
+ "order": "desc",
403
+ "orderBy": "_count",
404
+ "size": "10"
405
+ },
406
+ "type": "terms"
407
+ }
408
+ ],
409
+ "datasource": {
410
+ "type": "elasticsearch",
411
+ "uid": "wazuh_datasource_uid"
412
+ },
413
+ "metrics": [
414
+ {
415
+ "id": "1",
416
+ "type": "count"
417
+ }
418
+ ],
419
+ "query": "data_win_system_eventID:4740",
420
+ "refId": "A",
421
+ "timeField": "timestamp"
422
+ }
423
+ ],
424
+ "title": "ACCOUNTS LOCKED OUT",
425
+ "transformations": [
426
+ {
427
+ "id": "organize",
428
+ "options": {
429
+ "excludeByName": {},
430
+ "indexByName": {},
431
+ "renameByName": {
432
+ "data_win_eventdata_subjectUserName": "ACCOUNT",
433
+ "data_win_eventdata_targetUserName": "ACCOUNT"
434
+ }
435
+ }
436
+ }
437
+ ],
438
+ "type": "table"
439
+ },
440
+ {
441
+ "datasource": {
442
+ "type": "elasticsearch",
443
+ "uid": "wazuh_datasource_uid"
444
+ },
445
+ "fieldConfig": {
446
+ "defaults": {
447
+ "color": {
448
+ "mode": "thresholds"
449
+ },
450
+ "links": [],
451
+ "mappings": [],
452
+ "thresholds": {
453
+ "mode": "absolute",
454
+ "steps": [
455
+ {
456
+ "color": "orange",
457
+ "value": null
458
+ }
459
+ ]
460
+ }
461
+ },
462
+ "overrides": []
463
+ },
464
+ "gridPos": {
465
+ "h": 5,
466
+ "w": 3,
467
+ "x": 16,
468
+ "y": 1
469
+ },
470
+ "id": 127,
471
+ "options": {
472
+ "colorMode": "value",
473
+ "graphMode": "none",
474
+ "justifyMode": "auto",
475
+ "orientation": "auto",
476
+ "reduceOptions": {
477
+ "calcs": ["sum"],
478
+ "fields": "",
479
+ "values": false
480
+ },
481
+ "textMode": "auto"
482
+ },
483
+ "pluginVersion": "9.0.0",
484
+ "targets": [
485
+ {
486
+ "alias": "",
487
+ "bucketAggs": [
488
+ {
489
+ "field": "timestamp",
490
+ "id": "2",
491
+ "settings": {
492
+ "interval": "auto"
493
+ },
494
+ "type": "date_histogram"
495
+ }
496
+ ],
497
+ "datasource": {
498
+ "type": "elasticsearch",
499
+ "uid": "wazuh_datasource_uid"
500
+ },
501
+ "metrics": [
502
+ {
503
+ "id": "1",
504
+ "type": "count"
505
+ }
506
+ ],
507
+ "query": "data_win_system_eventID:4723",
508
+ "refId": "A",
509
+ "timeField": "timestamp"
510
+ }
511
+ ],
512
+ "title": "ACCOUNT PASSWORD CHANGES",
513
+ "transparent": true,
514
+ "type": "stat"
515
+ },
516
+ {
517
+ "datasource": {
518
+ "type": "elasticsearch",
519
+ "uid": "wazuh_datasource_uid"
520
+ },
521
+ "fieldConfig": {
522
+ "defaults": {
523
+ "color": {
524
+ "mode": "thresholds"
525
+ },
526
+ "custom": {
527
+ "align": "auto",
528
+ "displayMode": "auto",
529
+ "inspect": false
530
+ },
531
+ "links": [],
532
+ "mappings": [],
533
+ "thresholds": {
534
+ "mode": "absolute",
535
+ "steps": [
536
+ {
537
+ "color": "orange",
538
+ "value": null
539
+ }
540
+ ]
541
+ }
542
+ },
543
+ "overrides": [
544
+ {
545
+ "matcher": {
546
+ "id": "byName",
547
+ "options": "ACCOUNT"
548
+ },
549
+ "properties": [
550
+ {
551
+ "id": "custom.displayMode",
552
+ "value": "color-text"
553
+ }
554
+ ]
555
+ },
556
+ {
557
+ "matcher": {
558
+ "id": "byName",
559
+ "options": "Count"
560
+ },
561
+ "properties": [
562
+ {
563
+ "id": "custom.displayMode",
564
+ "value": "color-text"
565
+ }
566
+ ]
567
+ }
568
+ ]
569
+ },
570
+ "gridPos": {
571
+ "h": 5,
572
+ "w": 5,
573
+ "x": 19,
574
+ "y": 1
575
+ },
576
+ "id": 129,
577
+ "options": {
578
+ "footer": {
579
+ "fields": "",
580
+ "reducer": ["sum"],
581
+ "show": false
582
+ },
583
+ "showHeader": true
584
+ },
585
+ "pluginVersion": "9.0.0",
586
+ "targets": [
587
+ {
588
+ "alias": "",
589
+ "bucketAggs": [
590
+ {
591
+ "field": "data_win_eventdata_subjectUserName",
592
+ "id": "2",
593
+ "settings": {
594
+ "min_doc_count": "1",
595
+ "order": "desc",
596
+ "orderBy": "_term",
597
+ "size": "10"
598
+ },
599
+ "type": "terms"
600
+ }
601
+ ],
602
+ "datasource": {
603
+ "type": "elasticsearch",
604
+ "uid": "wazuh_datasource_uid"
605
+ },
606
+ "metrics": [
607
+ {
608
+ "id": "1",
609
+ "type": "count"
610
+ }
611
+ ],
612
+ "query": "data_win_system_eventID:4723",
613
+ "refId": "A",
614
+ "timeField": "timestamp"
615
+ }
616
+ ],
617
+ "title": "ACCOUNT PASSWORD CHANGES",
618
+ "transformations": [
619
+ {
620
+ "id": "organize",
621
+ "options": {
622
+ "excludeByName": {},
623
+ "indexByName": {},
624
+ "renameByName": {
625
+ "data_win_eventdata_subjectUserName": "ACCOUNT"
626
+ }
627
+ }
628
+ }
629
+ ],
630
+ "type": "table"
631
+ },
632
+ {
633
+ "datasource": {
634
+ "type": "elasticsearch",
635
+ "uid": "wazuh_datasource_uid"
636
+ },
637
+ "fieldConfig": {
638
+ "defaults": {
639
+ "color": {
640
+ "mode": "thresholds"
641
+ },
642
+ "links": [],
643
+ "mappings": [],
644
+ "thresholds": {
645
+ "mode": "absolute",
646
+ "steps": [
647
+ {
648
+ "color": "orange",
649
+ "value": null
650
+ }
651
+ ]
652
+ }
653
+ },
654
+ "overrides": []
655
+ },
656
+ "gridPos": {
657
+ "h": 5,
658
+ "w": 3,
659
+ "x": 0,
660
+ "y": 6
661
+ },
662
+ "id": 136,
663
+ "options": {
664
+ "colorMode": "value",
665
+ "graphMode": "none",
666
+ "justifyMode": "auto",
667
+ "orientation": "auto",
668
+ "reduceOptions": {
669
+ "calcs": ["sum"],
670
+ "fields": "",
671
+ "values": false
672
+ },
673
+ "textMode": "auto"
674
+ },
675
+ "pluginVersion": "9.0.0",
676
+ "targets": [
677
+ {
678
+ "alias": "",
679
+ "bucketAggs": [
680
+ {
681
+ "field": "timestamp",
682
+ "id": "2",
683
+ "settings": {
684
+ "interval": "auto"
685
+ },
686
+ "type": "date_histogram"
687
+ }
688
+ ],
689
+ "datasource": {
690
+ "type": "elasticsearch",
691
+ "uid": "wazuh_datasource_uid"
692
+ },
693
+ "metrics": [
694
+ {
695
+ "id": "1",
696
+ "type": "count"
697
+ }
698
+ ],
699
+ "query": "data_win_system_eventID:4738",
700
+ "refId": "A",
701
+ "timeField": "timestamp"
702
+ }
703
+ ],
704
+ "title": "ACCOUNTS MODIFIED",
705
+ "transparent": true,
706
+ "type": "stat"
707
+ },
708
+ {
709
+ "datasource": {
710
+ "type": "elasticsearch",
711
+ "uid": "wazuh_datasource_uid"
712
+ },
713
+ "fieldConfig": {
714
+ "defaults": {
715
+ "color": {
716
+ "mode": "thresholds"
717
+ },
718
+ "custom": {
719
+ "align": "auto",
720
+ "displayMode": "auto",
721
+ "inspect": false
722
+ },
723
+ "links": [],
724
+ "mappings": [],
725
+ "thresholds": {
726
+ "mode": "absolute",
727
+ "steps": [
728
+ {
729
+ "color": "orange",
730
+ "value": null
731
+ }
732
+ ]
733
+ }
734
+ },
735
+ "overrides": [
736
+ {
737
+ "matcher": {
738
+ "id": "byName",
739
+ "options": "ACCOUNT"
740
+ },
741
+ "properties": [
742
+ {
743
+ "id": "custom.displayMode",
744
+ "value": "color-text"
745
+ },
746
+ {
747
+ "id": "custom.width",
748
+ "value": 269
749
+ }
750
+ ]
751
+ },
752
+ {
753
+ "matcher": {
754
+ "id": "byName",
755
+ "options": "Count"
756
+ },
757
+ "properties": [
758
+ {
759
+ "id": "custom.displayMode",
760
+ "value": "color-text"
761
+ }
762
+ ]
763
+ }
764
+ ]
765
+ },
766
+ "gridPos": {
767
+ "h": 5,
768
+ "w": 5,
769
+ "x": 3,
770
+ "y": 6
771
+ },
772
+ "id": 137,
773
+ "options": {
774
+ "footer": {
775
+ "fields": "",
776
+ "reducer": ["sum"],
777
+ "show": false
778
+ },
779
+ "showHeader": true,
780
+ "sortBy": []
781
+ },
782
+ "pluginVersion": "9.0.0",
783
+ "targets": [
784
+ {
785
+ "alias": "",
786
+ "bucketAggs": [
787
+ {
788
+ "field": "data_win_eventdata_targetUserName",
789
+ "id": "2",
790
+ "settings": {
791
+ "min_doc_count": "1",
792
+ "order": "desc",
793
+ "orderBy": "_count",
794
+ "size": "10"
795
+ },
796
+ "type": "terms"
797
+ }
798
+ ],
799
+ "datasource": {
800
+ "type": "elasticsearch",
801
+ "uid": "wazuh_datasource_uid"
802
+ },
803
+ "metrics": [
804
+ {
805
+ "id": "1",
806
+ "type": "count"
807
+ }
808
+ ],
809
+ "query": "data_win_system_eventID:4738",
810
+ "refId": "A",
811
+ "timeField": "timestamp"
812
+ }
813
+ ],
814
+ "title": "ACCOUNTS MODIFIED",
815
+ "transformations": [
816
+ {
817
+ "id": "organize",
818
+ "options": {
819
+ "excludeByName": {},
820
+ "indexByName": {},
821
+ "renameByName": {
822
+ "data_win_eventdata_subjectUserName": "ACCOUNT",
823
+ "data_win_eventdata_targetUserName": "ACCOUNT"
824
+ }
825
+ }
826
+ }
827
+ ],
828
+ "type": "table"
829
+ },
830
+ {
831
+ "datasource": {
832
+ "type": "elasticsearch",
833
+ "uid": "wazuh_datasource_uid"
834
+ },
835
+ "fieldConfig": {
836
+ "defaults": {
837
+ "color": {
838
+ "mode": "thresholds"
839
+ },
840
+ "links": [],
841
+ "mappings": [],
842
+ "thresholds": {
843
+ "mode": "absolute",
844
+ "steps": [
845
+ {
846
+ "color": "orange",
847
+ "value": null
848
+ }
849
+ ]
850
+ }
851
+ },
852
+ "overrides": []
853
+ },
854
+ "gridPos": {
855
+ "h": 5,
856
+ "w": 4,
857
+ "x": 8,
858
+ "y": 6
859
+ },
860
+ "id": 131,
861
+ "options": {
862
+ "colorMode": "value",
863
+ "graphMode": "none",
864
+ "justifyMode": "auto",
865
+ "orientation": "auto",
866
+ "reduceOptions": {
867
+ "calcs": ["sum"],
868
+ "fields": "",
869
+ "values": false
870
+ },
871
+ "textMode": "auto"
872
+ },
873
+ "pluginVersion": "9.0.0",
874
+ "targets": [
875
+ {
876
+ "alias": "",
877
+ "bucketAggs": [
878
+ {
879
+ "field": "timestamp",
880
+ "id": "2",
881
+ "settings": {
882
+ "interval": "auto"
883
+ },
884
+ "type": "date_histogram"
885
+ }
886
+ ],
887
+ "datasource": {
888
+ "type": "elasticsearch",
889
+ "uid": "wazuh_datasource_uid"
890
+ },
891
+ "metrics": [
892
+ {
893
+ "id": "1",
894
+ "type": "count"
895
+ }
896
+ ],
897
+ "query": "(data_win_system_eventID:4728 OR data_win_system_eventID:4732 OR data_win_system_eventID:4756) AND _exists_:data_win_eventdata_memberName",
898
+ "refId": "A",
899
+ "timeField": "timestamp"
900
+ }
901
+ ],
902
+ "title": "ACCOUNTS ADDED TO PRIVILEGE GROUP",
903
+ "transparent": true,
904
+ "type": "stat"
905
+ },
906
+ {
907
+ "datasource": {
908
+ "type": "elasticsearch",
909
+ "uid": "wazuh_datasource_uid"
910
+ },
911
+ "fieldConfig": {
912
+ "defaults": {
913
+ "color": {
914
+ "mode": "thresholds"
915
+ },
916
+ "custom": {
917
+ "align": "auto",
918
+ "displayMode": "auto",
919
+ "inspect": false
920
+ },
921
+ "links": [],
922
+ "mappings": [],
923
+ "thresholds": {
924
+ "mode": "absolute",
925
+ "steps": [
926
+ {
927
+ "color": "orange",
928
+ "value": null
929
+ }
930
+ ]
931
+ }
932
+ },
933
+ "overrides": [
934
+ {
935
+ "matcher": {
936
+ "id": "byName",
937
+ "options": "ACCOUNT"
938
+ },
939
+ "properties": [
940
+ {
941
+ "id": "custom.displayMode",
942
+ "value": "color-text"
943
+ },
944
+ {
945
+ "id": "custom.width",
946
+ "value": 462
947
+ }
948
+ ]
949
+ },
950
+ {
951
+ "matcher": {
952
+ "id": "byName",
953
+ "options": "Count"
954
+ },
955
+ "properties": [
956
+ {
957
+ "id": "custom.displayMode",
958
+ "value": "color-text"
959
+ }
960
+ ]
961
+ },
962
+ {
963
+ "matcher": {
964
+ "id": "byName",
965
+ "options": "AD GROUP"
966
+ },
967
+ "properties": [
968
+ {
969
+ "id": "custom.displayMode",
970
+ "value": "color-text"
971
+ }
972
+ ]
973
+ }
974
+ ]
975
+ },
976
+ "gridPos": {
977
+ "h": 5,
978
+ "w": 12,
979
+ "x": 12,
980
+ "y": 6
981
+ },
982
+ "id": 138,
983
+ "options": {
984
+ "footer": {
985
+ "fields": "",
986
+ "reducer": ["sum"],
987
+ "show": false
988
+ },
989
+ "showHeader": true,
990
+ "sortBy": []
991
+ },
992
+ "pluginVersion": "9.0.0",
993
+ "targets": [
994
+ {
995
+ "alias": "",
996
+ "bucketAggs": [
997
+ {
998
+ "field": "data_win_eventdata_targetUserName",
999
+ "id": "2",
1000
+ "settings": {
1001
+ "min_doc_count": "1",
1002
+ "order": "desc",
1003
+ "orderBy": "_count",
1004
+ "size": "0"
1005
+ },
1006
+ "type": "terms"
1007
+ },
1008
+ {
1009
+ "field": "data_win_eventdata_memberName",
1010
+ "id": "3",
1011
+ "settings": {
1012
+ "min_doc_count": "1",
1013
+ "order": "desc",
1014
+ "orderBy": "_term",
1015
+ "size": "0"
1016
+ },
1017
+ "type": "terms"
1018
+ }
1019
+ ],
1020
+ "datasource": {
1021
+ "type": "elasticsearch",
1022
+ "uid": "wazuh_datasource_uid"
1023
+ },
1024
+ "metrics": [
1025
+ {
1026
+ "id": "1",
1027
+ "type": "count"
1028
+ }
1029
+ ],
1030
+ "query": "data_win_system_eventID:4728 OR data_win_system_eventID:4732 OR data_win_system_eventID:4756",
1031
+ "refId": "A",
1032
+ "timeField": "timestamp"
1033
+ }
1034
+ ],
1035
+ "title": "ACCOUNTS ADDED TO PRIVILEGE GROUP",
1036
+ "transformations": [
1037
+ {
1038
+ "id": "organize",
1039
+ "options": {
1040
+ "excludeByName": {},
1041
+ "indexByName": {},
1042
+ "renameByName": {
1043
+ "data_win_eventdata_memberName": "ACCOUNT",
1044
+ "data_win_eventdata_subjectUserName": "ACCOUNT",
1045
+ "data_win_eventdata_targetUserName": "AD GROUP"
1046
+ }
1047
+ }
1048
+ }
1049
+ ],
1050
+ "type": "table"
1051
+ },
1052
+ {
1053
+ "datasource": {
1054
+ "type": "elasticsearch",
1055
+ "uid": "wazuh_datasource_uid"
1056
+ },
1057
+ "fieldConfig": {
1058
+ "defaults": {
1059
+ "color": {
1060
+ "mode": "thresholds"
1061
+ },
1062
+ "custom": {
1063
+ "align": "auto",
1064
+ "displayMode": "auto",
1065
+ "inspect": false
1066
+ },
1067
+ "mappings": [],
1068
+ "thresholds": {
1069
+ "mode": "absolute",
1070
+ "steps": [
1071
+ {
1072
+ "color": "green",
1073
+ "value": null
1074
+ },
1075
+ {
1076
+ "color": "red",
1077
+ "value": 80
1078
+ }
1079
+ ]
1080
+ }
1081
+ },
1082
+ "overrides": [
1083
+ {
1084
+ "matcher": {
1085
+ "id": "byName",
1086
+ "options": "rule_level"
1087
+ },
1088
+ "properties": [
1089
+ {
1090
+ "id": "custom.width",
1091
+ "value": 93
1092
+ }
1093
+ ]
1094
+ },
1095
+ {
1096
+ "matcher": {
1097
+ "id": "byName",
1098
+ "options": "windows_event_id"
1099
+ },
1100
+ "properties": [
1101
+ {
1102
+ "id": "custom.width",
1103
+ "value": 186
1104
+ }
1105
+ ]
1106
+ },
1107
+ {
1108
+ "matcher": {
1109
+ "id": "byName",
1110
+ "options": "DATE/TIME"
1111
+ },
1112
+ "properties": [
1113
+ {
1114
+ "id": "custom.width",
1115
+ "value": 202
1116
+ }
1117
+ ]
1118
+ },
1119
+ {
1120
+ "matcher": {
1121
+ "id": "byName",
1122
+ "options": "AGENT"
1123
+ },
1124
+ "properties": [
1125
+ {
1126
+ "id": "custom.width",
1127
+ "value": 171
1128
+ }
1129
+ ]
1130
+ },
1131
+ {
1132
+ "matcher": {
1133
+ "id": "byName",
1134
+ "options": "SRC IP"
1135
+ },
1136
+ "properties": [
1137
+ {
1138
+ "id": "custom.width",
1139
+ "value": 167
1140
+ }
1141
+ ]
1142
+ },
1143
+ {
1144
+ "matcher": {
1145
+ "id": "byName",
1146
+ "options": "MESSAGE"
1147
+ },
1148
+ "properties": [
1149
+ {
1150
+ "id": "custom.width",
1151
+ "value": 1622
1152
+ }
1153
+ ]
1154
+ },
1155
+ {
1156
+ "matcher": {
1157
+ "id": "byName",
1158
+ "options": "rule_description"
1159
+ },
1160
+ "properties": [
1161
+ {
1162
+ "id": "custom.width",
1163
+ "value": 524
1164
+ }
1165
+ ]
1166
+ },
1167
+ {
1168
+ "matcher": {
1169
+ "id": "byName",
1170
+ "options": "EVENT ID"
1171
+ },
1172
+ "properties": [
1173
+ {
1174
+ "id": "links",
1175
+ "value": [
1176
+ {
1177
+ "targetBlank": true,
1178
+ "title": "VIEW EVENT DETAILS",
1179
+ "url": "https://grafana.company.local/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
1180
+ }
1181
+ ]
1182
+ }
1183
+ ]
1184
+ }
1185
+ ]
1186
+ },
1187
+ "gridPos": {
1188
+ "h": 10,
1189
+ "w": 24,
1190
+ "x": 0,
1191
+ "y": 11
1192
+ },
1193
+ "id": 148,
1194
+ "options": {
1195
+ "footer": {
1196
+ "fields": "",
1197
+ "reducer": ["sum"],
1198
+ "show": false
1199
+ },
1200
+ "showHeader": true,
1201
+ "sortBy": []
1202
+ },
1203
+ "pluginVersion": "9.0.0",
1204
+ "targets": [
1205
+ {
1206
+ "alias": "",
1207
+ "bucketAggs": [],
1208
+ "datasource": {
1209
+ "type": "elasticsearch",
1210
+ "uid": "wazuh_datasource_uid"
1211
+ },
1212
+ "metrics": [
1213
+ {
1214
+ "id": "1",
1215
+ "settings": {
1216
+ "size": "500"
1217
+ },
1218
+ "type": "raw_data"
1219
+ }
1220
+ ],
1221
+ "query": "(data_win_system_eventID:4720 OR data_win_system_eventID:4740 OR data_win_system_eventID:4738 OR data_win_system_eventID:4723 OR data_win_system_eventID:4728 OR data_win_system_eventID:4732 OR data_win_system_eventID:4756) AND agent_name:$agent_name",
1222
+ "queryType": "lucene",
1223
+ "refId": "A",
1224
+ "timeField": "timestamp"
1225
+ }
1226
+ ],
1227
+ "title": "USER ACCOUNTS - EVENTS",
1228
+ "transformations": [
1229
+ {
1230
+ "id": "organize",
1231
+ "options": {
1232
+ "excludeByName": {
1233
+ "@metadata_beat": true,
1234
+ "@metadata_type": true,
1235
+ "@metadata_version": true,
1236
+ "_id": false,
1237
+ "_index": true,
1238
+ "_type": true,
1239
+ "agent_ephemeral_id": true,
1240
+ "agent_hostname": true,
1241
+ "agent_id": true,
1242
+ "agent_ip": false,
1243
+ "agent_ip_city_name": true,
1244
+ "agent_ip_country_code": true,
1245
+ "agent_ip_geolocation": true,
1246
+ "agent_labels_customer": true,
1247
+ "agent_name": false,
1248
+ "agent_type": true,
1249
+ "agent_version": true,
1250
+ "beats_type": true,
1251
+ "cluster_name": true,
1252
+ "cluster_node": true,
1253
+ "collector_node_id": true,
1254
+ "data_win_eventXML_binaryData": true,
1255
+ "data_win_eventXML_binaryDataSize": true,
1256
+ "data_win_eventXML_param1": true,
1257
+ "data_win_eventdata_accessMask": true,
1258
+ "data_win_eventdata_authenticationPackageName": true,
1259
+ "data_win_eventdata_binary": true,
1260
+ "data_win_eventdata_data": true,
1261
+ "data_win_eventdata_domain": true,
1262
+ "data_win_eventdata_elevatedToken": true,
1263
+ "data_win_eventdata_failureReason": true,
1264
+ "data_win_eventdata_handleId": true,
1265
+ "data_win_eventdata_imagePath": true,
1266
+ "data_win_eventdata_impersonationLevel": true,
1267
+ "data_win_eventdata_ipAddress": true,
1268
+ "data_win_eventdata_ipPort": true,
1269
+ "data_win_eventdata_keyLength": true,
1270
+ "data_win_eventdata_lmPackageName": true,
1271
+ "data_win_eventdata_logonGuid": true,
1272
+ "data_win_eventdata_logonProcessName": true,
1273
+ "data_win_eventdata_logonType": true,
1274
+ "data_win_eventdata_memberName": true,
1275
+ "data_win_eventdata_memberSid": true,
1276
+ "data_win_eventdata_objectServer": true,
1277
+ "data_win_eventdata_packageName": true,
1278
+ "data_win_eventdata_passwordLastSet": true,
1279
+ "data_win_eventdata_privilegeList": true,
1280
+ "data_win_eventdata_processId": true,
1281
+ "data_win_eventdata_processName": true,
1282
+ "data_win_eventdata_restrictedAdminMode": true,
1283
+ "data_win_eventdata_sID": true,
1284
+ "data_win_eventdata_serviceName": true,
1285
+ "data_win_eventdata_serviceSid": true,
1286
+ "data_win_eventdata_serviceType": true,
1287
+ "data_win_eventdata_startType": true,
1288
+ "data_win_eventdata_status": true,
1289
+ "data_win_eventdata_subStatus": true,
1290
+ "data_win_eventdata_subjectDomainName": true,
1291
+ "data_win_eventdata_subjectLogonId": true,
1292
+ "data_win_eventdata_subjectUserName": true,
1293
+ "data_win_eventdata_subjectUserSid": true,
1294
+ "data_win_eventdata_targetDomainName": true,
1295
+ "data_win_eventdata_targetLinkedLogonId": true,
1296
+ "data_win_eventdata_targetLogonId": true,
1297
+ "data_win_eventdata_targetSid": true,
1298
+ "data_win_eventdata_targetUserName": true,
1299
+ "data_win_eventdata_targetUserSid": true,
1300
+ "data_win_eventdata_ticketEncryptionType": true,
1301
+ "data_win_eventdata_ticketOptions": true,
1302
+ "data_win_eventdata_user": true,
1303
+ "data_win_eventdata_virtualAccount": true,
1304
+ "data_win_eventdata_workstation": true,
1305
+ "data_win_eventdata_workstationName": true,
1306
+ "data_win_system_channel": true,
1307
+ "data_win_system_computer": true,
1308
+ "data_win_system_eventID": true,
1309
+ "data_win_system_eventRecordID": true,
1310
+ "data_win_system_eventSourceName": true,
1311
+ "data_win_system_keywords": true,
1312
+ "data_win_system_level": true,
1313
+ "data_win_system_opcode": true,
1314
+ "data_win_system_processID": true,
1315
+ "data_win_system_providerGuid": true,
1316
+ "data_win_system_providerName": true,
1317
+ "data_win_system_severityValue": true,
1318
+ "data_win_system_systemTime": true,
1319
+ "data_win_system_task": true,
1320
+ "data_win_system_threadID": true,
1321
+ "data_win_system_version": true,
1322
+ "decoder_name": true,
1323
+ "ecs_version": true,
1324
+ "gl2_accounted_message_size": true,
1325
+ "gl2_message_id": true,
1326
+ "gl2_processing_error": true,
1327
+ "gl2_remote_ip": true,
1328
+ "gl2_remote_port": true,
1329
+ "gl2_source_collector": true,
1330
+ "gl2_source_input": true,
1331
+ "gl2_source_node": true,
1332
+ "highlight": true,
1333
+ "host_name": true,
1334
+ "id": true,
1335
+ "location": true,
1336
+ "log_file_path": true,
1337
+ "log_offset": true,
1338
+ "manager_name": true,
1339
+ "message": true,
1340
+ "previous_output": true,
1341
+ "process_id": true,
1342
+ "rule_description": true,
1343
+ "rule_firedtimes": true,
1344
+ "rule_frequency": true,
1345
+ "rule_gdpr": true,
1346
+ "rule_gpg13": true,
1347
+ "rule_group1": true,
1348
+ "rule_group2": true,
1349
+ "rule_group3": true,
1350
+ "rule_groups": true,
1351
+ "rule_hipaa": true,
1352
+ "rule_id": true,
1353
+ "rule_mail": true,
1354
+ "rule_mitre_id": true,
1355
+ "rule_mitre_tactic": true,
1356
+ "rule_mitre_technique": true,
1357
+ "rule_nist_800_53": true,
1358
+ "rule_pci_dss": true,
1359
+ "rule_tsc": true,
1360
+ "sort": true,
1361
+ "source": true,
1362
+ "src_ip": true,
1363
+ "src_ip_city_name": true,
1364
+ "src_ip_country_code": true,
1365
+ "src_ip_geolocation": true,
1366
+ "streams": true,
1367
+ "syslog_tag": true,
1368
+ "syslog_type": true,
1369
+ "timestamp": false,
1370
+ "true": true,
1371
+ "user_name": true,
1372
+ "win_system_eventID": true,
1373
+ "windows_auth_package": true,
1374
+ "windows_domain": true,
1375
+ "windows_event_id": true,
1376
+ "windows_event_severity": false,
1377
+ "windows_logon_type": true
1378
+ },
1379
+ "indexByName": {
1380
+ "_id": 1,
1381
+ "_index": 3,
1382
+ "_type": 4,
1383
+ "agent_id": 5,
1384
+ "agent_ip": 6,
1385
+ "agent_ip_city_name": 7,
1386
+ "agent_ip_country_code": 8,
1387
+ "agent_ip_geolocation": 9,
1388
+ "agent_labels_customer": 54,
1389
+ "agent_name": 2,
1390
+ "data_win_eventdata_authenticationPackageName": 55,
1391
+ "data_win_eventdata_elevatedToken": 56,
1392
+ "data_win_eventdata_impersonationLevel": 57,
1393
+ "data_win_eventdata_ipAddress": 58,
1394
+ "data_win_eventdata_ipPort": 59,
1395
+ "data_win_eventdata_keyLength": 60,
1396
+ "data_win_eventdata_logonGuid": 61,
1397
+ "data_win_eventdata_logonProcessName": 62,
1398
+ "data_win_eventdata_logonType": 63,
1399
+ "data_win_eventdata_processId": 64,
1400
+ "data_win_eventdata_processName": 65,
1401
+ "data_win_eventdata_serviceName": 66,
1402
+ "data_win_eventdata_serviceSid": 67,
1403
+ "data_win_eventdata_status": 68,
1404
+ "data_win_eventdata_subjectDomainName": 69,
1405
+ "data_win_eventdata_subjectLogonId": 70,
1406
+ "data_win_eventdata_subjectUserName": 71,
1407
+ "data_win_eventdata_subjectUserSid": 72,
1408
+ "data_win_eventdata_targetDomainName": 73,
1409
+ "data_win_eventdata_targetLinkedLogonId": 74,
1410
+ "data_win_eventdata_targetLogonId": 75,
1411
+ "data_win_eventdata_targetUserName": 76,
1412
+ "data_win_eventdata_targetUserSid": 77,
1413
+ "data_win_eventdata_ticketEncryptionType": 78,
1414
+ "data_win_eventdata_ticketOptions": 79,
1415
+ "data_win_eventdata_virtualAccount": 80,
1416
+ "data_win_system_channel": 10,
1417
+ "data_win_system_computer": 11,
1418
+ "data_win_system_eventID": 12,
1419
+ "data_win_system_eventRecordID": 13,
1420
+ "data_win_system_keywords": 14,
1421
+ "data_win_system_level": 15,
1422
+ "data_win_system_message": 16,
1423
+ "data_win_system_opcode": 17,
1424
+ "data_win_system_processID": 18,
1425
+ "data_win_system_providerGuid": 19,
1426
+ "data_win_system_providerName": 20,
1427
+ "data_win_system_severityValue": 21,
1428
+ "data_win_system_systemTime": 22,
1429
+ "data_win_system_task": 23,
1430
+ "data_win_system_threadID": 24,
1431
+ "data_win_system_version": 25,
1432
+ "decoder_name": 26,
1433
+ "gl2_accounted_message_size": 27,
1434
+ "gl2_message_id": 28,
1435
+ "gl2_processing_error": 81,
1436
+ "gl2_remote_ip": 29,
1437
+ "gl2_remote_port": 30,
1438
+ "gl2_source_input": 31,
1439
+ "gl2_source_node": 32,
1440
+ "highlight": 33,
1441
+ "id": 34,
1442
+ "location": 35,
1443
+ "manager_name": 36,
1444
+ "message": 37,
1445
+ "rule_description": 38,
1446
+ "rule_firedtimes": 39,
1447
+ "rule_gdpr": 40,
1448
+ "rule_gpg13": 41,
1449
+ "rule_group1": 82,
1450
+ "rule_group2": 83,
1451
+ "rule_group3": 84,
1452
+ "rule_groups": 42,
1453
+ "rule_hipaa": 43,
1454
+ "rule_id": 44,
1455
+ "rule_level": 45,
1456
+ "rule_mail": 46,
1457
+ "rule_mitre_id": 85,
1458
+ "rule_mitre_tactic": 86,
1459
+ "rule_mitre_technique": 87,
1460
+ "rule_nist_800_53": 47,
1461
+ "rule_pci_dss": 48,
1462
+ "rule_tsc": 49,
1463
+ "sort": 50,
1464
+ "source": 51,
1465
+ "streams": 52,
1466
+ "syslog_level": 88,
1467
+ "syslog_type": 53,
1468
+ "timestamp": 0,
1469
+ "true": 89
1470
+ },
1471
+ "renameByName": {
1472
+ "_id": "EVENT ID",
1473
+ "agent_ip": "SRC IP",
1474
+ "agent_name": "AGENT",
1475
+ "data_win_system_message": "MESSAGE",
1476
+ "data_win_system_providerGuid": "",
1477
+ "rule_level": "RULE LEVEL",
1478
+ "syslog_level": "LEVEL",
1479
+ "timestamp": "DATE/TIME",
1480
+ "windows_event_severity": "EVENT LOG SEVERITY"
1481
+ }
1482
+ }
1483
+ }
1484
+ ],
1485
+ "transparent": true,
1486
+ "type": "table"
1487
+ },
1488
+ {
1489
+ "collapsed": false,
1490
+ "gridPos": {
1491
+ "h": 1,
1492
+ "w": 24,
1493
+ "x": 0,
1494
+ "y": 21
1495
+ },
1496
+ "id": 140,
1497
+ "panels": [],
1498
+ "title": "USER GROUPS",
1499
+ "type": "row"
1500
+ },
1501
+ {
1502
+ "datasource": {
1503
+ "type": "elasticsearch",
1504
+ "uid": "wazuh_datasource_uid"
1505
+ },
1506
+ "fieldConfig": {
1507
+ "defaults": {
1508
+ "color": {
1509
+ "mode": "thresholds"
1510
+ },
1511
+ "mappings": [],
1512
+ "thresholds": {
1513
+ "mode": "absolute",
1514
+ "steps": [
1515
+ {
1516
+ "color": "blue"
1517
+ }
1518
+ ]
1519
+ }
1520
+ },
1521
+ "overrides": []
1522
+ },
1523
+ "gridPos": {
1524
+ "h": 6,
1525
+ "w": 3,
1526
+ "x": 0,
1527
+ "y": 22
1528
+ },
1529
+ "id": 142,
1530
+ "options": {
1531
+ "colorMode": "value",
1532
+ "graphMode": "area",
1533
+ "justifyMode": "auto",
1534
+ "orientation": "auto",
1535
+ "reduceOptions": {
1536
+ "calcs": ["sum"],
1537
+ "fields": "",
1538
+ "values": false
1539
+ },
1540
+ "textMode": "auto"
1541
+ },
1542
+ "pluginVersion": "8.5.1",
1543
+ "targets": [
1544
+ {
1545
+ "alias": "",
1546
+ "bucketAggs": [
1547
+ {
1548
+ "field": "timestamp",
1549
+ "id": "2",
1550
+ "settings": {
1551
+ "interval": "auto"
1552
+ },
1553
+ "type": "date_histogram"
1554
+ }
1555
+ ],
1556
+ "datasource": {
1557
+ "type": "elasticsearch",
1558
+ "uid": "wazuh_datasource_uid"
1559
+ },
1560
+ "metrics": [
1561
+ {
1562
+ "id": "1",
1563
+ "type": "count"
1564
+ }
1565
+ ],
1566
+ "query": "data_win_system_eventID:4727",
1567
+ "refId": "A",
1568
+ "timeField": "timestamp"
1569
+ }
1570
+ ],
1571
+ "title": "GROUPS CREATED",
1572
+ "transparent": true,
1573
+ "type": "stat"
1574
+ },
1575
+ {
1576
+ "datasource": {
1577
+ "type": "elasticsearch",
1578
+ "uid": "wazuh_datasource_uid"
1579
+ },
1580
+ "fieldConfig": {
1581
+ "defaults": {
1582
+ "color": {
1583
+ "mode": "thresholds"
1584
+ },
1585
+ "custom": {
1586
+ "align": "auto",
1587
+ "displayMode": "auto",
1588
+ "inspect": false
1589
+ },
1590
+ "links": [],
1591
+ "mappings": [],
1592
+ "thresholds": {
1593
+ "mode": "absolute",
1594
+ "steps": [
1595
+ {
1596
+ "color": "blue"
1597
+ }
1598
+ ]
1599
+ }
1600
+ },
1601
+ "overrides": [
1602
+ {
1603
+ "matcher": {
1604
+ "id": "byName",
1605
+ "options": "ACCOUNT"
1606
+ },
1607
+ "properties": [
1608
+ {
1609
+ "id": "custom.displayMode",
1610
+ "value": "color-text"
1611
+ },
1612
+ {
1613
+ "id": "custom.width",
1614
+ "value": 269
1615
+ }
1616
+ ]
1617
+ },
1618
+ {
1619
+ "matcher": {
1620
+ "id": "byName",
1621
+ "options": "Count"
1622
+ },
1623
+ "properties": [
1624
+ {
1625
+ "id": "custom.displayMode",
1626
+ "value": "color-text"
1627
+ }
1628
+ ]
1629
+ }
1630
+ ]
1631
+ },
1632
+ "gridPos": {
1633
+ "h": 6,
1634
+ "w": 5,
1635
+ "x": 3,
1636
+ "y": 22
1637
+ },
1638
+ "id": 144,
1639
+ "options": {
1640
+ "footer": {
1641
+ "fields": "",
1642
+ "reducer": ["sum"],
1643
+ "show": false
1644
+ },
1645
+ "showHeader": true,
1646
+ "sortBy": []
1647
+ },
1648
+ "pluginVersion": "8.5.1",
1649
+ "targets": [
1650
+ {
1651
+ "alias": "",
1652
+ "bucketAggs": [
1653
+ {
1654
+ "field": "data_win_eventdata_targetUserName",
1655
+ "id": "2",
1656
+ "settings": {
1657
+ "min_doc_count": "1",
1658
+ "order": "desc",
1659
+ "orderBy": "_count",
1660
+ "size": "10"
1661
+ },
1662
+ "type": "terms"
1663
+ }
1664
+ ],
1665
+ "datasource": {
1666
+ "type": "elasticsearch",
1667
+ "uid": "wazuh_datasource_uid"
1668
+ },
1669
+ "metrics": [
1670
+ {
1671
+ "id": "1",
1672
+ "type": "count"
1673
+ }
1674
+ ],
1675
+ "query": "data_win_system_eventID:4727",
1676
+ "refId": "A",
1677
+ "timeField": "timestamp"
1678
+ }
1679
+ ],
1680
+ "title": "GROUPS ADDED",
1681
+ "transformations": [
1682
+ {
1683
+ "id": "organize",
1684
+ "options": {
1685
+ "excludeByName": {},
1686
+ "indexByName": {},
1687
+ "renameByName": {
1688
+ "data_win_eventdata_subjectUserName": "ACCOUNT",
1689
+ "data_win_eventdata_targetUserName": "ACCOUNT"
1690
+ }
1691
+ }
1692
+ }
1693
+ ],
1694
+ "type": "table"
1695
+ },
1696
+ {
1697
+ "datasource": {
1698
+ "type": "elasticsearch",
1699
+ "uid": "wazuh_datasource_uid"
1700
+ },
1701
+ "fieldConfig": {
1702
+ "defaults": {
1703
+ "color": {
1704
+ "mode": "thresholds"
1705
+ },
1706
+ "links": [],
1707
+ "mappings": [],
1708
+ "thresholds": {
1709
+ "mode": "absolute",
1710
+ "steps": [
1711
+ {
1712
+ "color": "orange"
1713
+ }
1714
+ ]
1715
+ }
1716
+ },
1717
+ "overrides": []
1718
+ },
1719
+ "gridPos": {
1720
+ "h": 6,
1721
+ "w": 4,
1722
+ "x": 8,
1723
+ "y": 22
1724
+ },
1725
+ "id": 143,
1726
+ "options": {
1727
+ "colorMode": "value",
1728
+ "graphMode": "none",
1729
+ "justifyMode": "auto",
1730
+ "orientation": "auto",
1731
+ "reduceOptions": {
1732
+ "calcs": ["sum"],
1733
+ "fields": "",
1734
+ "values": false
1735
+ },
1736
+ "textMode": "auto"
1737
+ },
1738
+ "pluginVersion": "8.5.1",
1739
+ "targets": [
1740
+ {
1741
+ "alias": "",
1742
+ "bucketAggs": [
1743
+ {
1744
+ "field": "timestamp",
1745
+ "id": "2",
1746
+ "settings": {
1747
+ "interval": "auto"
1748
+ },
1749
+ "type": "date_histogram"
1750
+ }
1751
+ ],
1752
+ "datasource": {
1753
+ "type": "elasticsearch",
1754
+ "uid": "wazuh_datasource_uid"
1755
+ },
1756
+ "metrics": [
1757
+ {
1758
+ "id": "1",
1759
+ "type": "count"
1760
+ }
1761
+ ],
1762
+ "query": "data_win_system_eventID:4764",
1763
+ "refId": "A",
1764
+ "timeField": "timestamp"
1765
+ }
1766
+ ],
1767
+ "title": "GROUPS MODIFIED",
1768
+ "transparent": true,
1769
+ "type": "stat"
1770
+ },
1771
+ {
1772
+ "datasource": {
1773
+ "type": "elasticsearch",
1774
+ "uid": "wazuh_datasource_uid"
1775
+ },
1776
+ "fieldConfig": {
1777
+ "defaults": {
1778
+ "color": {
1779
+ "mode": "thresholds"
1780
+ },
1781
+ "custom": {
1782
+ "align": "auto",
1783
+ "displayMode": "auto",
1784
+ "inspect": false
1785
+ },
1786
+ "links": [],
1787
+ "mappings": [],
1788
+ "thresholds": {
1789
+ "mode": "absolute",
1790
+ "steps": [
1791
+ {
1792
+ "color": "orange"
1793
+ }
1794
+ ]
1795
+ }
1796
+ },
1797
+ "overrides": [
1798
+ {
1799
+ "matcher": {
1800
+ "id": "byName",
1801
+ "options": "ACCOUNT"
1802
+ },
1803
+ "properties": [
1804
+ {
1805
+ "id": "custom.displayMode",
1806
+ "value": "color-text"
1807
+ },
1808
+ {
1809
+ "id": "custom.width",
1810
+ "value": 269
1811
+ }
1812
+ ]
1813
+ },
1814
+ {
1815
+ "matcher": {
1816
+ "id": "byName",
1817
+ "options": "Count"
1818
+ },
1819
+ "properties": [
1820
+ {
1821
+ "id": "custom.displayMode",
1822
+ "value": "color-text"
1823
+ }
1824
+ ]
1825
+ }
1826
+ ]
1827
+ },
1828
+ "gridPos": {
1829
+ "h": 6,
1830
+ "w": 5,
1831
+ "x": 12,
1832
+ "y": 22
1833
+ },
1834
+ "id": 145,
1835
+ "options": {
1836
+ "footer": {
1837
+ "fields": "",
1838
+ "reducer": ["sum"],
1839
+ "show": false
1840
+ },
1841
+ "showHeader": true,
1842
+ "sortBy": []
1843
+ },
1844
+ "pluginVersion": "8.5.1",
1845
+ "targets": [
1846
+ {
1847
+ "alias": "",
1848
+ "bucketAggs": [
1849
+ {
1850
+ "field": "data_win_eventdata_targetUserName",
1851
+ "id": "2",
1852
+ "settings": {
1853
+ "min_doc_count": "1",
1854
+ "order": "desc",
1855
+ "orderBy": "_count",
1856
+ "size": "10"
1857
+ },
1858
+ "type": "terms"
1859
+ }
1860
+ ],
1861
+ "datasource": {
1862
+ "type": "elasticsearch",
1863
+ "uid": "wazuh_datasource_uid"
1864
+ },
1865
+ "metrics": [
1866
+ {
1867
+ "id": "1",
1868
+ "type": "count"
1869
+ }
1870
+ ],
1871
+ "query": "data_win_system_eventID:4764",
1872
+ "refId": "A",
1873
+ "timeField": "timestamp"
1874
+ }
1875
+ ],
1876
+ "title": "GROUPS MODIFIED",
1877
+ "transformations": [
1878
+ {
1879
+ "id": "organize",
1880
+ "options": {
1881
+ "excludeByName": {},
1882
+ "indexByName": {},
1883
+ "renameByName": {
1884
+ "data_win_eventdata_subjectUserName": "ACCOUNT",
1885
+ "data_win_eventdata_targetUserName": "ACCOUNT"
1886
+ }
1887
+ }
1888
+ }
1889
+ ],
1890
+ "type": "table"
1891
+ },
1892
+ {
1893
+ "datasource": {
1894
+ "type": "elasticsearch",
1895
+ "uid": "wazuh_datasource_uid"
1896
+ },
1897
+ "fieldConfig": {
1898
+ "defaults": {
1899
+ "color": {
1900
+ "mode": "thresholds"
1901
+ },
1902
+ "custom": {
1903
+ "align": "auto",
1904
+ "displayMode": "auto",
1905
+ "inspect": false
1906
+ },
1907
+ "links": [],
1908
+ "mappings": [],
1909
+ "thresholds": {
1910
+ "mode": "absolute",
1911
+ "steps": [
1912
+ {
1913
+ "color": "orange"
1914
+ }
1915
+ ]
1916
+ }
1917
+ },
1918
+ "overrides": [
1919
+ {
1920
+ "matcher": {
1921
+ "id": "byName",
1922
+ "options": "ACCOUNT"
1923
+ },
1924
+ "properties": [
1925
+ {
1926
+ "id": "custom.displayMode",
1927
+ "value": "color-text"
1928
+ },
1929
+ {
1930
+ "id": "custom.width",
1931
+ "value": 462
1932
+ }
1933
+ ]
1934
+ },
1935
+ {
1936
+ "matcher": {
1937
+ "id": "byName",
1938
+ "options": "Count"
1939
+ },
1940
+ "properties": [
1941
+ {
1942
+ "id": "custom.displayMode",
1943
+ "value": "color-text"
1944
+ }
1945
+ ]
1946
+ },
1947
+ {
1948
+ "matcher": {
1949
+ "id": "byName",
1950
+ "options": "AD GROUP"
1951
+ },
1952
+ "properties": [
1953
+ {
1954
+ "id": "custom.displayMode",
1955
+ "value": "color-text"
1956
+ },
1957
+ {
1958
+ "id": "custom.width",
1959
+ "value": 365
1960
+ }
1961
+ ]
1962
+ }
1963
+ ]
1964
+ },
1965
+ "gridPos": {
1966
+ "h": 6,
1967
+ "w": 7,
1968
+ "x": 17,
1969
+ "y": 22
1970
+ },
1971
+ "id": 146,
1972
+ "options": {
1973
+ "footer": {
1974
+ "fields": "",
1975
+ "reducer": ["sum"],
1976
+ "show": false
1977
+ },
1978
+ "showHeader": true,
1979
+ "sortBy": []
1980
+ },
1981
+ "pluginVersion": "8.5.1",
1982
+ "targets": [
1983
+ {
1984
+ "alias": "",
1985
+ "bucketAggs": [
1986
+ {
1987
+ "field": "data_win_eventdata_targetUserName",
1988
+ "id": "2",
1989
+ "settings": {
1990
+ "min_doc_count": "1",
1991
+ "order": "desc",
1992
+ "orderBy": "_count",
1993
+ "size": "10"
1994
+ },
1995
+ "type": "terms"
1996
+ }
1997
+ ],
1998
+ "datasource": {
1999
+ "type": "elasticsearch",
2000
+ "uid": "wazuh_datasource_uid"
2001
+ },
2002
+ "metrics": [
2003
+ {
2004
+ "id": "1",
2005
+ "type": "count"
2006
+ }
2007
+ ],
2008
+ "query": "data_win_system_eventID:4728 OR data_win_system_eventID:4732 OR data_win_system_eventID:4756",
2009
+ "refId": "A",
2010
+ "timeField": "timestamp"
2011
+ }
2012
+ ],
2013
+ "title": "MODIFIED PRIVILEGE GROUPS",
2014
+ "transformations": [
2015
+ {
2016
+ "id": "organize",
2017
+ "options": {
2018
+ "excludeByName": {},
2019
+ "indexByName": {},
2020
+ "renameByName": {
2021
+ "data_win_eventdata_memberName": "ACCOUNT",
2022
+ "data_win_eventdata_subjectUserName": "ACCOUNT",
2023
+ "data_win_eventdata_targetUserName": "AD GROUP"
2024
+ }
2025
+ }
2026
+ }
2027
+ ],
2028
+ "type": "table"
2029
+ },
2030
+ {
2031
+ "datasource": {
2032
+ "type": "elasticsearch",
2033
+ "uid": "wazuh_datasource_uid"
2034
+ },
2035
+ "fieldConfig": {
2036
+ "defaults": {
2037
+ "color": {
2038
+ "mode": "thresholds"
2039
+ },
2040
+ "custom": {
2041
+ "align": "auto",
2042
+ "displayMode": "auto",
2043
+ "inspect": false
2044
+ },
2045
+ "mappings": [],
2046
+ "thresholds": {
2047
+ "mode": "absolute",
2048
+ "steps": [
2049
+ {
2050
+ "color": "green"
2051
+ },
2052
+ {
2053
+ "color": "red",
2054
+ "value": 80
2055
+ }
2056
+ ]
2057
+ }
2058
+ },
2059
+ "overrides": [
2060
+ {
2061
+ "matcher": {
2062
+ "id": "byName",
2063
+ "options": "rule_level"
2064
+ },
2065
+ "properties": [
2066
+ {
2067
+ "id": "custom.width",
2068
+ "value": 93
2069
+ }
2070
+ ]
2071
+ },
2072
+ {
2073
+ "matcher": {
2074
+ "id": "byName",
2075
+ "options": "windows_event_id"
2076
+ },
2077
+ "properties": [
2078
+ {
2079
+ "id": "custom.width",
2080
+ "value": 186
2081
+ }
2082
+ ]
2083
+ },
2084
+ {
2085
+ "matcher": {
2086
+ "id": "byName",
2087
+ "options": "DATE/TIME"
2088
+ },
2089
+ "properties": [
2090
+ {
2091
+ "id": "custom.width",
2092
+ "value": 202
2093
+ }
2094
+ ]
2095
+ },
2096
+ {
2097
+ "matcher": {
2098
+ "id": "byName",
2099
+ "options": "AGENT"
2100
+ },
2101
+ "properties": [
2102
+ {
2103
+ "id": "custom.width",
2104
+ "value": 171
2105
+ }
2106
+ ]
2107
+ },
2108
+ {
2109
+ "matcher": {
2110
+ "id": "byName",
2111
+ "options": "SRC IP"
2112
+ },
2113
+ "properties": [
2114
+ {
2115
+ "id": "custom.width",
2116
+ "value": 167
2117
+ }
2118
+ ]
2119
+ },
2120
+ {
2121
+ "matcher": {
2122
+ "id": "byName",
2123
+ "options": "MESSAGE"
2124
+ },
2125
+ "properties": [
2126
+ {
2127
+ "id": "custom.width",
2128
+ "value": 1622
2129
+ }
2130
+ ]
2131
+ },
2132
+ {
2133
+ "matcher": {
2134
+ "id": "byName",
2135
+ "options": "rule_description"
2136
+ },
2137
+ "properties": [
2138
+ {
2139
+ "id": "custom.width",
2140
+ "value": 524
2141
+ }
2142
+ ]
2143
+ },
2144
+ {
2145
+ "matcher": {
2146
+ "id": "byName",
2147
+ "options": "EVENT ID"
2148
+ },
2149
+ "properties": [
2150
+ {
2151
+ "id": "links",
2152
+ "value": [
2153
+ {
2154
+ "targetBlank": true,
2155
+ "title": "VIEW EVENT DETAILS",
2156
+ "url": "https://grafana.company.local/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
2157
+ }
2158
+ ]
2159
+ }
2160
+ ]
2161
+ }
2162
+ ]
2163
+ },
2164
+ "gridPos": {
2165
+ "h": 10,
2166
+ "w": 24,
2167
+ "x": 0,
2168
+ "y": 28
2169
+ },
2170
+ "id": 149,
2171
+ "options": {
2172
+ "footer": {
2173
+ "fields": "",
2174
+ "reducer": ["sum"],
2175
+ "show": false
2176
+ },
2177
+ "showHeader": true,
2178
+ "sortBy": []
2179
+ },
2180
+ "pluginVersion": "8.5.1",
2181
+ "targets": [
2182
+ {
2183
+ "alias": "",
2184
+ "bucketAggs": [],
2185
+ "datasource": {
2186
+ "type": "elasticsearch",
2187
+ "uid": "wazuh_datasource_uid"
2188
+ },
2189
+ "metrics": [
2190
+ {
2191
+ "id": "1",
2192
+ "settings": {
2193
+ "size": "500"
2194
+ },
2195
+ "type": "raw_data"
2196
+ }
2197
+ ],
2198
+ "query": "(data_win_system_eventID:4727 OR data_win_system_eventID:4764 OR data_win_system_eventID:4728 OR data_win_system_eventID:4732 OR data_win_system_eventID:4756) AND agent_name:$agent_name",
2199
+ "queryType": "lucene",
2200
+ "refId": "A",
2201
+ "timeField": "timestamp"
2202
+ }
2203
+ ],
2204
+ "title": "USER GROUPS - EVENTS",
2205
+ "transformations": [
2206
+ {
2207
+ "id": "organize",
2208
+ "options": {
2209
+ "excludeByName": {
2210
+ "@metadata_beat": true,
2211
+ "@metadata_type": true,
2212
+ "@metadata_version": true,
2213
+ "_id": false,
2214
+ "_index": true,
2215
+ "_type": true,
2216
+ "agent_ephemeral_id": true,
2217
+ "agent_hostname": true,
2218
+ "agent_id": true,
2219
+ "agent_ip": false,
2220
+ "agent_ip_city_name": true,
2221
+ "agent_ip_country_code": true,
2222
+ "agent_ip_geolocation": true,
2223
+ "agent_labels_customer": true,
2224
+ "agent_name": false,
2225
+ "agent_type": true,
2226
+ "agent_version": true,
2227
+ "beats_type": true,
2228
+ "cluster_name": true,
2229
+ "cluster_node": true,
2230
+ "collector_node_id": true,
2231
+ "data_win_eventXML_binaryData": true,
2232
+ "data_win_eventXML_binaryDataSize": true,
2233
+ "data_win_eventXML_param1": true,
2234
+ "data_win_eventdata_accessMask": true,
2235
+ "data_win_eventdata_authenticationPackageName": true,
2236
+ "data_win_eventdata_binary": true,
2237
+ "data_win_eventdata_data": true,
2238
+ "data_win_eventdata_domain": true,
2239
+ "data_win_eventdata_elevatedToken": true,
2240
+ "data_win_eventdata_failureReason": true,
2241
+ "data_win_eventdata_handleId": true,
2242
+ "data_win_eventdata_imagePath": true,
2243
+ "data_win_eventdata_impersonationLevel": true,
2244
+ "data_win_eventdata_ipAddress": true,
2245
+ "data_win_eventdata_ipPort": true,
2246
+ "data_win_eventdata_keyLength": true,
2247
+ "data_win_eventdata_lmPackageName": true,
2248
+ "data_win_eventdata_logonGuid": true,
2249
+ "data_win_eventdata_logonProcessName": true,
2250
+ "data_win_eventdata_logonType": true,
2251
+ "data_win_eventdata_memberName": true,
2252
+ "data_win_eventdata_memberSid": true,
2253
+ "data_win_eventdata_objectServer": true,
2254
+ "data_win_eventdata_packageName": true,
2255
+ "data_win_eventdata_passwordLastSet": true,
2256
+ "data_win_eventdata_privilegeList": true,
2257
+ "data_win_eventdata_processId": true,
2258
+ "data_win_eventdata_processName": true,
2259
+ "data_win_eventdata_restrictedAdminMode": true,
2260
+ "data_win_eventdata_sID": true,
2261
+ "data_win_eventdata_serviceName": true,
2262
+ "data_win_eventdata_serviceSid": true,
2263
+ "data_win_eventdata_serviceType": true,
2264
+ "data_win_eventdata_startType": true,
2265
+ "data_win_eventdata_status": true,
2266
+ "data_win_eventdata_subStatus": true,
2267
+ "data_win_eventdata_subjectDomainName": true,
2268
+ "data_win_eventdata_subjectLogonId": true,
2269
+ "data_win_eventdata_subjectUserName": true,
2270
+ "data_win_eventdata_subjectUserSid": true,
2271
+ "data_win_eventdata_targetDomainName": true,
2272
+ "data_win_eventdata_targetLinkedLogonId": true,
2273
+ "data_win_eventdata_targetLogonId": true,
2274
+ "data_win_eventdata_targetSid": true,
2275
+ "data_win_eventdata_targetUserName": true,
2276
+ "data_win_eventdata_targetUserSid": true,
2277
+ "data_win_eventdata_ticketEncryptionType": true,
2278
+ "data_win_eventdata_ticketOptions": true,
2279
+ "data_win_eventdata_user": true,
2280
+ "data_win_eventdata_virtualAccount": true,
2281
+ "data_win_eventdata_workstation": true,
2282
+ "data_win_eventdata_workstationName": true,
2283
+ "data_win_system_channel": true,
2284
+ "data_win_system_computer": true,
2285
+ "data_win_system_eventID": true,
2286
+ "data_win_system_eventRecordID": true,
2287
+ "data_win_system_eventSourceName": true,
2288
+ "data_win_system_keywords": true,
2289
+ "data_win_system_level": true,
2290
+ "data_win_system_opcode": true,
2291
+ "data_win_system_processID": true,
2292
+ "data_win_system_providerGuid": true,
2293
+ "data_win_system_providerName": true,
2294
+ "data_win_system_severityValue": true,
2295
+ "data_win_system_systemTime": true,
2296
+ "data_win_system_task": true,
2297
+ "data_win_system_threadID": true,
2298
+ "data_win_system_version": true,
2299
+ "decoder_name": true,
2300
+ "ecs_version": true,
2301
+ "gl2_accounted_message_size": true,
2302
+ "gl2_message_id": true,
2303
+ "gl2_processing_error": true,
2304
+ "gl2_remote_ip": true,
2305
+ "gl2_remote_port": true,
2306
+ "gl2_source_collector": true,
2307
+ "gl2_source_input": true,
2308
+ "gl2_source_node": true,
2309
+ "highlight": true,
2310
+ "host_name": true,
2311
+ "id": true,
2312
+ "location": true,
2313
+ "log_file_path": true,
2314
+ "log_offset": true,
2315
+ "manager_name": true,
2316
+ "message": true,
2317
+ "previous_output": true,
2318
+ "process_id": true,
2319
+ "rule_description": true,
2320
+ "rule_firedtimes": true,
2321
+ "rule_frequency": true,
2322
+ "rule_gdpr": true,
2323
+ "rule_gpg13": true,
2324
+ "rule_group1": true,
2325
+ "rule_group2": true,
2326
+ "rule_group3": true,
2327
+ "rule_groups": true,
2328
+ "rule_hipaa": true,
2329
+ "rule_id": true,
2330
+ "rule_mail": true,
2331
+ "rule_mitre_id": true,
2332
+ "rule_mitre_tactic": true,
2333
+ "rule_mitre_technique": true,
2334
+ "rule_nist_800_53": true,
2335
+ "rule_pci_dss": true,
2336
+ "rule_tsc": true,
2337
+ "sort": true,
2338
+ "source": true,
2339
+ "src_ip": true,
2340
+ "src_ip_city_name": true,
2341
+ "src_ip_country_code": true,
2342
+ "src_ip_geolocation": true,
2343
+ "streams": true,
2344
+ "syslog_tag": true,
2345
+ "syslog_type": true,
2346
+ "timestamp": false,
2347
+ "true": true,
2348
+ "user_name": true,
2349
+ "win_system_eventID": true,
2350
+ "windows_auth_package": true,
2351
+ "windows_domain": true,
2352
+ "windows_event_id": true,
2353
+ "windows_event_severity": false,
2354
+ "windows_logon_type": true
2355
+ },
2356
+ "indexByName": {
2357
+ "_id": 1,
2358
+ "_index": 3,
2359
+ "_type": 4,
2360
+ "agent_id": 5,
2361
+ "agent_ip": 6,
2362
+ "agent_ip_city_name": 7,
2363
+ "agent_ip_country_code": 8,
2364
+ "agent_ip_geolocation": 9,
2365
+ "agent_labels_customer": 54,
2366
+ "agent_name": 2,
2367
+ "data_win_eventdata_authenticationPackageName": 55,
2368
+ "data_win_eventdata_elevatedToken": 56,
2369
+ "data_win_eventdata_impersonationLevel": 57,
2370
+ "data_win_eventdata_ipAddress": 58,
2371
+ "data_win_eventdata_ipPort": 59,
2372
+ "data_win_eventdata_keyLength": 60,
2373
+ "data_win_eventdata_logonGuid": 61,
2374
+ "data_win_eventdata_logonProcessName": 62,
2375
+ "data_win_eventdata_logonType": 63,
2376
+ "data_win_eventdata_processId": 64,
2377
+ "data_win_eventdata_processName": 65,
2378
+ "data_win_eventdata_serviceName": 66,
2379
+ "data_win_eventdata_serviceSid": 67,
2380
+ "data_win_eventdata_status": 68,
2381
+ "data_win_eventdata_subjectDomainName": 69,
2382
+ "data_win_eventdata_subjectLogonId": 70,
2383
+ "data_win_eventdata_subjectUserName": 71,
2384
+ "data_win_eventdata_subjectUserSid": 72,
2385
+ "data_win_eventdata_targetDomainName": 73,
2386
+ "data_win_eventdata_targetLinkedLogonId": 74,
2387
+ "data_win_eventdata_targetLogonId": 75,
2388
+ "data_win_eventdata_targetUserName": 76,
2389
+ "data_win_eventdata_targetUserSid": 77,
2390
+ "data_win_eventdata_ticketEncryptionType": 78,
2391
+ "data_win_eventdata_ticketOptions": 79,
2392
+ "data_win_eventdata_virtualAccount": 80,
2393
+ "data_win_system_channel": 10,
2394
+ "data_win_system_computer": 11,
2395
+ "data_win_system_eventID": 12,
2396
+ "data_win_system_eventRecordID": 13,
2397
+ "data_win_system_keywords": 14,
2398
+ "data_win_system_level": 15,
2399
+ "data_win_system_message": 16,
2400
+ "data_win_system_opcode": 17,
2401
+ "data_win_system_processID": 18,
2402
+ "data_win_system_providerGuid": 19,
2403
+ "data_win_system_providerName": 20,
2404
+ "data_win_system_severityValue": 21,
2405
+ "data_win_system_systemTime": 22,
2406
+ "data_win_system_task": 23,
2407
+ "data_win_system_threadID": 24,
2408
+ "data_win_system_version": 25,
2409
+ "decoder_name": 26,
2410
+ "gl2_accounted_message_size": 27,
2411
+ "gl2_message_id": 28,
2412
+ "gl2_processing_error": 81,
2413
+ "gl2_remote_ip": 29,
2414
+ "gl2_remote_port": 30,
2415
+ "gl2_source_input": 31,
2416
+ "gl2_source_node": 32,
2417
+ "highlight": 33,
2418
+ "id": 34,
2419
+ "location": 35,
2420
+ "manager_name": 36,
2421
+ "message": 37,
2422
+ "rule_description": 38,
2423
+ "rule_firedtimes": 39,
2424
+ "rule_gdpr": 40,
2425
+ "rule_gpg13": 41,
2426
+ "rule_group1": 82,
2427
+ "rule_group2": 83,
2428
+ "rule_group3": 84,
2429
+ "rule_groups": 42,
2430
+ "rule_hipaa": 43,
2431
+ "rule_id": 44,
2432
+ "rule_level": 45,
2433
+ "rule_mail": 46,
2434
+ "rule_mitre_id": 85,
2435
+ "rule_mitre_tactic": 86,
2436
+ "rule_mitre_technique": 87,
2437
+ "rule_nist_800_53": 47,
2438
+ "rule_pci_dss": 48,
2439
+ "rule_tsc": 49,
2440
+ "sort": 50,
2441
+ "source": 51,
2442
+ "streams": 52,
2443
+ "syslog_level": 88,
2444
+ "syslog_type": 53,
2445
+ "timestamp": 0,
2446
+ "true": 89
2447
+ },
2448
+ "renameByName": {
2449
+ "_id": "EVENT ID",
2450
+ "agent_ip": "SRC IP",
2451
+ "agent_name": "AGENT",
2452
+ "data_win_system_message": "MESSAGE",
2453
+ "data_win_system_providerGuid": "",
2454
+ "rule_level": "RULE LEVEL",
2455
+ "syslog_level": "LEVEL",
2456
+ "timestamp": "DATE/TIME",
2457
+ "windows_event_severity": "EVENT LOG SEVERITY"
2458
+ }
2459
+ }
2460
+ }
2461
+ ],
2462
+ "transparent": true,
2463
+ "type": "table"
2464
+ }
2465
+ ],
2466
+ "refresh": "",
2467
+ "schemaVersion": 36,
2468
+ "style": "dark",
2469
+ "tags": ["EDR"],
2470
+ "templating": {
2471
+ "list": [
2472
+ {
2473
+ "datasource": {
2474
+ "type": "elasticsearch",
2475
+ "uid": "wazuh_datasource_uid"
2476
+ },
2477
+ "filters": [],
2478
+ "hide": 0,
2479
+ "label": "",
2480
+ "name": "Filters",
2481
+ "skipUrlSync": false,
2482
+ "type": "adhoc"
2483
+ },
2484
+ {
2485
+ "current": {
2486
+ "selected": false,
2487
+ "text": "All",
2488
+ "value": "$__all"
2489
+ },
2490
+ "datasource": {
2491
+ "type": "elasticsearch",
2492
+ "uid": "wazuh_datasource_uid"
2493
+ },
2494
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"(rule_group2:windows_system OR rule_group2:windows_application OR rule_group2:windows_security OR rule_group3:policy_changed)\"}",
2495
+ "hide": 0,
2496
+ "includeAll": true,
2497
+ "label": "Agent",
2498
+ "multi": false,
2499
+ "name": "agent_name",
2500
+ "options": [],
2501
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"(rule_group2:windows_system OR rule_group2:windows_application OR rule_group2:windows_security OR rule_group3:policy_changed)\"}",
2502
+ "refresh": 2,
2503
+ "regex": "",
2504
+ "skipUrlSync": false,
2505
+ "sort": 2,
2506
+ "tagValuesQuery": "",
2507
+ "tagsQuery": "",
2508
+ "type": "query",
2509
+ "useTags": false
2510
+ }
2511
+ ]
2512
+ },
2513
+ "time": {
2514
+ "from": "now-24h",
2515
+ "to": "now"
2516
+ },
2517
+ "timepicker": {
2518
+ "refresh_intervals": ["10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2519
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2520
+ },
2521
+ "timezone": "",
2522
+ "title": "EDR - USERS AND GROUPS",
2523
+ "uid": null,
2524
+ "version": 1,
2525
+ "weekStart": ""
2526
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_wazuh_inventory.json
new
+2042
@@ -0,0 +1,2042 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "collapsed": false,
44
+ "datasource": {
45
+ "type": "datasource",
46
+ "uid": "grafana"
47
+ },
48
+ "gridPos": {
49
+ "h": 1,
50
+ "w": 24,
51
+ "x": 0,
52
+ "y": 0
53
+ },
54
+ "id": 72,
55
+ "panels": [],
56
+ "title": "AGENTS INVENTORY - SUMMARY",
57
+ "type": "row"
58
+ },
59
+ {
60
+ "datasource": {
61
+ "type": "elasticsearch",
62
+ "uid": "wazuh_datasource_uid"
63
+ },
64
+ "fieldConfig": {
65
+ "defaults": {
66
+ "mappings": [
67
+ {
68
+ "options": {
69
+ "match": "null",
70
+ "result": {
71
+ "text": "N/A"
72
+ }
73
+ },
74
+ "type": "special"
75
+ }
76
+ ],
77
+ "thresholds": {
78
+ "mode": "absolute",
79
+ "steps": [
80
+ {
81
+ "color": "blue",
82
+ "value": null
83
+ }
84
+ ]
85
+ },
86
+ "unit": "short"
87
+ },
88
+ "overrides": []
89
+ },
90
+ "gridPos": {
91
+ "h": 8,
92
+ "w": 4,
93
+ "x": 0,
94
+ "y": 1
95
+ },
96
+ "id": 113,
97
+ "links": [],
98
+ "options": {
99
+ "colorMode": "value",
100
+ "graphMode": "area",
101
+ "justifyMode": "auto",
102
+ "orientation": "horizontal",
103
+ "reduceOptions": {
104
+ "calcs": ["sum"],
105
+ "fields": "",
106
+ "values": false
107
+ },
108
+ "text": {},
109
+ "textMode": "auto"
110
+ },
111
+ "pluginVersion": "10.0.2",
112
+ "targets": [
113
+ {
114
+ "bucketAggs": [
115
+ {
116
+ "$$hashKey": "object:50",
117
+ "field": "timestamp",
118
+ "id": "2",
119
+ "settings": {
120
+ "interval": "365d",
121
+ "min_doc_count": 0,
122
+ "trimEdges": 0
123
+ },
124
+ "type": "date_histogram"
125
+ }
126
+ ],
127
+ "datasource": {
128
+ "type": "elasticsearch",
129
+ "uid": "wazuh_datasource_uid"
130
+ },
131
+ "metrics": [
132
+ {
133
+ "field": "data_host_name",
134
+ "id": "1",
135
+ "type": "cardinality"
136
+ }
137
+ ],
138
+ "query": "rule_groups:wazuh_inventory",
139
+ "refId": "A",
140
+ "timeField": "timestamp"
141
+ }
142
+ ],
143
+ "title": "TOTAL AGENTS",
144
+ "type": "stat"
145
+ },
146
+ {
147
+ "datasource": {
148
+ "type": "elasticsearch",
149
+ "uid": "wazuh_datasource_uid"
150
+ },
151
+ "fieldConfig": {
152
+ "defaults": {
153
+ "mappings": [
154
+ {
155
+ "options": {
156
+ "match": "null",
157
+ "result": {
158
+ "text": "N/A"
159
+ }
160
+ },
161
+ "type": "special"
162
+ }
163
+ ],
164
+ "thresholds": {
165
+ "mode": "absolute",
166
+ "steps": [
167
+ {
168
+ "color": "green",
169
+ "value": null
170
+ }
171
+ ]
172
+ },
173
+ "unit": "short"
174
+ },
175
+ "overrides": []
176
+ },
177
+ "gridPos": {
178
+ "h": 8,
179
+ "w": 4,
180
+ "x": 4,
181
+ "y": 1
182
+ },
183
+ "id": 117,
184
+ "links": [],
185
+ "options": {
186
+ "colorMode": "value",
187
+ "graphMode": "area",
188
+ "justifyMode": "auto",
189
+ "orientation": "horizontal",
190
+ "reduceOptions": {
191
+ "calcs": ["sum"],
192
+ "fields": "",
193
+ "values": false
194
+ },
195
+ "text": {},
196
+ "textMode": "auto"
197
+ },
198
+ "pluginVersion": "10.0.2",
199
+ "targets": [
200
+ {
201
+ "bucketAggs": [
202
+ {
203
+ "$$hashKey": "object:50",
204
+ "field": "timestamp",
205
+ "id": "2",
206
+ "settings": {
207
+ "interval": "365d",
208
+ "min_doc_count": 0,
209
+ "trimEdges": 0
210
+ },
211
+ "type": "date_histogram"
212
+ }
213
+ ],
214
+ "datasource": {
215
+ "type": "elasticsearch",
216
+ "uid": "wazuh_datasource_uid"
217
+ },
218
+ "metrics": [
219
+ {
220
+ "field": "data_host_name",
221
+ "id": "1",
222
+ "type": "cardinality"
223
+ }
224
+ ],
225
+ "query": "data_status:active",
226
+ "refId": "A",
227
+ "timeField": "timestamp"
228
+ }
229
+ ],
230
+ "title": "AGENTS ONLINE",
231
+ "type": "stat"
232
+ },
233
+ {
234
+ "datasource": {
235
+ "type": "elasticsearch",
236
+ "uid": "wazuh_datasource_uid"
237
+ },
238
+ "fieldConfig": {
239
+ "defaults": {
240
+ "mappings": [
241
+ {
242
+ "options": {
243
+ "match": "null",
244
+ "result": {
245
+ "text": "N/A"
246
+ }
247
+ },
248
+ "type": "special"
249
+ }
250
+ ],
251
+ "thresholds": {
252
+ "mode": "absolute",
253
+ "steps": [
254
+ {
255
+ "color": "red",
256
+ "value": null
257
+ }
258
+ ]
259
+ },
260
+ "unit": "short"
261
+ },
262
+ "overrides": []
263
+ },
264
+ "gridPos": {
265
+ "h": 8,
266
+ "w": 4,
267
+ "x": 8,
268
+ "y": 1
269
+ },
270
+ "id": 120,
271
+ "links": [],
272
+ "options": {
273
+ "colorMode": "value",
274
+ "graphMode": "area",
275
+ "justifyMode": "auto",
276
+ "orientation": "horizontal",
277
+ "reduceOptions": {
278
+ "calcs": ["sum"],
279
+ "fields": "",
280
+ "values": false
281
+ },
282
+ "text": {},
283
+ "textMode": "auto"
284
+ },
285
+ "pluginVersion": "10.0.2",
286
+ "targets": [
287
+ {
288
+ "bucketAggs": [
289
+ {
290
+ "$$hashKey": "object:50",
291
+ "field": "timestamp",
292
+ "id": "2",
293
+ "settings": {
294
+ "interval": "365d",
295
+ "min_doc_count": 0,
296
+ "trimEdges": 0
297
+ },
298
+ "type": "date_histogram"
299
+ }
300
+ ],
301
+ "datasource": {
302
+ "type": "elasticsearch",
303
+ "uid": "wazuh_datasource_uid"
304
+ },
305
+ "metrics": [
306
+ {
307
+ "field": "data_host_name",
308
+ "id": "1",
309
+ "type": "cardinality"
310
+ }
311
+ ],
312
+ "query": "data_status:disconnected",
313
+ "refId": "A",
314
+ "timeField": "timestamp"
315
+ }
316
+ ],
317
+ "title": "AGENTS DISCONNECTED",
318
+ "type": "stat"
319
+ },
320
+ {
321
+ "datasource": {
322
+ "type": "elasticsearch",
323
+ "uid": "wazuh_datasource_uid"
324
+ },
325
+ "fieldConfig": {
326
+ "defaults": {
327
+ "mappings": [
328
+ {
329
+ "options": {
330
+ "match": "null",
331
+ "result": {
332
+ "text": "N/A"
333
+ }
334
+ },
335
+ "type": "special"
336
+ }
337
+ ],
338
+ "thresholds": {
339
+ "mode": "absolute",
340
+ "steps": [
341
+ {
342
+ "color": "orange",
343
+ "value": null
344
+ }
345
+ ]
346
+ },
347
+ "unit": "short"
348
+ },
349
+ "overrides": []
350
+ },
351
+ "gridPos": {
352
+ "h": 8,
353
+ "w": 4,
354
+ "x": 12,
355
+ "y": 1
356
+ },
357
+ "id": 121,
358
+ "links": [],
359
+ "options": {
360
+ "colorMode": "value",
361
+ "graphMode": "area",
362
+ "justifyMode": "auto",
363
+ "orientation": "horizontal",
364
+ "reduceOptions": {
365
+ "calcs": ["sum"],
366
+ "fields": "",
367
+ "values": false
368
+ },
369
+ "text": {},
370
+ "textMode": "auto"
371
+ },
372
+ "pluginVersion": "10.0.2",
373
+ "targets": [
374
+ {
375
+ "bucketAggs": [
376
+ {
377
+ "$$hashKey": "object:50",
378
+ "field": "timestamp",
379
+ "id": "2",
380
+ "settings": {
381
+ "interval": "365d",
382
+ "min_doc_count": 0,
383
+ "trimEdges": 0
384
+ },
385
+ "type": "date_histogram"
386
+ }
387
+ ],
388
+ "datasource": {
389
+ "type": "elasticsearch",
390
+ "uid": "wazuh_datasource_uid"
391
+ },
392
+ "metrics": [
393
+ {
394
+ "field": "data_host_name",
395
+ "id": "1",
396
+ "type": "cardinality"
397
+ }
398
+ ],
399
+ "query": "data_status:pending",
400
+ "refId": "A",
401
+ "timeField": "timestamp"
402
+ }
403
+ ],
404
+ "title": "AGENTS PENDING",
405
+ "type": "stat"
406
+ },
407
+ {
408
+ "datasource": {
409
+ "type": "elasticsearch",
410
+ "uid": "wazuh_datasource_uid"
411
+ },
412
+ "fieldConfig": {
413
+ "defaults": {
414
+ "mappings": [
415
+ {
416
+ "options": {
417
+ "match": "null",
418
+ "result": {
419
+ "text": "N/A"
420
+ }
421
+ },
422
+ "type": "special"
423
+ }
424
+ ],
425
+ "thresholds": {
426
+ "mode": "absolute",
427
+ "steps": [
428
+ {
429
+ "color": "orange",
430
+ "value": null
431
+ }
432
+ ]
433
+ },
434
+ "unit": "short"
435
+ },
436
+ "overrides": []
437
+ },
438
+ "gridPos": {
439
+ "h": 8,
440
+ "w": 4,
441
+ "x": 16,
442
+ "y": 1
443
+ },
444
+ "id": 122,
445
+ "links": [],
446
+ "options": {
447
+ "colorMode": "value",
448
+ "graphMode": "area",
449
+ "justifyMode": "auto",
450
+ "orientation": "horizontal",
451
+ "reduceOptions": {
452
+ "calcs": ["sum"],
453
+ "fields": "",
454
+ "values": false
455
+ },
456
+ "text": {},
457
+ "textMode": "auto"
458
+ },
459
+ "pluginVersion": "10.0.2",
460
+ "targets": [
461
+ {
462
+ "bucketAggs": [
463
+ {
464
+ "$$hashKey": "object:50",
465
+ "field": "timestamp",
466
+ "id": "2",
467
+ "settings": {
468
+ "interval": "365d",
469
+ "min_doc_count": 0,
470
+ "trimEdges": 0
471
+ },
472
+ "type": "date_histogram"
473
+ }
474
+ ],
475
+ "datasource": {
476
+ "type": "elasticsearch",
477
+ "uid": "wazuh_datasource_uid"
478
+ },
479
+ "metrics": [
480
+ {
481
+ "field": "data_host_name",
482
+ "id": "1",
483
+ "type": "cardinality"
484
+ }
485
+ ],
486
+ "query": "data_status:never_connected",
487
+ "refId": "A",
488
+ "timeField": "timestamp"
489
+ }
490
+ ],
491
+ "title": "AGENTS NEVER CONNECTED",
492
+ "type": "stat"
493
+ },
494
+ {
495
+ "datasource": {
496
+ "type": "elasticsearch",
497
+ "uid": "wazuh_datasource_uid"
498
+ },
499
+ "fieldConfig": {
500
+ "defaults": {
501
+ "color": {
502
+ "mode": "thresholds"
503
+ },
504
+ "decimals": 0,
505
+ "mappings": [],
506
+ "thresholds": {
507
+ "mode": "absolute",
508
+ "steps": [
509
+ {
510
+ "color": "green",
511
+ "value": null
512
+ }
513
+ ]
514
+ },
515
+ "unit": "short"
516
+ },
517
+ "overrides": [
518
+ {
519
+ "matcher": {
520
+ "id": "byName",
521
+ "options": "1"
522
+ },
523
+ "properties": [
524
+ {
525
+ "id": "color",
526
+ "value": {
527
+ "fixedColor": "#FF9830",
528
+ "mode": "fixed"
529
+ }
530
+ }
531
+ ]
532
+ },
533
+ {
534
+ "matcher": {
535
+ "id": "byName",
536
+ "options": "Alert"
537
+ },
538
+ "properties": [
539
+ {
540
+ "id": "color",
541
+ "value": {
542
+ "fixedColor": "#F2495C",
543
+ "mode": "fixed"
544
+ }
545
+ }
546
+ ]
547
+ },
548
+ {
549
+ "matcher": {
550
+ "id": "byName",
551
+ "options": "Error"
552
+ },
553
+ "properties": [
554
+ {
555
+ "id": "color",
556
+ "value": {
557
+ "fixedColor": "#F2495C",
558
+ "mode": "fixed"
559
+ }
560
+ }
561
+ ]
562
+ },
563
+ {
564
+ "matcher": {
565
+ "id": "byName",
566
+ "options": "Info"
567
+ },
568
+ "properties": [
569
+ {
570
+ "id": "color",
571
+ "value": {
572
+ "fixedColor": "#73BF69",
573
+ "mode": "fixed"
574
+ }
575
+ }
576
+ ]
577
+ },
578
+ {
579
+ "matcher": {
580
+ "id": "byName",
581
+ "options": "NOTICE"
582
+ },
583
+ "properties": [
584
+ {
585
+ "id": "color",
586
+ "value": {
587
+ "fixedColor": "#5794F2",
588
+ "mode": "fixed"
589
+ }
590
+ }
591
+ ]
592
+ },
593
+ {
594
+ "matcher": {
595
+ "id": "byName",
596
+ "options": "Notice"
597
+ },
598
+ "properties": [
599
+ {
600
+ "id": "color",
601
+ "value": {
602
+ "fixedColor": "#5794F2",
603
+ "mode": "fixed"
604
+ }
605
+ }
606
+ ]
607
+ },
608
+ {
609
+ "matcher": {
610
+ "id": "byName",
611
+ "options": "Result"
612
+ },
613
+ "properties": [
614
+ {
615
+ "id": "color",
616
+ "value": {
617
+ "fixedColor": "#B877D9",
618
+ "mode": "fixed"
619
+ }
620
+ }
621
+ ]
622
+ },
623
+ {
624
+ "matcher": {
625
+ "id": "byName",
626
+ "options": "Warning"
627
+ },
628
+ "properties": [
629
+ {
630
+ "id": "color",
631
+ "value": {
632
+ "fixedColor": "#FF9830",
633
+ "mode": "fixed"
634
+ }
635
+ }
636
+ ]
637
+ },
638
+ {
639
+ "matcher": {
640
+ "id": "byName",
641
+ "options": "INFORMATION"
642
+ },
643
+ "properties": [
644
+ {
645
+ "id": "color",
646
+ "value": {
647
+ "fixedColor": "green",
648
+ "mode": "fixed"
649
+ }
650
+ }
651
+ ]
652
+ },
653
+ {
654
+ "matcher": {
655
+ "id": "byName",
656
+ "options": "WARNING"
657
+ },
658
+ "properties": [
659
+ {
660
+ "id": "color",
661
+ "value": {
662
+ "fixedColor": "orange",
663
+ "mode": "fixed"
664
+ }
665
+ }
666
+ ]
667
+ },
668
+ {
669
+ "matcher": {
670
+ "id": "byName",
671
+ "options": "ERROR"
672
+ },
673
+ "properties": [
674
+ {
675
+ "id": "color",
676
+ "value": {
677
+ "fixedColor": "red",
678
+ "mode": "fixed"
679
+ }
680
+ }
681
+ ]
682
+ }
683
+ ]
684
+ },
685
+ "gridPos": {
686
+ "h": 8,
687
+ "w": 5,
688
+ "x": 0,
689
+ "y": 9
690
+ },
691
+ "id": 68,
692
+ "links": [],
693
+ "maxDataPoints": 3,
694
+ "options": {
695
+ "colorMode": "value",
696
+ "graphMode": "area",
697
+ "justifyMode": "auto",
698
+ "orientation": "auto",
699
+ "reduceOptions": {
700
+ "calcs": ["sum"],
701
+ "fields": "",
702
+ "values": false
703
+ },
704
+ "textMode": "auto"
705
+ },
706
+ "pluginVersion": "10.0.2",
707
+ "targets": [
708
+ {
709
+ "bucketAggs": [
710
+ {
711
+ "$$hashKey": "object:74",
712
+ "field": "timestamp",
713
+ "id": "2",
714
+ "settings": {
715
+ "interval": "365d",
716
+ "min_doc_count": 0,
717
+ "trimEdges": 0
718
+ },
719
+ "type": "date_histogram"
720
+ }
721
+ ],
722
+ "datasource": {
723
+ "type": "elasticsearch",
724
+ "uid": "wazuh_datasource_uid"
725
+ },
726
+ "metrics": [
727
+ {
728
+ "field": "data_os",
729
+ "id": "1",
730
+ "type": "cardinality"
731
+ }
732
+ ],
733
+ "query": "rule_groups:wazuh_inventory",
734
+ "refId": "A",
735
+ "timeField": "timestamp"
736
+ }
737
+ ],
738
+ "title": "AGENTS - OPERATING SYSTEM FAMLIES",
739
+ "type": "stat"
740
+ },
741
+ {
742
+ "datasource": {
743
+ "type": "elasticsearch",
744
+ "uid": "wazuh_datasource_uid"
745
+ },
746
+ "fieldConfig": {
747
+ "defaults": {
748
+ "color": {
749
+ "mode": "thresholds"
750
+ },
751
+ "custom": {
752
+ "align": "auto",
753
+ "cellOptions": {
754
+ "type": "auto"
755
+ },
756
+ "inspect": false
757
+ },
758
+ "decimals": 0,
759
+ "mappings": [],
760
+ "thresholds": {
761
+ "mode": "absolute",
762
+ "steps": [
763
+ {
764
+ "color": "green",
765
+ "value": null
766
+ },
767
+ {
768
+ "color": "red",
769
+ "value": 80
770
+ }
771
+ ]
772
+ },
773
+ "unit": "short"
774
+ },
775
+ "overrides": [
776
+ {
777
+ "matcher": {
778
+ "id": "byName",
779
+ "options": "1"
780
+ },
781
+ "properties": [
782
+ {
783
+ "id": "color",
784
+ "value": {
785
+ "fixedColor": "#FF9830",
786
+ "mode": "fixed"
787
+ }
788
+ }
789
+ ]
790
+ },
791
+ {
792
+ "matcher": {
793
+ "id": "byName",
794
+ "options": "Alert"
795
+ },
796
+ "properties": [
797
+ {
798
+ "id": "color",
799
+ "value": {
800
+ "fixedColor": "#F2495C",
801
+ "mode": "fixed"
802
+ }
803
+ }
804
+ ]
805
+ },
806
+ {
807
+ "matcher": {
808
+ "id": "byName",
809
+ "options": "Error"
810
+ },
811
+ "properties": [
812
+ {
813
+ "id": "color",
814
+ "value": {
815
+ "fixedColor": "#F2495C",
816
+ "mode": "fixed"
817
+ }
818
+ }
819
+ ]
820
+ },
821
+ {
822
+ "matcher": {
823
+ "id": "byName",
824
+ "options": "Info"
825
+ },
826
+ "properties": [
827
+ {
828
+ "id": "color",
829
+ "value": {
830
+ "fixedColor": "#73BF69",
831
+ "mode": "fixed"
832
+ }
833
+ }
834
+ ]
835
+ },
836
+ {
837
+ "matcher": {
838
+ "id": "byName",
839
+ "options": "NOTICE"
840
+ },
841
+ "properties": [
842
+ {
843
+ "id": "color",
844
+ "value": {
845
+ "fixedColor": "#5794F2",
846
+ "mode": "fixed"
847
+ }
848
+ }
849
+ ]
850
+ },
851
+ {
852
+ "matcher": {
853
+ "id": "byName",
854
+ "options": "Notice"
855
+ },
856
+ "properties": [
857
+ {
858
+ "id": "color",
859
+ "value": {
860
+ "fixedColor": "#5794F2",
861
+ "mode": "fixed"
862
+ }
863
+ }
864
+ ]
865
+ },
866
+ {
867
+ "matcher": {
868
+ "id": "byName",
869
+ "options": "Result"
870
+ },
871
+ "properties": [
872
+ {
873
+ "id": "color",
874
+ "value": {
875
+ "fixedColor": "#B877D9",
876
+ "mode": "fixed"
877
+ }
878
+ }
879
+ ]
880
+ },
881
+ {
882
+ "matcher": {
883
+ "id": "byName",
884
+ "options": "Warning"
885
+ },
886
+ "properties": [
887
+ {
888
+ "id": "color",
889
+ "value": {
890
+ "fixedColor": "#FF9830",
891
+ "mode": "fixed"
892
+ }
893
+ }
894
+ ]
895
+ },
896
+ {
897
+ "matcher": {
898
+ "id": "byName",
899
+ "options": "INFORMATION"
900
+ },
901
+ "properties": [
902
+ {
903
+ "id": "color",
904
+ "value": {
905
+ "fixedColor": "green",
906
+ "mode": "fixed"
907
+ }
908
+ }
909
+ ]
910
+ },
911
+ {
912
+ "matcher": {
913
+ "id": "byName",
914
+ "options": "WARNING"
915
+ },
916
+ "properties": [
917
+ {
918
+ "id": "color",
919
+ "value": {
920
+ "fixedColor": "orange",
921
+ "mode": "fixed"
922
+ }
923
+ }
924
+ ]
925
+ },
926
+ {
927
+ "matcher": {
928
+ "id": "byName",
929
+ "options": "ERROR"
930
+ },
931
+ "properties": [
932
+ {
933
+ "id": "color",
934
+ "value": {
935
+ "fixedColor": "red",
936
+ "mode": "fixed"
937
+ }
938
+ }
939
+ ]
940
+ }
941
+ ]
942
+ },
943
+ "gridPos": {
944
+ "h": 8,
945
+ "w": 6,
946
+ "x": 5,
947
+ "y": 9
948
+ },
949
+ "id": 118,
950
+ "links": [],
951
+ "maxDataPoints": 3,
952
+ "options": {
953
+ "cellHeight": "sm",
954
+ "footer": {
955
+ "countRows": false,
956
+ "fields": "",
957
+ "reducer": ["sum"],
958
+ "show": false
959
+ },
960
+ "showHeader": true
961
+ },
962
+ "pluginVersion": "10.0.2",
963
+ "targets": [
964
+ {
965
+ "bucketAggs": [
966
+ {
967
+ "$$hashKey": "object:73",
968
+ "fake": true,
969
+ "field": "data_os",
970
+ "id": "3",
971
+ "settings": {
972
+ "min_doc_count": 1,
973
+ "order": "desc",
974
+ "orderBy": "_count",
975
+ "size": "0"
976
+ },
977
+ "type": "terms"
978
+ }
979
+ ],
980
+ "datasource": {
981
+ "type": "elasticsearch",
982
+ "uid": "wazuh_datasource_uid"
983
+ },
984
+ "metrics": [
985
+ {
986
+ "$$hashKey": "object:71",
987
+ "field": "select field",
988
+ "id": "1",
989
+ "type": "count"
990
+ }
991
+ ],
992
+ "query": "rule_groups:wazuh_inventory",
993
+ "refId": "A",
994
+ "timeField": "timestamp"
995
+ }
996
+ ],
997
+ "title": "OPERATING SYSTEMS - FAMILY",
998
+ "transformations": [
999
+ {
1000
+ "id": "organize",
1001
+ "options": {
1002
+ "excludeByName": {
1003
+ "Count": true
1004
+ },
1005
+ "indexByName": {},
1006
+ "renameByName": {
1007
+ "data_os": "OS FAMILY"
1008
+ }
1009
+ }
1010
+ }
1011
+ ],
1012
+ "type": "table"
1013
+ },
1014
+ {
1015
+ "datasource": {
1016
+ "type": "elasticsearch",
1017
+ "uid": "wazuh_datasource_uid"
1018
+ },
1019
+ "fieldConfig": {
1020
+ "defaults": {
1021
+ "color": {
1022
+ "mode": "thresholds"
1023
+ },
1024
+ "custom": {
1025
+ "align": "auto",
1026
+ "cellOptions": {
1027
+ "type": "auto"
1028
+ },
1029
+ "inspect": false
1030
+ },
1031
+ "decimals": 0,
1032
+ "mappings": [],
1033
+ "thresholds": {
1034
+ "mode": "absolute",
1035
+ "steps": [
1036
+ {
1037
+ "color": "green",
1038
+ "value": null
1039
+ },
1040
+ {
1041
+ "color": "red",
1042
+ "value": 80
1043
+ }
1044
+ ]
1045
+ },
1046
+ "unit": "short"
1047
+ },
1048
+ "overrides": [
1049
+ {
1050
+ "matcher": {
1051
+ "id": "byName",
1052
+ "options": "1"
1053
+ },
1054
+ "properties": [
1055
+ {
1056
+ "id": "color",
1057
+ "value": {
1058
+ "fixedColor": "#FF9830",
1059
+ "mode": "fixed"
1060
+ }
1061
+ }
1062
+ ]
1063
+ },
1064
+ {
1065
+ "matcher": {
1066
+ "id": "byName",
1067
+ "options": "Alert"
1068
+ },
1069
+ "properties": [
1070
+ {
1071
+ "id": "color",
1072
+ "value": {
1073
+ "fixedColor": "#F2495C",
1074
+ "mode": "fixed"
1075
+ }
1076
+ }
1077
+ ]
1078
+ },
1079
+ {
1080
+ "matcher": {
1081
+ "id": "byName",
1082
+ "options": "Error"
1083
+ },
1084
+ "properties": [
1085
+ {
1086
+ "id": "color",
1087
+ "value": {
1088
+ "fixedColor": "#F2495C",
1089
+ "mode": "fixed"
1090
+ }
1091
+ }
1092
+ ]
1093
+ },
1094
+ {
1095
+ "matcher": {
1096
+ "id": "byName",
1097
+ "options": "Info"
1098
+ },
1099
+ "properties": [
1100
+ {
1101
+ "id": "color",
1102
+ "value": {
1103
+ "fixedColor": "#73BF69",
1104
+ "mode": "fixed"
1105
+ }
1106
+ }
1107
+ ]
1108
+ },
1109
+ {
1110
+ "matcher": {
1111
+ "id": "byName",
1112
+ "options": "NOTICE"
1113
+ },
1114
+ "properties": [
1115
+ {
1116
+ "id": "color",
1117
+ "value": {
1118
+ "fixedColor": "#5794F2",
1119
+ "mode": "fixed"
1120
+ }
1121
+ }
1122
+ ]
1123
+ },
1124
+ {
1125
+ "matcher": {
1126
+ "id": "byName",
1127
+ "options": "Notice"
1128
+ },
1129
+ "properties": [
1130
+ {
1131
+ "id": "color",
1132
+ "value": {
1133
+ "fixedColor": "#5794F2",
1134
+ "mode": "fixed"
1135
+ }
1136
+ }
1137
+ ]
1138
+ },
1139
+ {
1140
+ "matcher": {
1141
+ "id": "byName",
1142
+ "options": "Result"
1143
+ },
1144
+ "properties": [
1145
+ {
1146
+ "id": "color",
1147
+ "value": {
1148
+ "fixedColor": "#B877D9",
1149
+ "mode": "fixed"
1150
+ }
1151
+ }
1152
+ ]
1153
+ },
1154
+ {
1155
+ "matcher": {
1156
+ "id": "byName",
1157
+ "options": "Warning"
1158
+ },
1159
+ "properties": [
1160
+ {
1161
+ "id": "color",
1162
+ "value": {
1163
+ "fixedColor": "#FF9830",
1164
+ "mode": "fixed"
1165
+ }
1166
+ }
1167
+ ]
1168
+ },
1169
+ {
1170
+ "matcher": {
1171
+ "id": "byName",
1172
+ "options": "INFORMATION"
1173
+ },
1174
+ "properties": [
1175
+ {
1176
+ "id": "color",
1177
+ "value": {
1178
+ "fixedColor": "green",
1179
+ "mode": "fixed"
1180
+ }
1181
+ }
1182
+ ]
1183
+ },
1184
+ {
1185
+ "matcher": {
1186
+ "id": "byName",
1187
+ "options": "WARNING"
1188
+ },
1189
+ "properties": [
1190
+ {
1191
+ "id": "color",
1192
+ "value": {
1193
+ "fixedColor": "orange",
1194
+ "mode": "fixed"
1195
+ }
1196
+ }
1197
+ ]
1198
+ },
1199
+ {
1200
+ "matcher": {
1201
+ "id": "byName",
1202
+ "options": "ERROR"
1203
+ },
1204
+ "properties": [
1205
+ {
1206
+ "id": "color",
1207
+ "value": {
1208
+ "fixedColor": "red",
1209
+ "mode": "fixed"
1210
+ }
1211
+ }
1212
+ ]
1213
+ }
1214
+ ]
1215
+ },
1216
+ "gridPos": {
1217
+ "h": 8,
1218
+ "w": 6,
1219
+ "x": 11,
1220
+ "y": 9
1221
+ },
1222
+ "id": 124,
1223
+ "links": [],
1224
+ "maxDataPoints": 3,
1225
+ "options": {
1226
+ "cellHeight": "sm",
1227
+ "footer": {
1228
+ "countRows": false,
1229
+ "fields": "",
1230
+ "reducer": ["sum"],
1231
+ "show": false
1232
+ },
1233
+ "showHeader": true
1234
+ },
1235
+ "pluginVersion": "10.0.2",
1236
+ "targets": [
1237
+ {
1238
+ "bucketAggs": [
1239
+ {
1240
+ "$$hashKey": "object:73",
1241
+ "fake": true,
1242
+ "field": "data_os_name",
1243
+ "id": "3",
1244
+ "settings": {
1245
+ "min_doc_count": 1,
1246
+ "order": "desc",
1247
+ "orderBy": "_count",
1248
+ "size": "0"
1249
+ },
1250
+ "type": "terms"
1251
+ }
1252
+ ],
1253
+ "datasource": {
1254
+ "type": "elasticsearch",
1255
+ "uid": "wazuh_datasource_uid"
1256
+ },
1257
+ "metrics": [
1258
+ {
1259
+ "$$hashKey": "object:71",
1260
+ "field": "select field",
1261
+ "id": "1",
1262
+ "type": "count"
1263
+ }
1264
+ ],
1265
+ "query": "rule_groups:wazuh_inventory",
1266
+ "refId": "A",
1267
+ "timeField": "timestamp"
1268
+ }
1269
+ ],
1270
+ "title": "OPERATING SYSTEMS",
1271
+ "transformations": [
1272
+ {
1273
+ "id": "organize",
1274
+ "options": {
1275
+ "excludeByName": {
1276
+ "Count": true
1277
+ },
1278
+ "indexByName": {},
1279
+ "renameByName": {
1280
+ "data_os": "OS FAMILY",
1281
+ "data_os_name": "OS NAME"
1282
+ }
1283
+ }
1284
+ }
1285
+ ],
1286
+ "type": "table"
1287
+ },
1288
+ {
1289
+ "datasource": {
1290
+ "type": "elasticsearch",
1291
+ "uid": "wazuh_datasource_uid"
1292
+ },
1293
+ "fieldConfig": {
1294
+ "defaults": {
1295
+ "color": {
1296
+ "mode": "thresholds"
1297
+ },
1298
+ "custom": {
1299
+ "align": "auto",
1300
+ "cellOptions": {
1301
+ "type": "auto"
1302
+ },
1303
+ "inspect": false
1304
+ },
1305
+ "decimals": 0,
1306
+ "mappings": [],
1307
+ "thresholds": {
1308
+ "mode": "absolute",
1309
+ "steps": [
1310
+ {
1311
+ "color": "green",
1312
+ "value": null
1313
+ },
1314
+ {
1315
+ "color": "red",
1316
+ "value": 80
1317
+ }
1318
+ ]
1319
+ },
1320
+ "unit": "short"
1321
+ },
1322
+ "overrides": [
1323
+ {
1324
+ "matcher": {
1325
+ "id": "byName",
1326
+ "options": "1"
1327
+ },
1328
+ "properties": [
1329
+ {
1330
+ "id": "color",
1331
+ "value": {
1332
+ "fixedColor": "#FF9830",
1333
+ "mode": "fixed"
1334
+ }
1335
+ }
1336
+ ]
1337
+ },
1338
+ {
1339
+ "matcher": {
1340
+ "id": "byName",
1341
+ "options": "Alert"
1342
+ },
1343
+ "properties": [
1344
+ {
1345
+ "id": "color",
1346
+ "value": {
1347
+ "fixedColor": "#F2495C",
1348
+ "mode": "fixed"
1349
+ }
1350
+ }
1351
+ ]
1352
+ },
1353
+ {
1354
+ "matcher": {
1355
+ "id": "byName",
1356
+ "options": "Error"
1357
+ },
1358
+ "properties": [
1359
+ {
1360
+ "id": "color",
1361
+ "value": {
1362
+ "fixedColor": "#F2495C",
1363
+ "mode": "fixed"
1364
+ }
1365
+ }
1366
+ ]
1367
+ },
1368
+ {
1369
+ "matcher": {
1370
+ "id": "byName",
1371
+ "options": "Info"
1372
+ },
1373
+ "properties": [
1374
+ {
1375
+ "id": "color",
1376
+ "value": {
1377
+ "fixedColor": "#73BF69",
1378
+ "mode": "fixed"
1379
+ }
1380
+ }
1381
+ ]
1382
+ },
1383
+ {
1384
+ "matcher": {
1385
+ "id": "byName",
1386
+ "options": "NOTICE"
1387
+ },
1388
+ "properties": [
1389
+ {
1390
+ "id": "color",
1391
+ "value": {
1392
+ "fixedColor": "#5794F2",
1393
+ "mode": "fixed"
1394
+ }
1395
+ }
1396
+ ]
1397
+ },
1398
+ {
1399
+ "matcher": {
1400
+ "id": "byName",
1401
+ "options": "Notice"
1402
+ },
1403
+ "properties": [
1404
+ {
1405
+ "id": "color",
1406
+ "value": {
1407
+ "fixedColor": "#5794F2",
1408
+ "mode": "fixed"
1409
+ }
1410
+ }
1411
+ ]
1412
+ },
1413
+ {
1414
+ "matcher": {
1415
+ "id": "byName",
1416
+ "options": "Result"
1417
+ },
1418
+ "properties": [
1419
+ {
1420
+ "id": "color",
1421
+ "value": {
1422
+ "fixedColor": "#B877D9",
1423
+ "mode": "fixed"
1424
+ }
1425
+ }
1426
+ ]
1427
+ },
1428
+ {
1429
+ "matcher": {
1430
+ "id": "byName",
1431
+ "options": "Warning"
1432
+ },
1433
+ "properties": [
1434
+ {
1435
+ "id": "color",
1436
+ "value": {
1437
+ "fixedColor": "#FF9830",
1438
+ "mode": "fixed"
1439
+ }
1440
+ }
1441
+ ]
1442
+ },
1443
+ {
1444
+ "matcher": {
1445
+ "id": "byName",
1446
+ "options": "INFORMATION"
1447
+ },
1448
+ "properties": [
1449
+ {
1450
+ "id": "color",
1451
+ "value": {
1452
+ "fixedColor": "green",
1453
+ "mode": "fixed"
1454
+ }
1455
+ }
1456
+ ]
1457
+ },
1458
+ {
1459
+ "matcher": {
1460
+ "id": "byName",
1461
+ "options": "WARNING"
1462
+ },
1463
+ "properties": [
1464
+ {
1465
+ "id": "color",
1466
+ "value": {
1467
+ "fixedColor": "orange",
1468
+ "mode": "fixed"
1469
+ }
1470
+ }
1471
+ ]
1472
+ },
1473
+ {
1474
+ "matcher": {
1475
+ "id": "byName",
1476
+ "options": "ERROR"
1477
+ },
1478
+ "properties": [
1479
+ {
1480
+ "id": "color",
1481
+ "value": {
1482
+ "fixedColor": "red",
1483
+ "mode": "fixed"
1484
+ }
1485
+ }
1486
+ ]
1487
+ }
1488
+ ]
1489
+ },
1490
+ "gridPos": {
1491
+ "h": 8,
1492
+ "w": 7,
1493
+ "x": 17,
1494
+ "y": 9
1495
+ },
1496
+ "id": 123,
1497
+ "links": [],
1498
+ "maxDataPoints": 3,
1499
+ "options": {
1500
+ "cellHeight": "sm",
1501
+ "footer": {
1502
+ "countRows": false,
1503
+ "fields": "",
1504
+ "reducer": ["sum"],
1505
+ "show": false
1506
+ },
1507
+ "showHeader": true
1508
+ },
1509
+ "pluginVersion": "10.0.2",
1510
+ "targets": [
1511
+ {
1512
+ "bucketAggs": [
1513
+ {
1514
+ "$$hashKey": "object:73",
1515
+ "fake": true,
1516
+ "field": "data_wazuh_version",
1517
+ "id": "3",
1518
+ "settings": {
1519
+ "min_doc_count": 1,
1520
+ "order": "desc",
1521
+ "orderBy": "_count",
1522
+ "size": "0"
1523
+ },
1524
+ "type": "terms"
1525
+ }
1526
+ ],
1527
+ "datasource": {
1528
+ "type": "elasticsearch",
1529
+ "uid": "wazuh_datasource_uid"
1530
+ },
1531
+ "metrics": [
1532
+ {
1533
+ "$$hashKey": "object:71",
1534
+ "field": "select field",
1535
+ "id": "1",
1536
+ "type": "count"
1537
+ }
1538
+ ],
1539
+ "query": "rule_groups:wazuh_inventory",
1540
+ "refId": "A",
1541
+ "timeField": "timestamp"
1542
+ }
1543
+ ],
1544
+ "title": "AGENT VERSIONS",
1545
+ "transformations": [
1546
+ {
1547
+ "id": "organize",
1548
+ "options": {
1549
+ "excludeByName": {
1550
+ "Count": true
1551
+ },
1552
+ "indexByName": {},
1553
+ "renameByName": {
1554
+ "data_os": "OPERATING SYSTEM",
1555
+ "data_wazuh_version": "AGENT VERSION"
1556
+ }
1557
+ }
1558
+ }
1559
+ ],
1560
+ "type": "table"
1561
+ },
1562
+ {
1563
+ "datasource": {
1564
+ "type": "elasticsearch",
1565
+ "uid": "wazuh_datasource_uid"
1566
+ },
1567
+ "fieldConfig": {
1568
+ "defaults": {
1569
+ "color": {
1570
+ "mode": "thresholds"
1571
+ },
1572
+ "custom": {
1573
+ "align": "auto",
1574
+ "cellOptions": {
1575
+ "type": "auto"
1576
+ },
1577
+ "filterable": true,
1578
+ "inspect": false
1579
+ },
1580
+ "mappings": [],
1581
+ "thresholds": {
1582
+ "mode": "absolute",
1583
+ "steps": [
1584
+ {
1585
+ "color": "green",
1586
+ "value": null
1587
+ },
1588
+ {
1589
+ "color": "red",
1590
+ "value": 80
1591
+ }
1592
+ ]
1593
+ }
1594
+ },
1595
+ "overrides": [
1596
+ {
1597
+ "matcher": {
1598
+ "id": "byName",
1599
+ "options": "AGENT"
1600
+ },
1601
+ "properties": [
1602
+ {
1603
+ "id": "custom.width",
1604
+ "value": 216
1605
+ }
1606
+ ]
1607
+ },
1608
+ {
1609
+ "matcher": {
1610
+ "id": "byName",
1611
+ "options": "SRC IP"
1612
+ },
1613
+ "properties": [
1614
+ {
1615
+ "id": "custom.width",
1616
+ "value": 167
1617
+ }
1618
+ ]
1619
+ },
1620
+ {
1621
+ "matcher": {
1622
+ "id": "byName",
1623
+ "options": "MESSAGE"
1624
+ },
1625
+ "properties": [
1626
+ {
1627
+ "id": "custom.width",
1628
+ "value": 1519
1629
+ }
1630
+ ]
1631
+ },
1632
+ {
1633
+ "matcher": {
1634
+ "id": "byName",
1635
+ "options": "rule_description"
1636
+ },
1637
+ "properties": [
1638
+ {
1639
+ "id": "custom.width",
1640
+ "value": 524
1641
+ }
1642
+ ]
1643
+ },
1644
+ {
1645
+ "matcher": {
1646
+ "id": "byName",
1647
+ "options": "OS TYPE"
1648
+ },
1649
+ "properties": [
1650
+ {
1651
+ "id": "custom.width",
1652
+ "value": 431
1653
+ }
1654
+ ]
1655
+ },
1656
+ {
1657
+ "matcher": {
1658
+ "id": "byName",
1659
+ "options": "AGENT IP"
1660
+ },
1661
+ "properties": [
1662
+ {
1663
+ "id": "custom.width",
1664
+ "value": 181
1665
+ }
1666
+ ]
1667
+ },
1668
+ {
1669
+ "matcher": {
1670
+ "id": "byName",
1671
+ "options": "STATUS"
1672
+ },
1673
+ "properties": [
1674
+ {
1675
+ "id": "custom.width",
1676
+ "value": 145
1677
+ }
1678
+ ]
1679
+ },
1680
+ {
1681
+ "matcher": {
1682
+ "id": "byName",
1683
+ "options": "OS PLATFORM"
1684
+ },
1685
+ "properties": [
1686
+ {
1687
+ "id": "custom.width",
1688
+ "value": 161
1689
+ }
1690
+ ]
1691
+ },
1692
+ {
1693
+ "matcher": {
1694
+ "id": "byName",
1695
+ "options": "OS NAME"
1696
+ },
1697
+ "properties": [
1698
+ {
1699
+ "id": "custom.width",
1700
+ "value": 397
1701
+ }
1702
+ ]
1703
+ },
1704
+ {
1705
+ "matcher": {
1706
+ "id": "byName",
1707
+ "options": "OS MAJOR"
1708
+ },
1709
+ "properties": [
1710
+ {
1711
+ "id": "custom.width",
1712
+ "value": 143
1713
+ }
1714
+ ]
1715
+ },
1716
+ {
1717
+ "matcher": {
1718
+ "id": "byName",
1719
+ "options": "OS VERSION"
1720
+ },
1721
+ "properties": [
1722
+ {
1723
+ "id": "custom.width",
1724
+ "value": 205
1725
+ }
1726
+ ]
1727
+ },
1728
+ {
1729
+ "matcher": {
1730
+ "id": "byName",
1731
+ "options": "OS ARCH"
1732
+ },
1733
+ "properties": [
1734
+ {
1735
+ "id": "custom.width",
1736
+ "value": 135
1737
+ }
1738
+ ]
1739
+ },
1740
+ {
1741
+ "matcher": {
1742
+ "id": "byName",
1743
+ "options": "AGENT VERSION"
1744
+ },
1745
+ "properties": [
1746
+ {
1747
+ "id": "custom.width",
1748
+ "value": 180
1749
+ }
1750
+ ]
1751
+ },
1752
+ {
1753
+ "matcher": {
1754
+ "id": "byName",
1755
+ "options": "LAST KEEP ALIVE"
1756
+ },
1757
+ "properties": [
1758
+ {
1759
+ "id": "custom.width",
1760
+ "value": 291
1761
+ }
1762
+ ]
1763
+ }
1764
+ ]
1765
+ },
1766
+ "gridPos": {
1767
+ "h": 10,
1768
+ "w": 24,
1769
+ "x": 0,
1770
+ "y": 17
1771
+ },
1772
+ "id": 85,
1773
+ "options": {
1774
+ "cellHeight": "sm",
1775
+ "footer": {
1776
+ "countRows": false,
1777
+ "enablePagination": true,
1778
+ "fields": "",
1779
+ "reducer": ["sum"],
1780
+ "show": false
1781
+ },
1782
+ "showHeader": true,
1783
+ "sortBy": []
1784
+ },
1785
+ "pluginVersion": "10.0.2",
1786
+ "targets": [
1787
+ {
1788
+ "alias": "",
1789
+ "bucketAggs": [],
1790
+ "datasource": {
1791
+ "type": "elasticsearch",
1792
+ "uid": "wazuh_datasource_uid"
1793
+ },
1794
+ "metrics": [
1795
+ {
1796
+ "id": "1",
1797
+ "settings": {
1798
+ "size": "5000"
1799
+ },
1800
+ "type": "raw_data"
1801
+ }
1802
+ ],
1803
+ "query": "rule_groups:wazuh_inventory",
1804
+ "queryType": "lucene",
1805
+ "refId": "A",
1806
+ "timeField": "timestamp"
1807
+ }
1808
+ ],
1809
+ "title": "SIEM AGENTS",
1810
+ "transformations": [
1811
+ {
1812
+ "id": "organize",
1813
+ "options": {
1814
+ "excludeByName": {
1815
+ "@metadata_beat": true,
1816
+ "@metadata_type": true,
1817
+ "@metadata_version": true,
1818
+ "_id": true,
1819
+ "_index": true,
1820
+ "_type": true,
1821
+ "agent_ephemeral_id": true,
1822
+ "agent_hostname": true,
1823
+ "agent_id": true,
1824
+ "agent_ip": true,
1825
+ "agent_ip_city_name": true,
1826
+ "agent_ip_country_code": true,
1827
+ "agent_ip_geolocation": true,
1828
+ "agent_ip_reserved_ip": true,
1829
+ "agent_labels_customer": true,
1830
+ "agent_name": true,
1831
+ "agent_type": true,
1832
+ "agent_version": true,
1833
+ "beats_type": true,
1834
+ "cluster_name": true,
1835
+ "cluster_node": true,
1836
+ "collector_node_id": true,
1837
+ "data_host_name": false,
1838
+ "data_inventory_module": true,
1839
+ "data_ip_city_name": true,
1840
+ "data_ip_country_code": true,
1841
+ "data_ip_geolocation": true,
1842
+ "data_ip_reserved_ip": true,
1843
+ "data_os_architecture": true,
1844
+ "data_os_boot_time": true,
1845
+ "data_os_install_date": true,
1846
+ "data_os_lang": true,
1847
+ "data_os_locale": true,
1848
+ "data_os_sku": true,
1849
+ "data_os_sn": true,
1850
+ "data_os_system_memory": true,
1851
+ "data_os_system_name": true,
1852
+ "data_win_eventdata_domain": true,
1853
+ "data_win_eventdata_imagePath": true,
1854
+ "data_win_eventdata_sID": true,
1855
+ "data_win_eventdata_serviceName": true,
1856
+ "data_win_eventdata_serviceType": true,
1857
+ "data_win_eventdata_startType": true,
1858
+ "data_win_eventdata_timestamp": true,
1859
+ "data_win_eventdata_user": true,
1860
+ "data_win_system_channel": true,
1861
+ "data_win_system_computer": true,
1862
+ "data_win_system_eventID": true,
1863
+ "data_win_system_eventRecordID": true,
1864
+ "data_win_system_eventSourceName": true,
1865
+ "data_win_system_keywords": true,
1866
+ "data_win_system_level": true,
1867
+ "data_win_system_opcode": true,
1868
+ "data_win_system_processID": true,
1869
+ "data_win_system_providerGuid": true,
1870
+ "data_win_system_providerName": true,
1871
+ "data_win_system_severityValue": true,
1872
+ "data_win_system_systemTime": true,
1873
+ "data_win_system_task": true,
1874
+ "data_win_system_threadID": true,
1875
+ "data_win_system_version": true,
1876
+ "date": true,
1877
+ "decoder_name": true,
1878
+ "ecs_version": true,
1879
+ "gl2_accounted_message_size": true,
1880
+ "gl2_message_id": true,
1881
+ "gl2_processing_error": true,
1882
+ "gl2_remote_ip": true,
1883
+ "gl2_remote_port": true,
1884
+ "gl2_source_collector": true,
1885
+ "gl2_source_input": true,
1886
+ "gl2_source_node": true,
1887
+ "highlight": true,
1888
+ "host_name": true,
1889
+ "id": true,
1890
+ "location": true,
1891
+ "log_file_path": true,
1892
+ "log_offset": true,
1893
+ "manager_name": true,
1894
+ "message": true,
1895
+ "previous_output": true,
1896
+ "rule_description": true,
1897
+ "rule_firedtimes": true,
1898
+ "rule_frequency": true,
1899
+ "rule_gdpr": true,
1900
+ "rule_gpg13": true,
1901
+ "rule_group1": true,
1902
+ "rule_group2": true,
1903
+ "rule_groups": true,
1904
+ "rule_hipaa": true,
1905
+ "rule_id": true,
1906
+ "rule_level": true,
1907
+ "rule_mail": true,
1908
+ "rule_mitre_id": true,
1909
+ "rule_mitre_tactic": true,
1910
+ "rule_mitre_technique": true,
1911
+ "rule_nist_800_53": true,
1912
+ "rule_pci_dss": true,
1913
+ "rule_tsc": true,
1914
+ "sort": true,
1915
+ "source": true,
1916
+ "source_reserved_ip": true,
1917
+ "src_ip": true,
1918
+ "src_ip_city_name": true,
1919
+ "src_ip_country_code": true,
1920
+ "src_ip_geolocation": true,
1921
+ "streams": true,
1922
+ "syslog_level": true,
1923
+ "syslog_tag": true,
1924
+ "syslog_type": true,
1925
+ "timestamp": true,
1926
+ "timestamp_utc": true,
1927
+ "true": true,
1928
+ "user_name": true,
1929
+ "win_system_eventID": true,
1930
+ "windows_event_id": true,
1931
+ "windows_event_severity": false
1932
+ },
1933
+ "indexByName": {
1934
+ "_id": 10,
1935
+ "_index": 11,
1936
+ "_type": 12,
1937
+ "agent_id": 13,
1938
+ "agent_name": 38,
1939
+ "data_dateAdd": 42,
1940
+ "data_host_name": 0,
1941
+ "data_ip": 1,
1942
+ "data_ip_city_name": 43,
1943
+ "data_ip_country_code": 44,
1944
+ "data_ip_geolocation": 45,
1945
+ "data_last_keep_alive": 9,
1946
+ "data_os": 3,
1947
+ "data_os_arch": 7,
1948
+ "data_os_major": 5,
1949
+ "data_os_name": 4,
1950
+ "data_os_version": 6,
1951
+ "data_status": 2,
1952
+ "data_wazuh_version": 8,
1953
+ "decoder_name": 14,
1954
+ "gl2_accounted_message_size": 15,
1955
+ "gl2_message_id": 16,
1956
+ "gl2_processing_error": 37,
1957
+ "gl2_remote_ip": 17,
1958
+ "gl2_remote_port": 18,
1959
+ "gl2_source_input": 19,
1960
+ "gl2_source_node": 20,
1961
+ "highlight": 21,
1962
+ "id": 22,
1963
+ "location": 23,
1964
+ "manager_name": 24,
1965
+ "message": 25,
1966
+ "rule_description": 26,
1967
+ "rule_firedtimes": 27,
1968
+ "rule_group1": 39,
1969
+ "rule_groups": 28,
1970
+ "rule_id": 29,
1971
+ "rule_level": 30,
1972
+ "rule_mail": 31,
1973
+ "sort": 32,
1974
+ "source": 33,
1975
+ "streams": 34,
1976
+ "syslog_level": 40,
1977
+ "syslog_type": 35,
1978
+ "timestamp": 36,
1979
+ "true": 41
1980
+ },
1981
+ "renameByName": {
1982
+ "_id": "",
1983
+ "agent_ip": "SRC IP",
1984
+ "data_dateAdd": "DATE ADDED",
1985
+ "data_host_name": "AGENT",
1986
+ "data_ip": "AGENT IP",
1987
+ "data_last_keep_alive": "LAST KEEP ALIVE",
1988
+ "data_os": "OS PLATFORM",
1989
+ "data_os_arch": "OS ARCH",
1990
+ "data_os_build_number": "BUILD",
1991
+ "data_os_major": "OS MAJOR",
1992
+ "data_os_name": "OS NAME",
1993
+ "data_os_product_type": "OS WINDOWS TYPE",
1994
+ "data_os_type": "OS TYPE",
1995
+ "data_os_version": "OS VERSION",
1996
+ "data_status": "STATUS",
1997
+ "data_wazuh_version": "AGENT VERSION",
1998
+ "data_win_system_message": "MESSAGE",
1999
+ "data_win_system_providerGuid": "",
2000
+ "rule_level": "RULE LEVEL",
2001
+ "timestamp": "DATE/TIME",
2002
+ "windows_event_severity": "EVENT LOG SEVERITY"
2003
+ }
2004
+ }
2005
+ }
2006
+ ],
2007
+ "transparent": true,
2008
+ "type": "table"
2009
+ }
2010
+ ],
2011
+ "refresh": "",
2012
+ "schemaVersion": 38,
2013
+ "style": "dark",
2014
+ "tags": ["EDR"],
2015
+ "templating": {
2016
+ "list": [
2017
+ {
2018
+ "datasource": {
2019
+ "type": "elasticsearch",
2020
+ "uid": "wazuh_datasource_uid"
2021
+ },
2022
+ "filters": [],
2023
+ "hide": 0,
2024
+ "label": "",
2025
+ "name": "Filters",
2026
+ "skipUrlSync": false,
2027
+ "type": "adhoc"
2028
+ }
2029
+ ]
2030
+ },
2031
+ "time": {
2032
+ "from": "now-24h",
2033
+ "to": "now"
2034
+ },
2035
+ "timepicker": {
2036
+ "refresh_intervals": ["10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2037
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2038
+ },
2039
+ "timezone": "",
2040
+ "title": "EDR - SIEM AGENT INVENTORY",
2041
+ "weekStart": ""
2042
+}
backend/app/connectors/grafana/dashboards/Wazuh/edr_windows_event_logs.json
new
+7151
@@ -0,0 +1,7151 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "iteration": 1658194464346,
29
+ "links": [
30
+ {
31
+ "asDropdown": true,
32
+ "icon": "external link",
33
+ "includeVars": true,
34
+ "keepTime": true,
35
+ "tags": ["EDR"],
36
+ "targetBlank": true,
37
+ "title": "",
38
+ "type": "dashboards"
39
+ }
40
+ ],
41
+ "liveNow": false,
42
+ "panels": [
43
+ {
44
+ "collapsed": true,
45
+ "datasource": {
46
+ "type": "elasticsearch",
47
+ "uid": "wazuh_datasource_uid"
48
+ },
49
+ "gridPos": {
50
+ "h": 1,
51
+ "w": 24,
52
+ "x": 0,
53
+ "y": 0
54
+ },
55
+ "id": 72,
56
+ "panels": [
57
+ {
58
+ "datasource": {
59
+ "type": "elasticsearch",
60
+ "uid": "wazuh_datasource_uid"
61
+ },
62
+ "fieldConfig": {
63
+ "defaults": {
64
+ "mappings": [
65
+ {
66
+ "options": {
67
+ "match": "null",
68
+ "result": {
69
+ "text": "N/A"
70
+ }
71
+ },
72
+ "type": "special"
73
+ }
74
+ ],
75
+ "thresholds": {
76
+ "mode": "absolute",
77
+ "steps": [
78
+ {
79
+ "color": "blue"
80
+ }
81
+ ]
82
+ },
83
+ "unit": "short"
84
+ },
85
+ "overrides": []
86
+ },
87
+ "gridPos": {
88
+ "h": 7,
89
+ "w": 4,
90
+ "x": 0,
91
+ "y": 1
92
+ },
93
+ "id": 67,
94
+ "links": [],
95
+ "options": {
96
+ "colorMode": "value",
97
+ "graphMode": "area",
98
+ "justifyMode": "auto",
99
+ "orientation": "horizontal",
100
+ "reduceOptions": {
101
+ "calcs": ["sum"],
102
+ "fields": "",
103
+ "values": false
104
+ },
105
+ "text": {},
106
+ "textMode": "auto"
107
+ },
108
+ "pluginVersion": "9.0.0",
109
+ "targets": [
110
+ {
111
+ "bucketAggs": [
112
+ {
113
+ "$$hashKey": "object:50",
114
+ "field": "timestamp",
115
+ "id": "2",
116
+ "settings": {
117
+ "interval": "auto",
118
+ "min_doc_count": 0,
119
+ "trimEdges": 0
120
+ },
121
+ "type": "date_histogram"
122
+ }
123
+ ],
124
+ "metrics": [
125
+ {
126
+ "$$hashKey": "object:48",
127
+ "field": "select field",
128
+ "id": "1",
129
+ "type": "count"
130
+ }
131
+ ],
132
+ "query": "rule_groups:*windows_system AND agent_name:$agent_name",
133
+ "refId": "A",
134
+ "timeField": "timestamp"
135
+ }
136
+ ],
137
+ "title": "WINDOWS SYSTEM - EVENTS",
138
+ "type": "stat"
139
+ },
140
+ {
141
+ "datasource": {
142
+ "type": "elasticsearch",
143
+ "uid": "wazuh_datasource_uid"
144
+ },
145
+ "fieldConfig": {
146
+ "defaults": {
147
+ "color": {
148
+ "mode": "palette-classic"
149
+ },
150
+ "custom": {
151
+ "hideFrom": {
152
+ "legend": false,
153
+ "tooltip": false,
154
+ "viz": false
155
+ }
156
+ },
157
+ "decimals": 0,
158
+ "mappings": [],
159
+ "unit": "short"
160
+ },
161
+ "overrides": [
162
+ {
163
+ "matcher": {
164
+ "id": "byName",
165
+ "options": "1"
166
+ },
167
+ "properties": [
168
+ {
169
+ "id": "color",
170
+ "value": {
171
+ "fixedColor": "#FF9830",
172
+ "mode": "fixed"
173
+ }
174
+ }
175
+ ]
176
+ },
177
+ {
178
+ "matcher": {
179
+ "id": "byName",
180
+ "options": "Alert"
181
+ },
182
+ "properties": [
183
+ {
184
+ "id": "color",
185
+ "value": {
186
+ "fixedColor": "#F2495C",
187
+ "mode": "fixed"
188
+ }
189
+ }
190
+ ]
191
+ },
192
+ {
193
+ "matcher": {
194
+ "id": "byName",
195
+ "options": "Error"
196
+ },
197
+ "properties": [
198
+ {
199
+ "id": "color",
200
+ "value": {
201
+ "fixedColor": "#F2495C",
202
+ "mode": "fixed"
203
+ }
204
+ }
205
+ ]
206
+ },
207
+ {
208
+ "matcher": {
209
+ "id": "byName",
210
+ "options": "Info"
211
+ },
212
+ "properties": [
213
+ {
214
+ "id": "color",
215
+ "value": {
216
+ "fixedColor": "#73BF69",
217
+ "mode": "fixed"
218
+ }
219
+ }
220
+ ]
221
+ },
222
+ {
223
+ "matcher": {
224
+ "id": "byName",
225
+ "options": "NOTICE"
226
+ },
227
+ "properties": [
228
+ {
229
+ "id": "color",
230
+ "value": {
231
+ "fixedColor": "#5794F2",
232
+ "mode": "fixed"
233
+ }
234
+ }
235
+ ]
236
+ },
237
+ {
238
+ "matcher": {
239
+ "id": "byName",
240
+ "options": "Notice"
241
+ },
242
+ "properties": [
243
+ {
244
+ "id": "color",
245
+ "value": {
246
+ "fixedColor": "#5794F2",
247
+ "mode": "fixed"
248
+ }
249
+ }
250
+ ]
251
+ },
252
+ {
253
+ "matcher": {
254
+ "id": "byName",
255
+ "options": "Result"
256
+ },
257
+ "properties": [
258
+ {
259
+ "id": "color",
260
+ "value": {
261
+ "fixedColor": "#B877D9",
262
+ "mode": "fixed"
263
+ }
264
+ }
265
+ ]
266
+ },
267
+ {
268
+ "matcher": {
269
+ "id": "byName",
270
+ "options": "Warning"
271
+ },
272
+ "properties": [
273
+ {
274
+ "id": "color",
275
+ "value": {
276
+ "fixedColor": "#FF9830",
277
+ "mode": "fixed"
278
+ }
279
+ }
280
+ ]
281
+ },
282
+ {
283
+ "matcher": {
284
+ "id": "byName",
285
+ "options": "INFORMATION"
286
+ },
287
+ "properties": [
288
+ {
289
+ "id": "color",
290
+ "value": {
291
+ "fixedColor": "green",
292
+ "mode": "fixed"
293
+ }
294
+ }
295
+ ]
296
+ },
297
+ {
298
+ "matcher": {
299
+ "id": "byName",
300
+ "options": "WARNING"
301
+ },
302
+ "properties": [
303
+ {
304
+ "id": "color",
305
+ "value": {
306
+ "fixedColor": "orange",
307
+ "mode": "fixed"
308
+ }
309
+ }
310
+ ]
311
+ },
312
+ {
313
+ "matcher": {
314
+ "id": "byName",
315
+ "options": "ERROR"
316
+ },
317
+ "properties": [
318
+ {
319
+ "id": "color",
320
+ "value": {
321
+ "fixedColor": "red",
322
+ "mode": "fixed"
323
+ }
324
+ }
325
+ ]
326
+ }
327
+ ]
328
+ },
329
+ "gridPos": {
330
+ "h": 7,
331
+ "w": 5,
332
+ "x": 4,
333
+ "y": 1
334
+ },
335
+ "id": 68,
336
+ "links": [],
337
+ "maxDataPoints": 3,
338
+ "options": {
339
+ "displayLabels": [],
340
+ "legend": {
341
+ "calcs": [],
342
+ "displayMode": "table",
343
+ "placement": "bottom",
344
+ "values": ["value"]
345
+ },
346
+ "pieType": "donut",
347
+ "reduceOptions": {
348
+ "calcs": ["sum"],
349
+ "fields": "",
350
+ "values": false
351
+ },
352
+ "text": {},
353
+ "tooltip": {
354
+ "mode": "single",
355
+ "sort": "none"
356
+ }
357
+ },
358
+ "targets": [
359
+ {
360
+ "bucketAggs": [
361
+ {
362
+ "$$hashKey": "object:73",
363
+ "fake": true,
364
+ "field": "windows_event_severity",
365
+ "id": "3",
366
+ "settings": {
367
+ "min_doc_count": 1,
368
+ "order": "desc",
369
+ "orderBy": "_count",
370
+ "size": "0"
371
+ },
372
+ "type": "terms"
373
+ },
374
+ {
375
+ "$$hashKey": "object:74",
376
+ "field": "timestamp",
377
+ "id": "2",
378
+ "settings": {
379
+ "interval": "auto",
380
+ "min_doc_count": 0,
381
+ "trimEdges": 0
382
+ },
383
+ "type": "date_histogram"
384
+ }
385
+ ],
386
+ "metrics": [
387
+ {
388
+ "$$hashKey": "object:71",
389
+ "field": "select field",
390
+ "id": "1",
391
+ "type": "count"
392
+ }
393
+ ],
394
+ "query": "rule_groups:*windows_system AND agent_name:$agent_name",
395
+ "refId": "A",
396
+ "timeField": "timestamp"
397
+ }
398
+ ],
399
+ "title": "WINDOWS SYSTEM - SEVERITY LEVELS",
400
+ "type": "piechart"
401
+ },
402
+ {
403
+ "datasource": {
404
+ "type": "elasticsearch",
405
+ "uid": "wazuh_datasource_uid"
406
+ },
407
+ "fieldConfig": {
408
+ "defaults": {
409
+ "custom": {
410
+ "align": "auto",
411
+ "displayMode": "auto",
412
+ "filterable": false,
413
+ "inspect": false
414
+ },
415
+ "mappings": [],
416
+ "thresholds": {
417
+ "mode": "absolute",
418
+ "steps": [
419
+ {
420
+ "color": "orange"
421
+ },
422
+ {
423
+ "color": "red",
424
+ "value": 50
425
+ }
426
+ ]
427
+ }
428
+ },
429
+ "overrides": [
430
+ {
431
+ "matcher": {
432
+ "id": "byName",
433
+ "options": "Count"
434
+ },
435
+ "properties": [
436
+ {
437
+ "id": "custom.displayMode",
438
+ "value": "basic"
439
+ }
440
+ ]
441
+ },
442
+ {
443
+ "matcher": {
444
+ "id": "byName",
445
+ "options": "rule_description"
446
+ },
447
+ "properties": [
448
+ {
449
+ "id": "custom.width",
450
+ "value": 703
451
+ }
452
+ ]
453
+ },
454
+ {
455
+ "matcher": {
456
+ "id": "byName",
457
+ "options": "rule_level"
458
+ },
459
+ "properties": [
460
+ {
461
+ "id": "custom.width",
462
+ "value": 212
463
+ },
464
+ {
465
+ "id": "mappings",
466
+ "value": [
467
+ {
468
+ "options": {
469
+ "from": 1,
470
+ "result": {
471
+ "color": "green",
472
+ "index": 0
473
+ },
474
+ "to": 3
475
+ },
476
+ "type": "range"
477
+ },
478
+ {
479
+ "options": {
480
+ "from": 4,
481
+ "result": {
482
+ "color": "dark-yellow",
483
+ "index": 1
484
+ },
485
+ "to": 6
486
+ },
487
+ "type": "range"
488
+ },
489
+ {
490
+ "options": {
491
+ "from": 7,
492
+ "result": {
493
+ "color": "orange",
494
+ "index": 2
495
+ },
496
+ "to": 9
497
+ },
498
+ "type": "range"
499
+ },
500
+ {
501
+ "options": {
502
+ "from": 10,
503
+ "result": {
504
+ "color": "semi-dark-red",
505
+ "index": 3
506
+ },
507
+ "to": 15
508
+ },
509
+ "type": "range"
510
+ }
511
+ ]
512
+ }
513
+ ]
514
+ }
515
+ ]
516
+ },
517
+ "gridPos": {
518
+ "h": 7,
519
+ "w": 15,
520
+ "x": 9,
521
+ "y": 1
522
+ },
523
+ "id": 69,
524
+ "links": [],
525
+ "maxDataPoints": 3,
526
+ "options": {
527
+ "footer": {
528
+ "fields": "",
529
+ "reducer": ["sum"],
530
+ "show": false
531
+ },
532
+ "showHeader": true,
533
+ "sortBy": []
534
+ },
535
+ "pluginVersion": "9.0.0",
536
+ "targets": [
537
+ {
538
+ "bucketAggs": [
539
+ {
540
+ "$$hashKey": "object:3082",
541
+ "fake": true,
542
+ "field": "rule_description",
543
+ "id": "4",
544
+ "settings": {
545
+ "min_doc_count": 0,
546
+ "order": "desc",
547
+ "orderBy": "_count",
548
+ "size": "10"
549
+ },
550
+ "type": "terms"
551
+ },
552
+ {
553
+ "$$hashKey": "object:73",
554
+ "fake": true,
555
+ "field": "rule_level",
556
+ "id": "3",
557
+ "settings": {
558
+ "min_doc_count": 1,
559
+ "order": "desc",
560
+ "orderBy": "_count",
561
+ "size": "0"
562
+ },
563
+ "type": "terms"
564
+ }
565
+ ],
566
+ "metrics": [
567
+ {
568
+ "$$hashKey": "object:71",
569
+ "field": "select field",
570
+ "id": "1",
571
+ "type": "count"
572
+ }
573
+ ],
574
+ "query": "rule_groups:*windows_system AND agent_name:$agent_name",
575
+ "refId": "A",
576
+ "timeField": "timestamp"
577
+ }
578
+ ],
579
+ "title": "WINDOWS SYSTEM - EVENTS BY TYPE",
580
+ "type": "table"
581
+ },
582
+ {
583
+ "datasource": {
584
+ "type": "elasticsearch",
585
+ "uid": "wazuh_datasource_uid"
586
+ },
587
+ "fieldConfig": {
588
+ "defaults": {
589
+ "custom": {
590
+ "align": "auto",
591
+ "displayMode": "auto",
592
+ "filterable": false,
593
+ "inspect": false
594
+ },
595
+ "mappings": [],
596
+ "thresholds": {
597
+ "mode": "absolute",
598
+ "steps": [
599
+ {
600
+ "color": "green"
601
+ },
602
+ {
603
+ "color": "red",
604
+ "value": 80
605
+ }
606
+ ]
607
+ }
608
+ },
609
+ "overrides": [
610
+ {
611
+ "matcher": {
612
+ "id": "byName",
613
+ "options": "agent_name"
614
+ },
615
+ "properties": [
616
+ {
617
+ "id": "custom.width",
618
+ "value": 492
619
+ }
620
+ ]
621
+ }
622
+ ]
623
+ },
624
+ "gridPos": {
625
+ "h": 7,
626
+ "w": 9,
627
+ "x": 0,
628
+ "y": 8
629
+ },
630
+ "id": 70,
631
+ "links": [],
632
+ "maxDataPoints": 3,
633
+ "options": {
634
+ "footer": {
635
+ "fields": "",
636
+ "reducer": ["sum"],
637
+ "show": false
638
+ },
639
+ "showHeader": true,
640
+ "sortBy": []
641
+ },
642
+ "pluginVersion": "9.0.0",
643
+ "targets": [
644
+ {
645
+ "bucketAggs": [
646
+ {
647
+ "$$hashKey": "object:73",
648
+ "fake": true,
649
+ "field": "agent_name",
650
+ "id": "3",
651
+ "settings": {
652
+ "min_doc_count": 1,
653
+ "order": "desc",
654
+ "orderBy": "_count",
655
+ "size": "0"
656
+ },
657
+ "type": "terms"
658
+ }
659
+ ],
660
+ "metrics": [
661
+ {
662
+ "$$hashKey": "object:71",
663
+ "field": "select field",
664
+ "id": "1",
665
+ "type": "count"
666
+ }
667
+ ],
668
+ "query": "rule_groups:*windows_system AND agent_name:$agent_name",
669
+ "refId": "A",
670
+ "timeField": "timestamp"
671
+ }
672
+ ],
673
+ "title": "WINDOWS SYSTEM - EVENTS BY AGENT",
674
+ "type": "table"
675
+ },
676
+ {
677
+ "aliasColors": {},
678
+ "bars": true,
679
+ "dashLength": 10,
680
+ "dashes": false,
681
+ "datasource": {
682
+ "type": "elasticsearch",
683
+ "uid": "wazuh_datasource_uid"
684
+ },
685
+ "fill": 1,
686
+ "fillGradient": 0,
687
+ "gridPos": {
688
+ "h": 7,
689
+ "w": 15,
690
+ "x": 9,
691
+ "y": 8
692
+ },
693
+ "hiddenSeries": false,
694
+ "id": 83,
695
+ "legend": {
696
+ "alignAsTable": true,
697
+ "avg": false,
698
+ "current": false,
699
+ "max": false,
700
+ "min": false,
701
+ "rightSide": true,
702
+ "show": true,
703
+ "total": false,
704
+ "values": false
705
+ },
706
+ "lines": false,
707
+ "linewidth": 1,
708
+ "links": [],
709
+ "maxDataPoints": 3,
710
+ "nullPointMode": "null",
711
+ "options": {
712
+ "alertThreshold": true
713
+ },
714
+ "percentage": false,
715
+ "pluginVersion": "9.0.0",
716
+ "pointradius": 2,
717
+ "points": false,
718
+ "renderer": "flot",
719
+ "seriesOverrides": [],
720
+ "spaceLength": 10,
721
+ "stack": true,
722
+ "steppedLine": false,
723
+ "targets": [
724
+ {
725
+ "alias": "",
726
+ "bucketAggs": [
727
+ {
728
+ "field": "agent_name",
729
+ "id": "4",
730
+ "settings": {
731
+ "min_doc_count": "1",
732
+ "order": "desc",
733
+ "orderBy": "_count",
734
+ "size": "10"
735
+ },
736
+ "type": "terms"
737
+ },
738
+ {
739
+ "field": "timestamp",
740
+ "id": "5",
741
+ "settings": {
742
+ "interval": "auto",
743
+ "min_doc_count": "0",
744
+ "trimEdges": "0"
745
+ },
746
+ "type": "date_histogram"
747
+ }
748
+ ],
749
+ "metrics": [
750
+ {
751
+ "$$hashKey": "object:71",
752
+ "field": "select field",
753
+ "id": "1",
754
+ "type": "count"
755
+ }
756
+ ],
757
+ "query": "rule_groups:*windows_system AND agent_name:$agent_name",
758
+ "refId": "A",
759
+ "timeField": "timestamp"
760
+ }
761
+ ],
762
+ "thresholds": [],
763
+ "timeRegions": [],
764
+ "title": "WINDOWS SYSTEM - EVENTS BY AGENT (HISTOGRAM)",
765
+ "tooltip": {
766
+ "shared": true,
767
+ "sort": 0,
768
+ "value_type": "individual"
769
+ },
770
+ "type": "graph",
771
+ "xaxis": {
772
+ "mode": "time",
773
+ "show": true,
774
+ "values": []
775
+ },
776
+ "yaxes": [
777
+ {
778
+ "format": "short",
779
+ "logBase": 1,
780
+ "show": true
781
+ },
782
+ {
783
+ "format": "short",
784
+ "logBase": 1,
785
+ "show": true
786
+ }
787
+ ],
788
+ "yaxis": {
789
+ "align": false
790
+ }
791
+ },
792
+ {
793
+ "datasource": {
794
+ "type": "elasticsearch",
795
+ "uid": "wazuh_datasource_uid"
796
+ },
797
+ "fieldConfig": {
798
+ "defaults": {
799
+ "color": {
800
+ "mode": "thresholds"
801
+ },
802
+ "custom": {
803
+ "align": "auto",
804
+ "displayMode": "auto",
805
+ "inspect": false
806
+ },
807
+ "mappings": [],
808
+ "thresholds": {
809
+ "mode": "absolute",
810
+ "steps": [
811
+ {
812
+ "color": "green"
813
+ },
814
+ {
815
+ "color": "red",
816
+ "value": 80
817
+ }
818
+ ]
819
+ }
820
+ },
821
+ "overrides": [
822
+ {
823
+ "matcher": {
824
+ "id": "byName",
825
+ "options": "rule_level"
826
+ },
827
+ "properties": [
828
+ {
829
+ "id": "custom.width",
830
+ "value": 93
831
+ }
832
+ ]
833
+ },
834
+ {
835
+ "matcher": {
836
+ "id": "byName",
837
+ "options": "windows_event_id"
838
+ },
839
+ "properties": [
840
+ {
841
+ "id": "custom.width",
842
+ "value": 186
843
+ }
844
+ ]
845
+ },
846
+ {
847
+ "matcher": {
848
+ "id": "byName",
849
+ "options": "DATE/TIME"
850
+ },
851
+ "properties": [
852
+ {
853
+ "id": "custom.width",
854
+ "value": 202
855
+ }
856
+ ]
857
+ },
858
+ {
859
+ "matcher": {
860
+ "id": "byName",
861
+ "options": "AGENT"
862
+ },
863
+ "properties": [
864
+ {
865
+ "id": "custom.width",
866
+ "value": 171
867
+ }
868
+ ]
869
+ },
870
+ {
871
+ "matcher": {
872
+ "id": "byName",
873
+ "options": "SRC IP"
874
+ },
875
+ "properties": [
876
+ {
877
+ "id": "custom.width",
878
+ "value": 167
879
+ }
880
+ ]
881
+ },
882
+ {
883
+ "matcher": {
884
+ "id": "byName",
885
+ "options": "MESSAGE"
886
+ },
887
+ "properties": [
888
+ {
889
+ "id": "custom.width",
890
+ "value": 1519
891
+ }
892
+ ]
893
+ },
894
+ {
895
+ "matcher": {
896
+ "id": "byName",
897
+ "options": "rule_description"
898
+ },
899
+ "properties": [
900
+ {
901
+ "id": "custom.width",
902
+ "value": 524
903
+ }
904
+ ]
905
+ },
906
+ {
907
+ "matcher": {
908
+ "id": "byName",
909
+ "options": "RULE LEVEL"
910
+ },
911
+ "properties": [
912
+ {
913
+ "id": "custom.width",
914
+ "value": 196
915
+ }
916
+ ]
917
+ },
918
+ {
919
+ "matcher": {
920
+ "id": "byName",
921
+ "options": "EVENT ID"
922
+ },
923
+ "properties": [
924
+ {
925
+ "id": "links",
926
+ "value": [
927
+ {
928
+ "targetBlank": true,
929
+ "title": "VIEW EVENT DETAILS",
930
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
931
+ }
932
+ ]
933
+ }
934
+ ]
935
+ }
936
+ ]
937
+ },
938
+ "gridPos": {
939
+ "h": 10,
940
+ "w": 24,
941
+ "x": 0,
942
+ "y": 15
943
+ },
944
+ "id": 85,
945
+ "options": {
946
+ "footer": {
947
+ "fields": "",
948
+ "reducer": ["sum"],
949
+ "show": false
950
+ },
951
+ "showHeader": true,
952
+ "sortBy": []
953
+ },
954
+ "pluginVersion": "9.0.0",
955
+ "targets": [
956
+ {
957
+ "alias": "",
958
+ "bucketAggs": [],
959
+ "metrics": [
960
+ {
961
+ "id": "1",
962
+ "settings": {
963
+ "size": "500"
964
+ },
965
+ "type": "raw_data"
966
+ }
967
+ ],
968
+ "query": "rule_groups:*windows_system AND agent_name:$agent_name",
969
+ "queryType": "lucene",
970
+ "refId": "A",
971
+ "timeField": "timestamp"
972
+ }
973
+ ],
974
+ "title": "WINDOWS SYSTEM - EVENTS",
975
+ "transformations": [
976
+ {
977
+ "id": "organize",
978
+ "options": {
979
+ "excludeByName": {
980
+ "@metadata_beat": true,
981
+ "@metadata_type": true,
982
+ "@metadata_version": true,
983
+ "_id": false,
984
+ "_index": true,
985
+ "_type": true,
986
+ "agent_ephemeral_id": true,
987
+ "agent_hostname": true,
988
+ "agent_id": true,
989
+ "agent_ip": false,
990
+ "agent_ip_city_name": true,
991
+ "agent_ip_country_code": true,
992
+ "agent_ip_geolocation": true,
993
+ "agent_labels_customer": true,
994
+ "agent_name": false,
995
+ "agent_type": true,
996
+ "agent_version": true,
997
+ "beats_type": true,
998
+ "collector_node_id": true,
999
+ "data_win_eventdata_domain": true,
1000
+ "data_win_eventdata_imagePath": true,
1001
+ "data_win_eventdata_param1": true,
1002
+ "data_win_eventdata_param2": true,
1003
+ "data_win_eventdata_param3": true,
1004
+ "data_win_eventdata_param4": true,
1005
+ "data_win_eventdata_sID": true,
1006
+ "data_win_eventdata_serviceName": true,
1007
+ "data_win_eventdata_serviceType": true,
1008
+ "data_win_eventdata_startType": true,
1009
+ "data_win_eventdata_user": true,
1010
+ "data_win_system_channel": true,
1011
+ "data_win_system_computer": true,
1012
+ "data_win_system_eventID": true,
1013
+ "data_win_system_eventRecordID": true,
1014
+ "data_win_system_eventSourceName": true,
1015
+ "data_win_system_keywords": true,
1016
+ "data_win_system_level": true,
1017
+ "data_win_system_opcode": true,
1018
+ "data_win_system_processID": true,
1019
+ "data_win_system_providerGuid": true,
1020
+ "data_win_system_providerName": true,
1021
+ "data_win_system_severityValue": true,
1022
+ "data_win_system_systemTime": true,
1023
+ "data_win_system_task": true,
1024
+ "data_win_system_threadID": true,
1025
+ "data_win_system_version": true,
1026
+ "decoder_name": true,
1027
+ "ecs_version": true,
1028
+ "gl2_accounted_message_size": true,
1029
+ "gl2_message_id": true,
1030
+ "gl2_processing_error": true,
1031
+ "gl2_remote_ip": true,
1032
+ "gl2_remote_port": true,
1033
+ "gl2_source_collector": true,
1034
+ "gl2_source_input": true,
1035
+ "gl2_source_node": true,
1036
+ "highlight": true,
1037
+ "host_name": true,
1038
+ "id": true,
1039
+ "location": true,
1040
+ "log_file_path": true,
1041
+ "log_offset": true,
1042
+ "manager_name": true,
1043
+ "message": true,
1044
+ "previous_output": true,
1045
+ "rule_description": true,
1046
+ "rule_firedtimes": true,
1047
+ "rule_frequency": true,
1048
+ "rule_gdpr": true,
1049
+ "rule_gpg13": true,
1050
+ "rule_group1": true,
1051
+ "rule_group2": true,
1052
+ "rule_groups": true,
1053
+ "rule_hipaa": true,
1054
+ "rule_id": true,
1055
+ "rule_info": true,
1056
+ "rule_mail": true,
1057
+ "rule_mitre_id": true,
1058
+ "rule_mitre_tactic": true,
1059
+ "rule_mitre_technique": true,
1060
+ "rule_nist_800_53": true,
1061
+ "rule_pci_dss": true,
1062
+ "rule_tsc": true,
1063
+ "sort": true,
1064
+ "source": true,
1065
+ "src_ip": true,
1066
+ "src_ip_city_name": true,
1067
+ "src_ip_country_code": true,
1068
+ "src_ip_geolocation": true,
1069
+ "streams": true,
1070
+ "syslog_tag": true,
1071
+ "syslog_type": true,
1072
+ "timestamp": false,
1073
+ "true": true,
1074
+ "user_name": true,
1075
+ "win_system_eventID": true,
1076
+ "windows_event_id": true,
1077
+ "windows_event_severity": true
1078
+ },
1079
+ "indexByName": {
1080
+ "_id": 1,
1081
+ "_index": 3,
1082
+ "_type": 4,
1083
+ "agent_id": 5,
1084
+ "agent_ip": 6,
1085
+ "agent_labels_customer": 45,
1086
+ "agent_name": 2,
1087
+ "data_win_eventdata_imagePath": 46,
1088
+ "data_win_eventdata_serviceName": 47,
1089
+ "data_win_eventdata_serviceType": 48,
1090
+ "data_win_eventdata_startType": 49,
1091
+ "data_win_system_channel": 7,
1092
+ "data_win_system_computer": 8,
1093
+ "data_win_system_eventID": 9,
1094
+ "data_win_system_eventRecordID": 10,
1095
+ "data_win_system_eventSourceName": 50,
1096
+ "data_win_system_keywords": 11,
1097
+ "data_win_system_level": 12,
1098
+ "data_win_system_message": 13,
1099
+ "data_win_system_opcode": 14,
1100
+ "data_win_system_processID": 15,
1101
+ "data_win_system_providerGuid": 16,
1102
+ "data_win_system_providerName": 17,
1103
+ "data_win_system_severityValue": 18,
1104
+ "data_win_system_systemTime": 19,
1105
+ "data_win_system_task": 20,
1106
+ "data_win_system_threadID": 21,
1107
+ "data_win_system_version": 22,
1108
+ "decoder_name": 23,
1109
+ "gl2_accounted_message_size": 24,
1110
+ "gl2_message_id": 25,
1111
+ "gl2_processing_error": 51,
1112
+ "gl2_remote_ip": 26,
1113
+ "gl2_remote_port": 27,
1114
+ "gl2_source_input": 28,
1115
+ "gl2_source_node": 29,
1116
+ "highlight": 30,
1117
+ "id": 31,
1118
+ "location": 32,
1119
+ "manager_name": 33,
1120
+ "message": 34,
1121
+ "rule_description": 35,
1122
+ "rule_firedtimes": 36,
1123
+ "rule_group1": 52,
1124
+ "rule_group2": 53,
1125
+ "rule_groups": 37,
1126
+ "rule_id": 38,
1127
+ "rule_level": 39,
1128
+ "rule_mail": 40,
1129
+ "rule_mitre_id": 54,
1130
+ "rule_mitre_tactic": 55,
1131
+ "rule_mitre_technique": 56,
1132
+ "sort": 41,
1133
+ "source": 42,
1134
+ "streams": 43,
1135
+ "syslog_level": 57,
1136
+ "syslog_type": 44,
1137
+ "timestamp": 0,
1138
+ "true": 58
1139
+ },
1140
+ "renameByName": {
1141
+ "_id": "EVENT ID",
1142
+ "agent_ip": "SRC IP",
1143
+ "agent_name": "AGENT",
1144
+ "data_win_system_message": "MESSAGE",
1145
+ "data_win_system_providerGuid": "",
1146
+ "rule_level": "RULE LEVEL",
1147
+ "syslog_level": "LEVEL",
1148
+ "timestamp": "DATE/TIME",
1149
+ "windows_event_severity": "EVENT LOG SEVERITY"
1150
+ }
1151
+ }
1152
+ }
1153
+ ],
1154
+ "type": "table"
1155
+ }
1156
+ ],
1157
+ "title": "WINDOWS EVENT LOGS - SYSTEM",
1158
+ "type": "row"
1159
+ },
1160
+ {
1161
+ "collapsed": true,
1162
+ "datasource": {
1163
+ "type": "elasticsearch",
1164
+ "uid": "wazuh_datasource_uid"
1165
+ },
1166
+ "gridPos": {
1167
+ "h": 1,
1168
+ "w": 24,
1169
+ "x": 0,
1170
+ "y": 1
1171
+ },
1172
+ "id": 76,
1173
+ "panels": [
1174
+ {
1175
+ "datasource": {
1176
+ "type": "elasticsearch",
1177
+ "uid": "wazuh_datasource_uid"
1178
+ },
1179
+ "fieldConfig": {
1180
+ "defaults": {
1181
+ "mappings": [
1182
+ {
1183
+ "options": {
1184
+ "match": "null",
1185
+ "result": {
1186
+ "text": "N/A"
1187
+ }
1188
+ },
1189
+ "type": "special"
1190
+ }
1191
+ ],
1192
+ "thresholds": {
1193
+ "mode": "absolute",
1194
+ "steps": [
1195
+ {
1196
+ "color": "blue"
1197
+ }
1198
+ ]
1199
+ },
1200
+ "unit": "short"
1201
+ },
1202
+ "overrides": []
1203
+ },
1204
+ "gridPos": {
1205
+ "h": 7,
1206
+ "w": 4,
1207
+ "x": 0,
1208
+ "y": 2
1209
+ },
1210
+ "id": 86,
1211
+ "links": [],
1212
+ "options": {
1213
+ "colorMode": "value",
1214
+ "graphMode": "area",
1215
+ "justifyMode": "auto",
1216
+ "orientation": "horizontal",
1217
+ "reduceOptions": {
1218
+ "calcs": ["sum"],
1219
+ "fields": "",
1220
+ "values": false
1221
+ },
1222
+ "text": {},
1223
+ "textMode": "auto"
1224
+ },
1225
+ "pluginVersion": "9.0.0",
1226
+ "targets": [
1227
+ {
1228
+ "bucketAggs": [
1229
+ {
1230
+ "$$hashKey": "object:50",
1231
+ "field": "timestamp",
1232
+ "id": "2",
1233
+ "settings": {
1234
+ "interval": "auto",
1235
+ "min_doc_count": 0,
1236
+ "trimEdges": 0
1237
+ },
1238
+ "type": "date_histogram"
1239
+ }
1240
+ ],
1241
+ "metrics": [
1242
+ {
1243
+ "$$hashKey": "object:48",
1244
+ "field": "select field",
1245
+ "id": "1",
1246
+ "type": "count"
1247
+ }
1248
+ ],
1249
+ "query": "rule_groups:*windows_application AND agent_name:$agent_name",
1250
+ "refId": "A",
1251
+ "timeField": "timestamp"
1252
+ }
1253
+ ],
1254
+ "title": "WINDOWS APPLICATIONS - EVENTS",
1255
+ "type": "stat"
1256
+ },
1257
+ {
1258
+ "datasource": {
1259
+ "type": "elasticsearch",
1260
+ "uid": "wazuh_datasource_uid"
1261
+ },
1262
+ "fieldConfig": {
1263
+ "defaults": {
1264
+ "color": {
1265
+ "mode": "palette-classic"
1266
+ },
1267
+ "custom": {
1268
+ "hideFrom": {
1269
+ "legend": false,
1270
+ "tooltip": false,
1271
+ "viz": false
1272
+ }
1273
+ },
1274
+ "decimals": 0,
1275
+ "mappings": [],
1276
+ "unit": "short"
1277
+ },
1278
+ "overrides": [
1279
+ {
1280
+ "matcher": {
1281
+ "id": "byName",
1282
+ "options": "1"
1283
+ },
1284
+ "properties": [
1285
+ {
1286
+ "id": "color",
1287
+ "value": {
1288
+ "fixedColor": "#FF9830",
1289
+ "mode": "fixed"
1290
+ }
1291
+ }
1292
+ ]
1293
+ },
1294
+ {
1295
+ "matcher": {
1296
+ "id": "byName",
1297
+ "options": "Alert"
1298
+ },
1299
+ "properties": [
1300
+ {
1301
+ "id": "color",
1302
+ "value": {
1303
+ "fixedColor": "#F2495C",
1304
+ "mode": "fixed"
1305
+ }
1306
+ }
1307
+ ]
1308
+ },
1309
+ {
1310
+ "matcher": {
1311
+ "id": "byName",
1312
+ "options": "Error"
1313
+ },
1314
+ "properties": [
1315
+ {
1316
+ "id": "color",
1317
+ "value": {
1318
+ "fixedColor": "#F2495C",
1319
+ "mode": "fixed"
1320
+ }
1321
+ }
1322
+ ]
1323
+ },
1324
+ {
1325
+ "matcher": {
1326
+ "id": "byName",
1327
+ "options": "Info"
1328
+ },
1329
+ "properties": [
1330
+ {
1331
+ "id": "color",
1332
+ "value": {
1333
+ "fixedColor": "#73BF69",
1334
+ "mode": "fixed"
1335
+ }
1336
+ }
1337
+ ]
1338
+ },
1339
+ {
1340
+ "matcher": {
1341
+ "id": "byName",
1342
+ "options": "NOTICE"
1343
+ },
1344
+ "properties": [
1345
+ {
1346
+ "id": "color",
1347
+ "value": {
1348
+ "fixedColor": "#5794F2",
1349
+ "mode": "fixed"
1350
+ }
1351
+ }
1352
+ ]
1353
+ },
1354
+ {
1355
+ "matcher": {
1356
+ "id": "byName",
1357
+ "options": "Notice"
1358
+ },
1359
+ "properties": [
1360
+ {
1361
+ "id": "color",
1362
+ "value": {
1363
+ "fixedColor": "#5794F2",
1364
+ "mode": "fixed"
1365
+ }
1366
+ }
1367
+ ]
1368
+ },
1369
+ {
1370
+ "matcher": {
1371
+ "id": "byName",
1372
+ "options": "Result"
1373
+ },
1374
+ "properties": [
1375
+ {
1376
+ "id": "color",
1377
+ "value": {
1378
+ "fixedColor": "#B877D9",
1379
+ "mode": "fixed"
1380
+ }
1381
+ }
1382
+ ]
1383
+ },
1384
+ {
1385
+ "matcher": {
1386
+ "id": "byName",
1387
+ "options": "Warning"
1388
+ },
1389
+ "properties": [
1390
+ {
1391
+ "id": "color",
1392
+ "value": {
1393
+ "fixedColor": "#FF9830",
1394
+ "mode": "fixed"
1395
+ }
1396
+ }
1397
+ ]
1398
+ },
1399
+ {
1400
+ "matcher": {
1401
+ "id": "byName",
1402
+ "options": "INFORMATION"
1403
+ },
1404
+ "properties": [
1405
+ {
1406
+ "id": "color",
1407
+ "value": {
1408
+ "fixedColor": "green",
1409
+ "mode": "fixed"
1410
+ }
1411
+ }
1412
+ ]
1413
+ },
1414
+ {
1415
+ "matcher": {
1416
+ "id": "byName",
1417
+ "options": "WARNING"
1418
+ },
1419
+ "properties": [
1420
+ {
1421
+ "id": "color",
1422
+ "value": {
1423
+ "fixedColor": "orange",
1424
+ "mode": "fixed"
1425
+ }
1426
+ }
1427
+ ]
1428
+ },
1429
+ {
1430
+ "matcher": {
1431
+ "id": "byName",
1432
+ "options": "ERROR"
1433
+ },
1434
+ "properties": [
1435
+ {
1436
+ "id": "color",
1437
+ "value": {
1438
+ "fixedColor": "red",
1439
+ "mode": "fixed"
1440
+ }
1441
+ }
1442
+ ]
1443
+ }
1444
+ ]
1445
+ },
1446
+ "gridPos": {
1447
+ "h": 7,
1448
+ "w": 5,
1449
+ "x": 4,
1450
+ "y": 2
1451
+ },
1452
+ "id": 87,
1453
+ "links": [],
1454
+ "maxDataPoints": 3,
1455
+ "options": {
1456
+ "displayLabels": [],
1457
+ "legend": {
1458
+ "calcs": [],
1459
+ "displayMode": "table",
1460
+ "placement": "bottom",
1461
+ "values": ["value"]
1462
+ },
1463
+ "pieType": "donut",
1464
+ "reduceOptions": {
1465
+ "calcs": ["sum"],
1466
+ "fields": "",
1467
+ "values": false
1468
+ },
1469
+ "text": {},
1470
+ "tooltip": {
1471
+ "mode": "single",
1472
+ "sort": "none"
1473
+ }
1474
+ },
1475
+ "targets": [
1476
+ {
1477
+ "bucketAggs": [
1478
+ {
1479
+ "$$hashKey": "object:73",
1480
+ "fake": true,
1481
+ "field": "windows_event_severity",
1482
+ "id": "3",
1483
+ "settings": {
1484
+ "min_doc_count": 1,
1485
+ "order": "desc",
1486
+ "orderBy": "_count",
1487
+ "size": "0"
1488
+ },
1489
+ "type": "terms"
1490
+ },
1491
+ {
1492
+ "$$hashKey": "object:74",
1493
+ "field": "timestamp",
1494
+ "id": "2",
1495
+ "settings": {
1496
+ "interval": "auto",
1497
+ "min_doc_count": 0,
1498
+ "trimEdges": 0
1499
+ },
1500
+ "type": "date_histogram"
1501
+ }
1502
+ ],
1503
+ "metrics": [
1504
+ {
1505
+ "$$hashKey": "object:71",
1506
+ "field": "select field",
1507
+ "id": "1",
1508
+ "type": "count"
1509
+ }
1510
+ ],
1511
+ "query": "rule_groups:*windows_application AND agent_name:$agent_name",
1512
+ "refId": "A",
1513
+ "timeField": "timestamp"
1514
+ }
1515
+ ],
1516
+ "title": "WINDOWS APPLICATIONS - SEVERITY LEVELS",
1517
+ "type": "piechart"
1518
+ },
1519
+ {
1520
+ "datasource": {
1521
+ "type": "elasticsearch",
1522
+ "uid": "wazuh_datasource_uid"
1523
+ },
1524
+ "fieldConfig": {
1525
+ "defaults": {
1526
+ "custom": {
1527
+ "align": "auto",
1528
+ "displayMode": "auto",
1529
+ "filterable": false,
1530
+ "inspect": false
1531
+ },
1532
+ "mappings": [],
1533
+ "thresholds": {
1534
+ "mode": "absolute",
1535
+ "steps": [
1536
+ {
1537
+ "color": "orange"
1538
+ },
1539
+ {
1540
+ "color": "red",
1541
+ "value": 50
1542
+ }
1543
+ ]
1544
+ }
1545
+ },
1546
+ "overrides": [
1547
+ {
1548
+ "matcher": {
1549
+ "id": "byName",
1550
+ "options": "Count"
1551
+ },
1552
+ "properties": [
1553
+ {
1554
+ "id": "custom.displayMode",
1555
+ "value": "basic"
1556
+ }
1557
+ ]
1558
+ },
1559
+ {
1560
+ "matcher": {
1561
+ "id": "byName",
1562
+ "options": "rule_description"
1563
+ },
1564
+ "properties": [
1565
+ {
1566
+ "id": "custom.width",
1567
+ "value": 703
1568
+ }
1569
+ ]
1570
+ },
1571
+ {
1572
+ "matcher": {
1573
+ "id": "byName",
1574
+ "options": "rule_level"
1575
+ },
1576
+ "properties": [
1577
+ {
1578
+ "id": "custom.width",
1579
+ "value": 212
1580
+ },
1581
+ {
1582
+ "id": "mappings",
1583
+ "value": [
1584
+ {
1585
+ "options": {
1586
+ "from": 1,
1587
+ "result": {
1588
+ "color": "green",
1589
+ "index": 0
1590
+ },
1591
+ "to": 3
1592
+ },
1593
+ "type": "range"
1594
+ },
1595
+ {
1596
+ "options": {
1597
+ "from": 4,
1598
+ "result": {
1599
+ "color": "dark-yellow",
1600
+ "index": 1
1601
+ },
1602
+ "to": 6
1603
+ },
1604
+ "type": "range"
1605
+ },
1606
+ {
1607
+ "options": {
1608
+ "from": 7,
1609
+ "result": {
1610
+ "color": "orange",
1611
+ "index": 2
1612
+ },
1613
+ "to": 9
1614
+ },
1615
+ "type": "range"
1616
+ },
1617
+ {
1618
+ "options": {
1619
+ "from": 10,
1620
+ "result": {
1621
+ "color": "semi-dark-red",
1622
+ "index": 3
1623
+ },
1624
+ "to": 15
1625
+ },
1626
+ "type": "range"
1627
+ }
1628
+ ]
1629
+ }
1630
+ ]
1631
+ }
1632
+ ]
1633
+ },
1634
+ "gridPos": {
1635
+ "h": 7,
1636
+ "w": 15,
1637
+ "x": 9,
1638
+ "y": 2
1639
+ },
1640
+ "id": 88,
1641
+ "links": [],
1642
+ "maxDataPoints": 3,
1643
+ "options": {
1644
+ "footer": {
1645
+ "fields": "",
1646
+ "reducer": ["sum"],
1647
+ "show": false
1648
+ },
1649
+ "showHeader": true,
1650
+ "sortBy": []
1651
+ },
1652
+ "pluginVersion": "9.0.0",
1653
+ "targets": [
1654
+ {
1655
+ "bucketAggs": [
1656
+ {
1657
+ "$$hashKey": "object:3082",
1658
+ "fake": true,
1659
+ "field": "rule_description",
1660
+ "id": "4",
1661
+ "settings": {
1662
+ "min_doc_count": 0,
1663
+ "order": "desc",
1664
+ "orderBy": "_count",
1665
+ "size": "10"
1666
+ },
1667
+ "type": "terms"
1668
+ },
1669
+ {
1670
+ "$$hashKey": "object:73",
1671
+ "fake": true,
1672
+ "field": "rule_level",
1673
+ "id": "3",
1674
+ "settings": {
1675
+ "min_doc_count": 1,
1676
+ "order": "desc",
1677
+ "orderBy": "_count",
1678
+ "size": "0"
1679
+ },
1680
+ "type": "terms"
1681
+ }
1682
+ ],
1683
+ "metrics": [
1684
+ {
1685
+ "$$hashKey": "object:71",
1686
+ "field": "select field",
1687
+ "id": "1",
1688
+ "type": "count"
1689
+ }
1690
+ ],
1691
+ "query": "rule_groups:*windows_application AND agent_name:$agent_name",
1692
+ "refId": "A",
1693
+ "timeField": "timestamp"
1694
+ }
1695
+ ],
1696
+ "title": "WINDOWS APPLICATIONS - EVENTS BY TYPE",
1697
+ "type": "table"
1698
+ },
1699
+ {
1700
+ "datasource": {
1701
+ "type": "elasticsearch",
1702
+ "uid": "wazuh_datasource_uid"
1703
+ },
1704
+ "fieldConfig": {
1705
+ "defaults": {
1706
+ "custom": {
1707
+ "align": "auto",
1708
+ "displayMode": "auto",
1709
+ "filterable": false,
1710
+ "inspect": false
1711
+ },
1712
+ "mappings": [],
1713
+ "thresholds": {
1714
+ "mode": "absolute",
1715
+ "steps": [
1716
+ {
1717
+ "color": "green"
1718
+ },
1719
+ {
1720
+ "color": "red",
1721
+ "value": 80
1722
+ }
1723
+ ]
1724
+ }
1725
+ },
1726
+ "overrides": [
1727
+ {
1728
+ "matcher": {
1729
+ "id": "byName",
1730
+ "options": "agent_name"
1731
+ },
1732
+ "properties": [
1733
+ {
1734
+ "id": "custom.width",
1735
+ "value": 492
1736
+ }
1737
+ ]
1738
+ }
1739
+ ]
1740
+ },
1741
+ "gridPos": {
1742
+ "h": 7,
1743
+ "w": 9,
1744
+ "x": 0,
1745
+ "y": 9
1746
+ },
1747
+ "id": 90,
1748
+ "links": [],
1749
+ "maxDataPoints": 3,
1750
+ "options": {
1751
+ "footer": {
1752
+ "fields": "",
1753
+ "reducer": ["sum"],
1754
+ "show": false
1755
+ },
1756
+ "showHeader": true,
1757
+ "sortBy": []
1758
+ },
1759
+ "pluginVersion": "9.0.0",
1760
+ "targets": [
1761
+ {
1762
+ "bucketAggs": [
1763
+ {
1764
+ "$$hashKey": "object:73",
1765
+ "fake": true,
1766
+ "field": "agent_name",
1767
+ "id": "3",
1768
+ "settings": {
1769
+ "min_doc_count": 1,
1770
+ "order": "desc",
1771
+ "orderBy": "_count",
1772
+ "size": "0"
1773
+ },
1774
+ "type": "terms"
1775
+ }
1776
+ ],
1777
+ "metrics": [
1778
+ {
1779
+ "$$hashKey": "object:71",
1780
+ "field": "select field",
1781
+ "id": "1",
1782
+ "type": "count"
1783
+ }
1784
+ ],
1785
+ "query": "rule_groups:*windows_application AND agent_name:$agent_name",
1786
+ "refId": "A",
1787
+ "timeField": "timestamp"
1788
+ }
1789
+ ],
1790
+ "title": "WINDOWS APPLICATIONS - EVENTS BY AGENT",
1791
+ "type": "table"
1792
+ },
1793
+ {
1794
+ "aliasColors": {},
1795
+ "bars": true,
1796
+ "dashLength": 10,
1797
+ "dashes": false,
1798
+ "datasource": {
1799
+ "type": "elasticsearch",
1800
+ "uid": "wazuh_datasource_uid"
1801
+ },
1802
+ "fill": 1,
1803
+ "fillGradient": 0,
1804
+ "gridPos": {
1805
+ "h": 7,
1806
+ "w": 15,
1807
+ "x": 9,
1808
+ "y": 9
1809
+ },
1810
+ "hiddenSeries": false,
1811
+ "id": 91,
1812
+ "legend": {
1813
+ "alignAsTable": true,
1814
+ "avg": false,
1815
+ "current": false,
1816
+ "max": false,
1817
+ "min": false,
1818
+ "rightSide": true,
1819
+ "show": true,
1820
+ "total": false,
1821
+ "values": false
1822
+ },
1823
+ "lines": false,
1824
+ "linewidth": 1,
1825
+ "links": [],
1826
+ "maxDataPoints": 3,
1827
+ "nullPointMode": "null",
1828
+ "options": {
1829
+ "alertThreshold": true
1830
+ },
1831
+ "percentage": false,
1832
+ "pluginVersion": "9.0.0",
1833
+ "pointradius": 2,
1834
+ "points": false,
1835
+ "renderer": "flot",
1836
+ "seriesOverrides": [],
1837
+ "spaceLength": 10,
1838
+ "stack": true,
1839
+ "steppedLine": false,
1840
+ "targets": [
1841
+ {
1842
+ "alias": "",
1843
+ "bucketAggs": [
1844
+ {
1845
+ "field": "agent_name",
1846
+ "id": "4",
1847
+ "settings": {
1848
+ "min_doc_count": "1",
1849
+ "order": "desc",
1850
+ "orderBy": "_count",
1851
+ "size": "10"
1852
+ },
1853
+ "type": "terms"
1854
+ },
1855
+ {
1856
+ "field": "timestamp",
1857
+ "id": "5",
1858
+ "settings": {
1859
+ "interval": "auto",
1860
+ "min_doc_count": "0",
1861
+ "trimEdges": "0"
1862
+ },
1863
+ "type": "date_histogram"
1864
+ }
1865
+ ],
1866
+ "metrics": [
1867
+ {
1868
+ "$$hashKey": "object:71",
1869
+ "field": "select field",
1870
+ "id": "1",
1871
+ "type": "count"
1872
+ }
1873
+ ],
1874
+ "query": "rule_groups:*windows_application AND agent_name:$agent_name",
1875
+ "refId": "A",
1876
+ "timeField": "timestamp"
1877
+ }
1878
+ ],
1879
+ "thresholds": [],
1880
+ "timeRegions": [],
1881
+ "title": "WINDOWS APPLICATIONS - EVENTS BY AGENT (HISTOGRAM)",
1882
+ "tooltip": {
1883
+ "shared": true,
1884
+ "sort": 0,
1885
+ "value_type": "individual"
1886
+ },
1887
+ "type": "graph",
1888
+ "xaxis": {
1889
+ "mode": "time",
1890
+ "show": true,
1891
+ "values": []
1892
+ },
1893
+ "yaxes": [
1894
+ {
1895
+ "format": "short",
1896
+ "logBase": 1,
1897
+ "show": true
1898
+ },
1899
+ {
1900
+ "format": "short",
1901
+ "logBase": 1,
1902
+ "show": true
1903
+ }
1904
+ ],
1905
+ "yaxis": {
1906
+ "align": false
1907
+ }
1908
+ },
1909
+ {
1910
+ "datasource": {
1911
+ "type": "elasticsearch",
1912
+ "uid": "wazuh_datasource_uid"
1913
+ },
1914
+ "fieldConfig": {
1915
+ "defaults": {
1916
+ "color": {
1917
+ "mode": "thresholds"
1918
+ },
1919
+ "custom": {
1920
+ "align": "auto",
1921
+ "displayMode": "auto",
1922
+ "inspect": false
1923
+ },
1924
+ "mappings": [],
1925
+ "thresholds": {
1926
+ "mode": "absolute",
1927
+ "steps": [
1928
+ {
1929
+ "color": "green"
1930
+ },
1931
+ {
1932
+ "color": "red",
1933
+ "value": 80
1934
+ }
1935
+ ]
1936
+ }
1937
+ },
1938
+ "overrides": [
1939
+ {
1940
+ "matcher": {
1941
+ "id": "byName",
1942
+ "options": "rule_level"
1943
+ },
1944
+ "properties": [
1945
+ {
1946
+ "id": "custom.width",
1947
+ "value": 93
1948
+ }
1949
+ ]
1950
+ },
1951
+ {
1952
+ "matcher": {
1953
+ "id": "byName",
1954
+ "options": "windows_event_id"
1955
+ },
1956
+ "properties": [
1957
+ {
1958
+ "id": "custom.width",
1959
+ "value": 186
1960
+ }
1961
+ ]
1962
+ },
1963
+ {
1964
+ "matcher": {
1965
+ "id": "byName",
1966
+ "options": "DATE/TIME"
1967
+ },
1968
+ "properties": [
1969
+ {
1970
+ "id": "custom.width",
1971
+ "value": 202
1972
+ }
1973
+ ]
1974
+ },
1975
+ {
1976
+ "matcher": {
1977
+ "id": "byName",
1978
+ "options": "AGENT"
1979
+ },
1980
+ "properties": [
1981
+ {
1982
+ "id": "custom.width",
1983
+ "value": 171
1984
+ }
1985
+ ]
1986
+ },
1987
+ {
1988
+ "matcher": {
1989
+ "id": "byName",
1990
+ "options": "SRC IP"
1991
+ },
1992
+ "properties": [
1993
+ {
1994
+ "id": "custom.width",
1995
+ "value": 167
1996
+ }
1997
+ ]
1998
+ },
1999
+ {
2000
+ "matcher": {
2001
+ "id": "byName",
2002
+ "options": "MESSAGE"
2003
+ },
2004
+ "properties": [
2005
+ {
2006
+ "id": "custom.width",
2007
+ "value": 1519
2008
+ }
2009
+ ]
2010
+ },
2011
+ {
2012
+ "matcher": {
2013
+ "id": "byName",
2014
+ "options": "rule_description"
2015
+ },
2016
+ "properties": [
2017
+ {
2018
+ "id": "custom.width",
2019
+ "value": 524
2020
+ }
2021
+ ]
2022
+ },
2023
+ {
2024
+ "matcher": {
2025
+ "id": "byName",
2026
+ "options": "RULE LEVEL"
2027
+ },
2028
+ "properties": [
2029
+ {
2030
+ "id": "custom.width",
2031
+ "value": 188
2032
+ }
2033
+ ]
2034
+ },
2035
+ {
2036
+ "matcher": {
2037
+ "id": "byName",
2038
+ "options": "EVENT ID"
2039
+ },
2040
+ "properties": [
2041
+ {
2042
+ "id": "links",
2043
+ "value": [
2044
+ {
2045
+ "targetBlank": true,
2046
+ "title": "VIEW EVENT DETAILS",
2047
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
2048
+ }
2049
+ ]
2050
+ }
2051
+ ]
2052
+ }
2053
+ ]
2054
+ },
2055
+ "gridPos": {
2056
+ "h": 10,
2057
+ "w": 24,
2058
+ "x": 0,
2059
+ "y": 16
2060
+ },
2061
+ "id": 89,
2062
+ "options": {
2063
+ "footer": {
2064
+ "fields": "",
2065
+ "reducer": ["sum"],
2066
+ "show": false
2067
+ },
2068
+ "showHeader": true,
2069
+ "sortBy": []
2070
+ },
2071
+ "pluginVersion": "9.0.0",
2072
+ "targets": [
2073
+ {
2074
+ "alias": "",
2075
+ "bucketAggs": [],
2076
+ "metrics": [
2077
+ {
2078
+ "id": "1",
2079
+ "settings": {
2080
+ "size": "500"
2081
+ },
2082
+ "type": "raw_data"
2083
+ }
2084
+ ],
2085
+ "query": "rule_groups:*windows_application AND agent_name:$agent_name",
2086
+ "queryType": "lucene",
2087
+ "refId": "A",
2088
+ "timeField": "timestamp"
2089
+ }
2090
+ ],
2091
+ "title": "WINDOWS APPLICATIONS - EVENTS",
2092
+ "transformations": [
2093
+ {
2094
+ "id": "organize",
2095
+ "options": {
2096
+ "excludeByName": {
2097
+ "@metadata_beat": true,
2098
+ "@metadata_type": true,
2099
+ "@metadata_version": true,
2100
+ "_id": false,
2101
+ "_index": true,
2102
+ "_type": true,
2103
+ "agent_ephemeral_id": true,
2104
+ "agent_hostname": true,
2105
+ "agent_id": true,
2106
+ "agent_ip": false,
2107
+ "agent_ip_city_name": true,
2108
+ "agent_ip_country_code": true,
2109
+ "agent_ip_geolocation": true,
2110
+ "agent_labels_customer": true,
2111
+ "agent_name": false,
2112
+ "agent_type": true,
2113
+ "agent_version": true,
2114
+ "beats_type": true,
2115
+ "collector_node_id": true,
2116
+ "data_win_eventXML_binaryData": true,
2117
+ "data_win_eventXML_binaryDataSize": true,
2118
+ "data_win_eventXML_param1": true,
2119
+ "data_win_eventdata_binary": true,
2120
+ "data_win_eventdata_data": true,
2121
+ "data_win_eventdata_domain": true,
2122
+ "data_win_eventdata_imagePath": true,
2123
+ "data_win_eventdata_sID": true,
2124
+ "data_win_eventdata_serviceName": true,
2125
+ "data_win_eventdata_serviceType": true,
2126
+ "data_win_eventdata_startType": true,
2127
+ "data_win_eventdata_user": true,
2128
+ "data_win_system_channel": true,
2129
+ "data_win_system_computer": true,
2130
+ "data_win_system_eventID": true,
2131
+ "data_win_system_eventRecordID": true,
2132
+ "data_win_system_eventSourceName": true,
2133
+ "data_win_system_keywords": true,
2134
+ "data_win_system_level": true,
2135
+ "data_win_system_opcode": true,
2136
+ "data_win_system_processID": true,
2137
+ "data_win_system_providerGuid": true,
2138
+ "data_win_system_providerName": true,
2139
+ "data_win_system_severityValue": true,
2140
+ "data_win_system_systemTime": true,
2141
+ "data_win_system_task": true,
2142
+ "data_win_system_threadID": true,
2143
+ "data_win_system_version": true,
2144
+ "decoder_name": true,
2145
+ "ecs_version": true,
2146
+ "gl2_accounted_message_size": true,
2147
+ "gl2_message_id": true,
2148
+ "gl2_processing_error": true,
2149
+ "gl2_remote_ip": true,
2150
+ "gl2_remote_port": true,
2151
+ "gl2_source_collector": true,
2152
+ "gl2_source_input": true,
2153
+ "gl2_source_node": true,
2154
+ "highlight": true,
2155
+ "host_name": true,
2156
+ "id": true,
2157
+ "location": true,
2158
+ "log_file_path": true,
2159
+ "log_offset": true,
2160
+ "manager_name": true,
2161
+ "message": true,
2162
+ "previous_output": true,
2163
+ "rule_description": true,
2164
+ "rule_firedtimes": true,
2165
+ "rule_frequency": true,
2166
+ "rule_gdpr": true,
2167
+ "rule_gpg13": true,
2168
+ "rule_group1": true,
2169
+ "rule_group2": true,
2170
+ "rule_groups": true,
2171
+ "rule_hipaa": true,
2172
+ "rule_id": true,
2173
+ "rule_mail": true,
2174
+ "rule_mitre_id": true,
2175
+ "rule_mitre_tactic": true,
2176
+ "rule_mitre_technique": true,
2177
+ "rule_nist_800_53": true,
2178
+ "rule_pci_dss": true,
2179
+ "rule_tsc": true,
2180
+ "sort": true,
2181
+ "source": true,
2182
+ "src_ip": true,
2183
+ "src_ip_city_name": true,
2184
+ "src_ip_country_code": true,
2185
+ "src_ip_geolocation": true,
2186
+ "streams": true,
2187
+ "syslog_tag": true,
2188
+ "syslog_type": true,
2189
+ "timestamp": false,
2190
+ "true": true,
2191
+ "user_name": true,
2192
+ "win_system_eventID": true,
2193
+ "windows_event_id": true,
2194
+ "windows_event_severity": false
2195
+ },
2196
+ "indexByName": {
2197
+ "_id": 1,
2198
+ "_index": 3,
2199
+ "_type": 4,
2200
+ "agent_id": 5,
2201
+ "agent_ip": 6,
2202
+ "agent_ip_city_name": 7,
2203
+ "agent_ip_country_code": 8,
2204
+ "agent_ip_geolocation": 9,
2205
+ "agent_labels_customer": 48,
2206
+ "agent_name": 2,
2207
+ "data_win_eventXML_binaryData": 49,
2208
+ "data_win_eventXML_binaryDataSize": 50,
2209
+ "data_win_eventXML_param1": 51,
2210
+ "data_win_eventXML_param2": 52,
2211
+ "data_win_eventdata_data": 53,
2212
+ "data_win_system_channel": 10,
2213
+ "data_win_system_computer": 11,
2214
+ "data_win_system_eventID": 12,
2215
+ "data_win_system_eventRecordID": 13,
2216
+ "data_win_system_eventSourceName": 54,
2217
+ "data_win_system_keywords": 14,
2218
+ "data_win_system_level": 15,
2219
+ "data_win_system_message": 16,
2220
+ "data_win_system_opcode": 17,
2221
+ "data_win_system_processID": 18,
2222
+ "data_win_system_providerGuid": 19,
2223
+ "data_win_system_providerName": 20,
2224
+ "data_win_system_severityValue": 21,
2225
+ "data_win_system_systemTime": 22,
2226
+ "data_win_system_task": 23,
2227
+ "data_win_system_threadID": 24,
2228
+ "data_win_system_version": 25,
2229
+ "decoder_name": 26,
2230
+ "gl2_accounted_message_size": 27,
2231
+ "gl2_message_id": 28,
2232
+ "gl2_processing_error": 55,
2233
+ "gl2_remote_ip": 29,
2234
+ "gl2_remote_port": 30,
2235
+ "gl2_source_input": 31,
2236
+ "gl2_source_node": 32,
2237
+ "highlight": 33,
2238
+ "id": 34,
2239
+ "location": 35,
2240
+ "manager_name": 36,
2241
+ "message": 37,
2242
+ "rule_description": 38,
2243
+ "rule_firedtimes": 39,
2244
+ "rule_group1": 56,
2245
+ "rule_group2": 57,
2246
+ "rule_groups": 40,
2247
+ "rule_id": 41,
2248
+ "rule_level": 42,
2249
+ "rule_mail": 43,
2250
+ "sort": 44,
2251
+ "source": 45,
2252
+ "streams": 46,
2253
+ "syslog_level": 58,
2254
+ "syslog_type": 47,
2255
+ "timestamp": 0,
2256
+ "true": 59
2257
+ },
2258
+ "renameByName": {
2259
+ "_id": "EVENT ID",
2260
+ "agent_ip": "SRC IP",
2261
+ "agent_name": "AGENT",
2262
+ "data_win_system_message": "MESSAGE",
2263
+ "data_win_system_providerGuid": "",
2264
+ "rule_level": "RULE LEVEL",
2265
+ "syslog_level": "LEVEL",
2266
+ "timestamp": "DATE/TIME",
2267
+ "windows_event_severity": "EVENT LOG SEVERITY"
2268
+ }
2269
+ }
2270
+ }
2271
+ ],
2272
+ "type": "table"
2273
+ }
2274
+ ],
2275
+ "title": "WINDOWS EVENT LOGS - APPLICATION",
2276
+ "type": "row"
2277
+ },
2278
+ {
2279
+ "collapsed": true,
2280
+ "datasource": {
2281
+ "type": "elasticsearch",
2282
+ "uid": "wazuh_datasource_uid"
2283
+ },
2284
+ "gridPos": {
2285
+ "h": 1,
2286
+ "w": 24,
2287
+ "x": 0,
2288
+ "y": 2
2289
+ },
2290
+ "id": 74,
2291
+ "panels": [
2292
+ {
2293
+ "datasource": {
2294
+ "type": "elasticsearch",
2295
+ "uid": "wazuh_datasource_uid"
2296
+ },
2297
+ "fieldConfig": {
2298
+ "defaults": {
2299
+ "mappings": [
2300
+ {
2301
+ "options": {
2302
+ "match": "null",
2303
+ "result": {
2304
+ "text": "N/A"
2305
+ }
2306
+ },
2307
+ "type": "special"
2308
+ }
2309
+ ],
2310
+ "thresholds": {
2311
+ "mode": "absolute",
2312
+ "steps": [
2313
+ {
2314
+ "color": "blue"
2315
+ }
2316
+ ]
2317
+ },
2318
+ "unit": "short"
2319
+ },
2320
+ "overrides": []
2321
+ },
2322
+ "gridPos": {
2323
+ "h": 7,
2324
+ "w": 4,
2325
+ "x": 0,
2326
+ "y": 3
2327
+ },
2328
+ "id": 43,
2329
+ "links": [],
2330
+ "options": {
2331
+ "colorMode": "value",
2332
+ "graphMode": "area",
2333
+ "justifyMode": "auto",
2334
+ "orientation": "horizontal",
2335
+ "reduceOptions": {
2336
+ "calcs": ["sum"],
2337
+ "fields": "",
2338
+ "values": false
2339
+ },
2340
+ "text": {},
2341
+ "textMode": "auto"
2342
+ },
2343
+ "pluginVersion": "9.0.0",
2344
+ "targets": [
2345
+ {
2346
+ "bucketAggs": [
2347
+ {
2348
+ "$$hashKey": "object:50",
2349
+ "field": "timestamp",
2350
+ "id": "2",
2351
+ "settings": {
2352
+ "interval": "auto",
2353
+ "min_doc_count": 0,
2354
+ "trimEdges": 0
2355
+ },
2356
+ "type": "date_histogram"
2357
+ }
2358
+ ],
2359
+ "datasource": {
2360
+ "type": "elasticsearch",
2361
+ "uid": "wazuh_datasource_uid"
2362
+ },
2363
+ "metrics": [
2364
+ {
2365
+ "$$hashKey": "object:48",
2366
+ "field": "select field",
2367
+ "id": "1",
2368
+ "type": "count"
2369
+ }
2370
+ ],
2371
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
2372
+ "refId": "A",
2373
+ "timeField": "timestamp"
2374
+ }
2375
+ ],
2376
+ "title": "WINDOWS SECURITY - EVENTS",
2377
+ "type": "stat"
2378
+ },
2379
+ {
2380
+ "datasource": {
2381
+ "type": "elasticsearch",
2382
+ "uid": "wazuh_datasource_uid"
2383
+ },
2384
+ "fieldConfig": {
2385
+ "defaults": {
2386
+ "color": {
2387
+ "mode": "palette-classic"
2388
+ },
2389
+ "custom": {
2390
+ "hideFrom": {
2391
+ "legend": false,
2392
+ "tooltip": false,
2393
+ "viz": false
2394
+ }
2395
+ },
2396
+ "decimals": 0,
2397
+ "mappings": [],
2398
+ "unit": "short"
2399
+ },
2400
+ "overrides": [
2401
+ {
2402
+ "matcher": {
2403
+ "id": "byName",
2404
+ "options": "1"
2405
+ },
2406
+ "properties": [
2407
+ {
2408
+ "id": "color",
2409
+ "value": {
2410
+ "fixedColor": "#FF9830",
2411
+ "mode": "fixed"
2412
+ }
2413
+ }
2414
+ ]
2415
+ },
2416
+ {
2417
+ "matcher": {
2418
+ "id": "byName",
2419
+ "options": "Alert"
2420
+ },
2421
+ "properties": [
2422
+ {
2423
+ "id": "color",
2424
+ "value": {
2425
+ "fixedColor": "#F2495C",
2426
+ "mode": "fixed"
2427
+ }
2428
+ }
2429
+ ]
2430
+ },
2431
+ {
2432
+ "matcher": {
2433
+ "id": "byName",
2434
+ "options": "Error"
2435
+ },
2436
+ "properties": [
2437
+ {
2438
+ "id": "color",
2439
+ "value": {
2440
+ "fixedColor": "#F2495C",
2441
+ "mode": "fixed"
2442
+ }
2443
+ }
2444
+ ]
2445
+ },
2446
+ {
2447
+ "matcher": {
2448
+ "id": "byName",
2449
+ "options": "Info"
2450
+ },
2451
+ "properties": [
2452
+ {
2453
+ "id": "color",
2454
+ "value": {
2455
+ "fixedColor": "#73BF69",
2456
+ "mode": "fixed"
2457
+ }
2458
+ }
2459
+ ]
2460
+ },
2461
+ {
2462
+ "matcher": {
2463
+ "id": "byName",
2464
+ "options": "NOTICE"
2465
+ },
2466
+ "properties": [
2467
+ {
2468
+ "id": "color",
2469
+ "value": {
2470
+ "fixedColor": "#5794F2",
2471
+ "mode": "fixed"
2472
+ }
2473
+ }
2474
+ ]
2475
+ },
2476
+ {
2477
+ "matcher": {
2478
+ "id": "byName",
2479
+ "options": "Notice"
2480
+ },
2481
+ "properties": [
2482
+ {
2483
+ "id": "color",
2484
+ "value": {
2485
+ "fixedColor": "#5794F2",
2486
+ "mode": "fixed"
2487
+ }
2488
+ }
2489
+ ]
2490
+ },
2491
+ {
2492
+ "matcher": {
2493
+ "id": "byName",
2494
+ "options": "Result"
2495
+ },
2496
+ "properties": [
2497
+ {
2498
+ "id": "color",
2499
+ "value": {
2500
+ "fixedColor": "#B877D9",
2501
+ "mode": "fixed"
2502
+ }
2503
+ }
2504
+ ]
2505
+ },
2506
+ {
2507
+ "matcher": {
2508
+ "id": "byName",
2509
+ "options": "Warning"
2510
+ },
2511
+ "properties": [
2512
+ {
2513
+ "id": "color",
2514
+ "value": {
2515
+ "fixedColor": "#FF9830",
2516
+ "mode": "fixed"
2517
+ }
2518
+ }
2519
+ ]
2520
+ },
2521
+ {
2522
+ "matcher": {
2523
+ "id": "byName",
2524
+ "options": "AUDIT_SUCCESS"
2525
+ },
2526
+ "properties": [
2527
+ {
2528
+ "id": "color",
2529
+ "value": {
2530
+ "fixedColor": "green",
2531
+ "mode": "fixed"
2532
+ }
2533
+ }
2534
+ ]
2535
+ },
2536
+ {
2537
+ "matcher": {
2538
+ "id": "byName",
2539
+ "options": "AUDIT_FAILURE"
2540
+ },
2541
+ "properties": [
2542
+ {
2543
+ "id": "color",
2544
+ "value": {
2545
+ "fixedColor": "orange",
2546
+ "mode": "fixed"
2547
+ }
2548
+ }
2549
+ ]
2550
+ }
2551
+ ]
2552
+ },
2553
+ "gridPos": {
2554
+ "h": 7,
2555
+ "w": 5,
2556
+ "x": 4,
2557
+ "y": 3
2558
+ },
2559
+ "id": 59,
2560
+ "links": [],
2561
+ "maxDataPoints": 3,
2562
+ "options": {
2563
+ "displayLabels": [],
2564
+ "legend": {
2565
+ "calcs": [],
2566
+ "displayMode": "table",
2567
+ "placement": "right",
2568
+ "values": ["value"]
2569
+ },
2570
+ "pieType": "donut",
2571
+ "reduceOptions": {
2572
+ "calcs": ["sum"],
2573
+ "fields": "",
2574
+ "values": false
2575
+ },
2576
+ "text": {},
2577
+ "tooltip": {
2578
+ "mode": "single",
2579
+ "sort": "none"
2580
+ }
2581
+ },
2582
+ "targets": [
2583
+ {
2584
+ "bucketAggs": [
2585
+ {
2586
+ "$$hashKey": "object:73",
2587
+ "fake": true,
2588
+ "field": "data_win_system_severityValue",
2589
+ "id": "3",
2590
+ "settings": {
2591
+ "min_doc_count": 1,
2592
+ "order": "desc",
2593
+ "orderBy": "_count",
2594
+ "size": "0"
2595
+ },
2596
+ "type": "terms"
2597
+ },
2598
+ {
2599
+ "$$hashKey": "object:74",
2600
+ "field": "timestamp",
2601
+ "id": "2",
2602
+ "settings": {
2603
+ "interval": "auto",
2604
+ "min_doc_count": 0,
2605
+ "trimEdges": 0
2606
+ },
2607
+ "type": "date_histogram"
2608
+ }
2609
+ ],
2610
+ "datasource": {
2611
+ "type": "elasticsearch",
2612
+ "uid": "wazuh_datasource_uid"
2613
+ },
2614
+ "metrics": [
2615
+ {
2616
+ "$$hashKey": "object:71",
2617
+ "field": "select field",
2618
+ "id": "1",
2619
+ "type": "count"
2620
+ }
2621
+ ],
2622
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
2623
+ "refId": "A",
2624
+ "timeField": "timestamp"
2625
+ }
2626
+ ],
2627
+ "title": "WINDOWS SECURITY - SEVERITY LEVELS",
2628
+ "type": "piechart"
2629
+ },
2630
+ {
2631
+ "datasource": {
2632
+ "type": "elasticsearch",
2633
+ "uid": "wazuh_datasource_uid"
2634
+ },
2635
+ "fieldConfig": {
2636
+ "defaults": {
2637
+ "custom": {
2638
+ "align": "auto",
2639
+ "displayMode": "auto",
2640
+ "filterable": false,
2641
+ "inspect": false
2642
+ },
2643
+ "mappings": [],
2644
+ "thresholds": {
2645
+ "mode": "absolute",
2646
+ "steps": [
2647
+ {
2648
+ "color": "blue"
2649
+ }
2650
+ ]
2651
+ }
2652
+ },
2653
+ "overrides": [
2654
+ {
2655
+ "matcher": {
2656
+ "id": "byName",
2657
+ "options": "Count"
2658
+ },
2659
+ "properties": [
2660
+ {
2661
+ "id": "custom.displayMode",
2662
+ "value": "basic"
2663
+ }
2664
+ ]
2665
+ }
2666
+ ]
2667
+ },
2668
+ "gridPos": {
2669
+ "h": 7,
2670
+ "w": 15,
2671
+ "x": 9,
2672
+ "y": 3
2673
+ },
2674
+ "id": 63,
2675
+ "links": [],
2676
+ "maxDataPoints": 3,
2677
+ "options": {
2678
+ "footer": {
2679
+ "fields": "",
2680
+ "reducer": ["sum"],
2681
+ "show": false
2682
+ },
2683
+ "showHeader": true
2684
+ },
2685
+ "pluginVersion": "9.0.0",
2686
+ "targets": [
2687
+ {
2688
+ "bucketAggs": [
2689
+ {
2690
+ "$$hashKey": "object:3082",
2691
+ "fake": true,
2692
+ "field": "rule_description",
2693
+ "id": "4",
2694
+ "settings": {
2695
+ "min_doc_count": 0,
2696
+ "order": "desc",
2697
+ "orderBy": "_count",
2698
+ "size": "10"
2699
+ },
2700
+ "type": "terms"
2701
+ },
2702
+ {
2703
+ "$$hashKey": "object:73",
2704
+ "fake": true,
2705
+ "field": "rule_level",
2706
+ "id": "3",
2707
+ "settings": {
2708
+ "min_doc_count": 1,
2709
+ "order": "desc",
2710
+ "orderBy": "_count",
2711
+ "size": "0"
2712
+ },
2713
+ "type": "terms"
2714
+ }
2715
+ ],
2716
+ "datasource": {
2717
+ "type": "elasticsearch",
2718
+ "uid": "wazuh_datasource_uid"
2719
+ },
2720
+ "metrics": [
2721
+ {
2722
+ "$$hashKey": "object:71",
2723
+ "field": "select field",
2724
+ "id": "1",
2725
+ "type": "count"
2726
+ }
2727
+ ],
2728
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
2729
+ "refId": "A",
2730
+ "timeField": "timestamp"
2731
+ }
2732
+ ],
2733
+ "title": "WINDOWS SECURITY - EVENTS BY TYPE",
2734
+ "type": "table"
2735
+ },
2736
+ {
2737
+ "datasource": {
2738
+ "type": "elasticsearch",
2739
+ "uid": "wazuh_datasource_uid"
2740
+ },
2741
+ "fieldConfig": {
2742
+ "defaults": {
2743
+ "custom": {
2744
+ "align": "auto",
2745
+ "displayMode": "auto",
2746
+ "filterable": false,
2747
+ "inspect": false
2748
+ },
2749
+ "mappings": [],
2750
+ "thresholds": {
2751
+ "mode": "absolute",
2752
+ "steps": [
2753
+ {
2754
+ "color": "orange"
2755
+ },
2756
+ {
2757
+ "color": "red",
2758
+ "value": 80
2759
+ }
2760
+ ]
2761
+ }
2762
+ },
2763
+ "overrides": []
2764
+ },
2765
+ "gridPos": {
2766
+ "h": 7,
2767
+ "w": 9,
2768
+ "x": 0,
2769
+ "y": 10
2770
+ },
2771
+ "id": 60,
2772
+ "links": [],
2773
+ "maxDataPoints": 3,
2774
+ "options": {
2775
+ "footer": {
2776
+ "fields": "",
2777
+ "reducer": ["sum"],
2778
+ "show": false
2779
+ },
2780
+ "showHeader": true
2781
+ },
2782
+ "pluginVersion": "9.0.0",
2783
+ "targets": [
2784
+ {
2785
+ "bucketAggs": [
2786
+ {
2787
+ "$$hashKey": "object:2063",
2788
+ "fake": true,
2789
+ "field": "agent_name",
2790
+ "id": "4",
2791
+ "settings": {
2792
+ "min_doc_count": "1",
2793
+ "order": "desc",
2794
+ "orderBy": "_count",
2795
+ "size": "10"
2796
+ },
2797
+ "type": "terms"
2798
+ }
2799
+ ],
2800
+ "datasource": {
2801
+ "type": "elasticsearch",
2802
+ "uid": "wazuh_datasource_uid"
2803
+ },
2804
+ "metrics": [
2805
+ {
2806
+ "$$hashKey": "object:71",
2807
+ "field": "select field",
2808
+ "id": "1",
2809
+ "type": "count"
2810
+ }
2811
+ ],
2812
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
2813
+ "refId": "A",
2814
+ "timeField": "timestamp"
2815
+ }
2816
+ ],
2817
+ "title": "WINDOWS SECURITY - EVENTS BY AGENT",
2818
+ "type": "table"
2819
+ },
2820
+ {
2821
+ "aliasColors": {},
2822
+ "bars": true,
2823
+ "dashLength": 10,
2824
+ "dashes": false,
2825
+ "datasource": {
2826
+ "type": "elasticsearch",
2827
+ "uid": "wazuh_datasource_uid"
2828
+ },
2829
+ "fill": 1,
2830
+ "fillGradient": 0,
2831
+ "gridPos": {
2832
+ "h": 7,
2833
+ "w": 15,
2834
+ "x": 9,
2835
+ "y": 10
2836
+ },
2837
+ "hiddenSeries": false,
2838
+ "id": 92,
2839
+ "legend": {
2840
+ "alignAsTable": true,
2841
+ "avg": false,
2842
+ "current": false,
2843
+ "max": false,
2844
+ "min": false,
2845
+ "rightSide": true,
2846
+ "show": true,
2847
+ "total": false,
2848
+ "values": false
2849
+ },
2850
+ "lines": false,
2851
+ "linewidth": 1,
2852
+ "links": [],
2853
+ "maxDataPoints": 3,
2854
+ "nullPointMode": "null",
2855
+ "options": {
2856
+ "alertThreshold": true
2857
+ },
2858
+ "percentage": false,
2859
+ "pluginVersion": "9.0.0",
2860
+ "pointradius": 2,
2861
+ "points": false,
2862
+ "renderer": "flot",
2863
+ "seriesOverrides": [],
2864
+ "spaceLength": 10,
2865
+ "stack": true,
2866
+ "steppedLine": false,
2867
+ "targets": [
2868
+ {
2869
+ "alias": "",
2870
+ "bucketAggs": [
2871
+ {
2872
+ "field": "agent_name",
2873
+ "id": "4",
2874
+ "settings": {
2875
+ "min_doc_count": "1",
2876
+ "order": "desc",
2877
+ "orderBy": "_count",
2878
+ "size": "10"
2879
+ },
2880
+ "type": "terms"
2881
+ },
2882
+ {
2883
+ "field": "timestamp",
2884
+ "id": "5",
2885
+ "settings": {
2886
+ "interval": "auto",
2887
+ "min_doc_count": "0",
2888
+ "trimEdges": "0"
2889
+ },
2890
+ "type": "date_histogram"
2891
+ }
2892
+ ],
2893
+ "datasource": {
2894
+ "type": "elasticsearch",
2895
+ "uid": "wazuh_datasource_uid"
2896
+ },
2897
+ "metrics": [
2898
+ {
2899
+ "$$hashKey": "object:71",
2900
+ "field": "select field",
2901
+ "id": "1",
2902
+ "type": "count"
2903
+ }
2904
+ ],
2905
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
2906
+ "refId": "A",
2907
+ "timeField": "timestamp"
2908
+ }
2909
+ ],
2910
+ "thresholds": [],
2911
+ "timeRegions": [],
2912
+ "title": "WINDOWS SECURITY - EVENTS BY AGENT (HISTOGRAM)",
2913
+ "tooltip": {
2914
+ "shared": true,
2915
+ "sort": 0,
2916
+ "value_type": "individual"
2917
+ },
2918
+ "type": "graph",
2919
+ "xaxis": {
2920
+ "mode": "time",
2921
+ "show": true,
2922
+ "values": []
2923
+ },
2924
+ "yaxes": [
2925
+ {
2926
+ "format": "short",
2927
+ "logBase": 1,
2928
+ "show": true
2929
+ },
2930
+ {
2931
+ "format": "short",
2932
+ "logBase": 1,
2933
+ "show": true
2934
+ }
2935
+ ],
2936
+ "yaxis": {
2937
+ "align": false
2938
+ }
2939
+ },
2940
+ {
2941
+ "datasource": {
2942
+ "type": "elasticsearch",
2943
+ "uid": "wazuh_datasource_uid"
2944
+ },
2945
+ "fieldConfig": {
2946
+ "defaults": {
2947
+ "color": {
2948
+ "mode": "palette-classic"
2949
+ },
2950
+ "custom": {
2951
+ "hideFrom": {
2952
+ "legend": false,
2953
+ "tooltip": false,
2954
+ "viz": false
2955
+ }
2956
+ },
2957
+ "decimals": 0,
2958
+ "mappings": [],
2959
+ "unit": "short"
2960
+ },
2961
+ "overrides": [
2962
+ {
2963
+ "matcher": {
2964
+ "id": "byName",
2965
+ "options": "1"
2966
+ },
2967
+ "properties": [
2968
+ {
2969
+ "id": "color",
2970
+ "value": {
2971
+ "fixedColor": "#FF9830",
2972
+ "mode": "fixed"
2973
+ }
2974
+ }
2975
+ ]
2976
+ },
2977
+ {
2978
+ "matcher": {
2979
+ "id": "byName",
2980
+ "options": "Alert"
2981
+ },
2982
+ "properties": [
2983
+ {
2984
+ "id": "color",
2985
+ "value": {
2986
+ "fixedColor": "#F2495C",
2987
+ "mode": "fixed"
2988
+ }
2989
+ }
2990
+ ]
2991
+ },
2992
+ {
2993
+ "matcher": {
2994
+ "id": "byName",
2995
+ "options": "Error"
2996
+ },
2997
+ "properties": [
2998
+ {
2999
+ "id": "color",
3000
+ "value": {
3001
+ "fixedColor": "#F2495C",
3002
+ "mode": "fixed"
3003
+ }
3004
+ }
3005
+ ]
3006
+ },
3007
+ {
3008
+ "matcher": {
3009
+ "id": "byName",
3010
+ "options": "Info"
3011
+ },
3012
+ "properties": [
3013
+ {
3014
+ "id": "color",
3015
+ "value": {
3016
+ "fixedColor": "#73BF69",
3017
+ "mode": "fixed"
3018
+ }
3019
+ }
3020
+ ]
3021
+ },
3022
+ {
3023
+ "matcher": {
3024
+ "id": "byName",
3025
+ "options": "NOTICE"
3026
+ },
3027
+ "properties": [
3028
+ {
3029
+ "id": "color",
3030
+ "value": {
3031
+ "fixedColor": "#5794F2",
3032
+ "mode": "fixed"
3033
+ }
3034
+ }
3035
+ ]
3036
+ },
3037
+ {
3038
+ "matcher": {
3039
+ "id": "byName",
3040
+ "options": "Notice"
3041
+ },
3042
+ "properties": [
3043
+ {
3044
+ "id": "color",
3045
+ "value": {
3046
+ "fixedColor": "#5794F2",
3047
+ "mode": "fixed"
3048
+ }
3049
+ }
3050
+ ]
3051
+ },
3052
+ {
3053
+ "matcher": {
3054
+ "id": "byName",
3055
+ "options": "Result"
3056
+ },
3057
+ "properties": [
3058
+ {
3059
+ "id": "color",
3060
+ "value": {
3061
+ "fixedColor": "#B877D9",
3062
+ "mode": "fixed"
3063
+ }
3064
+ }
3065
+ ]
3066
+ },
3067
+ {
3068
+ "matcher": {
3069
+ "id": "byName",
3070
+ "options": "Warning"
3071
+ },
3072
+ "properties": [
3073
+ {
3074
+ "id": "color",
3075
+ "value": {
3076
+ "fixedColor": "#FF9830",
3077
+ "mode": "fixed"
3078
+ }
3079
+ }
3080
+ ]
3081
+ }
3082
+ ]
3083
+ },
3084
+ "gridPos": {
3085
+ "h": 7,
3086
+ "w": 4,
3087
+ "x": 0,
3088
+ "y": 17
3089
+ },
3090
+ "id": 94,
3091
+ "links": [],
3092
+ "maxDataPoints": 3,
3093
+ "options": {
3094
+ "displayLabels": [],
3095
+ "legend": {
3096
+ "calcs": [],
3097
+ "displayMode": "hidden",
3098
+ "placement": "bottom",
3099
+ "values": ["value"]
3100
+ },
3101
+ "pieType": "donut",
3102
+ "reduceOptions": {
3103
+ "calcs": ["sum"],
3104
+ "fields": "",
3105
+ "values": false
3106
+ },
3107
+ "text": {},
3108
+ "tooltip": {
3109
+ "mode": "single",
3110
+ "sort": "none"
3111
+ }
3112
+ },
3113
+ "targets": [
3114
+ {
3115
+ "bucketAggs": [
3116
+ {
3117
+ "$$hashKey": "object:73",
3118
+ "fake": true,
3119
+ "field": "data_win_eventdata_authenticationPackageName",
3120
+ "id": "3",
3121
+ "settings": {
3122
+ "min_doc_count": 1,
3123
+ "order": "desc",
3124
+ "orderBy": "_count",
3125
+ "size": "0"
3126
+ },
3127
+ "type": "terms"
3128
+ },
3129
+ {
3130
+ "$$hashKey": "object:74",
3131
+ "field": "timestamp",
3132
+ "id": "2",
3133
+ "settings": {
3134
+ "interval": "auto",
3135
+ "min_doc_count": 0,
3136
+ "trimEdges": 0
3137
+ },
3138
+ "type": "date_histogram"
3139
+ }
3140
+ ],
3141
+ "datasource": {
3142
+ "type": "elasticsearch",
3143
+ "uid": "wazuh_datasource_uid"
3144
+ },
3145
+ "metrics": [
3146
+ {
3147
+ "$$hashKey": "object:71",
3148
+ "field": "select field",
3149
+ "id": "1",
3150
+ "type": "count"
3151
+ }
3152
+ ],
3153
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
3154
+ "refId": "A",
3155
+ "timeField": "timestamp"
3156
+ }
3157
+ ],
3158
+ "title": "WINDOWS SECURITY - AUTH TYPES",
3159
+ "type": "piechart"
3160
+ },
3161
+ {
3162
+ "datasource": {
3163
+ "type": "elasticsearch",
3164
+ "uid": "wazuh_datasource_uid"
3165
+ },
3166
+ "fieldConfig": {
3167
+ "defaults": {
3168
+ "custom": {
3169
+ "align": "auto",
3170
+ "displayMode": "auto",
3171
+ "filterable": false,
3172
+ "inspect": false
3173
+ },
3174
+ "mappings": [],
3175
+ "thresholds": {
3176
+ "mode": "absolute",
3177
+ "steps": [
3178
+ {
3179
+ "color": "orange"
3180
+ },
3181
+ {
3182
+ "color": "red",
3183
+ "value": 80
3184
+ }
3185
+ ]
3186
+ }
3187
+ },
3188
+ "overrides": []
3189
+ },
3190
+ "gridPos": {
3191
+ "h": 7,
3192
+ "w": 5,
3193
+ "x": 4,
3194
+ "y": 17
3195
+ },
3196
+ "id": 95,
3197
+ "links": [],
3198
+ "maxDataPoints": 3,
3199
+ "options": {
3200
+ "footer": {
3201
+ "fields": "",
3202
+ "reducer": ["sum"],
3203
+ "show": false
3204
+ },
3205
+ "showHeader": true
3206
+ },
3207
+ "pluginVersion": "9.0.0",
3208
+ "targets": [
3209
+ {
3210
+ "bucketAggs": [
3211
+ {
3212
+ "$$hashKey": "object:2063",
3213
+ "fake": true,
3214
+ "field": "data_win_eventdata_authenticationPackageName",
3215
+ "id": "4",
3216
+ "settings": {
3217
+ "min_doc_count": "1",
3218
+ "order": "desc",
3219
+ "orderBy": "_count",
3220
+ "size": "10"
3221
+ },
3222
+ "type": "terms"
3223
+ }
3224
+ ],
3225
+ "datasource": {
3226
+ "type": "elasticsearch",
3227
+ "uid": "wazuh_datasource_uid"
3228
+ },
3229
+ "metrics": [
3230
+ {
3231
+ "$$hashKey": "object:71",
3232
+ "field": "select field",
3233
+ "id": "1",
3234
+ "type": "count"
3235
+ }
3236
+ ],
3237
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
3238
+ "refId": "A",
3239
+ "timeField": "timestamp"
3240
+ }
3241
+ ],
3242
+ "title": "WINDOWS SECURITY - AUTH TYPES",
3243
+ "type": "table"
3244
+ },
3245
+ {
3246
+ "datasource": {
3247
+ "type": "elasticsearch",
3248
+ "uid": "wazuh_datasource_uid"
3249
+ },
3250
+ "fieldConfig": {
3251
+ "defaults": {
3252
+ "custom": {
3253
+ "align": "auto",
3254
+ "displayMode": "auto",
3255
+ "filterable": false,
3256
+ "inspect": false
3257
+ },
3258
+ "mappings": [],
3259
+ "thresholds": {
3260
+ "mode": "absolute",
3261
+ "steps": [
3262
+ {
3263
+ "color": "orange"
3264
+ },
3265
+ {
3266
+ "color": "red",
3267
+ "value": 50
3268
+ }
3269
+ ]
3270
+ }
3271
+ },
3272
+ "overrides": [
3273
+ {
3274
+ "matcher": {
3275
+ "id": "byName",
3276
+ "options": "Count"
3277
+ },
3278
+ "properties": [
3279
+ {
3280
+ "id": "custom.displayMode",
3281
+ "value": "basic"
3282
+ }
3283
+ ]
3284
+ }
3285
+ ]
3286
+ },
3287
+ "gridPos": {
3288
+ "h": 7,
3289
+ "w": 15,
3290
+ "x": 9,
3291
+ "y": 17
3292
+ },
3293
+ "id": 96,
3294
+ "links": [],
3295
+ "maxDataPoints": 3,
3296
+ "options": {
3297
+ "footer": {
3298
+ "fields": "",
3299
+ "reducer": ["sum"],
3300
+ "show": false
3301
+ },
3302
+ "showHeader": true
3303
+ },
3304
+ "pluginVersion": "9.0.0",
3305
+ "targets": [
3306
+ {
3307
+ "bucketAggs": [
3308
+ {
3309
+ "$$hashKey": "object:3082",
3310
+ "fake": true,
3311
+ "field": "data_win_eventdata_subjectUserName",
3312
+ "id": "4",
3313
+ "settings": {
3314
+ "min_doc_count": 0,
3315
+ "order": "desc",
3316
+ "orderBy": "_count",
3317
+ "size": "10"
3318
+ },
3319
+ "type": "terms"
3320
+ },
3321
+ {
3322
+ "$$hashKey": "object:73",
3323
+ "fake": true,
3324
+ "field": "rule_level",
3325
+ "id": "3",
3326
+ "settings": {
3327
+ "min_doc_count": 1,
3328
+ "order": "desc",
3329
+ "orderBy": "_count",
3330
+ "size": "0"
3331
+ },
3332
+ "type": "terms"
3333
+ }
3334
+ ],
3335
+ "datasource": {
3336
+ "type": "elasticsearch",
3337
+ "uid": "wazuh_datasource_uid"
3338
+ },
3339
+ "metrics": [
3340
+ {
3341
+ "$$hashKey": "object:71",
3342
+ "field": "select field",
3343
+ "id": "1",
3344
+ "type": "count"
3345
+ }
3346
+ ],
3347
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
3348
+ "refId": "A",
3349
+ "timeField": "timestamp"
3350
+ }
3351
+ ],
3352
+ "title": "WINDOWS SECURITY - ACCOUNTS",
3353
+ "type": "table"
3354
+ },
3355
+ {
3356
+ "datasource": {
3357
+ "type": "elasticsearch",
3358
+ "uid": "wazuh_datasource_uid"
3359
+ },
3360
+ "fieldConfig": {
3361
+ "defaults": {
3362
+ "color": {
3363
+ "mode": "thresholds"
3364
+ },
3365
+ "custom": {
3366
+ "align": "auto",
3367
+ "displayMode": "auto",
3368
+ "inspect": false
3369
+ },
3370
+ "mappings": [],
3371
+ "thresholds": {
3372
+ "mode": "absolute",
3373
+ "steps": [
3374
+ {
3375
+ "color": "green"
3376
+ },
3377
+ {
3378
+ "color": "red",
3379
+ "value": 80
3380
+ }
3381
+ ]
3382
+ }
3383
+ },
3384
+ "overrides": [
3385
+ {
3386
+ "matcher": {
3387
+ "id": "byName",
3388
+ "options": "rule_level"
3389
+ },
3390
+ "properties": [
3391
+ {
3392
+ "id": "custom.width",
3393
+ "value": 93
3394
+ }
3395
+ ]
3396
+ },
3397
+ {
3398
+ "matcher": {
3399
+ "id": "byName",
3400
+ "options": "windows_event_id"
3401
+ },
3402
+ "properties": [
3403
+ {
3404
+ "id": "custom.width",
3405
+ "value": 186
3406
+ }
3407
+ ]
3408
+ },
3409
+ {
3410
+ "matcher": {
3411
+ "id": "byName",
3412
+ "options": "DATE/TIME"
3413
+ },
3414
+ "properties": [
3415
+ {
3416
+ "id": "custom.width",
3417
+ "value": 202
3418
+ }
3419
+ ]
3420
+ },
3421
+ {
3422
+ "matcher": {
3423
+ "id": "byName",
3424
+ "options": "AGENT"
3425
+ },
3426
+ "properties": [
3427
+ {
3428
+ "id": "custom.width",
3429
+ "value": 171
3430
+ }
3431
+ ]
3432
+ },
3433
+ {
3434
+ "matcher": {
3435
+ "id": "byName",
3436
+ "options": "SRC IP"
3437
+ },
3438
+ "properties": [
3439
+ {
3440
+ "id": "custom.width",
3441
+ "value": 167
3442
+ }
3443
+ ]
3444
+ },
3445
+ {
3446
+ "matcher": {
3447
+ "id": "byName",
3448
+ "options": "MESSAGE"
3449
+ },
3450
+ "properties": [
3451
+ {
3452
+ "id": "custom.width",
3453
+ "value": 1622
3454
+ }
3455
+ ]
3456
+ },
3457
+ {
3458
+ "matcher": {
3459
+ "id": "byName",
3460
+ "options": "rule_description"
3461
+ },
3462
+ "properties": [
3463
+ {
3464
+ "id": "custom.width",
3465
+ "value": 524
3466
+ }
3467
+ ]
3468
+ },
3469
+ {
3470
+ "matcher": {
3471
+ "id": "byName",
3472
+ "options": "EVENT ID"
3473
+ },
3474
+ "properties": [
3475
+ {
3476
+ "id": "links",
3477
+ "value": [
3478
+ {
3479
+ "targetBlank": true,
3480
+ "title": "VIEW EVENT DETAILS",
3481
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
3482
+ }
3483
+ ]
3484
+ }
3485
+ ]
3486
+ }
3487
+ ]
3488
+ },
3489
+ "gridPos": {
3490
+ "h": 10,
3491
+ "w": 24,
3492
+ "x": 0,
3493
+ "y": 24
3494
+ },
3495
+ "id": 93,
3496
+ "options": {
3497
+ "footer": {
3498
+ "fields": "",
3499
+ "reducer": ["sum"],
3500
+ "show": false
3501
+ },
3502
+ "showHeader": true,
3503
+ "sortBy": []
3504
+ },
3505
+ "pluginVersion": "9.0.0",
3506
+ "targets": [
3507
+ {
3508
+ "alias": "",
3509
+ "bucketAggs": [],
3510
+ "datasource": {
3511
+ "type": "elasticsearch",
3512
+ "uid": "wazuh_datasource_uid"
3513
+ },
3514
+ "metrics": [
3515
+ {
3516
+ "id": "1",
3517
+ "settings": {
3518
+ "size": "500"
3519
+ },
3520
+ "type": "raw_data"
3521
+ }
3522
+ ],
3523
+ "query": "rule_groups:*windows_security* AND agent_name:$agent_name",
3524
+ "queryType": "lucene",
3525
+ "refId": "A",
3526
+ "timeField": "timestamp"
3527
+ }
3528
+ ],
3529
+ "title": "WINDOWS SECURITY - EVENTS",
3530
+ "transformations": [
3531
+ {
3532
+ "id": "organize",
3533
+ "options": {
3534
+ "excludeByName": {
3535
+ "@metadata_beat": true,
3536
+ "@metadata_type": true,
3537
+ "@metadata_version": true,
3538
+ "_id": false,
3539
+ "_index": true,
3540
+ "_type": true,
3541
+ "agent_ephemeral_id": true,
3542
+ "agent_hostname": true,
3543
+ "agent_id": true,
3544
+ "agent_ip": false,
3545
+ "agent_ip_city_name": true,
3546
+ "agent_ip_country_code": true,
3547
+ "agent_ip_geolocation": true,
3548
+ "agent_labels_customer": true,
3549
+ "agent_name": false,
3550
+ "agent_type": true,
3551
+ "agent_version": true,
3552
+ "beats_type": true,
3553
+ "collector_node_id": true,
3554
+ "data_win_eventXML_binaryData": true,
3555
+ "data_win_eventXML_binaryDataSize": true,
3556
+ "data_win_eventXML_param1": true,
3557
+ "data_win_eventdata_accessMask": true,
3558
+ "data_win_eventdata_authenticationPackageName": true,
3559
+ "data_win_eventdata_binary": true,
3560
+ "data_win_eventdata_data": true,
3561
+ "data_win_eventdata_domain": true,
3562
+ "data_win_eventdata_elevatedToken": true,
3563
+ "data_win_eventdata_failureReason": true,
3564
+ "data_win_eventdata_handleId": true,
3565
+ "data_win_eventdata_imagePath": true,
3566
+ "data_win_eventdata_impersonationLevel": true,
3567
+ "data_win_eventdata_ipAddress": true,
3568
+ "data_win_eventdata_ipPort": true,
3569
+ "data_win_eventdata_keyLength": true,
3570
+ "data_win_eventdata_lmPackageName": true,
3571
+ "data_win_eventdata_logonGuid": true,
3572
+ "data_win_eventdata_logonProcessName": true,
3573
+ "data_win_eventdata_logonType": true,
3574
+ "data_win_eventdata_objectServer": true,
3575
+ "data_win_eventdata_packageName": true,
3576
+ "data_win_eventdata_passwordLastSet": true,
3577
+ "data_win_eventdata_privilegeList": true,
3578
+ "data_win_eventdata_processId": true,
3579
+ "data_win_eventdata_processName": true,
3580
+ "data_win_eventdata_restrictedAdminMode": true,
3581
+ "data_win_eventdata_sID": true,
3582
+ "data_win_eventdata_serviceName": true,
3583
+ "data_win_eventdata_serviceSid": true,
3584
+ "data_win_eventdata_serviceType": true,
3585
+ "data_win_eventdata_startType": true,
3586
+ "data_win_eventdata_status": true,
3587
+ "data_win_eventdata_subStatus": true,
3588
+ "data_win_eventdata_subjectDomainName": true,
3589
+ "data_win_eventdata_subjectLogonId": true,
3590
+ "data_win_eventdata_subjectUserName": true,
3591
+ "data_win_eventdata_subjectUserSid": true,
3592
+ "data_win_eventdata_targetDomainName": true,
3593
+ "data_win_eventdata_targetLinkedLogonId": true,
3594
+ "data_win_eventdata_targetLogonId": true,
3595
+ "data_win_eventdata_targetSid": true,
3596
+ "data_win_eventdata_targetUserName": true,
3597
+ "data_win_eventdata_targetUserSid": true,
3598
+ "data_win_eventdata_ticketEncryptionType": true,
3599
+ "data_win_eventdata_ticketOptions": true,
3600
+ "data_win_eventdata_user": true,
3601
+ "data_win_eventdata_virtualAccount": true,
3602
+ "data_win_eventdata_workstation": true,
3603
+ "data_win_eventdata_workstationName": true,
3604
+ "data_win_system_channel": true,
3605
+ "data_win_system_computer": true,
3606
+ "data_win_system_eventID": true,
3607
+ "data_win_system_eventRecordID": true,
3608
+ "data_win_system_eventSourceName": true,
3609
+ "data_win_system_keywords": true,
3610
+ "data_win_system_level": true,
3611
+ "data_win_system_opcode": true,
3612
+ "data_win_system_processID": true,
3613
+ "data_win_system_providerGuid": true,
3614
+ "data_win_system_providerName": true,
3615
+ "data_win_system_severityValue": true,
3616
+ "data_win_system_systemTime": true,
3617
+ "data_win_system_task": true,
3618
+ "data_win_system_threadID": true,
3619
+ "data_win_system_version": true,
3620
+ "decoder_name": true,
3621
+ "ecs_version": true,
3622
+ "gl2_accounted_message_size": true,
3623
+ "gl2_message_id": true,
3624
+ "gl2_processing_error": true,
3625
+ "gl2_remote_ip": true,
3626
+ "gl2_remote_port": true,
3627
+ "gl2_source_collector": true,
3628
+ "gl2_source_input": true,
3629
+ "gl2_source_node": true,
3630
+ "highlight": true,
3631
+ "host_name": true,
3632
+ "id": true,
3633
+ "location": true,
3634
+ "log_file_path": true,
3635
+ "log_offset": true,
3636
+ "manager_name": true,
3637
+ "message": true,
3638
+ "previous_output": true,
3639
+ "process_id": true,
3640
+ "rule_description": true,
3641
+ "rule_firedtimes": true,
3642
+ "rule_frequency": true,
3643
+ "rule_gdpr": true,
3644
+ "rule_gpg13": true,
3645
+ "rule_group1": true,
3646
+ "rule_group2": true,
3647
+ "rule_group3": true,
3648
+ "rule_groups": true,
3649
+ "rule_hipaa": true,
3650
+ "rule_id": true,
3651
+ "rule_mail": true,
3652
+ "rule_mitre_id": true,
3653
+ "rule_mitre_tactic": true,
3654
+ "rule_mitre_technique": true,
3655
+ "rule_nist_800_53": true,
3656
+ "rule_pci_dss": true,
3657
+ "rule_tsc": true,
3658
+ "sort": true,
3659
+ "source": true,
3660
+ "src_ip": true,
3661
+ "src_ip_city_name": true,
3662
+ "src_ip_country_code": true,
3663
+ "src_ip_geolocation": true,
3664
+ "streams": true,
3665
+ "syslog_tag": true,
3666
+ "syslog_type": true,
3667
+ "timestamp": false,
3668
+ "true": true,
3669
+ "user_name": true,
3670
+ "win_system_eventID": true,
3671
+ "windows_auth_package": true,
3672
+ "windows_domain": true,
3673
+ "windows_event_id": true,
3674
+ "windows_event_severity": false,
3675
+ "windows_logon_type": true
3676
+ },
3677
+ "indexByName": {
3678
+ "_id": 1,
3679
+ "_index": 3,
3680
+ "_type": 4,
3681
+ "agent_id": 5,
3682
+ "agent_ip": 6,
3683
+ "agent_ip_city_name": 7,
3684
+ "agent_ip_country_code": 8,
3685
+ "agent_ip_geolocation": 9,
3686
+ "agent_labels_customer": 54,
3687
+ "agent_name": 2,
3688
+ "data_win_eventdata_authenticationPackageName": 55,
3689
+ "data_win_eventdata_elevatedToken": 56,
3690
+ "data_win_eventdata_impersonationLevel": 57,
3691
+ "data_win_eventdata_ipAddress": 58,
3692
+ "data_win_eventdata_ipPort": 59,
3693
+ "data_win_eventdata_keyLength": 60,
3694
+ "data_win_eventdata_logonGuid": 61,
3695
+ "data_win_eventdata_logonProcessName": 62,
3696
+ "data_win_eventdata_logonType": 63,
3697
+ "data_win_eventdata_processId": 64,
3698
+ "data_win_eventdata_processName": 65,
3699
+ "data_win_eventdata_serviceName": 66,
3700
+ "data_win_eventdata_serviceSid": 67,
3701
+ "data_win_eventdata_status": 68,
3702
+ "data_win_eventdata_subjectDomainName": 69,
3703
+ "data_win_eventdata_subjectLogonId": 70,
3704
+ "data_win_eventdata_subjectUserName": 71,
3705
+ "data_win_eventdata_subjectUserSid": 72,
3706
+ "data_win_eventdata_targetDomainName": 73,
3707
+ "data_win_eventdata_targetLinkedLogonId": 74,
3708
+ "data_win_eventdata_targetLogonId": 75,
3709
+ "data_win_eventdata_targetUserName": 76,
3710
+ "data_win_eventdata_targetUserSid": 77,
3711
+ "data_win_eventdata_ticketEncryptionType": 78,
3712
+ "data_win_eventdata_ticketOptions": 79,
3713
+ "data_win_eventdata_virtualAccount": 80,
3714
+ "data_win_system_channel": 10,
3715
+ "data_win_system_computer": 11,
3716
+ "data_win_system_eventID": 12,
3717
+ "data_win_system_eventRecordID": 13,
3718
+ "data_win_system_keywords": 14,
3719
+ "data_win_system_level": 15,
3720
+ "data_win_system_message": 16,
3721
+ "data_win_system_opcode": 17,
3722
+ "data_win_system_processID": 18,
3723
+ "data_win_system_providerGuid": 19,
3724
+ "data_win_system_providerName": 20,
3725
+ "data_win_system_severityValue": 21,
3726
+ "data_win_system_systemTime": 22,
3727
+ "data_win_system_task": 23,
3728
+ "data_win_system_threadID": 24,
3729
+ "data_win_system_version": 25,
3730
+ "decoder_name": 26,
3731
+ "gl2_accounted_message_size": 27,
3732
+ "gl2_message_id": 28,
3733
+ "gl2_processing_error": 81,
3734
+ "gl2_remote_ip": 29,
3735
+ "gl2_remote_port": 30,
3736
+ "gl2_source_input": 31,
3737
+ "gl2_source_node": 32,
3738
+ "highlight": 33,
3739
+ "id": 34,
3740
+ "location": 35,
3741
+ "manager_name": 36,
3742
+ "message": 37,
3743
+ "rule_description": 38,
3744
+ "rule_firedtimes": 39,
3745
+ "rule_gdpr": 40,
3746
+ "rule_gpg13": 41,
3747
+ "rule_group1": 82,
3748
+ "rule_group2": 83,
3749
+ "rule_group3": 84,
3750
+ "rule_groups": 42,
3751
+ "rule_hipaa": 43,
3752
+ "rule_id": 44,
3753
+ "rule_level": 45,
3754
+ "rule_mail": 46,
3755
+ "rule_mitre_id": 85,
3756
+ "rule_mitre_tactic": 86,
3757
+ "rule_mitre_technique": 87,
3758
+ "rule_nist_800_53": 47,
3759
+ "rule_pci_dss": 48,
3760
+ "rule_tsc": 49,
3761
+ "sort": 50,
3762
+ "source": 51,
3763
+ "streams": 52,
3764
+ "syslog_level": 88,
3765
+ "syslog_type": 53,
3766
+ "timestamp": 0,
3767
+ "true": 89
3768
+ },
3769
+ "renameByName": {
3770
+ "_id": "EVENT ID",
3771
+ "agent_ip": "SRC IP",
3772
+ "agent_name": "AGENT",
3773
+ "data_win_system_message": "MESSAGE",
3774
+ "data_win_system_providerGuid": "",
3775
+ "rule_level": "RULE LEVEL",
3776
+ "syslog_level": "LEVEL",
3777
+ "timestamp": "DATE/TIME",
3778
+ "windows_event_severity": "EVENT LOG SEVERITY"
3779
+ }
3780
+ }
3781
+ }
3782
+ ],
3783
+ "type": "table"
3784
+ }
3785
+ ],
3786
+ "title": "WINDOWS EVENT LOGS - SECURITY",
3787
+ "type": "row"
3788
+ },
3789
+ {
3790
+ "collapsed": true,
3791
+ "datasource": {
3792
+ "type": "elasticsearch",
3793
+ "uid": "wazuh_datasource_uid"
3794
+ },
3795
+ "gridPos": {
3796
+ "h": 1,
3797
+ "w": 24,
3798
+ "x": 0,
3799
+ "y": 3
3800
+ },
3801
+ "id": 98,
3802
+ "panels": [
3803
+ {
3804
+ "datasource": {
3805
+ "type": "elasticsearch",
3806
+ "uid": "wazuh_datasource_uid"
3807
+ },
3808
+ "fieldConfig": {
3809
+ "defaults": {
3810
+ "mappings": [
3811
+ {
3812
+ "options": {
3813
+ "match": "null",
3814
+ "result": {
3815
+ "text": "N/A"
3816
+ }
3817
+ },
3818
+ "type": "special"
3819
+ }
3820
+ ],
3821
+ "thresholds": {
3822
+ "mode": "absolute",
3823
+ "steps": [
3824
+ {
3825
+ "color": "blue"
3826
+ }
3827
+ ]
3828
+ },
3829
+ "unit": "short"
3830
+ },
3831
+ "overrides": []
3832
+ },
3833
+ "gridPos": {
3834
+ "h": 7,
3835
+ "w": 4,
3836
+ "x": 0,
3837
+ "y": 4
3838
+ },
3839
+ "id": 99,
3840
+ "links": [],
3841
+ "options": {
3842
+ "colorMode": "value",
3843
+ "graphMode": "area",
3844
+ "justifyMode": "auto",
3845
+ "orientation": "horizontal",
3846
+ "reduceOptions": {
3847
+ "calcs": ["sum"],
3848
+ "fields": "",
3849
+ "values": false
3850
+ },
3851
+ "text": {},
3852
+ "textMode": "auto"
3853
+ },
3854
+ "pluginVersion": "9.0.0",
3855
+ "targets": [
3856
+ {
3857
+ "bucketAggs": [
3858
+ {
3859
+ "$$hashKey": "object:50",
3860
+ "field": "timestamp",
3861
+ "id": "2",
3862
+ "settings": {
3863
+ "interval": "auto",
3864
+ "min_doc_count": 0,
3865
+ "trimEdges": 0
3866
+ },
3867
+ "type": "date_histogram"
3868
+ }
3869
+ ],
3870
+ "datasource": {
3871
+ "type": "elasticsearch",
3872
+ "uid": "wazuh_datasource_uid"
3873
+ },
3874
+ "metrics": [
3875
+ {
3876
+ "$$hashKey": "object:48",
3877
+ "field": "select field",
3878
+ "id": "1",
3879
+ "type": "count"
3880
+ }
3881
+ ],
3882
+ "query": "rule_group2:windows_logonsessions AND agent_name:$agent_name",
3883
+ "refId": "A",
3884
+ "timeField": "timestamp"
3885
+ }
3886
+ ],
3887
+ "title": "WINDOWS LOGON SESSIONS",
3888
+ "type": "stat"
3889
+ },
3890
+ {
3891
+ "datasource": {
3892
+ "type": "elasticsearch",
3893
+ "uid": "wazuh_datasource_uid"
3894
+ },
3895
+ "fieldConfig": {
3896
+ "defaults": {
3897
+ "color": {
3898
+ "mode": "palette-classic"
3899
+ },
3900
+ "custom": {
3901
+ "hideFrom": {
3902
+ "legend": false,
3903
+ "tooltip": false,
3904
+ "viz": false
3905
+ }
3906
+ },
3907
+ "decimals": 0,
3908
+ "mappings": [],
3909
+ "unit": "short"
3910
+ },
3911
+ "overrides": [
3912
+ {
3913
+ "matcher": {
3914
+ "id": "byName",
3915
+ "options": "1"
3916
+ },
3917
+ "properties": [
3918
+ {
3919
+ "id": "color",
3920
+ "value": {
3921
+ "fixedColor": "#FF9830",
3922
+ "mode": "fixed"
3923
+ }
3924
+ }
3925
+ ]
3926
+ },
3927
+ {
3928
+ "matcher": {
3929
+ "id": "byName",
3930
+ "options": "Alert"
3931
+ },
3932
+ "properties": [
3933
+ {
3934
+ "id": "color",
3935
+ "value": {
3936
+ "fixedColor": "#F2495C",
3937
+ "mode": "fixed"
3938
+ }
3939
+ }
3940
+ ]
3941
+ },
3942
+ {
3943
+ "matcher": {
3944
+ "id": "byName",
3945
+ "options": "Error"
3946
+ },
3947
+ "properties": [
3948
+ {
3949
+ "id": "color",
3950
+ "value": {
3951
+ "fixedColor": "#F2495C",
3952
+ "mode": "fixed"
3953
+ }
3954
+ }
3955
+ ]
3956
+ },
3957
+ {
3958
+ "matcher": {
3959
+ "id": "byName",
3960
+ "options": "Info"
3961
+ },
3962
+ "properties": [
3963
+ {
3964
+ "id": "color",
3965
+ "value": {
3966
+ "fixedColor": "#73BF69",
3967
+ "mode": "fixed"
3968
+ }
3969
+ }
3970
+ ]
3971
+ },
3972
+ {
3973
+ "matcher": {
3974
+ "id": "byName",
3975
+ "options": "NOTICE"
3976
+ },
3977
+ "properties": [
3978
+ {
3979
+ "id": "color",
3980
+ "value": {
3981
+ "fixedColor": "#5794F2",
3982
+ "mode": "fixed"
3983
+ }
3984
+ }
3985
+ ]
3986
+ },
3987
+ {
3988
+ "matcher": {
3989
+ "id": "byName",
3990
+ "options": "Notice"
3991
+ },
3992
+ "properties": [
3993
+ {
3994
+ "id": "color",
3995
+ "value": {
3996
+ "fixedColor": "#5794F2",
3997
+ "mode": "fixed"
3998
+ }
3999
+ }
4000
+ ]
4001
+ },
4002
+ {
4003
+ "matcher": {
4004
+ "id": "byName",
4005
+ "options": "Result"
4006
+ },
4007
+ "properties": [
4008
+ {
4009
+ "id": "color",
4010
+ "value": {
4011
+ "fixedColor": "#B877D9",
4012
+ "mode": "fixed"
4013
+ }
4014
+ }
4015
+ ]
4016
+ },
4017
+ {
4018
+ "matcher": {
4019
+ "id": "byName",
4020
+ "options": "Warning"
4021
+ },
4022
+ "properties": [
4023
+ {
4024
+ "id": "color",
4025
+ "value": {
4026
+ "fixedColor": "#FF9830",
4027
+ "mode": "fixed"
4028
+ }
4029
+ }
4030
+ ]
4031
+ }
4032
+ ]
4033
+ },
4034
+ "gridPos": {
4035
+ "h": 7,
4036
+ "w": 5,
4037
+ "x": 4,
4038
+ "y": 4
4039
+ },
4040
+ "id": 102,
4041
+ "links": [],
4042
+ "maxDataPoints": 3,
4043
+ "options": {
4044
+ "displayLabels": [],
4045
+ "legend": {
4046
+ "calcs": [],
4047
+ "displayMode": "hidden",
4048
+ "placement": "bottom",
4049
+ "values": ["value"]
4050
+ },
4051
+ "pieType": "donut",
4052
+ "reduceOptions": {
4053
+ "calcs": ["sum"],
4054
+ "fields": "",
4055
+ "values": false
4056
+ },
4057
+ "text": {},
4058
+ "tooltip": {
4059
+ "mode": "single",
4060
+ "sort": "none"
4061
+ }
4062
+ },
4063
+ "targets": [
4064
+ {
4065
+ "bucketAggs": [
4066
+ {
4067
+ "$$hashKey": "object:73",
4068
+ "fake": true,
4069
+ "field": "data_LogonType",
4070
+ "id": "3",
4071
+ "settings": {
4072
+ "min_doc_count": 1,
4073
+ "order": "desc",
4074
+ "orderBy": "_count",
4075
+ "size": "0"
4076
+ },
4077
+ "type": "terms"
4078
+ },
4079
+ {
4080
+ "$$hashKey": "object:74",
4081
+ "field": "timestamp",
4082
+ "id": "2",
4083
+ "settings": {
4084
+ "interval": "auto",
4085
+ "min_doc_count": 0,
4086
+ "trimEdges": 0
4087
+ },
4088
+ "type": "date_histogram"
4089
+ }
4090
+ ],
4091
+ "datasource": {
4092
+ "type": "elasticsearch",
4093
+ "uid": "wazuh_datasource_uid"
4094
+ },
4095
+ "metrics": [
4096
+ {
4097
+ "$$hashKey": "object:71",
4098
+ "field": "select field",
4099
+ "id": "1",
4100
+ "type": "count"
4101
+ }
4102
+ ],
4103
+ "query": "rule_group2:windows_logonsessions AND agent_name:$agent_name",
4104
+ "refId": "A",
4105
+ "timeField": "timestamp"
4106
+ }
4107
+ ],
4108
+ "title": "WINDOWS LOGON SESSIONS - LOGON TYPES",
4109
+ "type": "piechart"
4110
+ },
4111
+ {
4112
+ "datasource": {
4113
+ "type": "elasticsearch",
4114
+ "uid": "wazuh_datasource_uid"
4115
+ },
4116
+ "fieldConfig": {
4117
+ "defaults": {
4118
+ "custom": {
4119
+ "align": "auto",
4120
+ "displayMode": "auto",
4121
+ "filterable": false,
4122
+ "inspect": false
4123
+ },
4124
+ "mappings": [],
4125
+ "thresholds": {
4126
+ "mode": "absolute",
4127
+ "steps": [
4128
+ {
4129
+ "color": "orange"
4130
+ },
4131
+ {
4132
+ "color": "red",
4133
+ "value": 80
4134
+ }
4135
+ ]
4136
+ }
4137
+ },
4138
+ "overrides": [
4139
+ {
4140
+ "matcher": {
4141
+ "id": "byName",
4142
+ "options": "data_LogonType"
4143
+ },
4144
+ "properties": [
4145
+ {
4146
+ "id": "custom.width",
4147
+ "value": 218
4148
+ }
4149
+ ]
4150
+ }
4151
+ ]
4152
+ },
4153
+ "gridPos": {
4154
+ "h": 7,
4155
+ "w": 5,
4156
+ "x": 9,
4157
+ "y": 4
4158
+ },
4159
+ "id": 101,
4160
+ "links": [],
4161
+ "maxDataPoints": 3,
4162
+ "options": {
4163
+ "footer": {
4164
+ "fields": "",
4165
+ "reducer": ["sum"],
4166
+ "show": false
4167
+ },
4168
+ "showHeader": true,
4169
+ "sortBy": []
4170
+ },
4171
+ "pluginVersion": "9.0.0",
4172
+ "targets": [
4173
+ {
4174
+ "bucketAggs": [
4175
+ {
4176
+ "$$hashKey": "object:2063",
4177
+ "fake": true,
4178
+ "field": "data_LogonType",
4179
+ "id": "4",
4180
+ "settings": {
4181
+ "min_doc_count": "1",
4182
+ "order": "desc",
4183
+ "orderBy": "_count",
4184
+ "size": "10"
4185
+ },
4186
+ "type": "terms"
4187
+ }
4188
+ ],
4189
+ "datasource": {
4190
+ "type": "elasticsearch",
4191
+ "uid": "wazuh_datasource_uid"
4192
+ },
4193
+ "metrics": [
4194
+ {
4195
+ "$$hashKey": "object:71",
4196
+ "field": "select field",
4197
+ "id": "1",
4198
+ "type": "count"
4199
+ }
4200
+ ],
4201
+ "query": "rule_group2:windows_logonsessions AND agent_name:$agent_name",
4202
+ "refId": "A",
4203
+ "timeField": "timestamp"
4204
+ }
4205
+ ],
4206
+ "title": "WINDOWS LOGON SESSIONS - LOGON TYPES",
4207
+ "type": "table"
4208
+ },
4209
+ {
4210
+ "datasource": {
4211
+ "type": "elasticsearch",
4212
+ "uid": "wazuh_datasource_uid"
4213
+ },
4214
+ "fieldConfig": {
4215
+ "defaults": {
4216
+ "custom": {
4217
+ "align": "auto",
4218
+ "displayMode": "auto",
4219
+ "filterable": false,
4220
+ "inspect": false
4221
+ },
4222
+ "mappings": [],
4223
+ "thresholds": {
4224
+ "mode": "absolute",
4225
+ "steps": [
4226
+ {
4227
+ "color": "orange"
4228
+ },
4229
+ {
4230
+ "color": "red",
4231
+ "value": 80
4232
+ }
4233
+ ]
4234
+ }
4235
+ },
4236
+ "overrides": [
4237
+ {
4238
+ "matcher": {
4239
+ "id": "byName",
4240
+ "options": "data_UserName"
4241
+ },
4242
+ "properties": [
4243
+ {
4244
+ "id": "custom.width",
4245
+ "value": 511
4246
+ }
4247
+ ]
4248
+ }
4249
+ ]
4250
+ },
4251
+ "gridPos": {
4252
+ "h": 7,
4253
+ "w": 10,
4254
+ "x": 14,
4255
+ "y": 4
4256
+ },
4257
+ "id": 105,
4258
+ "links": [],
4259
+ "maxDataPoints": 3,
4260
+ "options": {
4261
+ "footer": {
4262
+ "fields": "",
4263
+ "reducer": ["sum"],
4264
+ "show": false
4265
+ },
4266
+ "showHeader": true,
4267
+ "sortBy": []
4268
+ },
4269
+ "pluginVersion": "9.0.0",
4270
+ "targets": [
4271
+ {
4272
+ "bucketAggs": [
4273
+ {
4274
+ "$$hashKey": "object:2063",
4275
+ "fake": true,
4276
+ "field": "data_UserName",
4277
+ "id": "4",
4278
+ "settings": {
4279
+ "min_doc_count": "1",
4280
+ "order": "desc",
4281
+ "orderBy": "_count",
4282
+ "size": "0"
4283
+ },
4284
+ "type": "terms"
4285
+ }
4286
+ ],
4287
+ "datasource": {
4288
+ "type": "elasticsearch",
4289
+ "uid": "wazuh_datasource_uid"
4290
+ },
4291
+ "metrics": [
4292
+ {
4293
+ "$$hashKey": "object:71",
4294
+ "field": "select field",
4295
+ "id": "1",
4296
+ "type": "count"
4297
+ }
4298
+ ],
4299
+ "query": "rule_group2:windows_logonsessions AND agent_name:$agent_name",
4300
+ "refId": "A",
4301
+ "timeField": "timestamp"
4302
+ }
4303
+ ],
4304
+ "title": "WINDOWS LOGON SESSIONS - ACCOUNTS",
4305
+ "type": "table"
4306
+ },
4307
+ {
4308
+ "datasource": {
4309
+ "type": "elasticsearch",
4310
+ "uid": "wazuh_datasource_uid"
4311
+ },
4312
+ "fieldConfig": {
4313
+ "defaults": {
4314
+ "custom": {
4315
+ "align": "auto",
4316
+ "displayMode": "auto",
4317
+ "filterable": false,
4318
+ "inspect": false
4319
+ },
4320
+ "mappings": [],
4321
+ "thresholds": {
4322
+ "mode": "absolute",
4323
+ "steps": [
4324
+ {
4325
+ "color": "orange"
4326
+ },
4327
+ {
4328
+ "color": "red",
4329
+ "value": 80
4330
+ }
4331
+ ]
4332
+ }
4333
+ },
4334
+ "overrides": [
4335
+ {
4336
+ "matcher": {
4337
+ "id": "byName",
4338
+ "options": "agent_name"
4339
+ },
4340
+ "properties": [
4341
+ {
4342
+ "id": "custom.width",
4343
+ "value": 492
4344
+ }
4345
+ ]
4346
+ }
4347
+ ]
4348
+ },
4349
+ "gridPos": {
4350
+ "h": 7,
4351
+ "w": 9,
4352
+ "x": 0,
4353
+ "y": 11
4354
+ },
4355
+ "id": 100,
4356
+ "links": [],
4357
+ "maxDataPoints": 3,
4358
+ "options": {
4359
+ "footer": {
4360
+ "fields": "",
4361
+ "reducer": ["sum"],
4362
+ "show": false
4363
+ },
4364
+ "showHeader": true,
4365
+ "sortBy": []
4366
+ },
4367
+ "pluginVersion": "9.0.0",
4368
+ "targets": [
4369
+ {
4370
+ "bucketAggs": [
4371
+ {
4372
+ "$$hashKey": "object:2063",
4373
+ "fake": true,
4374
+ "field": "agent_name",
4375
+ "id": "4",
4376
+ "settings": {
4377
+ "min_doc_count": "1",
4378
+ "order": "desc",
4379
+ "orderBy": "_count",
4380
+ "size": "10"
4381
+ },
4382
+ "type": "terms"
4383
+ }
4384
+ ],
4385
+ "datasource": {
4386
+ "type": "elasticsearch",
4387
+ "uid": "wazuh_datasource_uid"
4388
+ },
4389
+ "metrics": [
4390
+ {
4391
+ "$$hashKey": "object:71",
4392
+ "field": "select field",
4393
+ "id": "1",
4394
+ "type": "count"
4395
+ }
4396
+ ],
4397
+ "query": "rule_group2:windows_logonsessions AND agent_name:$agent_name",
4398
+ "refId": "A",
4399
+ "timeField": "timestamp"
4400
+ }
4401
+ ],
4402
+ "title": "WINDOWS LOGON SESSIONS - AGENTS",
4403
+ "type": "table"
4404
+ },
4405
+ {
4406
+ "aliasColors": {},
4407
+ "bars": true,
4408
+ "dashLength": 10,
4409
+ "dashes": false,
4410
+ "datasource": {
4411
+ "type": "elasticsearch",
4412
+ "uid": "wazuh_datasource_uid"
4413
+ },
4414
+ "fill": 1,
4415
+ "fillGradient": 0,
4416
+ "gridPos": {
4417
+ "h": 7,
4418
+ "w": 15,
4419
+ "x": 9,
4420
+ "y": 11
4421
+ },
4422
+ "hiddenSeries": false,
4423
+ "id": 103,
4424
+ "legend": {
4425
+ "alignAsTable": true,
4426
+ "avg": false,
4427
+ "current": false,
4428
+ "max": false,
4429
+ "min": false,
4430
+ "rightSide": true,
4431
+ "show": true,
4432
+ "total": false,
4433
+ "values": false
4434
+ },
4435
+ "lines": false,
4436
+ "linewidth": 1,
4437
+ "links": [],
4438
+ "maxDataPoints": 3,
4439
+ "nullPointMode": "null",
4440
+ "options": {
4441
+ "alertThreshold": true
4442
+ },
4443
+ "percentage": false,
4444
+ "pluginVersion": "9.0.0",
4445
+ "pointradius": 2,
4446
+ "points": false,
4447
+ "renderer": "flot",
4448
+ "seriesOverrides": [],
4449
+ "spaceLength": 10,
4450
+ "stack": true,
4451
+ "steppedLine": false,
4452
+ "targets": [
4453
+ {
4454
+ "alias": "",
4455
+ "bucketAggs": [
4456
+ {
4457
+ "field": "agent_name",
4458
+ "id": "4",
4459
+ "settings": {
4460
+ "min_doc_count": "1",
4461
+ "order": "desc",
4462
+ "orderBy": "_count",
4463
+ "size": "10"
4464
+ },
4465
+ "type": "terms"
4466
+ },
4467
+ {
4468
+ "field": "timestamp",
4469
+ "id": "5",
4470
+ "settings": {
4471
+ "interval": "auto",
4472
+ "min_doc_count": "0",
4473
+ "trimEdges": "0"
4474
+ },
4475
+ "type": "date_histogram"
4476
+ }
4477
+ ],
4478
+ "datasource": {
4479
+ "type": "elasticsearch",
4480
+ "uid": "wazuh_datasource_uid"
4481
+ },
4482
+ "metrics": [
4483
+ {
4484
+ "$$hashKey": "object:71",
4485
+ "field": "select field",
4486
+ "id": "1",
4487
+ "type": "count"
4488
+ }
4489
+ ],
4490
+ "query": "rule_group2:windows_logonsessions AND agent_name:$agent_name",
4491
+ "refId": "A",
4492
+ "timeField": "timestamp"
4493
+ }
4494
+ ],
4495
+ "thresholds": [],
4496
+ "timeRegions": [],
4497
+ "title": "WINDOWS LOGON SESSIONS - (HISTOGRAM)",
4498
+ "tooltip": {
4499
+ "shared": true,
4500
+ "sort": 0,
4501
+ "value_type": "individual"
4502
+ },
4503
+ "type": "graph",
4504
+ "xaxis": {
4505
+ "mode": "time",
4506
+ "show": true,
4507
+ "values": []
4508
+ },
4509
+ "yaxes": [
4510
+ {
4511
+ "format": "short",
4512
+ "logBase": 1,
4513
+ "show": true
4514
+ },
4515
+ {
4516
+ "format": "short",
4517
+ "logBase": 1,
4518
+ "show": true
4519
+ }
4520
+ ],
4521
+ "yaxis": {
4522
+ "align": false
4523
+ }
4524
+ },
4525
+ {
4526
+ "datasource": {
4527
+ "type": "elasticsearch",
4528
+ "uid": "wazuh_datasource_uid"
4529
+ },
4530
+ "fieldConfig": {
4531
+ "defaults": {
4532
+ "color": {
4533
+ "mode": "thresholds"
4534
+ },
4535
+ "custom": {
4536
+ "align": "auto",
4537
+ "displayMode": "auto",
4538
+ "inspect": false
4539
+ },
4540
+ "mappings": [],
4541
+ "thresholds": {
4542
+ "mode": "absolute",
4543
+ "steps": [
4544
+ {
4545
+ "color": "green"
4546
+ },
4547
+ {
4548
+ "color": "red",
4549
+ "value": 80
4550
+ }
4551
+ ]
4552
+ }
4553
+ },
4554
+ "overrides": [
4555
+ {
4556
+ "matcher": {
4557
+ "id": "byName",
4558
+ "options": "rule_level"
4559
+ },
4560
+ "properties": [
4561
+ {
4562
+ "id": "custom.width",
4563
+ "value": 93
4564
+ }
4565
+ ]
4566
+ },
4567
+ {
4568
+ "matcher": {
4569
+ "id": "byName",
4570
+ "options": "windows_event_id"
4571
+ },
4572
+ "properties": [
4573
+ {
4574
+ "id": "custom.width",
4575
+ "value": 186
4576
+ }
4577
+ ]
4578
+ },
4579
+ {
4580
+ "matcher": {
4581
+ "id": "byName",
4582
+ "options": "DATE/TIME"
4583
+ },
4584
+ "properties": [
4585
+ {
4586
+ "id": "custom.width",
4587
+ "value": 202
4588
+ }
4589
+ ]
4590
+ },
4591
+ {
4592
+ "matcher": {
4593
+ "id": "byName",
4594
+ "options": "AGENT"
4595
+ },
4596
+ "properties": [
4597
+ {
4598
+ "id": "custom.width",
4599
+ "value": 171
4600
+ }
4601
+ ]
4602
+ },
4603
+ {
4604
+ "matcher": {
4605
+ "id": "byName",
4606
+ "options": "SRC IP"
4607
+ },
4608
+ "properties": [
4609
+ {
4610
+ "id": "custom.width",
4611
+ "value": 167
4612
+ }
4613
+ ]
4614
+ },
4615
+ {
4616
+ "matcher": {
4617
+ "id": "byName",
4618
+ "options": "MESSAGE"
4619
+ },
4620
+ "properties": [
4621
+ {
4622
+ "id": "custom.width",
4623
+ "value": 1519
4624
+ }
4625
+ ]
4626
+ },
4627
+ {
4628
+ "matcher": {
4629
+ "id": "byName",
4630
+ "options": "rule_description"
4631
+ },
4632
+ "properties": [
4633
+ {
4634
+ "id": "custom.width",
4635
+ "value": 524
4636
+ }
4637
+ ]
4638
+ },
4639
+ {
4640
+ "matcher": {
4641
+ "id": "byName",
4642
+ "options": "EVENT ID"
4643
+ },
4644
+ "properties": [
4645
+ {
4646
+ "id": "links",
4647
+ "value": [
4648
+ {
4649
+ "targetBlank": true,
4650
+ "title": "VIEW EVENT DETAILS",
4651
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
4652
+ }
4653
+ ]
4654
+ }
4655
+ ]
4656
+ }
4657
+ ]
4658
+ },
4659
+ "gridPos": {
4660
+ "h": 14,
4661
+ "w": 24,
4662
+ "x": 0,
4663
+ "y": 18
4664
+ },
4665
+ "id": 104,
4666
+ "options": {
4667
+ "footer": {
4668
+ "fields": "",
4669
+ "reducer": ["sum"],
4670
+ "show": false
4671
+ },
4672
+ "showHeader": true,
4673
+ "sortBy": []
4674
+ },
4675
+ "pluginVersion": "9.0.0",
4676
+ "targets": [
4677
+ {
4678
+ "alias": "",
4679
+ "bucketAggs": [],
4680
+ "datasource": {
4681
+ "type": "elasticsearch",
4682
+ "uid": "wazuh_datasource_uid"
4683
+ },
4684
+ "metrics": [
4685
+ {
4686
+ "id": "1",
4687
+ "settings": {
4688
+ "size": "500"
4689
+ },
4690
+ "type": "raw_data"
4691
+ }
4692
+ ],
4693
+ "query": "rule_group2:windows_logonsessions AND agent_name:$agent_name",
4694
+ "queryType": "lucene",
4695
+ "refId": "A",
4696
+ "timeField": "timestamp"
4697
+ }
4698
+ ],
4699
+ "title": "WINDOWS SECURITY - EVENTS",
4700
+ "transformations": [
4701
+ {
4702
+ "id": "organize",
4703
+ "options": {
4704
+ "excludeByName": {
4705
+ "@metadata_beat": true,
4706
+ "@metadata_type": true,
4707
+ "@metadata_version": true,
4708
+ "_id": false,
4709
+ "_index": true,
4710
+ "_type": true,
4711
+ "agent_ephemeral_id": true,
4712
+ "agent_hostname": true,
4713
+ "agent_id": true,
4714
+ "agent_ip": false,
4715
+ "agent_ip_city_name": true,
4716
+ "agent_ip_country_code": true,
4717
+ "agent_ip_geolocation": true,
4718
+ "agent_labels_customer": true,
4719
+ "agent_name": false,
4720
+ "agent_type": true,
4721
+ "agent_version": true,
4722
+ "beats_type": true,
4723
+ "collector_node_id": true,
4724
+ "data_AuthPackage": true,
4725
+ "data_DNSDomain": true,
4726
+ "data_LogonServer": true,
4727
+ "data_LogonSession": true,
4728
+ "data_Session": true,
4729
+ "data_Sid": true,
4730
+ "data_UPN": true,
4731
+ "data_win_eventXML_binaryData": true,
4732
+ "data_win_eventXML_binaryDataSize": true,
4733
+ "data_win_eventXML_param1": true,
4734
+ "data_win_eventdata_accessMask": true,
4735
+ "data_win_eventdata_authenticationPackageName": true,
4736
+ "data_win_eventdata_binary": true,
4737
+ "data_win_eventdata_data": true,
4738
+ "data_win_eventdata_domain": true,
4739
+ "data_win_eventdata_elevatedToken": true,
4740
+ "data_win_eventdata_failureReason": true,
4741
+ "data_win_eventdata_handleId": true,
4742
+ "data_win_eventdata_imagePath": true,
4743
+ "data_win_eventdata_impersonationLevel": true,
4744
+ "data_win_eventdata_ipAddress": true,
4745
+ "data_win_eventdata_ipPort": true,
4746
+ "data_win_eventdata_keyLength": true,
4747
+ "data_win_eventdata_lmPackageName": true,
4748
+ "data_win_eventdata_logonGuid": true,
4749
+ "data_win_eventdata_logonProcessName": true,
4750
+ "data_win_eventdata_logonType": true,
4751
+ "data_win_eventdata_objectServer": true,
4752
+ "data_win_eventdata_packageName": true,
4753
+ "data_win_eventdata_passwordLastSet": true,
4754
+ "data_win_eventdata_privilegeList": true,
4755
+ "data_win_eventdata_processId": true,
4756
+ "data_win_eventdata_processName": true,
4757
+ "data_win_eventdata_restrictedAdminMode": true,
4758
+ "data_win_eventdata_sID": true,
4759
+ "data_win_eventdata_serviceName": true,
4760
+ "data_win_eventdata_serviceType": true,
4761
+ "data_win_eventdata_startType": true,
4762
+ "data_win_eventdata_status": true,
4763
+ "data_win_eventdata_subStatus": true,
4764
+ "data_win_eventdata_subjectDomainName": true,
4765
+ "data_win_eventdata_subjectLogonId": true,
4766
+ "data_win_eventdata_subjectUserName": true,
4767
+ "data_win_eventdata_subjectUserSid": true,
4768
+ "data_win_eventdata_targetDomainName": true,
4769
+ "data_win_eventdata_targetLinkedLogonId": true,
4770
+ "data_win_eventdata_targetLogonId": true,
4771
+ "data_win_eventdata_targetSid": true,
4772
+ "data_win_eventdata_targetUserName": true,
4773
+ "data_win_eventdata_targetUserSid": true,
4774
+ "data_win_eventdata_user": true,
4775
+ "data_win_eventdata_virtualAccount": true,
4776
+ "data_win_eventdata_workstation": true,
4777
+ "data_win_eventdata_workstationName": true,
4778
+ "data_win_system_channel": true,
4779
+ "data_win_system_computer": true,
4780
+ "data_win_system_eventID": true,
4781
+ "data_win_system_eventRecordID": true,
4782
+ "data_win_system_eventSourceName": true,
4783
+ "data_win_system_keywords": true,
4784
+ "data_win_system_level": true,
4785
+ "data_win_system_opcode": true,
4786
+ "data_win_system_processID": true,
4787
+ "data_win_system_providerGuid": true,
4788
+ "data_win_system_providerName": true,
4789
+ "data_win_system_severityValue": true,
4790
+ "data_win_system_systemTime": true,
4791
+ "data_win_system_task": true,
4792
+ "data_win_system_threadID": true,
4793
+ "data_win_system_version": true,
4794
+ "date": true,
4795
+ "decoder_name": true,
4796
+ "ecs_version": true,
4797
+ "gl2_accounted_message_size": true,
4798
+ "gl2_message_id": true,
4799
+ "gl2_processing_error": true,
4800
+ "gl2_remote_ip": true,
4801
+ "gl2_remote_port": true,
4802
+ "gl2_source_collector": true,
4803
+ "gl2_source_input": true,
4804
+ "gl2_source_node": true,
4805
+ "highlight": true,
4806
+ "host_name": true,
4807
+ "id": true,
4808
+ "location": true,
4809
+ "log_file_path": true,
4810
+ "log_offset": true,
4811
+ "manager_name": true,
4812
+ "message": true,
4813
+ "previous_output": true,
4814
+ "process_id": true,
4815
+ "rule_description": true,
4816
+ "rule_firedtimes": true,
4817
+ "rule_frequency": true,
4818
+ "rule_gdpr": true,
4819
+ "rule_gpg13": true,
4820
+ "rule_group1": true,
4821
+ "rule_group2": true,
4822
+ "rule_groups": true,
4823
+ "rule_hipaa": true,
4824
+ "rule_id": true,
4825
+ "rule_level": true,
4826
+ "rule_mail": true,
4827
+ "rule_mitre_id": true,
4828
+ "rule_mitre_tactic": true,
4829
+ "rule_mitre_technique": true,
4830
+ "rule_nist_800_53": true,
4831
+ "rule_pci_dss": true,
4832
+ "rule_tsc": true,
4833
+ "sort": true,
4834
+ "source": true,
4835
+ "src_ip": true,
4836
+ "src_ip_city_name": true,
4837
+ "src_ip_country_code": true,
4838
+ "src_ip_geolocation": true,
4839
+ "streams": true,
4840
+ "syslog_tag": true,
4841
+ "syslog_type": true,
4842
+ "timestamp": false,
4843
+ "true": true,
4844
+ "user_name": true,
4845
+ "win_system_eventID": true,
4846
+ "windows_auth_package": true,
4847
+ "windows_domain": true,
4848
+ "windows_event_id": true,
4849
+ "windows_event_severity": false,
4850
+ "windows_logon_type": true
4851
+ },
4852
+ "indexByName": {
4853
+ "_id": 1,
4854
+ "_index": 4,
4855
+ "_type": 5,
4856
+ "agent_id": 6,
4857
+ "agent_ip": 7,
4858
+ "agent_ip_city_name": 8,
4859
+ "agent_ip_country_code": 9,
4860
+ "agent_ip_geolocation": 10,
4861
+ "agent_labels_customer": 46,
4862
+ "agent_name": 2,
4863
+ "data_AuthPackage": 33,
4864
+ "data_DNSDomain": 34,
4865
+ "data_LogonServer": 35,
4866
+ "data_LogonSession": 36,
4867
+ "data_LogonTime": 37,
4868
+ "data_LogonType": 38,
4869
+ "data_Processes": 39,
4870
+ "data_Session": 40,
4871
+ "data_Sid": 41,
4872
+ "data_UPN": 42,
4873
+ "data_UserName": 3,
4874
+ "decoder_name": 11,
4875
+ "gl2_accounted_message_size": 12,
4876
+ "gl2_message_id": 13,
4877
+ "gl2_processing_error": 47,
4878
+ "gl2_remote_ip": 14,
4879
+ "gl2_remote_port": 15,
4880
+ "gl2_source_input": 16,
4881
+ "gl2_source_node": 17,
4882
+ "highlight": 18,
4883
+ "id": 19,
4884
+ "location": 20,
4885
+ "manager_name": 21,
4886
+ "message": 22,
4887
+ "rule_description": 23,
4888
+ "rule_firedtimes": 24,
4889
+ "rule_group1": 48,
4890
+ "rule_group2": 49,
4891
+ "rule_groups": 25,
4892
+ "rule_id": 26,
4893
+ "rule_level": 27,
4894
+ "rule_mail": 28,
4895
+ "rule_mitre_id": 43,
4896
+ "rule_mitre_tactic": 44,
4897
+ "rule_mitre_technique": 45,
4898
+ "sort": 29,
4899
+ "source": 30,
4900
+ "streams": 31,
4901
+ "syslog_level": 50,
4902
+ "syslog_type": 32,
4903
+ "timestamp": 0,
4904
+ "true": 51
4905
+ },
4906
+ "renameByName": {
4907
+ "_id": "EVENT ID",
4908
+ "agent_ip": "SRC IP",
4909
+ "agent_name": "AGENT",
4910
+ "data_LogonTime": "LOGON TIME",
4911
+ "data_LogonType": "LOGON TYPE",
4912
+ "data_Processes": "RUNNING PROCESSES",
4913
+ "data_UserName": "USER NAME",
4914
+ "data_win_system_message": "MESSAGE",
4915
+ "data_win_system_providerGuid": "",
4916
+ "rule_level": "RULE LEVEL",
4917
+ "syslog_level": "LEVEL",
4918
+ "timestamp": "DATE/TIME",
4919
+ "windows_event_severity": "EVENT LOG SEVERITY"
4920
+ }
4921
+ }
4922
+ }
4923
+ ],
4924
+ "type": "table"
4925
+ }
4926
+ ],
4927
+ "title": "WINDOWS LOGON SESSIONS",
4928
+ "type": "row"
4929
+ },
4930
+ {
4931
+ "collapsed": true,
4932
+ "datasource": {
4933
+ "type": "elasticsearch",
4934
+ "uid": "wazuh_datasource_uid"
4935
+ },
4936
+ "gridPos": {
4937
+ "h": 1,
4938
+ "w": 24,
4939
+ "x": 0,
4940
+ "y": 4
4941
+ },
4942
+ "id": 107,
4943
+ "panels": [
4944
+ {
4945
+ "datasource": {
4946
+ "type": "elasticsearch",
4947
+ "uid": "wazuh_datasource_uid"
4948
+ },
4949
+ "fieldConfig": {
4950
+ "defaults": {
4951
+ "mappings": [
4952
+ {
4953
+ "options": {
4954
+ "match": "null",
4955
+ "result": {
4956
+ "text": "N/A"
4957
+ }
4958
+ },
4959
+ "type": "special"
4960
+ }
4961
+ ],
4962
+ "thresholds": {
4963
+ "mode": "absolute",
4964
+ "steps": [
4965
+ {
4966
+ "color": "blue"
4967
+ }
4968
+ ]
4969
+ },
4970
+ "unit": "short"
4971
+ },
4972
+ "overrides": []
4973
+ },
4974
+ "gridPos": {
4975
+ "h": 7,
4976
+ "w": 4,
4977
+ "x": 0,
4978
+ "y": 5
4979
+ },
4980
+ "id": 108,
4981
+ "links": [],
4982
+ "options": {
4983
+ "colorMode": "value",
4984
+ "graphMode": "area",
4985
+ "justifyMode": "auto",
4986
+ "orientation": "horizontal",
4987
+ "reduceOptions": {
4988
+ "calcs": ["sum"],
4989
+ "fields": "",
4990
+ "values": false
4991
+ },
4992
+ "text": {},
4993
+ "textMode": "auto"
4994
+ },
4995
+ "pluginVersion": "9.0.0",
4996
+ "targets": [
4997
+ {
4998
+ "bucketAggs": [
4999
+ {
This file is too large to show in full.
backend/app/connectors/grafana/dashboards/Wazuh/summary.json
new
+2889
@@ -0,0 +1,2889 @@
1
+{
2
+ "annotations": {
3
+ "list": [
4
+ {
5
+ "builtIn": 1,
6
+ "datasource": {
7
+ "type": "datasource",
8
+ "uid": "grafana"
9
+ },
10
+ "enable": true,
11
+ "hide": true,
12
+ "iconColor": "rgba(0, 211, 255, 1)",
13
+ "name": "Annotations & Alerts",
14
+ "target": {
15
+ "limit": 100,
16
+ "matchAny": false,
17
+ "tags": [],
18
+ "type": "dashboard"
19
+ },
20
+ "type": "dashboard"
21
+ }
22
+ ]
23
+ },
24
+ "editable": false,
25
+ "fiscalYearStartMonth": 0,
26
+ "graphTooltip": 0,
27
+ "id": null,
28
+ "links": [
29
+ {
30
+ "asDropdown": true,
31
+ "icon": "external link",
32
+ "includeVars": true,
33
+ "keepTime": true,
34
+ "tags": ["EDR"],
35
+ "targetBlank": true,
36
+ "title": "",
37
+ "type": "dashboards"
38
+ }
39
+ ],
40
+ "liveNow": false,
41
+ "panels": [
42
+ {
43
+ "datasource": {
44
+ "type": "elasticsearch",
45
+ "uid": "wazuh_datasource_uid"
46
+ },
47
+ "fieldConfig": {
48
+ "defaults": {
49
+ "mappings": [
50
+ {
51
+ "options": {
52
+ "match": "null",
53
+ "result": {
54
+ "text": "N/A"
55
+ }
56
+ },
57
+ "type": "special"
58
+ }
59
+ ],
60
+ "thresholds": {
61
+ "mode": "absolute",
62
+ "steps": [
63
+ {
64
+ "color": "orange",
65
+ "value": null
66
+ }
67
+ ]
68
+ },
69
+ "unit": "locale"
70
+ },
71
+ "overrides": []
72
+ },
73
+ "gridPos": {
74
+ "h": 7,
75
+ "w": 4,
76
+ "x": 0,
77
+ "y": 0
78
+ },
79
+ "id": 43,
80
+ "links": [],
81
+ "options": {
82
+ "colorMode": "value",
83
+ "graphMode": "area",
84
+ "justifyMode": "auto",
85
+ "orientation": "horizontal",
86
+ "reduceOptions": {
87
+ "calcs": ["sum"],
88
+ "fields": "",
89
+ "values": false
90
+ },
91
+ "text": {},
92
+ "textMode": "auto"
93
+ },
94
+ "pluginVersion": "10.0.2",
95
+ "targets": [
96
+ {
97
+ "bucketAggs": [
98
+ {
99
+ "field": "timestamp",
100
+ "id": "2",
101
+ "settings": {
102
+ "interval": "auto",
103
+ "min_doc_count": 0,
104
+ "trimEdges": 0
105
+ },
106
+ "type": "date_histogram"
107
+ }
108
+ ],
109
+ "metrics": [
110
+ {
111
+ "field": "select field",
112
+ "id": "1",
113
+ "type": "count"
114
+ }
115
+ ],
116
+ "query": "rule_level:>=12 AND agent_name:$agent_name",
117
+ "refId": "A",
118
+ "timeField": "timestamp"
119
+ }
120
+ ],
121
+ "title": "ALERTS",
122
+ "type": "stat"
123
+ },
124
+ {
125
+ "datasource": {
126
+ "type": "elasticsearch",
127
+ "uid": "wazuh_datasource_uid"
128
+ },
129
+ "fieldConfig": {
130
+ "defaults": {
131
+ "color": {
132
+ "mode": "thresholds"
133
+ },
134
+ "custom": {
135
+ "align": "auto",
136
+ "cellOptions": {
137
+ "type": "auto"
138
+ },
139
+ "inspect": false
140
+ },
141
+ "mappings": [],
142
+ "thresholds": {
143
+ "mode": "absolute",
144
+ "steps": [
145
+ {
146
+ "color": "dark-orange",
147
+ "value": null
148
+ }
149
+ ]
150
+ }
151
+ },
152
+ "overrides": [
153
+ {
154
+ "matcher": {
155
+ "id": "byName",
156
+ "options": "Time"
157
+ },
158
+ "properties": [
159
+ {
160
+ "id": "displayName",
161
+ "value": "Time"
162
+ },
163
+ {
164
+ "id": "unit",
165
+ "value": "time: YYYY-MM-DD HH:mm:ss"
166
+ },
167
+ {
168
+ "id": "custom.align"
169
+ }
170
+ ]
171
+ },
172
+ {
173
+ "matcher": {
174
+ "id": "byName",
175
+ "options": "Count"
176
+ },
177
+ "properties": [
178
+ {
179
+ "id": "displayName",
180
+ "value": "EVENTS"
181
+ },
182
+ {
183
+ "id": "unit",
184
+ "value": "short"
185
+ },
186
+ {
187
+ "id": "decimals",
188
+ "value": -1
189
+ },
190
+ {
191
+ "id": "custom.cellOptions",
192
+ "value": {
193
+ "mode": "gradient",
194
+ "type": "color-background"
195
+ }
196
+ },
197
+ {
198
+ "id": "custom.align"
199
+ },
200
+ {
201
+ "id": "thresholds",
202
+ "value": {
203
+ "mode": "absolute",
204
+ "steps": [
205
+ {
206
+ "color": "dark-orange",
207
+ "value": null
208
+ }
209
+ ]
210
+ }
211
+ }
212
+ ]
213
+ },
214
+ {
215
+ "matcher": {
216
+ "id": "byName",
217
+ "options": "agent_name"
218
+ },
219
+ "properties": [
220
+ {
221
+ "id": "displayName",
222
+ "value": "AGENT"
223
+ },
224
+ {
225
+ "id": "custom.cellOptions",
226
+ "value": {
227
+ "mode": "gradient",
228
+ "type": "color-background"
229
+ }
230
+ },
231
+ {
232
+ "id": "custom.align"
233
+ },
234
+ {
235
+ "id": "links",
236
+ "value": [
237
+ {
238
+ "targetBlank": true,
239
+ "title": "VIEW EVENTS",
240
+ "url": "https://grafana.company.local/explore?left=%5B%22now-1h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22agent_name:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
241
+ }
242
+ ]
243
+ }
244
+ ]
245
+ },
246
+ {
247
+ "matcher": {
248
+ "id": "byName",
249
+ "options": "Count"
250
+ },
251
+ "properties": [
252
+ {
253
+ "id": "displayName",
254
+ "value": "ALERTS"
255
+ },
256
+ {
257
+ "id": "unit",
258
+ "value": "short"
259
+ },
260
+ {
261
+ "id": "decimals",
262
+ "value": 0
263
+ },
264
+ {
265
+ "id": "custom.align"
266
+ }
267
+ ]
268
+ }
269
+ ]
270
+ },
271
+ "gridPos": {
272
+ "h": 7,
273
+ "w": 7,
274
+ "x": 4,
275
+ "y": 0
276
+ },
277
+ "id": 31,
278
+ "options": {
279
+ "cellHeight": "sm",
280
+ "footer": {
281
+ "countRows": false,
282
+ "fields": "",
283
+ "reducer": ["sum"],
284
+ "show": false
285
+ },
286
+ "showHeader": true
287
+ },
288
+ "pluginVersion": "10.0.2",
289
+ "targets": [
290
+ {
291
+ "bucketAggs": [
292
+ {
293
+ "fake": true,
294
+ "field": "agent_name",
295
+ "id": "4",
296
+ "settings": {
297
+ "min_doc_count": 1,
298
+ "order": "desc",
299
+ "orderBy": "_term",
300
+ "size": "0"
301
+ },
302
+ "type": "terms"
303
+ }
304
+ ],
305
+ "metrics": [
306
+ {
307
+ "field": "select field",
308
+ "id": "1",
309
+ "type": "count"
310
+ }
311
+ ],
312
+ "query": "rule_level:>=12 AND agent_name:$agent_name",
313
+ "refId": "A",
314
+ "timeField": "timestamp"
315
+ }
316
+ ],
317
+ "title": "ALERTS BY AGENT",
318
+ "transformations": [
319
+ {
320
+ "id": "merge",
321
+ "options": {
322
+ "reducers": []
323
+ }
324
+ }
325
+ ],
326
+ "type": "table"
327
+ },
328
+ {
329
+ "datasource": {
330
+ "type": "elasticsearch",
331
+ "uid": "wazuh_datasource_uid"
332
+ },
333
+ "gridPos": {
334
+ "h": 14,
335
+ "w": 13,
336
+ "x": 11,
337
+ "y": 0
338
+ },
339
+ "id": 47,
340
+ "options": {
341
+ "dedupStrategy": "signature",
342
+ "enableLogDetails": true,
343
+ "prettifyLogMessage": false,
344
+ "showCommonLabels": false,
345
+ "showLabels": false,
346
+ "showTime": true,
347
+ "sortOrder": "Descending",
348
+ "wrapLogMessage": false
349
+ },
350
+ "targets": [
351
+ {
352
+ "alias": "",
353
+ "bucketAggs": [],
354
+ "datasource": {
355
+ "type": "elasticsearch",
356
+ "uid": "wazuh_datasource_uid"
357
+ },
358
+ "metrics": [
359
+ {
360
+ "id": "1",
361
+ "settings": {
362
+ "limit": "250"
363
+ },
364
+ "type": "logs"
365
+ }
366
+ ],
367
+ "query": "syslog_level:ALERT AND agent_name:$agent_name",
368
+ "refId": "A",
369
+ "timeField": "timestamp"
370
+ }
371
+ ],
372
+ "title": "ALERTS - DETAILS",
373
+ "transformations": [
374
+ {
375
+ "id": "filterFieldsByName",
376
+ "options": {
377
+ "include": {
378
+ "names": [
379
+ "timestamp",
380
+ "rule_description",
381
+ "level",
382
+ "_id",
383
+ "agent_id",
384
+ "agent_ip",
385
+ "agent_name",
386
+ "data_vulnerability_cve",
387
+ "data_vulnerability_package_name",
388
+ "data_vulnerability_title",
389
+ "misp_Event.info",
390
+ "misp_category",
391
+ "misp_comment",
392
+ "misp_value",
393
+ "rule_firedtimes",
394
+ "rule_group1",
395
+ "rule_groups",
396
+ "rule_id",
397
+ "rule_level",
398
+ "rule_mail",
399
+ "opencti_source.value",
400
+ "opencti_source.entity_type",
401
+ "opencti_source.x_opencti_score"
402
+ ]
403
+ }
404
+ }
405
+ }
406
+ ],
407
+ "transparent": true,
408
+ "type": "logs"
409
+ },
410
+ {
411
+ "datasource": {
412
+ "type": "elasticsearch",
413
+ "uid": "wazuh_datasource_uid"
414
+ },
415
+ "fieldConfig": {
416
+ "defaults": {
417
+ "color": {
418
+ "mode": "thresholds"
419
+ },
420
+ "mappings": [
421
+ {
422
+ "options": {
423
+ "match": "null",
424
+ "result": {
425
+ "text": "N/A"
426
+ }
427
+ },
428
+ "type": "special"
429
+ }
430
+ ],
431
+ "max": 15,
432
+ "min": 0,
433
+ "thresholds": {
434
+ "mode": "absolute",
435
+ "steps": [
436
+ {
437
+ "color": "#299c46",
438
+ "value": null
439
+ },
440
+ {
441
+ "color": "rgba(237, 129, 40, 0.89)",
442
+ "value": 8
443
+ },
444
+ {
445
+ "color": "#d44a3a",
446
+ "value": 12
447
+ }
448
+ ]
449
+ },
450
+ "unit": "none"
451
+ },
452
+ "overrides": []
453
+ },
454
+ "gridPos": {
455
+ "h": 7,
456
+ "w": 4,
457
+ "x": 0,
458
+ "y": 7
459
+ },
460
+ "id": 16,
461
+ "links": [],
462
+ "options": {
463
+ "orientation": "horizontal",
464
+ "reduceOptions": {
465
+ "calcs": ["max"],
466
+ "fields": "",
467
+ "values": false
468
+ },
469
+ "showThresholdLabels": false,
470
+ "showThresholdMarkers": true,
471
+ "text": {}
472
+ },
473
+ "pluginVersion": "10.0.2",
474
+ "targets": [
475
+ {
476
+ "bucketAggs": [
477
+ {
478
+ "field": "timestamp",
479
+ "id": "2",
480
+ "settings": {
481
+ "interval": "auto",
482
+ "min_doc_count": 0,
483
+ "trimEdges": 0
484
+ },
485
+ "type": "date_histogram"
486
+ }
487
+ ],
488
+ "metrics": [
489
+ {
490
+ "field": "rule_level",
491
+ "id": "1",
492
+ "meta": {},
493
+ "settings": {},
494
+ "type": "max"
495
+ }
496
+ ],
497
+ "query": "agent_name:$agent_name",
498
+ "refId": "A",
499
+ "timeField": "timestamp"
500
+ }
501
+ ],
502
+ "title": "MAX SEVERITY (0 - 15)",
503
+ "type": "gauge"
504
+ },
505
+ {
506
+ "datasource": {
507
+ "type": "elasticsearch",
508
+ "uid": "wazuh_datasource_uid"
509
+ },
510
+ "fieldConfig": {
511
+ "defaults": {
512
+ "color": {
513
+ "mode": "thresholds"
514
+ },
515
+ "custom": {
516
+ "align": "auto",
517
+ "cellOptions": {
518
+ "type": "auto"
519
+ },
520
+ "inspect": false
521
+ },
522
+ "mappings": [],
523
+ "thresholds": {
524
+ "mode": "absolute",
525
+ "steps": [
526
+ {
527
+ "color": "dark-orange",
528
+ "value": null
529
+ }
530
+ ]
531
+ }
532
+ },
533
+ "overrides": [
534
+ {
535
+ "matcher": {
536
+ "id": "byName",
537
+ "options": "Time"
538
+ },
539
+ "properties": [
540
+ {
541
+ "id": "displayName",
542
+ "value": "Time"
543
+ },
544
+ {
545
+ "id": "unit",
546
+ "value": "time: YYYY-MM-DD HH:mm:ss"
547
+ },
548
+ {
549
+ "id": "custom.align"
550
+ }
551
+ ]
552
+ },
553
+ {
554
+ "matcher": {
555
+ "id": "byName",
556
+ "options": "Count"
557
+ },
558
+ "properties": [
559
+ {
560
+ "id": "displayName",
561
+ "value": "EVENTS"
562
+ },
563
+ {
564
+ "id": "unit",
565
+ "value": "short"
566
+ },
567
+ {
568
+ "id": "decimals",
569
+ "value": -1
570
+ },
571
+ {
572
+ "id": "custom.cellOptions",
573
+ "value": {
574
+ "type": "color-background"
575
+ }
576
+ },
577
+ {
578
+ "id": "custom.align"
579
+ },
580
+ {
581
+ "id": "thresholds",
582
+ "value": {
583
+ "mode": "absolute",
584
+ "steps": [
585
+ {
586
+ "color": "dark-orange",
587
+ "value": null
588
+ }
589
+ ]
590
+ }
591
+ }
592
+ ]
593
+ },
594
+ {
595
+ "matcher": {
596
+ "id": "byName",
597
+ "options": "rule_groups"
598
+ },
599
+ "properties": [
600
+ {
601
+ "id": "displayName",
602
+ "value": "ALERTS BY TYPE"
603
+ },
604
+ {
605
+ "id": "unit",
606
+ "value": "short"
607
+ },
608
+ {
609
+ "id": "decimals",
610
+ "value": -1
611
+ },
612
+ {
613
+ "id": "custom.cellOptions",
614
+ "value": {
615
+ "type": "color-background"
616
+ }
617
+ },
618
+ {
619
+ "id": "custom.align"
620
+ }
621
+ ]
622
+ }
623
+ ]
624
+ },
625
+ "gridPos": {
626
+ "h": 7,
627
+ "w": 7,
628
+ "x": 4,
629
+ "y": 7
630
+ },
631
+ "id": 44,
632
+ "options": {
633
+ "cellHeight": "sm",
634
+ "footer": {
635
+ "countRows": false,
636
+ "fields": "",
637
+ "reducer": ["sum"],
638
+ "show": false
639
+ },
640
+ "showHeader": true
641
+ },
642
+ "pluginVersion": "10.0.2",
643
+ "targets": [
644
+ {
645
+ "bucketAggs": [
646
+ {
647
+ "fake": true,
648
+ "field": "rule_groups",
649
+ "id": "4",
650
+ "settings": {
651
+ "min_doc_count": 1,
652
+ "order": "desc",
653
+ "orderBy": "_term",
654
+ "size": "0"
655
+ },
656
+ "type": "terms"
657
+ }
658
+ ],
659
+ "metrics": [
660
+ {
661
+ "field": "select field",
662
+ "id": "1",
663
+ "type": "count"
664
+ }
665
+ ],
666
+ "query": "rule_level:>=12 AND agent_name:$agent_name",
667
+ "refId": "A",
668
+ "timeField": "timestamp"
669
+ }
670
+ ],
671
+ "title": "ALERTS BY CATEGORY",
672
+ "transformations": [
673
+ {
674
+ "id": "merge",
675
+ "options": {
676
+ "reducers": []
677
+ }
678
+ }
679
+ ],
680
+ "type": "table"
681
+ },
682
+ {
683
+ "datasource": {
684
+ "type": "elasticsearch",
685
+ "uid": "wazuh_datasource_uid"
686
+ },
687
+ "fieldConfig": {
688
+ "defaults": {
689
+ "mappings": [
690
+ {
691
+ "options": {
692
+ "match": "null",
693
+ "result": {
694
+ "text": "N/A"
695
+ }
696
+ },
697
+ "type": "special"
698
+ }
699
+ ],
700
+ "thresholds": {
701
+ "mode": "absolute",
702
+ "steps": [
703
+ {
704
+ "color": "blue",
705
+ "value": null
706
+ }
707
+ ]
708
+ },
709
+ "unit": "none"
710
+ },
711
+ "overrides": []
712
+ },
713
+ "gridPos": {
714
+ "h": 5,
715
+ "w": 4,
716
+ "x": 0,
717
+ "y": 14
718
+ },
719
+ "id": 45,
720
+ "links": [],
721
+ "maxDataPoints": 100,
722
+ "options": {
723
+ "colorMode": "value",
724
+ "graphMode": "none",
725
+ "justifyMode": "auto",
726
+ "orientation": "horizontal",
727
+ "reduceOptions": {
728
+ "calcs": ["max"],
729
+ "fields": "",
730
+ "values": false
731
+ },
732
+ "text": {},
733
+ "textMode": "auto"
734
+ },
735
+ "pluginVersion": "10.0.2",
736
+ "targets": [
737
+ {
738
+ "bucketAggs": [
739
+ {
740
+ "$$hashKey": "object:235",
741
+ "field": "timestamp",
742
+ "id": "2",
743
+ "settings": {
744
+ "interval": "365d",
745
+ "min_doc_count": 0,
746
+ "trimEdges": 0
747
+ },
748
+ "type": "date_histogram"
749
+ }
750
+ ],
751
+ "metrics": [
752
+ {
753
+ "$$hashKey": "object:233",
754
+ "field": "agent_name",
755
+ "id": "1",
756
+ "meta": {},
757
+ "settings": {},
758
+ "type": "cardinality"
759
+ }
760
+ ],
761
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
762
+ "refId": "A",
763
+ "timeField": "timestamp"
764
+ }
765
+ ],
766
+ "title": "AGENTS",
767
+ "type": "stat"
768
+ },
769
+ {
770
+ "datasource": {
771
+ "type": "elasticsearch",
772
+ "uid": "wazuh_datasource_uid"
773
+ },
774
+ "fieldConfig": {
775
+ "defaults": {
776
+ "color": {
777
+ "mode": "palette-classic"
778
+ },
779
+ "custom": {
780
+ "axisCenteredZero": false,
781
+ "axisColorMode": "text",
782
+ "axisLabel": "",
783
+ "axisPlacement": "auto",
784
+ "barAlignment": 0,
785
+ "drawStyle": "bars",
786
+ "fillOpacity": 0,
787
+ "gradientMode": "none",
788
+ "hideFrom": {
789
+ "legend": false,
790
+ "tooltip": false,
791
+ "viz": false
792
+ },
793
+ "lineInterpolation": "linear",
794
+ "lineWidth": 1,
795
+ "pointSize": 5,
796
+ "scaleDistribution": {
797
+ "type": "linear"
798
+ },
799
+ "showPoints": "auto",
800
+ "spanNulls": false,
801
+ "stacking": {
802
+ "group": "A",
803
+ "mode": "normal"
804
+ },
805
+ "thresholdsStyle": {
806
+ "mode": "off"
807
+ }
808
+ },
809
+ "mappings": [],
810
+ "thresholds": {
811
+ "mode": "absolute",
812
+ "steps": [
813
+ {
814
+ "color": "green",
815
+ "value": null
816
+ },
817
+ {
818
+ "color": "red",
819
+ "value": 80
820
+ }
821
+ ]
822
+ }
823
+ },
824
+ "overrides": []
825
+ },
826
+ "gridPos": {
827
+ "h": 11,
828
+ "w": 20,
829
+ "x": 4,
830
+ "y": 14
831
+ },
832
+ "id": 49,
833
+ "options": {
834
+ "legend": {
835
+ "calcs": [],
836
+ "displayMode": "table",
837
+ "placement": "right",
838
+ "showLegend": true
839
+ },
840
+ "tooltip": {
841
+ "mode": "single",
842
+ "sort": "none"
843
+ }
844
+ },
845
+ "targets": [
846
+ {
847
+ "alias": "",
848
+ "bucketAggs": [
849
+ {
850
+ "field": "agent_name",
851
+ "id": "3",
852
+ "settings": {
853
+ "min_doc_count": "1",
854
+ "order": "desc",
855
+ "orderBy": "_term",
856
+ "size": "10"
857
+ },
858
+ "type": "terms"
859
+ },
860
+ {
861
+ "field": "timestamp",
862
+ "id": "2",
863
+ "settings": {
864
+ "interval": "5m"
865
+ },
866
+ "type": "date_histogram"
867
+ }
868
+ ],
869
+ "datasource": {
870
+ "type": "elasticsearch",
871
+ "uid": "wazuh_datasource_uid"
872
+ },
873
+ "metrics": [
874
+ {
875
+ "id": "1",
876
+ "type": "count"
877
+ }
878
+ ],
879
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
880
+ "refId": "A",
881
+ "timeField": "timestamp"
882
+ }
883
+ ],
884
+ "title": "TOP 10 AGENTS - HISTOGRAM",
885
+ "transparent": true,
886
+ "type": "timeseries"
887
+ },
888
+ {
889
+ "datasource": {
890
+ "type": "elasticsearch",
891
+ "uid": "wazuh_datasource_uid"
892
+ },
893
+ "fieldConfig": {
894
+ "defaults": {
895
+ "mappings": [
896
+ {
897
+ "options": {
898
+ "match": "null",
899
+ "result": {
900
+ "text": "N/A"
901
+ }
902
+ },
903
+ "type": "special"
904
+ }
905
+ ],
906
+ "thresholds": {
907
+ "mode": "absolute",
908
+ "steps": [
909
+ {
910
+ "color": "blue",
911
+ "value": null
912
+ }
913
+ ]
914
+ },
915
+ "unit": "locale"
916
+ },
917
+ "overrides": []
918
+ },
919
+ "gridPos": {
920
+ "h": 6,
921
+ "w": 4,
922
+ "x": 0,
923
+ "y": 19
924
+ },
925
+ "id": 18,
926
+ "links": [],
927
+ "options": {
928
+ "colorMode": "value",
929
+ "graphMode": "area",
930
+ "justifyMode": "auto",
931
+ "orientation": "horizontal",
932
+ "reduceOptions": {
933
+ "calcs": ["sum"],
934
+ "fields": "",
935
+ "values": false
936
+ },
937
+ "text": {},
938
+ "textMode": "auto"
939
+ },
940
+ "pluginVersion": "10.0.2",
941
+ "targets": [
942
+ {
943
+ "bucketAggs": [
944
+ {
945
+ "$$hashKey": "object:331",
946
+ "field": "timestamp",
947
+ "id": "2",
948
+ "settings": {
949
+ "interval": "auto",
950
+ "min_doc_count": 0,
951
+ "trimEdges": 0
952
+ },
953
+ "type": "date_histogram"
954
+ }
955
+ ],
956
+ "metrics": [
957
+ {
958
+ "$$hashKey": "object:329",
959
+ "field": "select field",
960
+ "id": "1",
961
+ "type": "count"
962
+ }
963
+ ],
964
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
965
+ "refId": "A",
966
+ "timeField": "timestamp"
967
+ }
968
+ ],
969
+ "title": "EVENTS (TOTAL)",
970
+ "type": "stat"
971
+ },
972
+ {
973
+ "datasource": {
974
+ "type": "elasticsearch",
975
+ "uid": "wazuh_datasource_uid"
976
+ },
977
+ "fieldConfig": {
978
+ "defaults": {
979
+ "color": {
980
+ "mode": "palette-classic"
981
+ },
982
+ "custom": {
983
+ "hideFrom": {
984
+ "legend": false,
985
+ "tooltip": false,
986
+ "viz": false
987
+ }
988
+ },
989
+ "decimals": 0,
990
+ "mappings": [],
991
+ "unit": "short"
992
+ },
993
+ "overrides": [
994
+ {
995
+ "matcher": {
996
+ "id": "byName",
997
+ "options": "1"
998
+ },
999
+ "properties": [
1000
+ {
1001
+ "id": "color",
1002
+ "value": {
1003
+ "fixedColor": "#C8F2C2",
1004
+ "mode": "fixed"
1005
+ }
1006
+ }
1007
+ ]
1008
+ },
1009
+ {
1010
+ "matcher": {
1011
+ "id": "byName",
1012
+ "options": "2"
1013
+ },
1014
+ "properties": [
1015
+ {
1016
+ "id": "color",
1017
+ "value": {
1018
+ "fixedColor": "#96D98D",
1019
+ "mode": "fixed"
1020
+ }
1021
+ }
1022
+ ]
1023
+ },
1024
+ {
1025
+ "matcher": {
1026
+ "id": "byName",
1027
+ "options": "3"
1028
+ },
1029
+ "properties": [
1030
+ {
1031
+ "id": "color",
1032
+ "value": {
1033
+ "fixedColor": "#56A64B",
1034
+ "mode": "fixed"
1035
+ }
1036
+ }
1037
+ ]
1038
+ },
1039
+ {
1040
+ "matcher": {
1041
+ "id": "byName",
1042
+ "options": "4"
1043
+ },
1044
+ "properties": [
1045
+ {
1046
+ "id": "color",
1047
+ "value": {
1048
+ "fixedColor": "#37872D",
1049
+ "mode": "fixed"
1050
+ }
1051
+ }
1052
+ ]
1053
+ },
1054
+ {
1055
+ "matcher": {
1056
+ "id": "byName",
1057
+ "options": "5"
1058
+ },
1059
+ "properties": [
1060
+ {
1061
+ "id": "color",
1062
+ "value": {
1063
+ "fixedColor": "#FFF899",
1064
+ "mode": "fixed"
1065
+ }
1066
+ }
1067
+ ]
1068
+ },
1069
+ {
1070
+ "matcher": {
1071
+ "id": "byName",
1072
+ "options": "7"
1073
+ },
1074
+ "properties": [
1075
+ {
1076
+ "id": "color",
1077
+ "value": {
1078
+ "fixedColor": "#F2CC0C",
1079
+ "mode": "fixed"
1080
+ }
1081
+ }
1082
+ ]
1083
+ },
1084
+ {
1085
+ "matcher": {
1086
+ "id": "byName",
1087
+ "options": "9"
1088
+ },
1089
+ "properties": [
1090
+ {
1091
+ "id": "color",
1092
+ "value": {
1093
+ "fixedColor": "#FF9830",
1094
+ "mode": "fixed"
1095
+ }
1096
+ }
1097
+ ]
1098
+ },
1099
+ {
1100
+ "matcher": {
1101
+ "id": "byName",
1102
+ "options": "10"
1103
+ },
1104
+ "properties": [
1105
+ {
1106
+ "id": "color",
1107
+ "value": {
1108
+ "fixedColor": "#FF9830",
1109
+ "mode": "fixed"
1110
+ }
1111
+ }
1112
+ ]
1113
+ },
1114
+ {
1115
+ "matcher": {
1116
+ "id": "byName",
1117
+ "options": "12"
1118
+ },
1119
+ "properties": [
1120
+ {
1121
+ "id": "color",
1122
+ "value": {
1123
+ "fixedColor": "#F2495C",
1124
+ "mode": "fixed"
1125
+ }
1126
+ }
1127
+ ]
1128
+ },
1129
+ {
1130
+ "matcher": {
1131
+ "id": "byName",
1132
+ "options": "13"
1133
+ },
1134
+ "properties": [
1135
+ {
1136
+ "id": "color",
1137
+ "value": {
1138
+ "fixedColor": "#FF7383",
1139
+ "mode": "fixed"
1140
+ }
1141
+ }
1142
+ ]
1143
+ }
1144
+ ]
1145
+ },
1146
+ "gridPos": {
1147
+ "h": 12,
1148
+ "w": 6,
1149
+ "x": 0,
1150
+ "y": 25
1151
+ },
1152
+ "id": 23,
1153
+ "links": [],
1154
+ "maxDataPoints": 3,
1155
+ "options": {
1156
+ "displayLabels": [],
1157
+ "legend": {
1158
+ "calcs": [],
1159
+ "displayMode": "table",
1160
+ "placement": "right",
1161
+ "showLegend": true,
1162
+ "values": ["value", "percent"]
1163
+ },
1164
+ "pieType": "donut",
1165
+ "reduceOptions": {
1166
+ "calcs": ["sum"],
1167
+ "fields": "",
1168
+ "values": false
1169
+ },
1170
+ "text": {},
1171
+ "tooltip": {
1172
+ "mode": "single",
1173
+ "sort": "none"
1174
+ }
1175
+ },
1176
+ "targets": [
1177
+ {
1178
+ "bucketAggs": [
1179
+ {
1180
+ "$$hashKey": "object:235",
1181
+ "fake": true,
1182
+ "field": "rule_level",
1183
+ "id": "3",
1184
+ "settings": {
1185
+ "min_doc_count": 1,
1186
+ "order": "desc",
1187
+ "orderBy": "_count",
1188
+ "size": "10"
1189
+ },
1190
+ "type": "terms"
1191
+ },
1192
+ {
1193
+ "$$hashKey": "object:236",
1194
+ "field": "timestamp",
1195
+ "id": "2",
1196
+ "settings": {
1197
+ "interval": "auto",
1198
+ "min_doc_count": 0,
1199
+ "trimEdges": 0
1200
+ },
1201
+ "type": "date_histogram"
1202
+ }
1203
+ ],
1204
+ "metrics": [
1205
+ {
1206
+ "$$hashKey": "object:233",
1207
+ "field": "select field",
1208
+ "id": "1",
1209
+ "meta": {},
1210
+ "settings": {},
1211
+ "type": "count"
1212
+ }
1213
+ ],
1214
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
1215
+ "refId": "A",
1216
+ "timeField": "timestamp"
1217
+ }
1218
+ ],
1219
+ "title": "SECURITY EVENTS BY ALERT LEVEL",
1220
+ "type": "piechart"
1221
+ },
1222
+ {
1223
+ "datasource": {
1224
+ "type": "elasticsearch",
1225
+ "uid": "wazuh_datasource_uid"
1226
+ },
1227
+ "fieldConfig": {
1228
+ "defaults": {
1229
+ "color": {
1230
+ "mode": "palette-classic"
1231
+ },
1232
+ "custom": {
1233
+ "axisCenteredZero": false,
1234
+ "axisColorMode": "text",
1235
+ "axisLabel": "",
1236
+ "axisPlacement": "auto",
1237
+ "barAlignment": 0,
1238
+ "drawStyle": "bars",
1239
+ "fillOpacity": 0,
1240
+ "gradientMode": "none",
1241
+ "hideFrom": {
1242
+ "legend": false,
1243
+ "tooltip": false,
1244
+ "viz": false
1245
+ },
1246
+ "lineInterpolation": "linear",
1247
+ "lineWidth": 1,
1248
+ "pointSize": 5,
1249
+ "scaleDistribution": {
1250
+ "type": "linear"
1251
+ },
1252
+ "showPoints": "auto",
1253
+ "spanNulls": false,
1254
+ "stacking": {
1255
+ "group": "A",
1256
+ "mode": "normal"
1257
+ },
1258
+ "thresholdsStyle": {
1259
+ "mode": "off"
1260
+ }
1261
+ },
1262
+ "mappings": [],
1263
+ "thresholds": {
1264
+ "mode": "absolute",
1265
+ "steps": [
1266
+ {
1267
+ "color": "green",
1268
+ "value": null
1269
+ },
1270
+ {
1271
+ "color": "red",
1272
+ "value": 80
1273
+ }
1274
+ ]
1275
+ }
1276
+ },
1277
+ "overrides": []
1278
+ },
1279
+ "gridPos": {
1280
+ "h": 12,
1281
+ "w": 18,
1282
+ "x": 6,
1283
+ "y": 25
1284
+ },
1285
+ "id": 50,
1286
+ "options": {
1287
+ "legend": {
1288
+ "calcs": [],
1289
+ "displayMode": "table",
1290
+ "placement": "right",
1291
+ "showLegend": true
1292
+ },
1293
+ "tooltip": {
1294
+ "mode": "single",
1295
+ "sort": "none"
1296
+ }
1297
+ },
1298
+ "targets": [
1299
+ {
1300
+ "alias": "",
1301
+ "bucketAggs": [
1302
+ {
1303
+ "field": "rule_level",
1304
+ "id": "3",
1305
+ "settings": {
1306
+ "min_doc_count": "1",
1307
+ "order": "desc",
1308
+ "orderBy": "_count",
1309
+ "size": "10"
1310
+ },
1311
+ "type": "terms"
1312
+ },
1313
+ {
1314
+ "field": "timestamp",
1315
+ "id": "2",
1316
+ "settings": {
1317
+ "interval": "5m"
1318
+ },
1319
+ "type": "date_histogram"
1320
+ }
1321
+ ],
1322
+ "datasource": {
1323
+ "type": "elasticsearch",
1324
+ "uid": "wazuh_datasource_uid"
1325
+ },
1326
+ "metrics": [
1327
+ {
1328
+ "id": "1",
1329
+ "type": "count"
1330
+ }
1331
+ ],
1332
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
1333
+ "refId": "A",
1334
+ "timeField": "timestamp"
1335
+ }
1336
+ ],
1337
+ "title": "EVENTS SEVERITY - HISTOGRAM",
1338
+ "type": "timeseries"
1339
+ },
1340
+ {
1341
+ "datasource": {
1342
+ "type": "elasticsearch",
1343
+ "uid": "wazuh_datasource_uid"
1344
+ },
1345
+ "fieldConfig": {
1346
+ "defaults": {
1347
+ "color": {
1348
+ "mode": "thresholds"
1349
+ },
1350
+ "custom": {
1351
+ "align": "auto",
1352
+ "cellOptions": {
1353
+ "type": "auto"
1354
+ },
1355
+ "inspect": false
1356
+ },
1357
+ "decimals": 2,
1358
+ "displayName": "",
1359
+ "mappings": [],
1360
+ "thresholds": {
1361
+ "mode": "absolute",
1362
+ "steps": [
1363
+ {
1364
+ "color": "green",
1365
+ "value": null
1366
+ },
1367
+ {
1368
+ "color": "red",
1369
+ "value": 80
1370
+ }
1371
+ ]
1372
+ },
1373
+ "unit": "short"
1374
+ },
1375
+ "overrides": [
1376
+ {
1377
+ "matcher": {
1378
+ "id": "byName",
1379
+ "options": "Time"
1380
+ },
1381
+ "properties": [
1382
+ {
1383
+ "id": "displayName",
1384
+ "value": "Time"
1385
+ },
1386
+ {
1387
+ "id": "unit",
1388
+ "value": "time: YYYY-MM-DD HH:mm:ss"
1389
+ },
1390
+ {
1391
+ "id": "custom.align"
1392
+ }
1393
+ ]
1394
+ },
1395
+ {
1396
+ "matcher": {
1397
+ "id": "byName",
1398
+ "options": "Count"
1399
+ },
1400
+ "properties": [
1401
+ {
1402
+ "id": "displayName",
1403
+ "value": "Events"
1404
+ },
1405
+ {
1406
+ "id": "unit",
1407
+ "value": "short"
1408
+ },
1409
+ {
1410
+ "id": "decimals",
1411
+ "value": -1
1412
+ },
1413
+ {
1414
+ "id": "custom.align"
1415
+ }
1416
+ ]
1417
+ },
1418
+ {
1419
+ "matcher": {
1420
+ "id": "byName",
1421
+ "options": "rule_groups"
1422
+ },
1423
+ "properties": [
1424
+ {
1425
+ "id": "displayName",
1426
+ "value": "Rule Groups"
1427
+ },
1428
+ {
1429
+ "id": "unit",
1430
+ "value": "short"
1431
+ },
1432
+ {
1433
+ "id": "decimals",
1434
+ "value": 2
1435
+ },
1436
+ {
1437
+ "id": "custom.align"
1438
+ },
1439
+ {
1440
+ "id": "mappings",
1441
+ "value": [
1442
+ {
1443
+ "options": {
1444
+ "apache, web, modsecurity": {
1445
+ "index": 7,
1446
+ "text": "Apache ModSec"
1447
+ },
1448
+ "dnsstat, dnsstat_alert": {
1449
+ "index": 47,
1450
+ "text": "Domain Stats - Alert"
1451
+ },
1452
+ "dnsstat, dnsstat_error": {
1453
+ "index": 41,
1454
+ "text": "Domain Stats - Entry Not found in RDAP"
1455
+ },
1456
+ "docker, docker-error": {
1457
+ "index": 43,
1458
+ "text": "Docker Error"
1459
+ },
1460
+ "linux, docker, falco": {
1461
+ "index": 56,
1462
+ "text": "Linux Docker: Container Event"
1463
+ },
1464
+ "linux, packetbeat, dns": {
1465
+ "index": 58,
1466
+ "text": "Linux - DNS Request"
1467
+ },
1468
+ "linux, packetbeat, http": {
1469
+ "index": 73,
1470
+ "text": "Linux Packetbeat - HTTP Connection"
1471
+ },
1472
+ "linux, packetbeat, tls": {
1473
+ "index": 72,
1474
+ "text": "Linux Packetbeat - HTTPS Connection"
1475
+ },
1476
+ "linux, sysmon, sysmon_event1": {
1477
+ "index": 3,
1478
+ "text": "Linux Sysmon - Process Started"
1479
+ },
1480
+ "linux, sysmon, sysmon_event3": {
1481
+ "index": 2,
1482
+ "text": "Linux Sysmon - Network Connection"
1483
+ },
1484
+ "linux, sysmon, sysmon_event5": {
1485
+ "index": 1,
1486
+ "text": "Linux Sysmon - Process Terminated"
1487
+ },
1488
+ "linux, sysmon, sysmon_event9": {
1489
+ "index": 46,
1490
+ "text": "Linux Sysmon - RawAccessRead"
1491
+ },
1492
+ "linux, sysmon, sysmon_event_11": {
1493
+ "index": 4,
1494
+ "text": "Linux Sysmon - FileCreate"
1495
+ },
1496
+ "linux, sysmon, sysmon_event_16": {
1497
+ "index": 6,
1498
+ "text": "Linux Sysmon - Sysmon Config Changed"
1499
+ },
1500
+ "linux, sysmon, sysmon_event_23": {
1501
+ "index": 5,
1502
+ "text": "Linux Sysmon - File Removed"
1503
+ },
1504
+ "local, systemd": {
1505
+ "index": 74,
1506
+ "text": "Linux Systemd"
1507
+ },
1508
+ "openvpn, authentication_success": {
1509
+ "index": 68,
1510
+ "text": "OpenVPN Client - Auth Success"
1511
+ },
1512
+ "osquery, bpf_socket_events": {
1513
+ "index": 80,
1514
+ "text": "OSQUERY - Socket Events"
1515
+ },
1516
+ "osquery, list_processes_with_hash": {
1517
+ "index": 81,
1518
+ "text": "OSQUERY - Process Hash"
1519
+ },
1520
+ "osquery, process_events": {
1521
+ "index": 79,
1522
+ "text": "OSQUERY - Process Events"
1523
+ },
1524
+ "ossec": {
1525
+ "index": 15,
1526
+ "text": "OSSEC Event"
1527
+ },
1528
+ "ossec, rootcheck": {
1529
+ "index": 19,
1530
+ "text": "OSSEC - Rootcheck"
1531
+ },
1532
+ "ossec, syscheck, syscheck_entry_added, syscheck_file": {
1533
+ "index": 9,
1534
+ "text": "Syscheck - File Added"
1535
+ },
1536
+ "ossec, syscheck, syscheck_entry_added, syscheck_registry": {
1537
+ "index": 39,
1538
+ "text": "Syscheck - Windows Registry (Entry Added)"
1539
+ },
1540
+ "ossec, syscheck, syscheck_entry_deleted, syscheck_file": {
1541
+ "index": 52,
1542
+ "text": "Syscheck - File Deleted"
1543
+ },
1544
+ "ossec, syscheck, syscheck_entry_deleted, syscheck_registry": {
1545
+ "index": 45,
1546
+ "text": "Syscheck - Windows Registry (Entry Deleted)"
1547
+ },
1548
+ "ossec, syscheck, syscheck_entry_modified, syscheck_file": {
1549
+ "index": 14,
1550
+ "text": "Syscheck - File Modified"
1551
+ },
1552
+ "ossec, syscheck, syscheck_entry_modified, syscheck_registry": {
1553
+ "index": 30,
1554
+ "text": "Syscheck - Windows Registry (Entry Modified)"
1555
+ },
1556
+ "pam, syslog": {
1557
+ "index": 18,
1558
+ "text": "Linux PAM"
1559
+ },
1560
+ "pam, syslog, authentication_failed": {
1561
+ "index": 67,
1562
+ "text": "Linux PAM - Auth Failed"
1563
+ },
1564
+ "pam, syslog, authentication_success": {
1565
+ "index": 12,
1566
+ "text": "Linux PAM - Auth Success"
1567
+ },
1568
+ "sca": {
1569
+ "index": 17,
1570
+ "text": "Security Config Assessment"
1571
+ },
1572
+ "syslog, adduser": {
1573
+ "index": 54,
1574
+ "text": "Linux - User Added"
1575
+ },
1576
+ "syslog, dpkg": {
1577
+ "index": 11,
1578
+ "text": "Lunux dpkg"
1579
+ },
1580
+ "syslog, dpkg, config_changed": {
1581
+ "index": 10,
1582
+ "text": "Linux dpkg - Config Changed"
1583
+ },
1584
+ "syslog, errors, service_availability": {
1585
+ "index": 75,
1586
+ "text": "Linux Syslog - System Error"
1587
+ },
1588
+ "syslog, linuxkernel": {
1589
+ "index": 57,
1590
+ "text": "Linux - Kernel Event"
1591
+ },
1592
+ "syslog, linuxkernel, promisc": {
1593
+ "index": 29,
1594
+ "text": "Linux Kernel - Promisc. Interface"
1595
+ },
1596
+ "syslog, sshd, authentication_success": {
1597
+ "index": 13,
1598
+ "text": "SSH - Auth Success"
1599
+ },
1600
+ "syslog, sshd, recon": {
1601
+ "index": 51,
1602
+ "text": "Linux - SSH Daemon Alert"
1603
+ },
1604
+ "syslog, sudo": {
1605
+ "index": 16,
1606
+ "text": "Lunux - Sudo"
1607
+ },
1608
+ "threat_intel, alienvault, otx_alert": {
1609
+ "index": 63,
1610
+ "text": "Threat Intel - AlienVault OTX IoC Alert"
1611
+ },
1612
+ "threat_intel, misp, misp_alert": {
1613
+ "index": 40,
1614
+ "text": "Threat Intel - MISP IoC Alert"
1615
+ },
1616
+ "threat_intel, opencti, opencti_alert": {
1617
+ "index": 62,
1618
+ "text": "Threat Intel - OpenCTI IoC Alert"
1619
+ },
1620
+ "threat_intel, opencti, opencti_error": {
1621
+ "index": 64,
1622
+ "text": "Threat Intel - OpenCTI API Error"
1623
+ },
1624
+ "usb": {
1625
+ "index": 69,
1626
+ "text": "USB Port Event"
1627
+ },
1628
+ "vulnerability-detector": {
1629
+ "index": 0,
1630
+ "text": "Vulnerability Detector"
1631
+ },
1632
+ "vulnerability-detector, snyk": {
1633
+ "index": 55,
1634
+ "text": "Vulnerability Detector - Docker Images"
1635
+ },
1636
+ "wazuh, agent_flooding": {
1637
+ "index": 33,
1638
+ "text": "Wazuh Agent - Event Queue Flooding"
1639
+ },
1640
+ "windows, chainsaw, sigma": {
1641
+ "index": 82,
1642
+ "text": "Windows - Chainsaw (Sigma)"
1643
+ },
1644
+ "windows, inventory": {
1645
+ "index": 27,
1646
+ "text": "Windows Agent Inventory"
1647
+ },
1648
+ "windows, sysmon, sysmon_event1, windows_sysmon_event1": {
1649
+ "index": 48,
1650
+ "text": "Windows Sysmon - Process Started"
1651
+ },
1652
+ "windows, sysmon, sysmon_event1, windows_sysmon_event1, sysmon_anomaly": {
1653
+ "index": 77,
1654
+ "text": "Windows Sysmon - Process Started Anomaly"
1655
+ },
1656
+ "windows, sysmon, sysmon_event2": {
1657
+ "index": 78,
1658
+ "text": "Windows Sysmon - A Process changed File Creation Time"
1659
+ },
1660
+ "windows, sysmon, sysmon_event3": {
1661
+ "index": 36,
1662
+ "text": "Windows Sysmon - Network Connection"
1663
+ },
1664
+ "windows, sysmon, sysmon_event3, sysmon_anomaly": {
1665
+ "index": 76,
1666
+ "text": "Windows Sysmon - Network Connection Anomaly"
1667
+ },
1668
+ "windows, sysmon, sysmon_event7": {
1669
+ "index": 25,
1670
+ "text": "Windows Sysmon - DLL SideLoading"
1671
+ },
1672
+ "windows, sysmon, sysmon_event_10": {
1673
+ "index": 32,
1674
+ "text": "Windows Sysmon - Process Injection"
1675
+ },
1676
+ "windows, sysmon, sysmon_event_11": {
1677
+ "index": 20,
1678
+ "text": "Windows Sysmon - FileCreate"
1679
+ },
1680
+ "windows, sysmon, sysmon_event_12": {
1681
+ "index": 23,
1682
+ "text": "Windows Sysmon - RegistryEvent (Object create and delete)"
1683
+ },
1684
+ "windows, sysmon, sysmon_event_13": {
1685
+ "index": 24,
1686
+ "text": "Windows Sysmon - RegistryEvent (ValueSet)"
1687
+ },
1688
+ "windows, sysmon, sysmon_event_15": {
1689
+ "index": 61,
1690
+ "text": "Windows Sysmon - FileCreateStreamHash"
1691
+ },
1692
+ "windows, sysmon, sysmon_event_17": {
1693
+ "index": 70,
1694
+ "text": "Windows Sysmon - Pipe Created"
1695
+ },
1696
+ "windows, sysmon, sysmon_event_22": {
1697
+ "index": 38,
1698
+ "text": "Windows Sysmon - DNS Request"
1699
+ },
1700
+ "windows, sysmon, sysmon_event_23": {
1701
+ "index": 28,
1702
+ "text": "Windows Sysmon - File Removed"
1703
+ },
1704
+ "windows, sysmon, sysmon_event_25": {
1705
+ "index": 71,
1706
+ "text": "Windows Sysmon - Process Tampering"
1707
+ },
1708
+ "windows, sysmon, sysmon_process-anomalies": {
1709
+ "index": 53,
1710
+ "text": "Windows Sysmon - Process Anomalies"
1711
+ },
1712
+ "windows, system_error": {
1713
+ "index": 49,
1714
+ "text": "Windows - System Error"
1715
+ },
1716
+ "windows, windows_application": {
1717
+ "index": 31,
1718
+ "text": "WinEvtLogs - Application"
1719
+ },
1720
+ "windows, windows_application, system_error": {
1721
+ "index": 59,
1722
+ "text": "WinEvtLogs - Application Error"
1723
+ },
1724
+ "windows, windows_autoruns": {
1725
+ "index": 37,
1726
+ "text": "Windows Persistent Footholds"
1727
+ },
1728
+ "windows, windows_defender": {
1729
+ "index": 35,
1730
+ "text": "Windows Defender"
1731
+ },
1732
+ "windows, windows_firewall, firewall": {
1733
+ "index": 60,
1734
+ "text": "Windows - Windows Firewall"
1735
+ },
1736
+ "windows, windows_logonsessions": {
1737
+ "index": 26,
1738
+ "text": "Windows Logon Sessions (Snapshot)"
1739
+ },
1740
+ "windows, windows_powershell": {
1741
+ "index": 50,
1742
+ "text": "Windows - PowerShell"
1743
+ },
1744
+ "windows, windows_security": {
1745
+ "index": 22,
1746
+ "text": "WinEvtLogs - Security"
1747
+ },
1748
+ "windows, windows_security, authentication_failed": {
1749
+ "index": 65,
1750
+ "text": "Windows - Failed Authentication"
1751
+ },
1752
+ "windows, windows_security, authentication_success": {
1753
+ "index": 21,
1754
+ "text": "Windows - Successful Auths"
1755
+ },
1756
+ "windows, windows_sigcheck": {
1757
+ "index": 42,
1758
+ "text": "Windows Exec Analysis"
1759
+ },
1760
+ "windows, windows_system": {
1761
+ "index": 44,
1762
+ "text": "WinEvtLogs - System"
1763
+ },
1764
+ "windows, windows_system, policy_changed": {
1765
+ "index": 34,
1766
+ "text": "Windows Group Policy"
1767
+ },
1768
+ "windows, windows_system, system_error": {
1769
+ "index": 66,
1770
+ "text": "Windows - System Error"
1771
+ },
1772
+ "yara": {
1773
+ "index": 8,
1774
+ "text": "Yara Malware Scanner"
1775
+ }
1776
+ },
1777
+ "type": "value"
1778
+ }
1779
+ ]
1780
+ },
1781
+ {
1782
+ "id": "links",
1783
+ "value": [
1784
+ {
1785
+ "targetBlank": true,
1786
+ "title": "VIEW EVENTS",
1787
+ "url": "https://grafana.company.local/explore?left=%5B%22now-1h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22rule_groups:${__value.raw}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D"
1788
+ }
1789
+ ]
1790
+ }
1791
+ ]
1792
+ },
1793
+ {
1794
+ "matcher": {
1795
+ "id": "byName",
1796
+ "options": "Rule Groups"
1797
+ },
1798
+ "properties": [
1799
+ {
1800
+ "id": "custom.width",
1801
+ "value": 302
1802
+ }
1803
+ ]
1804
+ }
1805
+ ]
1806
+ },
1807
+ "gridPos": {
1808
+ "h": 14,
1809
+ "w": 6,
1810
+ "x": 0,
1811
+ "y": 37
1812
+ },
1813
+ "id": 24,
1814
+ "links": [],
1815
+ "options": {
1816
+ "cellHeight": "sm",
1817
+ "footer": {
1818
+ "countRows": false,
1819
+ "fields": "",
1820
+ "reducer": ["sum"],
1821
+ "show": false
1822
+ },
1823
+ "showHeader": true,
1824
+ "sortBy": []
1825
+ },
1826
+ "pluginVersion": "10.0.2",
1827
+ "targets": [
1828
+ {
1829
+ "bucketAggs": [
1830
+ {
1831
+ "$$hashKey": "object:332",
1832
+ "field": "rule_groups",
1833
+ "id": "2",
1834
+ "settings": {
1835
+ "min_doc_count": 1,
1836
+ "order": "desc",
1837
+ "orderBy": "_count",
1838
+ "size": "0"
1839
+ },
1840
+ "type": "terms"
1841
+ }
1842
+ ],
1843
+ "metrics": [
1844
+ {
1845
+ "$$hashKey": "object:330",
1846
+ "field": "select field",
1847
+ "id": "1",
1848
+ "meta": {},
1849
+ "settings": {},
1850
+ "type": "count"
1851
+ }
1852
+ ],
1853
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
1854
+ "refId": "A",
1855
+ "timeField": "timestamp"
1856
+ }
1857
+ ],
1858
+ "title": "EVENTS BY CATEGORY GROUP",
1859
+ "transformations": [
1860
+ {
1861
+ "id": "merge",
1862
+ "options": {
1863
+ "reducers": []
1864
+ }
1865
+ }
1866
+ ],
1867
+ "type": "table"
1868
+ },
1869
+ {
1870
+ "datasource": {
1871
+ "type": "elasticsearch",
1872
+ "uid": "wazuh_datasource_uid"
1873
+ },
1874
+ "fieldConfig": {
1875
+ "defaults": {
1876
+ "color": {
1877
+ "mode": "palette-classic"
1878
+ },
1879
+ "custom": {
1880
+ "axisCenteredZero": false,
1881
+ "axisColorMode": "text",
1882
+ "axisLabel": "",
1883
+ "axisPlacement": "auto",
1884
+ "barAlignment": 0,
1885
+ "drawStyle": "bars",
1886
+ "fillOpacity": 0,
1887
+ "gradientMode": "none",
1888
+ "hideFrom": {
1889
+ "legend": false,
1890
+ "tooltip": false,
1891
+ "viz": false
1892
+ },
1893
+ "lineInterpolation": "linear",
1894
+ "lineWidth": 1,
1895
+ "pointSize": 5,
1896
+ "scaleDistribution": {
1897
+ "type": "linear"
1898
+ },
1899
+ "showPoints": "auto",
1900
+ "spanNulls": false,
1901
+ "stacking": {
1902
+ "group": "A",
1903
+ "mode": "normal"
1904
+ },
1905
+ "thresholdsStyle": {
1906
+ "mode": "off"
1907
+ }
1908
+ },
1909
+ "mappings": [],
1910
+ "thresholds": {
1911
+ "mode": "absolute",
1912
+ "steps": [
1913
+ {
1914
+ "color": "green",
1915
+ "value": null
1916
+ },
1917
+ {
1918
+ "color": "red",
1919
+ "value": 80
1920
+ }
1921
+ ]
1922
+ }
1923
+ },
1924
+ "overrides": []
1925
+ },
1926
+ "gridPos": {
1927
+ "h": 14,
1928
+ "w": 18,
1929
+ "x": 6,
1930
+ "y": 37
1931
+ },
1932
+ "id": 51,
1933
+ "options": {
1934
+ "legend": {
1935
+ "calcs": [],
1936
+ "displayMode": "table",
1937
+ "placement": "right",
1938
+ "showLegend": true
1939
+ },
1940
+ "tooltip": {
1941
+ "mode": "single",
1942
+ "sort": "none"
1943
+ }
1944
+ },
1945
+ "targets": [
1946
+ {
1947
+ "alias": "",
1948
+ "bucketAggs": [
1949
+ {
1950
+ "field": "rule_groups",
1951
+ "id": "3",
1952
+ "settings": {
1953
+ "min_doc_count": "1",
1954
+ "order": "desc",
1955
+ "orderBy": "_count",
1956
+ "size": "10"
1957
+ },
1958
+ "type": "terms"
1959
+ },
1960
+ {
1961
+ "field": "timestamp",
1962
+ "id": "2",
1963
+ "settings": {
1964
+ "interval": "5m"
1965
+ },
1966
+ "type": "date_histogram"
1967
+ }
1968
+ ],
1969
+ "datasource": {
1970
+ "type": "elasticsearch",
1971
+ "uid": "wazuh_datasource_uid"
1972
+ },
1973
+ "metrics": [
1974
+ {
1975
+ "id": "1",
1976
+ "type": "count"
1977
+ }
1978
+ ],
1979
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
1980
+ "refId": "A",
1981
+ "timeField": "timestamp"
1982
+ }
1983
+ ],
1984
+ "title": "EVENTS BY ALERT GROUP (TOP 10) - HISTOGRAM",
1985
+ "transparent": true,
1986
+ "type": "timeseries"
1987
+ },
1988
+ {
1989
+ "datasource": {
1990
+ "type": "elasticsearch",
1991
+ "uid": "wazuh_datasource_uid"
1992
+ },
1993
+ "fieldConfig": {
1994
+ "defaults": {
1995
+ "color": {
1996
+ "mode": "thresholds"
1997
+ },
1998
+ "custom": {
1999
+ "align": "auto",
2000
+ "cellOptions": {
2001
+ "type": "auto"
2002
+ },
2003
+ "filterable": true,
2004
+ "inspect": false
2005
+ },
2006
+ "mappings": [],
2007
+ "thresholds": {
2008
+ "mode": "absolute",
2009
+ "steps": [
2010
+ {
2011
+ "color": "green"
2012
+ },
2013
+ {
2014
+ "color": "red",
2015
+ "value": 80
2016
+ }
2017
+ ]
2018
+ }
2019
+ },
2020
+ "overrides": [
2021
+ {
2022
+ "matcher": {
2023
+ "id": "byName",
2024
+ "options": "timestamp"
2025
+ },
2026
+ "properties": [
2027
+ {
2028
+ "id": "displayName",
2029
+ "value": "Date/Time"
2030
+ },
2031
+ {
2032
+ "id": "unit",
2033
+ "value": "time: YYYY-MM-DD HH:mm:ss"
2034
+ },
2035
+ {
2036
+ "id": "custom.align"
2037
+ }
2038
+ ]
2039
+ },
2040
+ {
2041
+ "matcher": {
2042
+ "id": "byName",
2043
+ "options": "agent_name"
2044
+ },
2045
+ "properties": [
2046
+ {
2047
+ "id": "displayName",
2048
+ "value": "AGENT"
2049
+ },
2050
+ {
2051
+ "id": "unit",
2052
+ "value": "short"
2053
+ },
2054
+ {
2055
+ "id": "decimals",
2056
+ "value": 2
2057
+ },
2058
+ {
2059
+ "id": "custom.align"
2060
+ }
2061
+ ]
2062
+ },
2063
+ {
2064
+ "matcher": {
2065
+ "id": "byName",
2066
+ "options": "agent_ip"
2067
+ },
2068
+ "properties": [
2069
+ {
2070
+ "id": "displayName",
2071
+ "value": "IP ADDRESS"
2072
+ },
2073
+ {
2074
+ "id": "unit",
2075
+ "value": "short"
2076
+ },
2077
+ {
2078
+ "id": "decimals",
2079
+ "value": 2
2080
+ },
2081
+ {
2082
+ "id": "custom.align"
2083
+ }
2084
+ ]
2085
+ },
2086
+ {
2087
+ "matcher": {
2088
+ "id": "byName",
2089
+ "options": "rule_level"
2090
+ },
2091
+ "properties": [
2092
+ {
2093
+ "id": "displayName",
2094
+ "value": "RULE LEVEL"
2095
+ },
2096
+ {
2097
+ "id": "unit",
2098
+ "value": "short"
2099
+ },
2100
+ {
2101
+ "id": "decimals",
2102
+ "value": -1
2103
+ },
2104
+ {
2105
+ "id": "custom.cellOptions",
2106
+ "value": {
2107
+ "mode": "gradient",
2108
+ "type": "color-background"
2109
+ }
2110
+ },
2111
+ {
2112
+ "id": "custom.align"
2113
+ },
2114
+ {
2115
+ "id": "thresholds",
2116
+ "value": {
2117
+ "mode": "absolute",
2118
+ "steps": [
2119
+ {
2120
+ "color": "#37872D"
2121
+ },
2122
+ {
2123
+ "color": "rgba(237, 129, 40, 0.89)",
2124
+ "value": 7
2125
+ },
2126
+ {
2127
+ "color": "rgba(245, 54, 54, 0.9)",
2128
+ "value": 12
2129
+ }
2130
+ ]
2131
+ }
2132
+ }
2133
+ ]
2134
+ },
2135
+ {
2136
+ "matcher": {
2137
+ "id": "byName",
2138
+ "options": "rule_description"
2139
+ },
2140
+ "properties": [
2141
+ {
2142
+ "id": "displayName",
2143
+ "value": "RULE DESCRIPTION"
2144
+ },
2145
+ {
2146
+ "id": "unit",
2147
+ "value": "short"
2148
+ },
2149
+ {
2150
+ "id": "decimals",
2151
+ "value": 2
2152
+ },
2153
+ {
2154
+ "id": "custom.align"
2155
+ }
2156
+ ]
2157
+ },
2158
+ {
2159
+ "matcher": {
2160
+ "id": "byName",
2161
+ "options": "Date/Time"
2162
+ },
2163
+ "properties": [
2164
+ {
2165
+ "id": "custom.width",
2166
+ "value": 242
2167
+ }
2168
+ ]
2169
+ },
2170
+ {
2171
+ "matcher": {
2172
+ "id": "byName",
2173
+ "options": "AGENT"
2174
+ },
2175
+ "properties": [
2176
+ {
2177
+ "id": "custom.width",
2178
+ "value": 160
2179
+ }
2180
+ ]
2181
+ },
2182
+ {
2183
+ "matcher": {
2184
+ "id": "byName",
2185
+ "options": "MITRE TACTIC"
2186
+ },
2187
+ "properties": [
2188
+ {
2189
+ "id": "custom.width",
2190
+ "value": 332
2191
+ }
2192
+ ]
2193
+ },
2194
+ {
2195
+ "matcher": {
2196
+ "id": "byName",
2197
+ "options": "RULE LEVEL"
2198
+ },
2199
+ "properties": [
2200
+ {
2201
+ "id": "custom.width",
2202
+ "value": 122
2203
+ }
2204
+ ]
2205
+ },
2206
+ {
2207
+ "matcher": {
2208
+ "id": "byName",
2209
+ "options": "IP ADDRESS"
2210
+ },
2211
+ "properties": [
2212
+ {
2213
+ "id": "custom.width",
2214
+ "value": 163
2215
+ }
2216
+ ]
2217
+ },
2218
+ {
2219
+ "matcher": {
2220
+ "id": "byName",
2221
+ "options": "MITRE TECHNIQUE"
2222
+ },
2223
+ "properties": [
2224
+ {
2225
+ "id": "custom.width",
2226
+ "value": 312
2227
+ }
2228
+ ]
2229
+ },
2230
+ {
2231
+ "matcher": {
2232
+ "id": "byName",
2233
+ "options": "rule_id"
2234
+ },
2235
+ "properties": [
2236
+ {
2237
+ "id": "custom.width",
2238
+ "value": 96
2239
+ }
2240
+ ]
2241
+ },
2242
+ {
2243
+ "matcher": {
2244
+ "id": "byName",
2245
+ "options": "EVENT ID"
2246
+ },
2247
+ "properties": [
2248
+ {
2249
+ "id": "links",
2250
+ "value": [
2251
+ {
2252
+ "targetBlank": true,
2253
+ "title": "VIEW EVENT DETAILS",
2254
+ "url": "https://grafana.company.local/explore?left=%7B%22datasource%22:%22WAZUH%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22query%22:%22_id:${__value.text}%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D,%22range%22:%7B%22from%22:%22now-6h%22,%22to%22:%22now%22%7D%7D"
2255
+ }
2256
+ ]
2257
+ }
2258
+ ]
2259
+ }
2260
+ ]
2261
+ },
2262
+ "gridPos": {
2263
+ "h": 16,
2264
+ "w": 24,
2265
+ "x": 0,
2266
+ "y": 51
2267
+ },
2268
+ "id": 27,
2269
+ "options": {
2270
+ "cellHeight": "sm",
2271
+ "footer": {
2272
+ "countRows": false,
2273
+ "fields": "",
2274
+ "reducer": ["sum"],
2275
+ "show": false
2276
+ },
2277
+ "showHeader": true,
2278
+ "sortBy": [
2279
+ {
2280
+ "desc": true,
2281
+ "displayName": "Date/Time"
2282
+ }
2283
+ ]
2284
+ },
2285
+ "pluginVersion": "10.0.2",
2286
+ "targets": [
2287
+ {
2288
+ "bucketAggs": [],
2289
+ "datasource": {
2290
+ "type": "elasticsearch",
2291
+ "uid": "wazuh_datasource_uid"
2292
+ },
2293
+ "metrics": [
2294
+ {
2295
+ "id": "1",
2296
+ "settings": {
2297
+ "size": "250"
2298
+ },
2299
+ "type": "raw_data"
2300
+ }
2301
+ ],
2302
+ "query": "agent_name:$agent_name AND rule_level:$rule_level",
2303
+ "refId": "A",
2304
+ "timeField": "timestamp"
2305
+ }
2306
+ ],
2307
+ "title": "EVENTS",
2308
+ "transformations": [
2309
+ {
2310
+ "id": "merge",
2311
+ "options": {
2312
+ "reducers": []
2313
+ }
2314
+ },
2315
+ {
2316
+ "id": "filterFieldsByName",
2317
+ "options": {
2318
+ "include": {
2319
+ "names": [
2320
+ "timestamp",
2321
+ "agent_ip",
2322
+ "agent_name",
2323
+ "rule_description",
2324
+ "rule_id",
2325
+ "rule_level",
2326
+ "rule_mitre_tactic",
2327
+ "rule_mitre_technique",
2328
+ "_id"
2329
+ ]
2330
+ }
2331
+ }
2332
+ },
2333
+ {
2334
+ "id": "organize",
2335
+ "options": {
2336
+ "excludeByName": {
2337
+ "@metadata_beat": true,
2338
+ "@metadata_type": true,
2339
+ "@metadata_version": true,
2340
+ "IMPHASH": true,
2341
+ "MD5": true,
2342
+ "SHA1": true,
2343
+ "SHA256": true,
2344
+ "_id": false,
2345
+ "_index": true,
2346
+ "_type": true,
2347
+ "agent_ephemeral_id": true,
2348
+ "agent_hostname": true,
2349
+ "agent_id": true,
2350
+ "agent_ip_city_name": true,
2351
+ "agent_ip_country_code": true,
2352
+ "agent_ip_geolocation": true,
2353
+ "agent_name": false,
2354
+ "agent_type": true,
2355
+ "agent_version": true,
2356
+ "beats_type": true,
2357
+ "collector_node_id": true,
2358
+ "data_alert_action": true,
2359
+ "data_alert_category": true,
2360
+ "data_alert_gid": true,
2361
+ "data_alert_rev": true,
2362
+ "data_alert_severity": true,
2363
+ "data_alert_signature": true,
2364
+ "data_alert_signature_id": true,
2365
+ "data_app_proto": true,
2366
+ "data_audit_auid": true,
2367
+ "data_audit_command": true,
2368
+ "data_audit_euid": true,
2369
+ "data_audit_exe": true,
2370
+ "data_audit_gid": true,
2371
+ "data_audit_id": true,
2372
+ "data_audit_pid": true,
2373
+ "data_audit_res": true,
2374
+ "data_audit_session": true,
2375
+ "data_audit_type": true,
2376
+ "data_audit_uid": true,
2377
+ "data_dest_ip": true,
2378
+ "data_dest_port": true,
2379
+ "data_dstuser": true,
2380
+ "data_event_type": true,
2381
+ "data_extra_data": true,
2382
+ "data_file": true,
2383
+ "data_flow_bytes_toclient": true,
2384
+ "data_flow_bytes_toserver": true,
2385
+ "data_flow_id": true,
2386
+ "data_flow_pkts_toclient": true,
2387
+ "data_flow_pkts_toserver": true,
2388
+ "data_flow_start": true,
2389
+ "data_http_http_content_type": true,
2390
+ "data_http_http_port": true,
2391
+ "data_http_length": true,
2392
+ "data_http_status": true,
2393
+ "data_http_url": true,
2394
+ "data_id": true,
2395
+ "data_in_iface": true,
2396
+ "data_metadata_flowbits": true,
2397
+ "data_metadata_flowints_http_anomaly_count": true,
2398
+ "data_metadata_flowints_tcp_retransmission_count": true,
2399
+ "data_osquery_action": true,
2400
+ "data_osquery_calendarTime": true,
2401
+ "data_osquery_columns_address": true,
2402
+ "data_osquery_columns_address_city_name": true,
2403
+ "data_osquery_columns_address_country_code": true,
2404
+ "data_osquery_columns_address_geolocation": true,
2405
+ "data_osquery_columns_cmdline": true,
2406
+ "data_osquery_columns_cwd": true,
2407
+ "data_osquery_columns_description": true,
2408
+ "data_osquery_columns_directory": true,
2409
+ "data_osquery_columns_disk_bytes_read": true,
2410
+ "data_osquery_columns_disk_bytes_written": true,
2411
+ "data_osquery_columns_egid": true,
2412
+ "data_osquery_columns_euid": true,
2413
+ "data_osquery_columns_family": true,
2414
+ "data_osquery_columns_fd": true,
2415
+ "data_osquery_columns_gid": true,
2416
+ "data_osquery_columns_gid_signed": true,
2417
+ "data_osquery_columns_host": true,
2418
+ "data_osquery_columns_interface": true,
2419
+ "data_osquery_columns_local_address": true,
2420
+ "data_osquery_columns_local_address_city_name": true,
2421
+ "data_osquery_columns_local_address_country_code": true,
2422
+ "data_osquery_columns_local_address_geolocation": true,
2423
+ "data_osquery_columns_local_port": true,
2424
+ "data_osquery_columns_mac": true,
2425
+ "data_osquery_columns_name": true,
2426
+ "data_osquery_columns_net_namespace": true,
2427
+ "data_osquery_columns_nice": true,
2428
+ "data_osquery_columns_on_disk": true,
2429
+ "data_osquery_columns_parent": true,
2430
+ "data_osquery_columns_path": true,
2431
+ "data_osquery_columns_pgroup": true,
2432
+ "data_osquery_columns_pid": true,
2433
+ "data_osquery_columns_port": true,
2434
+ "data_osquery_columns_protocol": true,
2435
+ "data_osquery_columns_remote_address": true,
2436
+ "data_osquery_columns_remote_address_city_name": true,
2437
+ "data_osquery_columns_remote_address_country_code": true,
2438
+ "data_osquery_columns_remote_address_geolocation": true,
2439
+ "data_osquery_columns_remote_port": true,
2440
+ "data_osquery_columns_resident_size": true,
2441
+ "data_osquery_columns_root": true,
2442
+ "data_osquery_columns_sgid": true,
2443
+ "data_osquery_columns_shell": true,
2444
+ "data_osquery_columns_socket": true,
2445
+ "data_osquery_columns_start_time": true,
2446
+ "data_osquery_columns_state": true,
2447
+ "data_osquery_columns_suid": true,
2448
+ "data_osquery_columns_system_time": true,
2449
+ "data_osquery_columns_threads": true,
2450
+ "data_osquery_columns_time_utc": true,
2451
+ "data_osquery_columns_total_size": true,
2452
+ "data_osquery_columns_tty": true,
2453
+ "data_osquery_columns_type": true,
2454
+ "data_osquery_columns_uid": true,
2455
+ "data_osquery_columns_uid_signed": true,
2456
+ "data_osquery_columns_user": true,
2457
+ "data_osquery_columns_user_time": true,
2458
+ "data_osquery_columns_username": true,
2459
+ "data_osquery_columns_wired_size": true,
2460
+ "data_osquery_counter": true,
2461
+ "data_osquery_decorations_host_uuid": true,
2462
+ "data_osquery_decorations_hostname": true,
2463
+ "data_osquery_epoch": true,
2464
+ "data_osquery_hostIdentifier": true,
2465
+ "data_osquery_name": true,
2466
+ "data_osquery_numerics": true,
2467
+ "data_osquery_unixTime": true,
2468
+ "data_proto": true,
2469
+ "data_sca_check_command": true,
2470
+ "data_sca_check_compliance_cis": true,
2471
+ "data_sca_check_compliance_cis_csc": true,
2472
+ "data_sca_check_compliance_gdpr_IV": true,
2473
+ "data_sca_check_compliance_gpg_13": true,
2474
+ "data_sca_check_compliance_hipaa": true,
2475
+ "data_sca_check_compliance_nist_800_53": true,
2476
+ "data_sca_check_compliance_pci_dss": true,
2477
+ "data_sca_check_compliance_tsc": true,
2478
+ "data_sca_check_description": true,
2479
+ "data_sca_check_id": true,
2480
+ "data_sca_check_previous_result": true,
2481
+ "data_sca_check_rationale": true,
2482
+ "data_sca_check_remediation": true,
2483
+ "data_sca_check_result": true,
2484
+ "data_sca_check_title": true,
2485
+ "data_sca_description": true,
2486
+ "data_sca_failed": true,
2487
+ "data_sca_file": true,
2488
+ "data_sca_invalid": true,
2489
+ "data_sca_passed": true,
2490
+ "data_sca_policy": true,
2491
+ "data_sca_policy_id": true,
2492
+ "data_sca_scan_id": true,
2493
+ "data_sca_score": true,
2494
+ "data_sca_total_checks": true,
2495
+ "data_sca_type": true,
2496
+ "data_script": true,
2497
+ "data_src_ip": true,
2498
+ "data_src_ip_city_name": true,
2499
+ "data_src_ip_country_code": true,
2500
+ "data_src_ip_geolocation": true,
2501
+ "data_src_port": true,
2502
+ "data_srcip": true,
2503
+ "data_srcip_city_name": true,
2504
+ "data_srcip_country_code": true,
2505
+ "data_srcip_geolocation": true,
2506
+ "data_srcuser": true,
2507
+ "data_timestamp": true,
2508
+ "data_title": true,
2509
+ "data_tls_session_resumed": true,
2510
+ "data_tls_version": true,
2511
+ "data_tx_id": true,
2512
+ "data_type": true,
2513
+ "data_win_eventXML_binaryData": true,
2514
+ "data_win_eventXML_binaryDataSize": true,
2515
+ "data_win_eventXML_param1": true,
2516
+ "data_win_eventdata_authenticationPackageName": true,
2517
+ "data_win_eventdata_callTrace": true,
2518
+ "data_win_eventdata_commandLine": true,
2519
+ "data_win_eventdata_company": true,
2520
+ "data_win_eventdata_creationUtcTime": true,
2521
+ "data_win_eventdata_currentDirectory": true,
2522
+ "data_win_eventdata_description": true,
2523
+ "data_win_eventdata_destinationHostname": true,
2524
+ "data_win_eventdata_destinationIp": true,
2525
+ "data_win_eventdata_destinationIp_city_name": true,
2526
+ "data_win_eventdata_destinationIp_country_code": true,
2527
+ "data_win_eventdata_destinationIp_geolocation": true,
2528
+ "data_win_eventdata_destinationIsIpv6": true,
2529
+ "data_win_eventdata_destinationPort": true,
2530
+ "data_win_eventdata_destinationPortName": true,
2531
+ "data_win_eventdata_details": true,
2532
+ "data_win_eventdata_elevatedToken": true,
2533
+ "data_win_eventdata_eventType": true,
2534
+ "data_win_eventdata_fileVersion": true,
2535
+ "data_win_eventdata_fileVersion_city_name": true,
2536
+ "data_win_eventdata_fileVersion_country_code": true,
2537
+ "data_win_eventdata_fileVersion_geolocation": true,
2538
+ "data_win_eventdata_grantedAccess": true,
2539
+ "data_win_eventdata_hashes": true,
2540
+ "data_win_eventdata_image": true,
2541
+ "data_win_eventdata_imageLoaded": true,
2542
+ "data_win_eventdata_impersonationLevel": true,
2543
+ "data_win_eventdata_initiated": true,
2544
+ "data_win_eventdata_integrityLevel": true,
2545
+ "data_win_eventdata_ipAddress": true,
2546
+ "data_win_eventdata_ipPort": true,
2547
+ "data_win_eventdata_keyLength": true,
2548
+ "data_win_eventdata_logonGuid": true,
2549
+ "data_win_eventdata_logonId": true,
2550
+ "data_win_eventdata_logonProcessName": true,
2551
+ "data_win_eventdata_logonType": true,
2552
+ "data_win_eventdata_originalFileName": true,
2553
+ "data_win_eventdata_param1": true,
2554
+ "data_win_eventdata_param2": true,
2555
+ "data_win_eventdata_param3": true,
2556
+ "data_win_eventdata_param4": true,
2557
+ "data_win_eventdata_parentCommandLine": true,
2558
+ "data_win_eventdata_parentImage": true,
2559
+ "data_win_eventdata_parentProcessGuid": true,
2560
+ "data_win_eventdata_parentProcessId": true,
2561
+ "data_win_eventdata_processGuid": true,
2562
+ "data_win_eventdata_processId": true,
2563
+ "data_win_eventdata_processName": true,
2564
+ "data_win_eventdata_product": true,
2565
+ "data_win_eventdata_protocol": true,
2566
+ "data_win_eventdata_queryName": true,
2567
+ "data_win_eventdata_queryResults": true,
2568
+ "data_win_eventdata_queryStatus": true,
2569
+ "data_win_eventdata_ruleName": true,
2570
+ "data_win_eventdata_serviceName": true,
2571
+ "data_win_eventdata_serviceSid": true,
2572
+ "data_win_eventdata_signature": true,
2573
+ "data_win_eventdata_signatureStatus": true,
2574
+ "data_win_eventdata_signed": true,
2575
+ "data_win_eventdata_sourceHostname": true,
2576
+ "data_win_eventdata_sourceImage": true,
2577
+ "data_win_eventdata_sourceIp": true,
2578
+ "data_win_eventdata_sourceIp_city_name": true,
2579
+ "data_win_eventdata_sourceIp_country_code": true,
2580
+ "data_win_eventdata_sourceIp_geolocation": true,
2581
+ "data_win_eventdata_sourceIsIpv6": true,
2582
+ "data_win_eventdata_sourcePort": true,
2583
+ "data_win_eventdata_sourceProcessGUID": true,
2584
+ "data_win_eventdata_sourceProcessId": true,
2585
+ "data_win_eventdata_sourceThreadId": true,
2586
+ "data_win_eventdata_status": true,
2587
+ "data_win_eventdata_subjectDomainName": true,
2588
+ "data_win_eventdata_subjectLogonId": true,
2589
+ "data_win_eventdata_subjectUserName": true,
2590
+ "data_win_eventdata_subjectUserSid": true,
2591
+ "data_win_eventdata_targetDomainName": true,
2592
+ "data_win_eventdata_targetFilename": true,
2593
+ "data_win_eventdata_targetImage": true,
2594
+ "data_win_eventdata_targetLinkedLogonId": true,
2595
+ "data_win_eventdata_targetLogonId": true,
2596
+ "data_win_eventdata_targetObject": true,
2597
+ "data_win_eventdata_targetProcessGUID": true,
2598
+ "data_win_eventdata_targetProcessId": true,
2599
+ "data_win_eventdata_targetUserName": true,
2600
+ "data_win_eventdata_targetUserSid": true,
2601
+ "data_win_eventdata_terminalSessionId": true,
2602
+ "data_win_eventdata_ticketEncryptionType": true,
2603
+ "data_win_eventdata_ticketOptions": true,
2604
+ "data_win_eventdata_user": true,
2605
+ "data_win_eventdata_utcTime": true,
2606
+ "data_win_eventdata_virtualAccount": true,
2607
+ "data_win_system_channel": true,
2608
+ "data_win_system_computer": true,
2609
+ "data_win_system_eventID": true,
2610
+ "data_win_system_eventRecordID": true,
2611
+ "data_win_system_eventSourceName": true,
2612
+ "data_win_system_keywords": true,
2613
+ "data_win_system_level": true,
2614
+ "data_win_system_message": true,
2615
+ "data_win_system_opcode": true,
2616
+ "data_win_system_processID": true,
2617
+ "data_win_system_providerGuid": true,
2618
+ "data_win_system_providerName": true,
2619
+ "data_win_system_severityValue": true,
2620
+ "data_win_system_systemTime": true,
2621
+ "data_win_system_task": true,
2622
+ "data_win_system_threadID": true,
2623
+ "data_win_system_version": true,
2624
+ "decoder_name": true,
2625
+ "decoder_parent": true,
2626
+ "dns_query": true,
2627
+ "dns_query_threat_indicated": true,
2628
+ "dst_ip": true,
2629
+ "dst_ip_city_name": true,
2630
+ "dst_ip_country_code": true,
2631
+ "dst_ip_geolocation": true,
2632
+ "dst_ip_threat_indicated": true,
2633
+ "dst_port": true,
2634
+ "ecs_version": true,
2635
+ "error": true,
2636
+ "event_hash": true,
2637
+ "file_path": true,
2638
+ "firewall_rule_name": true,
2639
+ "full_log": false,
2640
+ "gl2_accounted_message_size": true,
2641
+ "gl2_message_id": true,
2642
+ "gl2_remote_ip": true,
2643
+ "gl2_remote_port": true,
2644
+ "gl2_source_collector": true,
2645
+ "gl2_source_input": true,
2646
+ "gl2_source_node": true,
2647
+ "hash_md5": true,
2648
+ "hash_sha1": true,
2649
+ "hash_sha256": true,
2650
+ "highlight": true,
2651
+ "host_architecture": true,
2652
+ "host_containerized": true,
2653
+ "host_hostname": true,
2654
+ "host_id": true,
2655
+ "host_ip": true,
2656
+ "host_mac": true,
2657
+ "host_name": true,
2658
+ "host_os_codename": true,
2659
+ "host_os_kernel": true,
2660
+ "host_os_name": true,
2661
+ "host_os_platform": true,
2662
+ "host_os_version": true,
2663
+ "hostname": true,
2664
+ "id": true,
2665
+ "input_type": true,
2666
+ "level": true,
2667
+ "location": true,
2668
+ "log_file_path": true,
2669
+ "log_offset": true,
2670
+ "manager_name": true,
2671
+ "message": true,
2672
+ "module": true,
2673
+ "parent_process_cmd_line": true,
2674
+ "parent_process_id": true,
2675
+ "parent_process_image": true,
2676
+ "pid": true,
2677
+ "predecoder_hostname": true,
2678
+ "predecoder_program_name": true,
2679
+ "predecoder_timestamp": true,
2680
+ "previous_log": true,
2681
+ "previous_output": true,
2682
+ "process_cmd_line": true,
2683
+ "process_id": true,
2684
+ "process_image": true,
2685
+ "process_name": true,
2686
+ "protocol": true,
2687
+ "rule_cis": true,
2688
+ "rule_cis_csc": true,
2689
+ "rule_firedtimes": true,
2690
+ "rule_gdpr": true,
2691
+ "rule_gdpr_IV": true,
2692
+ "rule_gpg13": true,
2693
+ "rule_gpg_13": true,
2694
+ "rule_groups": true,
2695
+ "rule_hipaa": true,
2696
+ "rule_id": false,
2697
+ "rule_info": true,
2698
+ "rule_mail": true,
2699
+ "rule_mitre_id": true,
2700
+ "rule_mitre_tactic": false,
2701
+ "rule_nist_800_53": true,
2702
+ "rule_pci_dss": true,
2703
+ "rule_tsc": true,
2704
+ "scanid": true,
2705
+ "service": true,
2706
+ "software_package": true,
2707
+ "software_vendor": true,
2708
+ "sort": true,
2709
+ "source": true,
2710
+ "src_ip": true,
2711
+ "src_ip_city_name": true,
2712
+ "src_ip_country_code": true,
2713
+ "src_ip_geolocation": true,
2714
+ "src_port": true,
2715
+ "streams": true,
2716
+ "syscheck_attrs_after": true,
2717
+ "syscheck_audit_effective_user_id": true,
2718
+ "syscheck_audit_effective_user_name": true,
2719
+ "syscheck_audit_group_id": true,
2720
+ "syscheck_audit_group_name": true,
2721
+ "syscheck_audit_login_user_id": true,
2722
+ "syscheck_audit_login_user_name": true,
2723
+ "syscheck_audit_process_cwd": true,
2724
+ "syscheck_audit_process_id": true,
2725
+ "syscheck_audit_process_name": true,
2726
+ "syscheck_audit_process_parent_cwd": true,
2727
+ "syscheck_audit_process_parent_name": true,
2728
+ "syscheck_audit_process_ppid": true,
2729
+ "syscheck_audit_user_id": true,
2730
+ "syscheck_audit_user_name": true,
2731
+ "syscheck_changed_attributes": true,
2732
+ "syscheck_event": true,
2733
+ "syscheck_gid_after": true,
2734
+ "syscheck_gname_after": true,
2735
+ "syscheck_hard_links": true,
2736
+ "syscheck_inode_after": true,
2737
+ "syscheck_inode_before": true,
2738
+ "syscheck_md5_after": true,
2739
+ "syscheck_md5_before": true,
2740
+ "syscheck_mode": true,
2741
+ "syscheck_mtime_after": true,
2742
+ "syscheck_mtime_before": true,
2743
+ "syscheck_path": true,
2744
+ "syscheck_perm_after": true,
2745
+ "syscheck_perm_before": true,
2746
+ "syscheck_sha1_after": true,
2747
+ "syscheck_sha1_before": true,
2748
+ "syscheck_sha256_after": true,
2749
+ "syscheck_sha256_before": true,
2750
+ "syscheck_size_after": true,
2751
+ "syscheck_size_before": true,
2752
+ "syscheck_uid_after": true,
2753
+ "syscheck_uname_after": true,
2754
+ "syscheck_win_perm_after": true,
2755
+ "syscheck_win_perm_after_0_allowed": true,
2756
+ "syscheck_win_perm_after_0_name": true,
2757
+ "syscheck_win_perm_after_1_allowed": true,
2758
+ "syscheck_win_perm_after_1_name": true,
2759
+ "syscheck_win_perm_after_2_allowed": true,
2760
+ "syscheck_win_perm_after_2_name": true,
2761
+ "syscheck_win_perm_after_3_allowed": true,
2762
+ "syscheck_win_perm_after_3_name": true,
2763
+ "syslog_customer": true,
2764
+ "syslog_tag": true,
2765
+ "syslog_type": true,
2766
+ "sysmon_event_description": true,
2767
+ "threat_ids": true,
2768
+ "threat_indicated": true,
2769
+ "threat_names": true,
2770
+ "time": true,
2771
+ "timestamp": false,
2772
+ "user_name": true,
2773
+ "win_registry_key": true,
2774
+ "win_system_eventID": true,
2775
+ "windows_auth_package": true,
2776
+ "windows_domain": true,
2777
+ "windows_event_id": true,
2778
+ "windows_event_severity": true,
2779
+ "windows_logon_type": true
2780
+ },
2781
+ "indexByName": {
2782
+ "_id": 1,
2783
+ "agent_ip": 3,
2784
+ "agent_name": 2,
2785
+ "rule_description": 4,
2786
+ "rule_id": 6,
2787
+ "rule_level": 5,
2788
+ "rule_mitre_tactic": 7,
2789
+ "rule_mitre_technique": 8,
2790
+ "timestamp": 0
2791
+ },
2792
+ "renameByName": {
2793
+ "_id": "EVENT ID",
2794
+ "rule_id": "RULE ID",
2795
+ "rule_mitre_tactic": "MITRE TACTIC",
2796
+ "rule_mitre_technique": "MITRE TECHNIQUE",
2797
+ "timestamp": "DATE/TIME"
2798
+ }
2799
+ }
2800
+ }
2801
+ ],
2802
+ "transparent": true,
2803
+ "type": "table"
2804
+ }
2805
+ ],
2806
+ "refresh": "",
2807
+ "schemaVersion": 38,
2808
+ "style": "dark",
2809
+ "tags": ["EDR"],
2810
+ "templating": {
2811
+ "list": [
2812
+ {
2813
+ "datasource": {
2814
+ "type": "elasticsearch",
2815
+ "uid": "wazuh_datasource_uid"
2816
+ },
2817
+ "filters": [],
2818
+ "hide": 0,
2819
+ "label": "",
2820
+ "name": "Filters",
2821
+ "skipUrlSync": false,
2822
+ "type": "adhoc"
2823
+ },
2824
+ {
2825
+ "current": {
2826
+ "selected": false,
2827
+ "text": "All",
2828
+ "value": "$__all"
2829
+ },
2830
+ "datasource": {
2831
+ "type": "elasticsearch",
2832
+ "uid": "wazuh_datasource_uid"
2833
+ },
2834
+ "definition": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"\"}",
2835
+ "hide": 0,
2836
+ "includeAll": true,
2837
+ "label": "Agent",
2838
+ "multi": false,
2839
+ "name": "agent_name",
2840
+ "options": [],
2841
+ "query": "{ \"find\": \"terms\", \"field\": \"agent_name\", \"query\": \"\"}",
2842
+ "refresh": 2,
2843
+ "regex": "",
2844
+ "skipUrlSync": false,
2845
+ "sort": 2,
2846
+ "tagValuesQuery": "",
2847
+ "tagsQuery": "",
2848
+ "type": "query",
2849
+ "useTags": false
2850
+ },
2851
+ {
2852
+ "current": {
2853
+ "selected": false,
2854
+ "text": "All",
2855
+ "value": "$__all"
2856
+ },
2857
+ "datasource": {
2858
+ "type": "elasticsearch",
2859
+ "uid": "wazuh_datasource_uid"
2860
+ },
2861
+ "definition": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2862
+ "hide": 0,
2863
+ "includeAll": true,
2864
+ "label": "Rule Level",
2865
+ "multi": false,
2866
+ "name": "rule_level",
2867
+ "options": [],
2868
+ "query": "{ \"find\": \"terms\", \"field\": \"rule_level\", \"query\": \"\"}",
2869
+ "refresh": 2,
2870
+ "regex": "",
2871
+ "skipUrlSync": false,
2872
+ "sort": 0,
2873
+ "type": "query"
2874
+ }
2875
+ ]
2876
+ },
2877
+ "time": {
2878
+ "from": "now-6h",
2879
+ "to": "now"
2880
+ },
2881
+ "timepicker": {
2882
+ "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
2883
+ "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
2884
+ },
2885
+ "timezone": "",
2886
+ "title": "EDR - _SUMMARY",
2887
+ "weekStart": "",
2888
+ "uid": null
2889
+}
backend/app/connectors/grafana/routes/dashboards.py
new
+52
@@ -0,0 +1,52 @@
1
+import json
2
+import os
3
+from pathlib import Path
4
+from typing import List
5
+
6
+from fastapi import APIRouter
7
+from fastapi import BackgroundTasks
8
+from fastapi import Body
9
+from fastapi import Depends
10
+from fastapi import HTTPException
11
+from fastapi import Security
12
+from loguru import logger
13
+
14
+from app.auth.utils import AuthHandler
15
+from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
16
+from app.connectors.grafana.schema.dashboards import GrafanaDashboardResponse
17
+from app.connectors.grafana.services.dashboards import provision_dashboards
18
+from app.connectors.grafana.utils.universal import create_grafana_client
19
+from app.connectors.influxdb.utils.universal import create_influxdb_client
20
+from app.connectors.wazuh_indexer.schema.alerts import AlertsByHostResponse
21
+from app.connectors.wazuh_indexer.schema.alerts import AlertsByRulePerHostResponse
22
+from app.connectors.wazuh_indexer.schema.alerts import AlertsByRuleResponse
23
+from app.connectors.wazuh_indexer.schema.alerts import AlertsSearchBody
24
+from app.connectors.wazuh_indexer.schema.alerts import AlertsSearchResponse
25
+from app.connectors.wazuh_indexer.schema.alerts import HostAlertsSearchBody
26
+from app.connectors.wazuh_indexer.schema.alerts import HostAlertsSearchResponse
27
+from app.connectors.wazuh_indexer.schema.alerts import IndexAlertsSearchBody
28
+from app.connectors.wazuh_indexer.schema.alerts import IndexAlertsSearchResponse
29
+from app.connectors.wazuh_indexer.services.alerts import get_alerts
30
+from app.connectors.wazuh_indexer.services.alerts import get_alerts_by_host
31
+from app.connectors.wazuh_indexer.services.alerts import get_alerts_by_rule
32
+from app.connectors.wazuh_indexer.services.alerts import get_alerts_by_rule_per_host
33
+from app.connectors.wazuh_indexer.services.alerts import get_host_alerts
34
+from app.connectors.wazuh_indexer.services.alerts import get_index_alerts
35
+from app.connectors.wazuh_indexer.utils.universal import collect_indices
36
+
37
+# App specific imports
38
+
39
+
40
+grafana_dashboards_router = APIRouter()
41
+
42
+
43
+@grafana_dashboards_router.post(
44
+ "/dashboards",
45
+ response_model=GrafanaDashboardResponse,
46
+ description="Provision Grafana dashboards",
47
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
48
+)
49
+async def provision_dashboards_route(request: DashboardProvisionRequest = Body(...)):
50
+ logger.info("Provisioning Grafana dashboards")
51
+ provision = await provision_dashboards(request)
52
+ return provision
backend/app/connectors/grafana/schema/dashboards.py
new
+64
@@ -0,0 +1,64 @@
1
+from enum import Enum
2
+from typing import List
3
+from typing import Union
4
+
5
+from pydantic import BaseModel
6
+from pydantic import Field
7
+from pydantic import validator
8
+
9
+
10
+class GrafanaDashboard(BaseModel):
11
+ id: int
12
+ slug: str
13
+ status: str
14
+ uid: str
15
+ url: str
16
+ version: int
17
+
18
+
19
+class GrafanaDashboardResponse(BaseModel):
20
+ provisioned_dashboards: list[GrafanaDashboard]
21
+ success: bool
22
+ message: str
23
+
24
+
25
+# ! DASHBOARD CLASSES NEED TO BE DEFINED HERE !
26
+class WazuhDashboard(Enum):
27
+ SUMMARY = ("Wazuh", "summary.json")
28
+ EDR_WINDOWS_EVENT_LOGS = ("Wazuh", "edr_windows_event_logs.json")
29
+ EDR_WAZUH_INVENOTRY = ("Wazuh", "edr_wazuh_inventory.json")
30
+ EDR_USERS_AND_GROUPS = ("Wazuh", "edr_users_and_groups.json")
31
+ EDR_SYSTEM_VULNERABILITIES = ("Wazuh", "edr_system_vulnerabilities.json")
32
+ EDR_SYSTEM_SECURITY_AUDIT = ("Wazuh", "edr_system_security_audit.json")
33
+ EDR_SYSTEM_PROCESSES = ("Wazuh", "edr_system_processes.json")
34
+ EDR_PROCESS_INJECTION = ("Wazuh", "edr_process_injection.json")
35
+ EDR_OPEN_AUDIT = ("Wazuh", "edr_open_audit.json")
36
+ EDR_NETWORK_SCAN = ("Wazuh", "edr_network_scan.json")
37
+ EDR_MITRE = ("Wazuh", "edr_mitre.json")
38
+ EDR_FIM = ("Wazuh", "edr_fim.json")
39
+ EDR_DOCKER_MONITORING = ("Wazuh", "edr_docker_monitoring.json")
40
+ EDR_DNS_REQUESTS = ("Wazuh", "edr_dns_requests.json")
41
+ EDR_DLL_SIDE_LOADING = ("Wazuh", "edr_dll_side_loading.json")
42
+ EDR_COMPLIANCE = ("Wazuh", "edr_compliance.json")
43
+ EDR_AV_MALWARE_IOC = ("Wazuh", "edr_av_malware_ioc.json")
44
+ EDR_AGENT_INVENTORY = ("Wazuh", "edr_agent_inventory.json")
45
+ EDR_AD_INVENOTRY = ("Wazuh", "edr_ad_inventory.json")
46
+
47
+
48
+class Office365Dashboard(Enum):
49
+ DASHBOARD_1 = ("Office365", "dashboard1.json")
50
+ DASHBOARD_2 = ("Office365", "dashboard2.json")
51
+
52
+
53
+class DashboardProvisionRequest(BaseModel):
54
+ dashboards: List[str] = Field(..., description="List of dashboard identifiers to provision")
55
+ organizationId: int = Field(0, description="Organization ID to provision dashboards to")
56
+ folderId: int = Field(0, description="Folder ID to provision dashboards to")
57
+ datasourceUid: str = Field("uid-to-be-replaced", description="Datasource UID to use for dashboards")
58
+
59
+ @validator("dashboards", each_item=True)
60
+ def check_dashboard_exists(cls, e):
61
+ valid_dashboards = {item.name: item for item in list(WazuhDashboard) + list(Office365Dashboard)}
62
+ if e not in valid_dashboards:
63
+ raise ValueError(f'Dashboard identifier "{e}" is not recognized.')
64
+ return e
backend/app/connectors/grafana/schema/organization.py
new
+8
@@ -0,0 +1,8 @@
1
+from enum import Enum
2
+
3
+from pydantic import BaseModel
4
+
5
+
6
+class GrafanaCreateOrganizationResponse(BaseModel):
7
+ message: str
8
+ orgId: int
backend/app/connectors/grafana/services/dashboards.py
new
+92
@@ -0,0 +1,92 @@
1
+import json
2
+from pathlib import Path
3
+from typing import List
4
+
5
+from fastapi import HTTPException
6
+from loguru import logger
7
+
8
+from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
9
+from app.connectors.grafana.schema.dashboards import GrafanaDashboard
10
+from app.connectors.grafana.schema.dashboards import GrafanaDashboardResponse
11
+from app.connectors.grafana.schema.dashboards import Office365Dashboard
12
+from app.connectors.grafana.schema.dashboards import WazuhDashboard
13
+from app.connectors.grafana.utils.universal import create_grafana_client
14
+
15
+
16
+def get_dashboard_path(dashboard_info: tuple) -> Path:
17
+ """Returns the path to the dashboard JSON file."""
18
+ folder_name, file_name = dashboard_info
19
+ current_file = Path(__file__) # Path to the current file
20
+ base_dir = current_file.parent.parent # Move up two levels to the 'grafana' directory
21
+ return base_dir / "dashboards" / folder_name / file_name
22
+
23
+
24
+def load_dashboard_json(dashboard_info: tuple, datasource_uid: str) -> dict:
25
+ file_path = get_dashboard_path(dashboard_info)
26
+ try:
27
+ with open(file_path, "r") as file:
28
+ dashboard_data = json.load(file)
29
+
30
+ # Search for 'uid' with 'wazuh_datasource_uid' and replace it
31
+ replace_uid_value(dashboard_data, datasource_uid)
32
+
33
+ return dashboard_data
34
+
35
+ except FileNotFoundError:
36
+ logger.error(f"Dashboard JSON file not found at {file_path}")
37
+ raise HTTPException(status_code=404, detail="Dashboard JSON file not found")
38
+ except json.JSONDecodeError:
39
+ logger.error("Error decoding JSON from file")
40
+ raise HTTPException(status_code=500, detail="Error decoding JSON from file")
41
+
42
+
43
+def replace_uid_value(obj, new_value, key_to_replace="uid", old_value="wazuh_datasource_uid"):
44
+ if isinstance(obj, dict):
45
+ for k, v in obj.items():
46
+ if k == key_to_replace and v == old_value:
47
+ obj[k] = new_value
48
+ elif isinstance(v, (dict, list)):
49
+ replace_uid_value(v, new_value, key_to_replace, old_value)
50
+ elif isinstance(obj, list):
51
+ for item in obj:
52
+ replace_uid_value(item, new_value, key_to_replace, old_value)
53
+
54
+
55
+async def update_dashboard(dashboard_json: dict, organization_id: int, folder_id: int) -> dict:
56
+ logger.info(f"Updating dashboards for organization {organization_id} and folder {folder_id}")
57
+ try:
58
+ grafana_client = await create_grafana_client("Grafana")
59
+ # Switch to the newly created organization
60
+ grafana_client.user.switch_actual_user_organisation(organization_id)
61
+ logger.info(f"Updating dashboards for organization {organization_id} and folder {folder_id}")
62
+ dashboard_update_payload = {"dashboard": dashboard_json, "folderId": folder_id, "overwrite": True}
63
+ return grafana_client.dashboard.update_dashboard(dashboard_update_payload)
64
+ except Exception as e:
65
+ logger.error(f"Error updating dashboard: {e}")
66
+ raise HTTPException(status_code=500, detail=f"Error updating dashboard: {e}")
67
+
68
+
69
+async def provision_dashboards(dashboard_request: DashboardProvisionRequest) -> GrafanaDashboardResponse:
70
+ logger.info(f"Received dashboard provision request: {dashboard_request}")
71
+ provisioned_dashboards = []
72
+ errors = []
73
+
74
+ valid_dashboards = {item.name: item for item in list(WazuhDashboard) + list(Office365Dashboard)}
75
+
76
+ for dashboard_name in dashboard_request.dashboards:
77
+ dashboard_enum = valid_dashboards[dashboard_name]
78
+ try:
79
+ dashboard_json = load_dashboard_json(dashboard_enum.value, datasource_uid=dashboard_request.datasourceUid)
80
+ updated_dashboard = await update_dashboard(
81
+ dashboard_json=dashboard_json,
82
+ organization_id=dashboard_request.organizationId,
83
+ folder_id=dashboard_request.folderId,
84
+ )
85
+ provisioned_dashboards.append(GrafanaDashboard(**updated_dashboard))
86
+ except HTTPException as e:
87
+ errors.append(f"Failed to update dashboard {dashboard_name}: {e.detail}")
88
+ raise HTTPException(status_code=500, detail=f"Error updating dashboard: {e}")
89
+
90
+ success = len(errors) == 0
91
+ message = "All dashboards provisioned successfully" if success else "Some dashboards failed to provision"
92
+ return GrafanaDashboardResponse(provisioned_dashboards=provisioned_dashboards, success=success, message=message)
backend/app/connectors/grafana/utils/universal.py
new
+110
@@ -0,0 +1,110 @@
1
+from datetime import datetime
2
+from datetime import timedelta
3
+from typing import Any
4
+from typing import Dict
5
+from typing import Iterable
6
+from typing import Tuple
7
+
8
+from elasticsearch7 import Elasticsearch
9
+from fastapi import HTTPException
10
+from grafana_client import GrafanaApi
11
+from loguru import logger
12
+
13
+from app.connectors.grafana.schema.organization import GrafanaCreateOrganizationResponse
14
+from app.connectors.utils import get_connector_info_from_db
15
+from app.connectors.wazuh_indexer.schema.indices import IndexConfigModel
16
+from app.connectors.wazuh_indexer.schema.indices import Indices
17
+from app.db.db_session import get_db_session
18
+
19
+
20
+async def construct_grafana_url(connector_url: str, username: str, password: str) -> str:
21
+ """
22
+ Constructs a Grafana URL with embedded credentials.
23
+
24
+ Args:
25
+ connector_url (str): The base URL of the Grafana instance.
26
+ username (str): Username for Grafana authentication.
27
+ password (str): Password for Grafana authentication.
28
+
29
+ Returns:
30
+ str: The complete Grafana URL with credentials.
31
+ """
32
+ if "http://" in connector_url:
33
+ return connector_url.replace("http://", f"http://{username}:{password}@")
34
+ elif "https://" in connector_url:
35
+ return connector_url.replace("https://", f"https://{username}:{password}@")
36
+ else:
37
+ raise ValueError("Invalid connector URL format")
38
+
39
+
40
+async def verify_grafana_credentials(attributes: Dict[str, Any]) -> Dict[str, Any]:
41
+ """
42
+ Verifies the connection to Grafana service.
43
+
44
+ Returns:
45
+ dict: A dictionary containing 'connectionSuccessful' status and 'authToken' if the connection is successful.
46
+ """
47
+ logger.info(f"Verifying the Grafana connection to {attributes['connector_url']}")
48
+ connector_url = attributes["connector_url"]
49
+ username = attributes["connector_username"]
50
+ password = attributes["connector_password"]
51
+
52
+ grafana_url = await construct_grafana_url(connector_url, username, password)
53
+
54
+ grafana_client = GrafanaApi.from_url(grafana_url)
55
+ try:
56
+ create_org = grafana_client.organization.create_organization(
57
+ organization={
58
+ "name": "CoPilot Auth Test",
59
+ },
60
+ )
61
+ logger.info(f"Create organization: {create_org}")
62
+
63
+ create_org = GrafanaCreateOrganizationResponse(**create_org)
64
+
65
+ remove_org = grafana_client.organizations.delete_organization(organization_id=create_org.orgId)
66
+ logger.info(f"Remove organization: {remove_org}")
67
+
68
+ logger.info(f"Connection to {grafana_url} successful")
69
+ return {"connectionSuccessful": True, "message": "Grafana connection successful"}
70
+ except Exception as e:
71
+ logger.error(f"Connection to {grafana_url} failed with error: {e}")
72
+ return {"connectionSuccessful": False, "message": f"Connection to {grafana_url} failed with error: {e}"}
73
+
74
+
75
+async def verify_grafana_connection(connector_name: str) -> str:
76
+ """
77
+ Returns the authentication token for the InfluxDB service.
78
+
79
+ Returns:
80
+ str: Authentication token for the InfluxDB service.
81
+ """
82
+ async with get_db_session() as session: # This will correctly enter the context manager
83
+ attributes = await get_connector_info_from_db(connector_name, session)
84
+ logger.info(f"Verifying the InfluxDB connection to {attributes['connector_url']}")
85
+ if attributes is None:
86
+ logger.error("No InfluxDB connector found in the database")
87
+ return None
88
+ return await verify_grafana_credentials(attributes)
89
+
90
+
91
+async def create_grafana_client(connector_name: str) -> GrafanaApi:
92
+ """
93
+ Returns an GrafanaApi client for the Grafana service.
94
+
95
+ Returns:
96
+ GrafanaApi: GrafanaApi client for the Grafana service.
97
+ """
98
+ async with get_db_session() as session: # This will correctly enter the context manager
99
+ attributes = await get_connector_info_from_db(connector_name, session)
100
+ if attributes is None:
101
+ raise HTTPException(status_code=500, detail=f"No {connector_name} connector found in the database")
102
+ try:
103
+ grafana_url = await construct_grafana_url(
104
+ attributes["connector_url"],
105
+ attributes["connector_username"],
106
+ attributes["connector_password"],
107
+ )
108
+ return GrafanaApi.from_url(grafana_url)
109
+ except Exception as e:
110
+ raise HTTPException(status_code=500, detail=f"Failed to create Grafana client: {e}")
backend/app/connectors/graylog/schema/collector.py
+6
-6
@@ -62,7 +62,7 @@ class GraylogIndicesResponse(BaseModel):
62
class ConfiguredInputAttributes(BaseModel):
63
recv_buffer_size: int
64
tcp_keepalive: bool
65
- use_null_delimiter: bool
65
+ use_null_delimiter: Optional[bool]
66
number_worker_threads: int
67
tls_client_auth_cert_file: Optional[str]
68
force_rdns: Optional[bool]
@@ -74,7 +74,7 @@ class ConfiguredInputAttributes(BaseModel):
74
tls_key_file: Optional[str]
75
tls_enable: bool
76
tls_key_password: Optional[str]
77
- max_message_size: int
77
+ max_message_size: Optional[int]
78
tls_client_auth: str
79
override_source: Optional[str]
80
charset_name: Optional[str]
@@ -91,14 +91,14 @@ class ConfiguredInput(BaseModel):
91
creator_user_id: str
92
attributes: ConfiguredInputAttributes
93
static_fields: Dict[str, str]
94
- node: str
94
+ node: Optional[str]
95
id: str
96
97
98
class MessageInputAttributes(BaseModel):
99
recv_buffer_size: int
100
tcp_keepalive: bool
101
- use_null_delimiter: bool
101
+ use_null_delimiter: Optional[bool]
102
number_worker_threads: int
103
tls_client_auth_cert_file: Optional[str]
104
bind_address: str
@@ -107,7 +107,7 @@ class MessageInputAttributes(BaseModel):
107
tls_key_file: Optional[str]
108
tls_enable: bool
109
tls_key_password: Optional[str]
110
- max_message_size: int
110
+ max_message_size: Optional[int]
111
tls_client_auth: str
112
113
@@ -121,7 +121,7 @@ class MessageInput(BaseModel):
121
creator_user_id: str
122
attributes: MessageInputAttributes
123
static_fields: Dict[str, str]
124
- node: str
124
+ node: Optional[str]
125
id: str
126
127
backend/app/connectors/graylog/utils/universal.py
+2
@@ -140,6 +140,8 @@ async def send_post_request(endpoint: str, data: Dict[str, Any] = None, connecto
140
return {"data": response.json(), "success": True, "message": "Successfully completed request"}
141
elif response.status_code == 204:
142
return {"data": None, "success": True, "message": "Successfully completed request with no content"}
143
+ elif response.status_code == 201:
144
+ return {"data": response.json(), "success": True, "message": "Successfully created data"}
145
else:
146
raise HTTPException(
147
status_code=500,
backend/app/connectors/influxdb/routes/alerts.py
new
+44
@@ -0,0 +1,44 @@
1
+from typing import List
2
+
3
+from fastapi import APIRouter
4
+from fastapi import BackgroundTasks
5
+from fastapi import Depends
6
+from fastapi import HTTPException
7
+from fastapi import Security
8
+from loguru import logger
9
+
10
+from app.auth.utils import AuthHandler
11
+from app.connectors.influxdb.schema.alerts import InfluxDBAlertsResponse
12
+from app.connectors.influxdb.services.alerts import get_alerts
13
+from app.connectors.influxdb.utils.universal import create_influxdb_client
14
+from app.connectors.wazuh_indexer.schema.alerts import AlertsByHostResponse
15
+from app.connectors.wazuh_indexer.schema.alerts import AlertsByRulePerHostResponse
16
+from app.connectors.wazuh_indexer.schema.alerts import AlertsByRuleResponse
17
+from app.connectors.wazuh_indexer.schema.alerts import AlertsSearchBody
18
+from app.connectors.wazuh_indexer.schema.alerts import AlertsSearchResponse
19
+from app.connectors.wazuh_indexer.schema.alerts import HostAlertsSearchBody
20
+from app.connectors.wazuh_indexer.schema.alerts import HostAlertsSearchResponse
21
+from app.connectors.wazuh_indexer.schema.alerts import IndexAlertsSearchBody
22
+from app.connectors.wazuh_indexer.schema.alerts import IndexAlertsSearchResponse
23
+from app.connectors.wazuh_indexer.services.alerts import get_alerts_by_host
24
+from app.connectors.wazuh_indexer.services.alerts import get_alerts_by_rule
25
+from app.connectors.wazuh_indexer.services.alerts import get_alerts_by_rule_per_host
26
+from app.connectors.wazuh_indexer.services.alerts import get_host_alerts
27
+from app.connectors.wazuh_indexer.services.alerts import get_index_alerts
28
+from app.connectors.wazuh_indexer.utils.universal import collect_indices
29
+
30
+# App specific imports
31
+
32
+
33
+influxdb_alerts_router = APIRouter()
34
+
35
+
36
+@influxdb_alerts_router.get(
37
+ "/alerts",
38
+ response_model=InfluxDBAlertsResponse,
39
+ description="Get influxdb alerts",
40
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
41
+)
42
+async def get_all_alerts():
43
+ logger.info("Fetching all alerts from influxdb")
44
+ return await get_alerts()
backend/app/connectors/influxdb/schema/alerts.py
new
+19
@@ -0,0 +1,19 @@
1
+from datetime import datetime
2
+from typing import Optional
3
+
4
+from pydantic import BaseModel
5
+
6
+
7
+class InfluxDBAlert(BaseModel):
8
+ time: datetime
9
+ message: str
10
+ checkID: str
11
+ checkName: str
12
+ level: str
13
+
14
+
15
+# If you need to parse a list of these alerts:
16
+class InfluxDBAlertsResponse(BaseModel):
17
+ alerts: list[InfluxDBAlert]
18
+ success: bool
19
+ message: str
backend/app/connectors/influxdb/services/alerts.py
new
+69
@@ -0,0 +1,69 @@
1
+from datetime import datetime
2
+from typing import List
3
+
4
+from fastapi import HTTPException
5
+from loguru import logger
6
+
7
+from app.connectors.influxdb.schema.alerts import InfluxDBAlert
8
+from app.connectors.influxdb.schema.alerts import InfluxDBAlertsResponse
9
+from app.connectors.influxdb.utils.universal import create_influxdb_client
10
+from app.connectors.influxdb.utils.universal import get_influxdb_organization
11
+
12
+# Constants
13
+BUCKET_NAME = "_monitoring"
14
+
15
+
16
+def construct_query() -> str:
17
+ """Constructs the InfluxDB query."""
18
+ return """
19
+ from(bucket: "{bucket_name}")
20
+ |> range(start: -1h, stop: now())
21
+ |> filter(fn: (r) => r._measurement == "statuses" and r._field == "_message")
22
+ |> filter(fn: (r) => exists r._check_id and exists r._value and exists r._check_name and exists r._level)
23
+ |> keep(columns: ["_time", "_value", "_check_id", "_check_name", "_level"])
24
+ |> rename(columns: {{ "_time": "time", "_value": "message", "_check_id": "checkID", "_check_name": "checkName", "_level": "level" }})
25
+ |> group()
26
+ |> sort(columns: ["time"], desc: true)
27
+ |> limit(n: 100, offset: 29)
28
+ """.format(
29
+ bucket_name=BUCKET_NAME,
30
+ )
31
+
32
+
33
+async def process_alert_records(result) -> List[InfluxDBAlert]:
34
+ """Processes alert records from InfluxDB query result."""
35
+ alerts = []
36
+ for table in result:
37
+ for record in table.records:
38
+ alert = InfluxDBAlert(
39
+ time=record.values.get("time").isoformat() if record.values.get("time") else None,
40
+ message=record.values.get("message"),
41
+ checkID=record.values.get("checkID"),
42
+ checkName=record.values.get("checkName"),
43
+ level=record.values.get("level"),
44
+ )
45
+ alerts.append(alert)
46
+ return alerts
47
+
48
+
49
+async def get_alerts() -> InfluxDBAlertsResponse:
50
+ """Fetches alerts from InfluxDB and returns them."""
51
+ client = await create_influxdb_client("InfluxDB")
52
+ try:
53
+ query = construct_query()
54
+ query_api = client.query_api()
55
+ result = await query_api.query(org=await get_influxdb_organization(), query=query)
56
+
57
+ alerts = await process_alert_records(result)
58
+
59
+ return InfluxDBAlertsResponse(
60
+ alerts=alerts,
61
+ success=True,
62
+ message="Successfully fetched alerts",
63
+ )
64
+
65
+ except Exception as e:
66
+ logger.error(f"Error fetching alerts: {e}")
67
+ raise HTTPException(status_code=500, detail=f"Error fetching alerts: {e}")
68
+ finally:
69
+ await client.close()
backend/app/connectors/influxdb/utils/universal.py
new
+96
@@ -0,0 +1,96 @@
1
+from datetime import datetime
2
+from datetime import timedelta
3
+from typing import Any
4
+from typing import Dict
5
+from typing import Iterable
6
+from typing import Tuple
7
+
8
+from elasticsearch7 import Elasticsearch
9
+from fastapi import HTTPException
10
+from influxdb_client.client.influxdb_client_async import InfluxDBClientAsync
11
+from loguru import logger
12
+
13
+from app.connectors.utils import get_connector_info_from_db
14
+from app.connectors.wazuh_indexer.schema.indices import IndexConfigModel
15
+from app.connectors.wazuh_indexer.schema.indices import Indices
16
+from app.db.db_session import get_db_session
17
+
18
+
19
+async def verify_influxdb_credentials(attributes: Dict[str, Any]) -> Dict[str, Any]:
20
+ """
21
+ Verifies the connection to InfluxDB service.
22
+
23
+ Returns:
24
+ dict: A dictionary containing 'connectionSuccessful' status and 'authToken' if the connection is successful.
25
+ """
26
+ logger.info(f"Verifying the InfluxDB connection to {attributes['connector_url']}")
27
+ influxdb_client = InfluxDBClientAsync(
28
+ url=attributes["connector_url"],
29
+ token=attributes["connector_api_key"],
30
+ org="SOCFORTRESS",
31
+ )
32
+ try:
33
+ ping = await influxdb_client.ping()
34
+ logger.info(f"Response from InfluxDB: {ping}")
35
+ if ping:
36
+ logger.info(f"Connection to {attributes['connector_url']} successful")
37
+ return {"connectionSuccessful": True, "message": "InfluxDB connection successful"}
38
+ else:
39
+ logger.error(f"Connection to {attributes['connector_url']} failed")
40
+ return {"connectionSuccessful": False, "message": f"Connection to {attributes['connector_url']} failed"}
41
+ except Exception as e:
42
+ logger.error(f"Connection to {attributes['connector_url']} failed with error: {e}")
43
+ return {"connectionSuccessful": False, "message": f"Connection to {attributes['connector_url']} failed with error: {e}"}
44
+ finally:
45
+ # Make sure to close the client session
46
+ await influxdb_client.close()
47
+
48
+
49
+async def verify_influxdb_connection(connector_name: str) -> str:
50
+ """
51
+ Returns the authentication token for the InfluxDB service.
52
+
53
+ Returns:
54
+ str: Authentication token for the InfluxDB service.
55
+ """
56
+ async with get_db_session() as session: # This will correctly enter the context manager
57
+ attributes = await get_connector_info_from_db(connector_name, session)
58
+ logger.info(f"Verifying the InfluxDB connection to {attributes['connector_url']}")
59
+ if attributes is None:
60
+ logger.error("No InfluxDB connector found in the database")
61
+ return None
62
+ return await verify_influxdb_credentials(attributes)
63
+
64
+
65
+async def create_influxdb_client(connector_name: str) -> InfluxDBClientAsync:
66
+ """
67
+ Returns an InfluxDBClientAsync client for the InfluxDB service.
68
+
69
+ Returns:
70
+ InfluxDBClientAsync: InfluxDBClientAsync client for the InfluxDB service.
71
+ """
72
+ # attributes = get_connector_info_from_db(connector_name)
73
+ async with get_db_session() as session: # This will correctly enter the context manager
74
+ attributes = await get_connector_info_from_db(connector_name, session)
75
+ if attributes is None:
76
+ raise HTTPException(status_code=500, detail=f"No {connector_name} connector found in the database")
77
+ try:
78
+ return InfluxDBClientAsync(
79
+ url=attributes["connector_url"],
80
+ token=attributes["connector_api_key"],
81
+ org="SOCFORTRESS",
82
+ )
83
+ except Exception as e:
84
+ raise HTTPException(status_code=500, detail=f"Failed to create Elasticsearch client: {e}")
85
+
86
+
87
+async def get_influxdb_organization() -> str:
88
+ """
89
+ Read the `connector_extra_data` from the database and return the organization name.
90
+ which is the first item. For example: `SOCFORTRESS,telegraf`.
91
+ """
92
+ async with get_db_session() as session: # This will correctly enter the context manager
93
+ attributes = await get_connector_info_from_db("InfluxDB", session)
94
+ if attributes is None:
95
+ raise HTTPException(status_code=500, detail=f"No InfluxDB connector found in the database")
96
+ return attributes["connector_extra_data"].split(",")[0]
backend/app/connectors/models.py
+1
@@ -66,6 +66,7 @@ class Connectors(SQLModel, table=True):
66
connector_accepts_api_key: bool = Field(default=False)
67
connector_accepts_username_password: bool = Field(default=False)
68
connector_accepts_file: bool = Field(default=False)
69
+ connector_extra_data: Optional[str] = Field(default=None)
70
71
# Relationship
72
history_logs: List[ConnectorHistory] = Relationship(back_populates="connector", sa_relationship_kwargs={"lazy": "selectin"})
backend/app/connectors/schema.py
+1
@@ -31,6 +31,7 @@ class ConnectorResponse(BaseModel):
31
connector_accepts_api_key: bool
32
connector_accepts_username_password: bool
33
connector_accepts_file: bool
34
+ connector_extra_data: Optional[str]
35
history_logs: Optional[List[ConnectorHistoryResponse]]
36
37
class Config:
backend/app/connectors/services.py
+16
@@ -20,7 +20,9 @@ from werkzeug.utils import secure_filename
20
21
from app.connectors.cortex.utils.universal import verify_cortex_connection
22
from app.connectors.dfir_iris.utils.universal import verify_dfir_iris_connection
23
+from app.connectors.grafana.utils.universal import verify_grafana_connection
24
from app.connectors.graylog.utils.universal import verify_graylog_connection
25
+from app.connectors.influxdb.utils.universal import verify_influxdb_connection
26
from app.connectors.models import Connectors
27
from app.connectors.schema import ConnectorResponse
28
from app.connectors.shuffle.utils.universal import verify_shuffle_connection
@@ -91,6 +93,18 @@ class SublimeService(ConnectorServiceInterface):
93
return await verify_sublime_connection(connector.connector_name)
94
95
96
+# InfluxDB Service
97
+class InfluxDBService(ConnectorServiceInterface):
98
+ async def verify_authentication(self, connector: ConnectorResponse) -> Optional[ConnectorResponse]:
99
+ return await verify_influxdb_connection(connector.connector_name)
100
+
101
+
102
+# Grafana Service
103
+class GrafanaService(ConnectorServiceInterface):
104
+ async def verify_authentication(self, connector: ConnectorResponse) -> Optional[ConnectorResponse]:
105
+ return await verify_grafana_connection(connector.connector_name)
106
+
107
+
108
# Factory function to create a service instance based on connector name
109
def get_connector_service(connector_name: str) -> Type[ConnectorServiceInterface]:
110
service_map = {
@@ -102,6 +116,8 @@ def get_connector_service(connector_name: str) -> Type[ConnectorServiceInterface
116
"Cortex": CortexService,
117
"Shuffle": ShuffleService,
118
"Sublime": SublimeService,
119
+ "InfluxDB": InfluxDBService,
120
+ "Grafana": GrafanaService,
121
}
122
return service_map.get(connector_name, None)
123
backend/app/connectors/wazuh_manager/utils/universal.py
+6
@@ -171,6 +171,7 @@ async def send_put_request(
171
endpoint: str,
172
data: Optional[Dict[str, Any]],
173
params: Optional[Dict[str, str]] = None,
174
+ xml_data: Optional[bool] = False,
175
connector_name: str = "Wazuh-Manager",
176
) -> Dict[str, Any]:
177
"""
@@ -179,6 +180,8 @@ async def send_put_request(
180
Args:
181
endpoint (str): The endpoint to send the PUT request to.
182
data (Dict[str, Any]): The data to send with the PUT request.
183
+ params (Optional[Dict[str, str]], optional): The parameters to send with the PUT request. Defaults to None.
184
+ xml_data (Optional[bool], optional): Whether or not the data is XML. Defaults to False.
185
connector_name (str, optional): The name of the connector to use. Defaults to "Wazuh-Manager".
186
187
Returns:
@@ -191,6 +194,9 @@ async def send_put_request(
194
if attributes is None:
195
logger.error("No Wazuh Manager connector found in the database")
196
return None
197
+ # Add the `Content-Type` header to the request if the data is XML
198
+ if xml_data:
199
+ wazuh_manager_client["Content-Type"] = "application/xml"
200
try:
201
response = requests.put(
202
f"{attributes['connector_url']}/{endpoint}",
backend/app/customer_provisioning/routes/provision.py
new
+54
@@ -0,0 +1,54 @@
1
+import json
2
+import os
3
+from pathlib import Path
4
+from typing import List
5
+
6
+from fastapi import APIRouter
7
+from fastapi import BackgroundTasks
8
+from fastapi import Body
9
+from fastapi import Depends
10
+from fastapi import HTTPException
11
+from fastapi import Security
12
+from loguru import logger
13
+from sqlalchemy.ext.asyncio import AsyncSession
14
+from sqlalchemy.future import select
15
+
16
+from app.auth.utils import AuthHandler
17
+from app.connectors.services import ConnectorServices
18
+from app.customer_provisioning.schema.provision import ProvisionNewCustomer
19
+from app.customer_provisioning.services.provision_wazuh import provision_wazuh_customer
20
+from app.db.db_session import get_session
21
+from app.db.universal_models import Customers
22
+
23
+# App specific imports
24
+
25
+
26
+customer_provisioning_router = APIRouter()
27
+
28
+
29
+async def check_customer_exists(customer_name: str, session: AsyncSession = Depends(get_session)) -> Customers:
30
+ logger.info(f"Checking if customer {customer_name} exists")
31
+ result = await session.execute(select(Customers).filter(Customers.customer_name == customer_name))
32
+ customer = result.scalars().first()
33
+
34
+ if not customer:
35
+ raise HTTPException(status_code=404, detail=f"Customer: {customer_name} not found. Please create the customer first.")
36
+
37
+ return customer
38
+
39
+
40
+@customer_provisioning_router.post(
41
+ "/provision",
42
+ # response_model=GrafanaDashboardResponse,
43
+ description="Provision New Customer",
44
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
45
+)
46
+async def provision_customer_route(
47
+ request: ProvisionNewCustomer = Body(...),
48
+ _customer: Customers = Depends(check_customer_exists),
49
+ session: AsyncSession = Depends(get_session),
50
+):
51
+ logger.info("Provisioning new customer")
52
+ customer_provision = await provision_wazuh_customer(request, session=session)
53
+
54
+ return {"message": "Provisioning new customer"}
backend/app/customer_provisioning/schema/provision.py
new
+333
@@ -0,0 +1,333 @@
1
+import re
2
+from datetime import datetime
3
+from enum import Enum
4
+from typing import Dict
5
+from typing import List
6
+from typing import Optional
7
+
8
+from pydantic import BaseModel
9
+from pydantic import Field
10
+from pydantic import validator
11
+
12
+from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
13
+
14
+
15
+class CustomerSubsctipion(Enum):
16
+ WAZUH = "Wazuh"
17
+ OFFICE365 = "Office365"
18
+
19
+
20
+class ProvisionNewCustomer(BaseModel):
21
+ customer_name: str = Field(..., example="SOC Fortress", description="Name of the customer")
22
+ customer_code: str = Field(
23
+ ...,
24
+ example="SOCF",
25
+ description="Code of the customer. Referenced in Wazuh Agent Label, Graylog Stream, etc.",
26
+ )
27
+ customer_index_name: str = Field(..., example="socf", description="Index prefix for the customer's Graylog instance")
28
+ customer_grafana_org_name: str = Field(..., example="SOCFortress", description="Name of the customer's Grafana organization")
29
+ hot_data_retention: int = Field(..., example=30, description="Number of days to retain hot data")
30
+ index_replicas: int = Field(..., example=1, description="Number of replicas for the customer's Graylog instance")
31
+ index_shards: int = Field(..., example=1, description="Number of shards for the customer's Graylog instance")
32
+ customer_subscription: List[CustomerSubsctipion] = Field(
33
+ ...,
34
+ example=["Wazuh", "Office365"],
35
+ description="List of subscriptions for the customer",
36
+ )
37
+ dashboards_to_include: DashboardProvisionRequest = Field(..., description="Dashboards to include in the customer's Grafana instance")
38
+ wazuh_auth_password: str = Field(..., description="Password for the Wazuh API user")
39
+ wazuh_registration_port: str = Field(..., description="Port for the Wazuh registration service")
40
+ wazuh_logs_port: str = Field(..., description="Port for the Wazuh logs service")
41
+
42
+ @validator("customer_index_name")
43
+ def validate_customer_index_name(cls, v):
44
+ pattern = r"^[a-z0-9][a-z0-9_+-]*$"
45
+ if not re.match(pattern, v):
46
+ raise ValueError(
47
+ "customer_index_name must start with a lowercase letter or number and can only contain lowercase letters, numbers, underscores, plus signs, and hyphens.",
48
+ )
49
+ return v
50
+
51
+
52
+class CustomerProvisionMeta(BaseModel):
53
+ index_set_id: str
54
+ stream_id: str
55
+ pipeline_ids: List[str]
56
+ grafana_organization_id: int
57
+ wazuh_datasource_uid: str
58
+ grafana_edr_folder_id: int
59
+
60
+
61
+class WazuhAgentsTemplatePaths(Enum):
62
+ LINUX_AGENT = ("templates", "linux_agent.conf")
63
+ WINDOWS_AGENT = ("templates", "windows_agent.conf")
64
+ MAC_AGENT = ("templates", "mac_agent.conf")
65
+
66
+
67
+####################################### ! GRAYLOG PROVISIONING ! #########################
68
+
69
+
70
+#! INDEX SETS !#
71
+class TimeBasedRotationStrategyConfig(BaseModel):
72
+ type: str
73
+ rotation_period: Optional[str] = None
74
+
75
+
76
+class TimeBasedRetentionStrategyConfig(BaseModel):
77
+ type: str
78
+ max_number_of_indices: Optional[int] = None
79
+
80
+
81
+class TimeBasedIndexSet(BaseModel):
82
+ title: str
83
+ description: str
84
+ index_prefix: str
85
+ rotation_strategy_class: str
86
+ rotation_strategy: TimeBasedRotationStrategyConfig
87
+ retention_strategy_class: str
88
+ retention_strategy: TimeBasedRetentionStrategyConfig
89
+ creation_date: str
90
+ index_analyzer: str
91
+ shards: int
92
+ replicas: int
93
+ index_optimization_max_num_segments: int
94
+ index_optimization_disabled: bool
95
+ writable: bool
96
+ field_type_refresh_interval: int
97
+
98
+ class Config:
99
+ schema_extra = {
100
+ "example": {
101
+ "title": "Wazuh - Example Company",
102
+ "description": "Wazuh - Example Company",
103
+ "index_prefix": "wazuh-examplecode",
104
+ "rotation_strategy_class": "org.graylog2.indexer.rotation.strategies.SizeBasedRotationStrategy",
105
+ "rotation_strategy": {
106
+ "type": "org.graylog2.indexer.rotation.strategies.SizeBasedRotationStrategyConfig",
107
+ "max_size": 2684354560,
108
+ },
109
+ "retention_strategy_class": "org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy",
110
+ "retention_strategy": {
111
+ "type": "org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig",
112
+ "max_number_of_indices": 20,
113
+ },
114
+ "creation_date": "2021-01-01T00:00:00.000Z",
115
+ "index_analyzer": "standard",
116
+ "shards": 1,
117
+ "replicas": 0,
118
+ "index_optimization_max_num_segments": 1,
119
+ "index_optimization_disabled": False,
120
+ "writable": True,
121
+ "field_type_refresh_interval": 5000,
122
+ },
123
+ }
124
+
125
+
126
+class RotationStrategyConfig(BaseModel):
127
+ type: str
128
+ rotation_period: str = Field(..., alias="rotation_period")
129
+ max_rotation_period: Optional[str] = Field(None, alias="max_rotation_period")
130
+ rotate_empty_index_set: bool = Field(..., alias="rotate_empty_index_set")
131
+
132
+
133
+class RetentionStrategyConfig(BaseModel):
134
+ type: str
135
+ max_number_of_indices: int = Field(..., alias="max_number_of_indices")
136
+
137
+
138
+class GraylogIndexSetData(BaseModel):
139
+ id: str
140
+ title: str
141
+ description: str
142
+ can_be_default: bool = Field(..., alias="can_be_default")
143
+ index_prefix: str = Field(..., alias="index_prefix")
144
+ shards: int
145
+ replicas: int
146
+ rotation_strategy_class: str = Field(..., alias="rotation_strategy_class")
147
+ rotation_strategy: RotationStrategyConfig
148
+ retention_strategy_class: str = Field(..., alias="retention_strategy_class")
149
+ retention_strategy: RetentionStrategyConfig
150
+ creation_date: str = Field(..., alias="creation_date")
151
+ index_analyzer: str = Field(..., alias="index_analyzer")
152
+ index_optimization_max_num_segments: int = Field(..., alias="index_optimization_max_num_segments")
153
+ index_optimization_disabled: bool = Field(..., alias="index_optimization_disabled")
154
+ field_type_refresh_interval: int = Field(..., alias="field_type_refresh_interval")
155
+ index_template_type: Optional[str] = Field(None, alias="index_template_type")
156
+ default: bool
157
+ writable: bool
158
+
159
+
160
+class GraylogIndexSetCreationResponse(BaseModel):
161
+ data: GraylogIndexSetData
162
+ success: bool
163
+ message: str
164
+
165
+
166
+# ! STREAMS ! #
167
+class StreamRule(BaseModel):
168
+ field: str
169
+ type: int
170
+ inverted: bool
171
+ value: str
172
+
173
+
174
+class WazuhEventStream(BaseModel):
175
+ title: str = Field(..., description="Title of the stream")
176
+ description: str = Field(..., description="Description of the stream")
177
+ index_set_id: str = Field(..., description="ID of the associated index set")
178
+ rules: List[StreamRule] = Field(..., description="List of rules for the stream")
179
+ matching_type: str = Field(..., description="Matching type for the rules")
180
+ remove_matches_from_default_stream: bool = Field(..., description="Whether to remove matches from the default stream")
181
+ content_pack: Optional[str] = Field(None, description="Associated content pack, if any")
182
+
183
+ class Config:
184
+ schema_extra = {
185
+ "example": {
186
+ "title": "WAZUH EVENTS CUSTOMERS - Example Company",
187
+ "description": "WAZUH EVENTS CUSTOMERS - Example Company",
188
+ "index_set_id": "12345",
189
+ "rules": [{"field": "agent_labels_customer", "type": 1, "inverted": False, "value": "ExampleCode"}],
190
+ "matching_type": "AND",
191
+ "remove_matches_from_default_stream": True,
192
+ "content_pack": None,
193
+ },
194
+ }
195
+
196
+
197
+class StreamData(BaseModel):
198
+ stream_id: str = Field(..., description="ID of the created stream")
199
+
200
+
201
+class StreamCreationResponse(BaseModel):
202
+ data: StreamData
203
+ success: bool = Field(..., description="Indicates if the request was successful")
204
+ message: str = Field(..., description="A message detailing the outcome of the request")
205
+
206
+
207
+class StreamAndPipelineData(BaseModel):
208
+ stream_id: str = Field(..., description="ID of the stream")
209
+ pipeline_ids: List[str] = Field(..., description="List of pipeline IDs connected to the stream")
210
+
211
+
212
+class StreamConnectionToPipelineRequest(BaseModel):
213
+ stream_id: str = Field(..., description="ID of the stream to connect")
214
+ pipeline_ids: List[str] = Field(..., description="List of pipeline IDs to connect to the stream")
215
+
216
+
217
+class StreamConnectionToPipelineResponse(BaseModel):
218
+ data: StreamAndPipelineData
219
+ success: bool = Field(..., description="Indicates if the request was successful")
220
+ message: str = Field(..., description="A message detailing the outcome of the request")
221
+
222
+
223
+####################################### ! GRAFANA PROVISIONING ! #########################
224
+
225
+
226
+# ! Organization ! #
227
+class GrafanaOrganizationCreation(BaseModel):
228
+ message: str = Field(..., description="Message detailing the outcome of the request")
229
+ orgId: int = Field(..., description="ID of the created organization")
230
+
231
+
232
+# ! Data Source ! #
233
+class GrafanaSecureJsonData(BaseModel):
234
+ basicAuthPassword: str = Field(..., alias="basicAuthPassword")
235
+
236
+
237
+class GrafanaJsonData(BaseModel):
238
+ database: str = Field(..., alias="database")
239
+ flavor: str = Field(..., alias="flavor")
240
+ version: str = Field(..., alias="version")
241
+ includeFrozen: bool = Field(False, alias="includeFrozen")
242
+ logLevelField: str = Field(..., alias="logLevelField")
243
+ logMessageField: str = Field(..., alias="logMessageField")
244
+ maxConcurrentShardRequests: int = Field(5, alias="maxConcurrentShardRequests")
245
+ timeField: str = Field(..., alias="timeField")
246
+ tlsSkipVerify: bool = Field(True, alias="tlsSkipVerify")
247
+
248
+
249
+class GrafanaDatasource(BaseModel):
250
+ name: str
251
+ type: str
252
+ typeName: str = Field(..., alias="typeName")
253
+ access: str
254
+ url: str
255
+ database: str
256
+ basicAuth: bool = Field(True, alias="basicAuth")
257
+ basicAuthUser: str = Field(..., alias="basicAuthUser")
258
+ secureJsonData: GrafanaSecureJsonData
259
+ isDefault: bool = Field(False, alias="isDefault")
260
+ jsonData: GrafanaJsonData
261
+ readOnly: bool = Field(True, alias="readOnly")
262
+
263
+
264
+# ! Datasource Creation Response! #
265
+class DataSourceCreationJsonData(BaseModel):
266
+ database: str = Field(..., alias="database")
267
+ flavor: str = Field(..., alias="flavor")
268
+ includeFrozen: bool = Field(..., alias="includeFrozen")
269
+ logLevelField: str = Field(..., alias="logLevelField")
270
+ logMessageField: str = Field(..., alias="logMessageField")
271
+ maxConcurrentShardRequests: int = Field(..., alias="maxConcurrentShardRequests")
272
+ timeField: str = Field(..., alias="timeField")
273
+ tlsSkipVerify: bool = Field(..., alias="tlsSkipVerify")
274
+ version: str
275
+
276
+
277
+class DataSourceCreationSecureJsonFields(BaseModel):
278
+ basicAuthPassword: bool = Field(..., alias="basicAuthPassword")
279
+
280
+
281
+class DataSourceCreationDatasource(BaseModel):
282
+ id: int
283
+ uid: str
284
+ orgId: int = Field(..., alias="orgId")
285
+ name: str
286
+ type: str
287
+ typeLogoUrl: str = Field(..., alias="typeLogoUrl")
288
+ access: str
289
+ url: str
290
+ user: str
291
+ database: str
292
+ basicAuth: bool = Field(..., alias="basicAuth")
293
+ basicAuthUser: str = Field(..., alias="basicAuthUser")
294
+ withCredentials: bool = Field(..., alias="withCredentials")
295
+ isDefault: bool = Field(..., alias="isDefault")
296
+ jsonData: DataSourceCreationJsonData
297
+ secureJsonFields: DataSourceCreationSecureJsonFields = Field(..., alias="secureJsonFields")
298
+ version: int
299
+ readOnly: bool = Field(..., alias="readOnly")
300
+
301
+
302
+class GrafanaDataSourceCreationResponse(BaseModel):
303
+ datasource: DataSourceCreationDatasource
304
+ id: int
305
+ message: str
306
+ name: str
307
+
308
+
309
+# ! Folder Creation Response! #
310
+class GrafanaFolderCreationResponse(BaseModel):
311
+ id: int
312
+ uid: str
313
+ title: str
314
+ url: str
315
+ hasAcl: bool = Field(..., alias="hasAcl")
316
+ canSave: bool = Field(..., alias="canSave")
317
+ canEdit: bool = Field(..., alias="canEdit")
318
+ canAdmin: bool = Field(..., alias="canAdmin")
319
+ canDelete: bool = Field(..., alias="canDelete")
320
+ createdBy: str = Field(..., alias="createdBy")
321
+ created: datetime
322
+ updatedBy: str = Field(..., alias="updatedBy")
323
+ updated: datetime
324
+ version: int
325
+
326
+
327
+# ! OpenSearch Version ! #
328
+class NodeInfo(BaseModel):
329
+ version: str
330
+
331
+
332
+class NodesVersionResponse(BaseModel):
333
+ nodes: Dict[str, NodeInfo]
backend/app/customer_provisioning/services/provision_wazuh.py
new
+358
@@ -0,0 +1,358 @@
1
+import json
2
+from datetime import datetime
3
+from pathlib import Path
4
+
5
+from fastapi import HTTPException
6
+from loguru import logger
7
+from sqlalchemy.ext.asyncio import AsyncSession
8
+
9
+from app.connectors.grafana.schema.dashboards import DashboardProvisionRequest
10
+from app.connectors.grafana.services.dashboards import provision_dashboards
11
+from app.connectors.grafana.utils.universal import create_grafana_client
12
+from app.connectors.graylog.services.management import start_stream
13
+from app.connectors.graylog.services.pipelines import get_pipelines
14
+from app.connectors.graylog.utils.universal import send_post_request
15
+from app.connectors.wazuh_indexer.utils.universal import create_wazuh_indexer_client
16
+from app.connectors.wazuh_manager.utils.universal import (
17
+ send_post_request as send_wazuh_post_request,
18
+)
19
+from app.connectors.wazuh_manager.utils.universal import (
20
+ send_put_request as send_wazuh_put_request,
21
+)
22
+from app.customer_provisioning.schema.provision import CustomerProvisionMeta
23
+from app.customer_provisioning.schema.provision import GrafanaDatasource
24
+from app.customer_provisioning.schema.provision import GrafanaDataSourceCreationResponse
25
+from app.customer_provisioning.schema.provision import GrafanaFolderCreationResponse
26
+from app.customer_provisioning.schema.provision import GrafanaOrganizationCreation
27
+from app.customer_provisioning.schema.provision import GraylogIndexSetCreationResponse
28
+from app.customer_provisioning.schema.provision import NodesVersionResponse
29
+from app.customer_provisioning.schema.provision import ProvisionNewCustomer
30
+from app.customer_provisioning.schema.provision import StreamConnectionToPipelineRequest
31
+from app.customer_provisioning.schema.provision import (
32
+ StreamConnectionToPipelineResponse,
33
+)
34
+from app.customer_provisioning.schema.provision import StreamCreationResponse
35
+from app.customer_provisioning.schema.provision import TimeBasedIndexSet
36
+from app.customer_provisioning.schema.provision import WazuhAgentsTemplatePaths
37
+from app.customer_provisioning.schema.provision import WazuhEventStream
38
+from app.db.universal_models import CustomersMeta
39
+from app.utils import get_connector_attribute
40
+
41
+
42
+######### ! GRAYLOG PROVISIONING ! ############
43
+# ! INDEX SETS ! #
44
+# Function to create index set configuration
45
+def build_index_set_config(request: ProvisionNewCustomer) -> TimeBasedIndexSet:
46
+ return TimeBasedIndexSet(
47
+ title=f"Wazuh - {request.customer_name}",
48
+ description=f"Wazuh - {request.customer_name}",
49
+ index_prefix=request.customer_index_name,
50
+ rotation_strategy_class="org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy",
51
+ rotation_strategy={
52
+ "type": "org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategyConfig",
53
+ "rotation_period": "P1D",
54
+ "rotate_empty_index_set": False,
55
+ "max_rotation_period": None,
56
+ },
57
+ retention_strategy_class="org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy",
58
+ retention_strategy={
59
+ "type": "org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig",
60
+ "max_number_of_indices": request.hot_data_retention,
61
+ },
62
+ creation_date=datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
63
+ index_analyzer="standard",
64
+ shards=request.index_shards,
65
+ replicas=request.index_replicas,
66
+ index_optimization_max_num_segments=1,
67
+ index_optimization_disabled=False,
68
+ writable=True,
69
+ field_type_refresh_interval=5000,
70
+ )
71
+
72
+
73
+# Function to send the POST request and handle the response
74
+async def send_index_set_creation_request(index_set: TimeBasedIndexSet) -> GraylogIndexSetCreationResponse:
75
+ json_index_set = json.dumps(index_set.dict())
76
+ logger.info(f"json_index_set set: {json_index_set}")
77
+ response_json = await send_post_request(endpoint="/api/system/indices/index_sets", data=index_set.dict())
78
+ return GraylogIndexSetCreationResponse(**response_json)
79
+
80
+
81
+# Refactored create_index_set function
82
+async def create_index_set(request: ProvisionNewCustomer) -> GraylogIndexSetCreationResponse:
83
+ logger.info(f"Creating index set for customer {request.customer_name}")
84
+ index_set_config = build_index_set_config(request)
85
+ return await send_index_set_creation_request(index_set_config)
86
+
87
+
88
+# Function to extract index set ID
89
+def extract_index_set_id(response: GraylogIndexSetCreationResponse) -> str:
90
+ return response.data.id
91
+
92
+
93
+# ! Event STREAMS ! #
94
+# Function to create event stream configuration
95
+def build_event_stream_config(request: ProvisionNewCustomer, index_set_id: str) -> WazuhEventStream:
96
+ return WazuhEventStream(
97
+ title=f"WAZUH EVENTS CUSTOMERS - {request.customer_name}",
98
+ description=f"WAZUH EVENTS CUSTOMERS - {request.customer_name}",
99
+ index_set_id=index_set_id,
100
+ rules=[
101
+ {
102
+ "field": "agent_labels_customer",
103
+ "type": 1,
104
+ "inverted": False,
105
+ "value": request.customer_code,
106
+ },
107
+ ],
108
+ matching_type="AND",
109
+ remove_matches_from_default_stream=True,
110
+ content_pack=None,
111
+ )
112
+
113
+
114
+async def send_event_stream_creation_request(event_stream: WazuhEventStream) -> StreamCreationResponse:
115
+ json_event_stream = json.dumps(event_stream.dict())
116
+ logger.info(f"json_event_stream set: {json_event_stream}")
117
+ response_json = await send_post_request(endpoint="/api/streams", data=event_stream.dict())
118
+ return StreamCreationResponse(**response_json)
119
+
120
+
121
+async def create_event_stream(request: ProvisionNewCustomer, index_set_id: str):
122
+ logger.info(f"Creating event stream for customer {request.customer_name}")
123
+ event_stream_config = build_event_stream_config(request, index_set_id)
124
+ return await send_event_stream_creation_request(event_stream_config)
125
+
126
+
127
+# ! PIPELINES ! #
128
+# Function to get pipeline ID
129
+async def get_pipeline_id(subscription: str) -> str:
130
+ logger.info(f"Getting pipeline ID for subscription {subscription}")
131
+ pipelines_response = await get_pipelines()
132
+ if pipelines_response.success:
133
+ for pipeline in pipelines_response.pipelines:
134
+ if subscription.lower() in pipeline.description.lower():
135
+ return [pipeline.id]
136
+ logger.error(f"Failed to get pipeline ID for subscription {subscription}")
137
+ raise HTTPException(status_code=500, detail=f"Failed to get pipeline ID for subscription {subscription}")
138
+ else:
139
+ logger.error(f"Failed to get pipelines: {pipelines_response.message}")
140
+ raise HTTPException(status_code=500, detail=f"Failed to get pipelines: {pipelines_response.message}")
141
+
142
+
143
+async def connect_stream_to_pipeline(stream_and_pipeline: StreamConnectionToPipelineRequest):
144
+ logger.info(f"Connecting stream {stream_and_pipeline.stream_id} to pipeline {stream_and_pipeline.pipeline_ids}")
145
+ response_json = await send_post_request(endpoint="/api/system/pipelines/connections/to_stream", data=stream_and_pipeline.dict())
146
+ logger.info(f"Response: {response_json}")
147
+ return StreamConnectionToPipelineResponse(**response_json)
148
+
149
+
150
+######### ! WAZUH MANAGER PROVISIONING ! ############
151
+# Function to generate group codes
152
+def generate_group_code(group, customer_code):
153
+ return f"{group}_{customer_code}"
154
+
155
+
156
+# Separate function for sending POST requests to Wazuh
157
+async def create_wazuh_group(group_code):
158
+ endpoint = "groups"
159
+ data = {"group_id": group_code}
160
+ return await send_wazuh_post_request(endpoint=endpoint, data=data)
161
+
162
+
163
+# Main function to create Wazuh groups
164
+async def create_wazuh_groups(request: ProvisionNewCustomer):
165
+ logger.info(f"Creating Wazuh groups for customer {request.customer_name} with code {request.customer_code}")
166
+
167
+ wazuh_groups = ["Linux", "Windows", "Mac"] # This list can be moved to a config file or a global variable
168
+
169
+ for group in wazuh_groups:
170
+ group_code = generate_group_code(group, request.customer_code)
171
+ logger.info(f"Creating group with code {group_code}")
172
+ try:
173
+ response = await create_wazuh_group(group_code)
174
+ logger.info(f"Response for {group_code}: {response}")
175
+ except Exception as e:
176
+ logger.error(f"Error creating group {group_code}: {e}")
177
+
178
+
179
+# Function to get the template file path
180
+def get_template_path(template_info: WazuhAgentsTemplatePaths) -> Path:
181
+ folder_name, file_name = template_info.value
182
+ current_file = Path(__file__) # Path to the current file
183
+ base_dir = current_file.parent.parent # Move up two levels to the base directory
184
+ return base_dir / folder_name / file_name
185
+
186
+
187
+# Function to update Wazuh group configuration
188
+async def configure_wazuh_group(group_code, template_path):
189
+ logger.info(f"Configuring Wazuh group {group_code}")
190
+
191
+ # Read the contents of the template file
192
+ with open(template_path, "r") as template_file:
193
+ config_template = template_file.read()
194
+
195
+ # Replace placeholder with the customer code
196
+ group_config = config_template.replace("REPLACE", group_code.split("_")[-1])
197
+
198
+ # Make the API request to update the group configuration
199
+ return await send_wazuh_put_request(endpoint=f"groups/{group_code}/configuration", data=group_config, xml_data=True)
200
+
201
+
202
+# Function to apply configurations for all groups
203
+async def apply_group_configurations(request: ProvisionNewCustomer):
204
+ logger.info(f"Applying configurations for Wazuh groups for customer {request.customer_name} with code {request.customer_code}")
205
+
206
+ group_templates = {
207
+ "Linux": WazuhAgentsTemplatePaths.LINUX_AGENT,
208
+ "Windows": WazuhAgentsTemplatePaths.WINDOWS_AGENT,
209
+ "Mac": WazuhAgentsTemplatePaths.MAC_AGENT,
210
+ }
211
+
212
+ for group, template in group_templates.items():
213
+ group_code = f"{group}_{request.customer_code}"
214
+ template_path = get_template_path(template)
215
+ try:
216
+ await configure_wazuh_group(group_code, template_path)
217
+ except Exception as e:
218
+ logger.error(f"Error configuring group {group_code}: {e}")
219
+
220
+
221
+######### ! Grafana PROVISIONING ! ############
222
+async def create_grafana_organization(request: ProvisionNewCustomer) -> GrafanaOrganizationCreation:
223
+ logger.info(f"Creating Grafana organization for customer {request.customer_name}")
224
+ grafana_client = await create_grafana_client("Grafana")
225
+ results = grafana_client.organization.create_organization(
226
+ organization={
227
+ "name": request.customer_grafana_org_name,
228
+ },
229
+ )
230
+ return GrafanaOrganizationCreation(**results)
231
+
232
+
233
+async def create_grafana_datasource(
234
+ request: ProvisionNewCustomer,
235
+ organization_id: int,
236
+ session: AsyncSession,
237
+) -> GrafanaDataSourceCreationResponse:
238
+ logger.info(f"Creating Grafana datasource")
239
+ grafana_client = await create_grafana_client("Grafana")
240
+ # Switch to the newly created organization
241
+ grafana_client.user.switch_actual_user_organisation(organization_id)
242
+ datasource_payload = GrafanaDatasource(
243
+ name="WAZUH TEST",
244
+ type="grafana-opensearch-datasource",
245
+ typeName="OpenSearch",
246
+ access="proxy",
247
+ url=await get_connector_attribute(connector_id=1, column_name="connector_url", session=session),
248
+ database=f"{request.customer_index_name}*",
249
+ basicAuth=True,
250
+ basicAuthUser=await get_connector_attribute(connector_id=1, column_name="connector_username", session=session),
251
+ secureJsonData={
252
+ "basicAuthPassword": await get_connector_attribute(connector_id=1, column_name="connector_password", session=session),
253
+ },
254
+ isDefault=False,
255
+ jsonData={
256
+ "database": f"{request.customer_index_name}*",
257
+ "flavor": "opensearch",
258
+ "includeFrozen": False,
259
+ "logLevelField": "syslog_level",
260
+ "logMessageField": "rule_description",
261
+ "maxConcurrentShardRequests": 5,
262
+ "pplEnabled": True,
263
+ "timeField": "timestamp",
264
+ "tlsSkipVerify": True,
265
+ "version": await get_opensearch_version(),
266
+ },
267
+ readOnly=True,
268
+ )
269
+ results = grafana_client.datasource.create_datasource(
270
+ datasource=datasource_payload.dict(),
271
+ )
272
+ return GrafanaDataSourceCreationResponse(**results)
273
+
274
+
275
+async def create_grafana_folder(organization_id: int, folder_title: str) -> GrafanaFolderCreationResponse:
276
+ logger.info(f"Creating Grafana folder")
277
+ grafana_client = await create_grafana_client("Grafana")
278
+ # Switch to the newly created organization
279
+ grafana_client.user.switch_actual_user_organisation(organization_id)
280
+ results = grafana_client.folder.create_folder(
281
+ title=folder_title,
282
+ )
283
+ logger.info(f"Folder creation results: {results}")
284
+ return GrafanaFolderCreationResponse(**results)
285
+
286
+
287
+async def get_opensearch_version() -> str:
288
+ logger.info("Getting OpenSearch version")
289
+ opensearch_client = await create_wazuh_indexer_client("Wazuh-Indexer")
290
+
291
+ # Retrieve version information
292
+ version_response = opensearch_client.nodes.info(node_id="_local", filter_path=["nodes.*.version"])
293
+
294
+ # Parse the response to get the first version found
295
+ nodes_version_response = NodesVersionResponse(**version_response)
296
+ for node_id, node_info in nodes_version_response.nodes.items():
297
+ return node_info.version
298
+
299
+ # If no version is found, raise an exception
300
+ raise HTTPException(status_code=500, detail=f"Failed to retrieve OpenSearch version.")
301
+
302
+
303
+######### ! Update CustomerMeta Table ! ############
304
+async def update_customer_meta_table(request: ProvisionNewCustomer, customer_meta: CustomerProvisionMeta, session: AsyncSession):
305
+ logger.info(f"Updating customer meta table for customer {request.customer_name}")
306
+ customer_meta = CustomersMeta(
307
+ customer_code=request.customer_code,
308
+ customer_name=request.customer_name,
309
+ customer_meta_graylog_index=customer_meta.index_set_id,
310
+ customer_meta_graylog_stream=customer_meta.stream_id,
311
+ customer_meta_grafana_org_id=customer_meta.grafana_organization_id,
312
+ customer_meta_wazuh_group=request.customer_code,
313
+ customer_meta_index_retention=str(request.hot_data_retention),
314
+ customer_meta_wazuh_registration_port=request.wazuh_registration_port,
315
+ customer_meta_wazuh_log_ingestion_port=request.wazuh_logs_port,
316
+ customer_meta_wazuh_auth_password=request.wazuh_auth_password,
317
+ )
318
+ session.add(customer_meta)
319
+ await session.commit()
320
+
321
+
322
+# ! MAIN FUNCTION ! #
323
+async def provision_wazuh_customer(request: ProvisionNewCustomer, session: AsyncSession):
324
+ logger.info(f"Provisioning new customer {request}")
325
+ # Initialize an empty dictionary to store the meta data
326
+ provision_meta_data = {}
327
+ provision_meta_data["index_set_id"] = (await create_index_set(request)).data.id
328
+ provision_meta_data["stream_id"] = (await create_event_stream(request, provision_meta_data["index_set_id"])).data.stream_id
329
+ provision_meta_data["pipeline_ids"] = await get_pipeline_id(subscription="Wazuh")
330
+ stream_and_pipeline = StreamConnectionToPipelineRequest(
331
+ stream_id=provision_meta_data["stream_id"],
332
+ pipeline_ids=provision_meta_data["pipeline_ids"],
333
+ )
334
+ await connect_stream_to_pipeline(stream_and_pipeline)
335
+ if await start_stream(stream_id=provision_meta_data["stream_id"]) is False:
336
+ raise HTTPException(status_code=500, detail=f"Failed to start stream {provision_meta_data['stream_id']}")
337
+ await create_wazuh_groups(request)
338
+ await apply_group_configurations(request)
339
+ provision_meta_data["grafana_organization_id"] = (await create_grafana_organization(request)).orgId
340
+ provision_meta_data["wazuh_datasource_uid"] = (
341
+ await create_grafana_datasource(request=request, organization_id=provision_meta_data["grafana_organization_id"], session=session)
342
+ ).datasource.uid
343
+ provision_meta_data["grafana_edr_folder_id"] = (
344
+ await create_grafana_folder(organization_id=provision_meta_data["grafana_organization_id"], folder_title="EDR")
345
+ ).id
346
+ await provision_dashboards(
347
+ DashboardProvisionRequest(
348
+ dashboards=request.dashboards_to_include.dashboards,
349
+ organizationId=provision_meta_data["grafana_organization_id"],
350
+ folderId=provision_meta_data["grafana_edr_folder_id"],
351
+ datasourceUid=provision_meta_data["wazuh_datasource_uid"],
352
+ ),
353
+ )
354
+
355
+ customer_provision_meta = CustomerProvisionMeta(**provision_meta_data)
356
+ await update_customer_meta_table(request, customer_provision_meta, session)
357
+
358
+ return {"message": "Provisioning new customer"}
backend/app/customer_provisioning/templates/linux_agent.conf
new
+158
@@ -0,0 +1,158 @@
1
+<!--
2
+- SOCFortress TEMPLATE TO PROVISION agent.conf IN A NEW GROUP
3
+-->
4
+<agent_config>
5
+ <labels>
6
+ <label key="customer">REPLACE</label>
7
+ </labels>
8
+ <client_buffer>
9
+ <!-- Agent buffer options -->
10
+ <disabled>no</disabled>
11
+ <queue_size>100000</queue_size>
12
+ <events_per_second>1000</events_per_second>
13
+ </client_buffer>
14
+ <!-- Policy monitoring -->
15
+ <sca>
16
+ <enabled>yes</enabled>
17
+ <scan_on_start>yes</scan_on_start>
18
+ <interval>12h</interval>
19
+ <skip_nfs>yes</skip_nfs>
20
+ </sca>
21
+ <rootcheck>
22
+ <disabled>no</disabled>
23
+ <!-- Frequency that rootcheck is executed - every 12 hours -->
24
+ <frequency>43200</frequency>
25
+ <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
26
+ <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
27
+ <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
28
+ <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
29
+ <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>
30
+ <skip_nfs>yes</skip_nfs>
31
+ </rootcheck>
32
+ <wodle name="open-scap">
33
+ <disabled>yes</disabled>
34
+ <timeout>1800</timeout>
35
+ <interval>1d</interval>
36
+ <scan-on-start>yes</scan-on-start>
37
+ <content type="xccdf" path="ssg-debian-8-ds.xml">
38
+ <profile>xccdf_org.ssgproject.content_profile_common</profile>
39
+ </content>
40
+ <content type="oval" path="cve-debian-oval.xml"/>
41
+ </wodle>
42
+ <!-- File integrity monitoring -->
43
+ <syscheck>
44
+ <disabled>no</disabled>
45
+ <!-- Frequency that syscheck is executed default every 12 hours -->
46
+ <frequency>43200</frequency>
47
+ <scan_on_start>yes</scan_on_start>
48
+ <!-- Directories to check (perform all possible verifications) -->
49
+ <directories check_all="yes" realtime="yes">/opt</directories>
50
+ <directories>/etc,/usr/bin,/usr/sbin</directories>
51
+ <directories>/bin,/sbin,/boot</directories>
52
+ <!-- Files/directories to ignore -->
53
+ <ignore>/etc/mtab</ignore>
54
+ <ignore>/etc/hosts.deny</ignore>
55
+ <ignore>/etc/mail/statistics</ignore>
56
+ <ignore>/etc/random-seed</ignore>
57
+ <ignore>/etc/random.seed</ignore>
58
+ <ignore>/etc/adjtime</ignore>
59
+ <ignore>/etc/httpd/logs</ignore>
60
+ <ignore>/etc/utmpx</ignore>
61
+ <ignore>/etc/wtmpx</ignore>
62
+ <ignore>/etc/cups/certs</ignore>
63
+ <ignore>/etc/dumpdates</ignore>
64
+ <ignore>/etc/svc/volatile</ignore>
65
+ <ignore>/sys/kernel/security</ignore>
66
+ <ignore>/sys/kernel/debug</ignore>
67
+ <!-- File types to ignore -->
68
+ <ignore type="sregex">.log$|.swp$</ignore>
69
+ <!-- Check the file, but never compute the diff -->
70
+ <nodiff>/etc/ssl/private.key</nodiff>
71
+ <skip_nfs>yes</skip_nfs>
72
+ <skip_dev>yes</skip_dev>
73
+ <skip_proc>yes</skip_proc>
74
+ <skip_sys>yes</skip_sys>
75
+ <!-- Nice value for Syscheck process -->
76
+ <process_priority>15</process_priority>
77
+ <!-- Maximum output throughput -->
78
+ <max_eps>100</max_eps>
79
+ <!-- Database synchronization settings -->
80
+ <synchronization>
81
+ <enabled>yes</enabled>
82
+ <interval>5m</interval>
83
+ <response_timeout>30</response_timeout>
84
+ <queue_size>16384</queue_size>
85
+ <max_eps>10</max_eps>
86
+ </synchronization>
87
+ </syscheck>
88
+ <!-- Log analysis -->
89
+ <localfile>
90
+ <log_format>syslog</log_format>
91
+ <location>/var/ossec/logs/active-responses.log</location>
92
+ </localfile>
93
+ <localfile>
94
+ <log_format>syslog</log_format>
95
+ <location>/var/log/messages</location>
96
+ </localfile>
97
+ <localfile>
98
+ <log_format>syslog</log_format>
99
+ <location>/var/log/auth.log</location>
100
+ </localfile>
101
+ <localfile>
102
+ <log_format>syslog</log_format>
103
+ <location>/var/log/syslog</location>
104
+ </localfile>
105
+ <localfile>
106
+ <log_format>json</log_format>
107
+ <location>/var/log/osquery/osqueryd.results.log</location>
108
+ </localfile>
109
+ <localfile>
110
+ <log_format>json</log_format>
111
+ <location>/tmp/packetbeat/packetbeat</location>
112
+ </localfile>
113
+ <localfile>
114
+ <log_format>json</log_format>
115
+ <location>/tmp/packetbeat/packetbeat-*.ndjson</location>
116
+ </localfile>
117
+ <localfile>
118
+ <log_format>command</log_format>
119
+ <command>df -P</command>
120
+ <frequency>360</frequency>
121
+ </localfile>
122
+ <localfile>
123
+ <log_format>full_command</log_format>
124
+ <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>
125
+ <frequency>360</frequency>
126
+ </localfile>
127
+ <localfile>
128
+ <log_format>full_command</log_format>
129
+ <command>last -n 5</command>
130
+ <frequency>360</frequency>
131
+ </localfile>
132
+ <wodle name="osquery">
133
+ <disabled>yes</disabled>
134
+ <run_daemon>yes</run_daemon>
135
+ <log_path>/var/log/osquery/osqueryd.results.log</log_path>
136
+ <config_path>/etc/osquery/osquery.conf</config_path>
137
+ <add_labels>yes</add_labels>
138
+ </wodle>
139
+ <wodle name="syscollector">
140
+ <disabled>no</disabled>
141
+ <interval>24h</interval>
142
+ <scan_on_start>yes</scan_on_start>
143
+ <packages>yes</packages>
144
+ <os>yes</os>
145
+ <hotfixes>yes</hotfixes>
146
+ <ports all="no">yes</ports>
147
+ <processes>yes</processes>
148
+ </wodle>
149
+ <wodle name="command">
150
+ <disabled>no</disabled>
151
+ <tag>open-audit</tag>
152
+ <command>/usr/bin/bash /usr/share/socfortress/scripts/open-audit.sh</command>
153
+ <interval>24h</interval>
154
+ <ignore_output>yes</ignore_output>
155
+ <run_on_start>yes</run_on_start>
156
+ <timeout>0</timeout>
157
+ </wodle>
158
+</agent_config>
backend/app/customer_provisioning/templates/mac_agent.conf
new
+142
@@ -0,0 +1,142 @@
1
+<agent_config>
2
+ <labels>
3
+ <label key="customer">REPLACE</label>
4
+ </labels>
5
+ <client_buffer>
6
+ <!-- Agent buffer options -->
7
+ <disabled>no</disabled>
8
+ <queue_size>100000</queue_size>
9
+ <events_per_second>1000</events_per_second>
10
+ </client_buffer>
11
+ <!-- Policy monitoring -->
12
+ <sca>
13
+ <enabled>yes</enabled>
14
+ <scan_on_start>yes</scan_on_start>
15
+ <time>04:00</time>
16
+ <skip_nfs>yes</skip_nfs>
17
+ <policies>
18
+ <policy>ruleset/sca/cis_apple_macOS_13.x.yml</policy>
19
+ </policies>
20
+ </sca>
21
+ <rootcheck>
22
+ <disabled>no</disabled>
23
+ <!-- Frequency that rootcheck is executed - every 12 hours -->
24
+ <frequency>43200</frequency>
25
+ <rootkit_files>/Library/Ossec/etc/shared/rootkit_files.txt</rootkit_files>
26
+ <rootkit_trojans>/Library/Ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
27
+ <system_audit>/Library/Ossec/etc/shared/system_audit_rcl.txt</system_audit>
28
+ <system_audit>/Library/Ossec/etc/shared/system_audit_ssh.txt</system_audit>
29
+ <skip_nfs>yes</skip_nfs>
30
+ </rootcheck>
31
+ <!-- File integrity monitoring -->
32
+ <syscheck>
33
+ <disabled>no</disabled>
34
+ <!-- Frequency that syscheck is executed default every 12 hours -->
35
+ <frequency>43200</frequency>
36
+ <scan_on_start>yes</scan_on_start>
37
+ <!-- Directories to check (perform all possible verifications) -->
38
+ <directories check_all="yes" realtime="yes">/opt</directories>
39
+ <directories>/etc,/usr/bin,/usr/sbin</directories>
40
+ <directories>/bin,/sbin,/boot</directories>
41
+ <!-- Files/directories to ignore -->
42
+ <ignore>/etc/hosts.deny</ignore>
43
+ <ignore>/etc/mail/statistics</ignore>
44
+ <ignore>/etc/random-seed</ignore>
45
+ <ignore>/etc/random.seed</ignore>
46
+ <ignore>/etc/adjtime</ignore>
47
+ <ignore>/etc/httpd/logs</ignore>
48
+ <ignore>/etc/utmpx</ignore>
49
+ <ignore>/etc/wtmpx</ignore>
50
+ <ignore>/etc/cups/certs</ignore>
51
+ <ignore>/etc/dumpdates</ignore>
52
+ <ignore>/etc/svc/volatile</ignore>
53
+ <ignore>/sys/kernel/security</ignore>
54
+ <ignore>/sys/kernel/debug</ignore>
55
+ <!-- File types to ignore -->
56
+ <ignore type="sregex">.log$|.swp$</ignore>
57
+ <!-- Check the file, but never compute the diff -->
58
+ <nodiff>/etc/ssl/private.key</nodiff>
59
+ <skip_nfs>yes</skip_nfs>
60
+ <skip_dev>yes</skip_dev>
61
+ <skip_proc>yes</skip_proc>
62
+ <skip_sys>yes</skip_sys>
63
+ <!-- Nice value for Syscheck process -->
64
+ <process_priority>15</process_priority>
65
+ <!-- Maximum output throughput -->
66
+ <max_eps>100</max_eps>
67
+ <!-- Database synchronization settings -->
68
+ <synchronization>
69
+ <enabled>yes</enabled>
70
+ <interval>5m</interval>
71
+ <response_timeout>30</response_timeout>
72
+ <queue_size>16384</queue_size>
73
+ <max_eps>10</max_eps>
74
+ </synchronization>
75
+ </syscheck>
76
+ <!-- Log analysis -->
77
+ <localfile>
78
+ <location>macos</location>
79
+ <log_format>macos</log_format>
80
+ <query type="trace,log,activity" level="info">(process == "sudo") or (process == "sessionlogoutd" and message contains "logout is complete.") or (process == "sshd") or (process == "tccd" and message contains "Update Access Record") or (message contains "SessionAgentNotificationCenter") or (process == "screensharingd" and message contains "Authentication") or (process == "securityd" and eventMessage contains "Session" and subsystem == "com.apple.securityd")</query>
81
+ </localfile>
82
+ <localfile>
83
+ <log_format>syslog</log_format>
84
+ <location>/Library/Ossec/logs/active-responses.log</location>
85
+ </localfile>
86
+ <localfile>
87
+ <log_format>syslog</log_format>
88
+ <location>/var/log/system.log</location>
89
+ </localfile>
90
+ <localfile>
91
+ <log_format>json</log_format>
92
+ <location>/var/log/osquery/osqueryd.results.log</location>
93
+ </localfile>
94
+ <localfile>
95
+ <log_format>json</log_format>
96
+ <location>/usr/local/var/log/packetbeat</location>
97
+ </localfile>
98
+ <localfile>
99
+ <log_format>json</log_format>
100
+ <location>/tmp/packetbeat/packetbeat-*.ndjson</location>
101
+ </localfile>
102
+ <localfile>
103
+ <log_format>command</log_format>
104
+ <command>df -P</command>
105
+ <frequency>360</frequency>
106
+ </localfile>
107
+ <localfile>
108
+ <log_format>full_command</log_format>
109
+ <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>
110
+ <frequency>360</frequency>
111
+ </localfile>
112
+ <localfile>
113
+ <log_format>full_command</log_format>
114
+ <command>last</command>
115
+ <frequency>360</frequency>
116
+ </localfile>
117
+ <wodle name="osquery">
118
+ <disabled>yes</disabled>
119
+ <run_daemon>yes</run_daemon>
120
+ <log_path>/var/log/osquery/osqueryd.results.log</log_path>
121
+ <config_path>/var/osquery/osquery.conf</config_path>
122
+ <add_labels>yes</add_labels>
123
+ </wodle>
124
+ <wodle name="syscollector">
125
+ <disabled>no</disabled>
126
+ <interval>24h</interval>
127
+ <scan_on_start>yes</scan_on_start>
128
+ <packages>yes</packages>
129
+ <os>yes</os>
130
+ <ports all="no">yes</ports>
131
+ <processes>yes</processes>
132
+ </wodle>
133
+ <wodle name="command">
134
+ <disabled>no</disabled>
135
+ <tag>open-audit</tag>
136
+ <command>/bin/bash /opt/socfortress/scripts/open-audit-osx.sh</command>
137
+ <interval>24h</interval>
138
+ <ignore_output>yes</ignore_output>
139
+ <run_on_start>yes</run_on_start>
140
+ <timeout>0</timeout>
141
+ </wodle>
142
+</agent_config>
backend/app/customer_provisioning/templates/windows_agent.conf
new
+229
@@ -0,0 +1,229 @@
1
+<!--
2
+- SOCFortress TEMPLATE TO PROVISION agent.conf IN A NEW GROUP
3
+-->
4
+<agent_config>
5
+ <labels>
6
+ <label key="customer">REPLACE</label>
7
+ </labels>
8
+ <client_buffer>
9
+ <!-- Agent buffer options -->
10
+ <disabled>no</disabled>
11
+ <queue_size>100000</queue_size>
12
+ <events_per_second>1000</events_per_second>
13
+ </client_buffer>
14
+ <!-- Policy monitoring -->
15
+ <rootcheck>
16
+ <disabled>no</disabled>
17
+ <windows_apps>./shared/win_applications_rcl.txt</windows_apps>
18
+ <windows_malware>./shared/win_malware_rcl.txt</windows_malware>
19
+ </rootcheck>
20
+ <sca>
21
+ <enabled>yes</enabled>
22
+ <scan_on_start>yes</scan_on_start>
23
+ <interval>12h</interval>
24
+ <skip_nfs>yes</skip_nfs>
25
+ </sca>
26
+ <!-- File integrity monitoring -->
27
+ <syscheck>
28
+ <disabled>no</disabled>
29
+ <!-- Frequency that syscheck is executed default every 12 hours -->
30
+ <frequency>43200</frequency>
31
+ <!-- Default files to be monitored. -->
32
+ <directories recursion_level="0" restrict="regedit.exe$|system.ini$|win.ini$">%WINDIR%</directories>
33
+ <directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedt32.exe|regsvr32.exe|runas.exe|sc.exe|schtasks.exe|sethc.exe|subst.exe$">%WINDIR%\SysNative</directories>
34
+ <directories recursion_level="0">%WINDIR%\SysNative\drivers\etc</directories>
35
+ <directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\SysNative\wbem</directories>
36
+ <directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\SysNative\WindowsPowerShell\v1.0</directories>
37
+ <directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\SysNative</directories>
38
+ <!-- 32-bit programs. -->
39
+ <directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedit.exe$|regedt32.exe$|regsvr32.exe$|runas.exe$|sc.exe$|schtasks.exe$|sethc.exe$|subst.exe$">%WINDIR%\System32</directories>
40
+ <directories recursion_level="0">%WINDIR%\System32\drivers\etc</directories>
41
+ <directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\System32\wbem</directories>
42
+ <directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\System32\WindowsPowerShell\v1.0</directories>
43
+ <directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\System32</directories>
44
+ <directories realtime="yes">%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup</directories>
45
+ <ignore>%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini</ignore>
46
+ <ignore type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|.dat$|.log1$|.log2$</ignore>
47
+ <!-- Windows registry entries to monitor. -->
48
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\batfile</windows_registry>
49
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\cmdfile</windows_registry>
50
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\comfile</windows_registry>
51
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\exefile</windows_registry>
52
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\piffile</windows_registry>
53
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects</windows_registry>
54
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Directory</windows_registry>
55
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Folder</windows_registry>
56
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Classes\Protocols</windows_registry>
57
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Policies</windows_registry>
58
+ <windows_registry>HKEY_LOCAL_MACHINE\Security</windows_registry>
59
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer</windows_registry>
60
+ <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>
61
+ <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs</windows_registry>
62
+ <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg</windows_registry>
63
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
64
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry>
65
+ <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</windows_registry>
66
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL</windows_registry>
67
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies</windows_registry>
68
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</windows_registry>
69
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</windows_registry>
70
+ <windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components</windows_registry>
71
+ <!-- Windows registry entries to ignore. -->
72
+ <registry_ignore>HKEY_LOCAL_MACHINE\Security\Policy\Secrets</registry_ignore>
73
+ <registry_ignore>HKEY_LOCAL_MACHINE\Security\SAM\Domains\Account\Users</registry_ignore>
74
+ <registry_ignore type="sregex">\Enum$</registry_ignore>
75
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\AppCs</registry_ignore>
76
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\DHCP</registry_ignore>
77
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn</registry_ignore>
78
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut</registry_ignore>
79
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap</registry_ignore>
80
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo</registry_ignore>
81
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\Parameters\Cache</registry_ignore>
82
+ <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</registry_ignore>
83
+ <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ADOVMPPackage\Final</registry_ignore>
84
+ <!-- SOCFortress FIM Added -->
85
+ <directories realtime="yes">c:\users\*</directories>
86
+ <ignore type="sregex">\appdata</ignore>
87
+ <ignore>c:\users\*\ntuser.*</ignore>
88
+ <!-- Frequency for ACL checking (seconds) -->
89
+ <windows_audit_interval>60</windows_audit_interval>
90
+ <!-- Nice value for Syscheck module -->
91
+ <process_priority>10</process_priority>
92
+ <!-- Maximum output throughput -->
93
+ <max_eps>100</max_eps>
94
+ <!-- Database synchronization settings -->
95
+ <synchronization>
96
+ <enabled>yes</enabled>
97
+ <interval>5m</interval>
98
+ <max_interval>1h</max_interval>
99
+ <max_eps>10</max_eps>
100
+ </synchronization>
101
+ </syscheck>
102
+ <!-- System inventory -->
103
+ <wodle name="syscollector">
104
+ <disabled>no</disabled>
105
+ <interval>1h</interval>
106
+ <scan_on_start>yes</scan_on_start>
107
+ <hardware>yes</hardware>
108
+ <os>yes</os>
109
+ <network>yes</network>
110
+ <packages>yes</packages>
111
+ <ports all="no">yes</ports>
112
+ <processes>yes</processes>
113
+ <!-- Database synchronization settings -->
114
+ <synchronization>
115
+ <max_eps>10</max_eps>
116
+ </synchronization>
117
+ </wodle>
118
+ <!-- CIS policies evaluation -->
119
+ <wodle name="cis-cat">
120
+ <disabled>yes</disabled>
121
+ <timeout>1800</timeout>
122
+ <interval>1d</interval>
123
+ <scan-on-start>yes</scan-on-start>
124
+ <java_path>\\server\jre\bin\java.exe</java_path>
125
+ <ciscat_path>C:\cis-cat</ciscat_path>
126
+ </wodle>
127
+ <!-- Osquery integration -->
128
+ <wodle name="osquery">
129
+ <disabled>yes</disabled>
130
+ <run_daemon>yes</run_daemon>
131
+ <bin_path>C:\Program Files\osquery\osqueryd</bin_path>
132
+ <log_path>C:\Program Files\osquery\log\osqueryd.results.log</log_path>
133
+ <config_path>C:\Program Files\osquery\osquery.conf</config_path>
134
+ <add_labels>yes</add_labels>
135
+ </wodle>
136
+ <!-- Active response -->
137
+ <active-response>
138
+ <disabled>no</disabled>
139
+ <ca_store>wpk_root.pem</ca_store>
140
+ <ca_verification>yes</ca_verification>
141
+ </active-response>
142
+ <!-- Log analysis -->
143
+ <localfile>
144
+ <location>Microsoft-Windows-Sysmon/Operational</location>
145
+ <log_format>eventchannel</log_format>
146
+ </localfile>
147
+ <localfile>
148
+ <location>Windows PowerShell</location>
149
+ <log_format>eventchannel</log_format>
150
+ </localfile>
151
+ <localfile>
152
+ <location>Microsoft-Windows-CodeIntegrity/Operational</location>
153
+ <log_format>eventchannel</log_format>
154
+ </localfile>
155
+ <localfile>
156
+ <location>Microsoft-Windows-TaskScheduler/Operational</location>
157
+ <log_format>eventchannel</log_format>
158
+ </localfile>
159
+ <localfile>
160
+ <location>Microsoft-Windows-PowerShell/Operational</location>
161
+ <log_format>eventchannel</log_format>
162
+ </localfile>
163
+ <localfile>
164
+ <location>Microsoft-Windows-Windows Firewall With Advanced Security/Firewall</location>
165
+ <log_format>eventchannel</log_format>
166
+ </localfile>
167
+ <localfile>
168
+ <location>Microsoft-Windows-Windows Defender/Operational</location>
169
+ <log_format>eventchannel</log_format>
170
+ </localfile>
171
+ <localfile>
172
+ <location>FSecureUltralightSDK</location>
173
+ <log_format>eventchannel</log_format>
174
+ </localfile>
175
+ <wodle name="command">
176
+ <disabled>no</disabled>
177
+ <tag>sigcheck</tag>
178
+ <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\sigcheck.ps1"</command>
179
+ <interval>1d</interval>
180
+ <ignore_output>yes</ignore_output>
181
+ <run_on_start>yes</run_on_start>
182
+ <timeout>0</timeout>
183
+ </wodle>
184
+ <wodle name="command">
185
+ <disabled>no</disabled>
186
+ <tag>autoruns</tag>
187
+ <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\autoruns.ps1"</command>
188
+ <interval>1d</interval>
189
+ <ignore_output>yes</ignore_output>
190
+ <run_on_start>yes</run_on_start>
191
+ <timeout>0</timeout>
192
+ </wodle>
193
+ <wodle name="command">
194
+ <disabled>no</disabled>
195
+ <tag>logonsessions</tag>
196
+ <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\logonsessions.ps1"</command>
197
+ <interval>1h</interval>
198
+ <ignore_output>yes</ignore_output>
199
+ <run_on_start>yes</run_on_start>
200
+ <timeout>0</timeout>
201
+ </wodle>
202
+ <wodle name="command">
203
+ <disabled>no</disabled>
204
+ <tag>open-audit</tag>
205
+ <command>"C:\Program Files (x86)\ossec-agent\active-response\bin\open_audit.cmd"</command>
206
+ <interval>24h</interval>
207
+ <ignore_output>yes</ignore_output>
208
+ <run_on_start>yes</run_on_start>
209
+ <timeout>0</timeout>
210
+ </wodle>
211
+ <wodle name="command">
212
+ <disabled>no</disabled>
213
+ <tag>dll_for_chainsaw</tag>
214
+ <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\socfortress\Files\install_dll.ps1"</command>
215
+ <interval>24h</interval>
216
+ <ignore_output>yes</ignore_output>
217
+ <run_on_start>yes</run_on_start>
218
+ <timeout>0</timeout>
219
+ </wodle>
220
+ <wodle name="command">
221
+ <disabled>no</disabled>
222
+ <tag>clear_active_responses_logs</tag>
223
+ <command>Powershell.exe -executionpolicy bypass -File "C:\Program Files (x86)\ossec-agent\active-response\bin\clear_active_responses_logs.ps1"</command>
224
+ <interval>24h</interval>
225
+ <ignore_output>yes</ignore_output>
226
+ <run_on_start>yes</run_on_start>
227
+ <timeout>0</timeout>
228
+ </wodle>
229
+</agent_config>
backend/app/customers/schema/customers.py
+10
-10
@@ -60,12 +60,12 @@ class CustomersResponse(BaseModel):
60
class CustomerMetaRequestBody(BaseModel):
61
customer_meta_graylog_index: str = Field(..., description="Graylog index for the customer")
62
customer_meta_graylog_stream: str = Field(..., description="Graylog stream for the customer")
63
- customer_meta_influx_org: str = Field(..., description="InfluxDB organization for the customer")
64
- customer_meta_grafana_org: str = Field(..., description="Grafana organization for the customer")
63
+ customer_meta_grafana_org_id: str = Field(..., description="Grafana organization for the customer")
64
customer_meta_wazuh_group: str = Field(..., description="Wazuh group for the customer")
66
- index_retention: int = Field(..., description="Index retention for the customer")
67
- wazuh_registration_port: int = Field(..., description="Wazuh registration port for the customer")
68
- wazuh_log_ingestion_port: int = Field(..., description="Wazuh log ingestion port for the customer")
65
+ customer_meta_index_retention: str = Field(..., description="Index retention for the customer")
66
+ customer_meta_wazuh_registration_port: str = Field(..., description="Wazuh registration port for the customer")
67
+ customer_meta_wazuh_log_ingestion_port: str = Field(..., description="Wazuh log ingestion port for the customer")
68
+ customer_meta_wazuh_auth_password: str = Field(..., description="Wazuh auth password for the customer")
69
70
class Config:
71
orm_mode = True
@@ -73,12 +73,12 @@ class CustomerMetaRequestBody(BaseModel):
73
"example": {
74
"customer_meta_graylog_index": "graylog_index",
75
"customer_meta_graylog_stream": "graylog_stream",
76
- "customer_meta_influx_org": "influx_org",
77
- "customer_meta_grafana_org": "grafana_org",
76
+ "customer_meta_grafana_org_id": "grafana_org",
77
"customer_meta_wazuh_group": "wazuh_group",
79
- "index_retention": 30,
80
- "wazuh_registration_port": 1514,
81
- "wazuh_log_ingestion_port": 1515,
78
+ "customer_meta_index_retention": "30D",
79
+ "customer_meta_wazuh_registration_port": "1514",
80
+ "customer_meta_wazuh_log_ingestion_port": "1515",
81
+ "customer_meta_wazuh_auth_password": "wazuh_password",
82
},
83
}
84
backend/app/db/db_populate.py
+28
-6
@@ -7,7 +7,7 @@ from app.auth.models.users import Role
7
from app.connectors.models import Connectors
8
9
10
-def add_connectors_if_not_exist(session: Session):
10
+async def add_connectors_if_not_exist(session: AsyncSession):
11
# List of connectors to add
12
connector_list = [
13
{
@@ -130,20 +130,42 @@ def add_connectors_if_not_exist(session: Session):
130
"connector_configured": True,
131
"connector_accepts_api_key": True,
132
},
133
+ {
134
+ "connector_name": "InfluxDB",
135
+ "connector_type": "3",
136
+ "connector_url": "http://ashwzhma.socfortress.local:8086",
137
+ "connector_username": None,
138
+ "connector_password": None,
139
+ "connector_api_key": "23PySXxdhw7hUgwOCjEfUhSLL32A41GBZwflP1k0XFQbL64q4rfju23uc_elokQ0546Cp-s25DnVRj8urQmt5w==",
140
+ "connector_configured": True,
141
+ "connector_accepts_api_key": True,
142
+ "connector_extra_data": "telegraf",
143
+ },
144
+ {
145
+ "connector_name": "Grafana",
146
+ "connector_type": "3",
147
+ "connector_url": "http://192.168.200.218:3000",
148
+ "connector_username": "admin",
149
+ "connector_password": "admin",
150
+ "connector_api_key": None,
151
+ "connector_configured": True,
152
+ "connector_accepts_username_password": True,
153
+ },
154
]
155
156
for connector_data in connector_list:
136
- # Check if connector already exists in the database
137
- existing_connector = session.query(Connectors).filter_by(connector_name=connector_data["connector_name"]).first()
157
+ # Asynchronously check if connector already exists in the database
158
+ query = select(Connectors).where(Connectors.connector_name == connector_data["connector_name"])
159
+ result = await session.execute(query)
160
+ existing_connector = result.scalars().first()
161
162
if existing_connector is None:
140
- # If connector does not exist, create new connector entry
163
new_connector = Connectors(**connector_data)
142
- session.add(new_connector)
164
+ session.add(new_connector) # Use session.add() to add new objects
165
logger.info(f"Added new connector: {connector_data['connector_name']}")
166
167
# Commit the changes if any new connectors were added
146
- session.commit()
168
+ await session.commit()
169
170
171
async def add_roles_if_not_exist(session: AsyncSession) -> None:
backend/app/db/db_setup.py
+5
@@ -8,6 +8,7 @@ from sqlmodel import SQLModel
8
from app.auth.services.universal import create_admin_user
9
from app.auth.services.universal import create_scheduler_user
10
from app.auth.services.universal import remove_scheduler_user
11
+from app.db.db_populate import add_connectors_if_not_exist
12
from app.db.db_populate import add_roles_if_not_exist
13
14
# from sqlalchemy import inspect
@@ -48,6 +49,10 @@ async def create_tables(async_engine):
49
async with async_engine.begin() as conn:
50
# This will create all tables
51
await conn.run_sync(SQLModel.metadata.create_all)
52
+ # Use AsyncSession for adding connectors
53
+ async with AsyncSession(async_engine) as session:
54
+ async with session.begin():
55
+ await add_connectors_if_not_exist(session)
56
57
58
async def create_roles(async_engine):
backend/app/db/universal_models.py
+10
-10
@@ -50,12 +50,12 @@ class CustomersMeta(SQLModel, table=True):
50
customer_name: str = Field(max_length=255)
51
customer_meta_graylog_index: str = Field(max_length=1024)
52
customer_meta_graylog_stream: str = Field(max_length=1024)
53
- customer_meta_influx_org: str = Field(max_length=1024)
54
- customer_meta_grafana_org: str = Field(max_length=1024)
53
+ customer_meta_grafana_org_id: str = Field(max_length=1024)
54
customer_meta_wazuh_group: str = Field(max_length=1024)
56
- index_retention: Optional[int] = Field()
57
- wazuh_registration_port: Optional[int] = Field()
58
- wazuh_log_ingestion_port: Optional[int] = Field()
55
+ customer_meta_index_retention: Optional[str] = Field()
56
+ customer_meta_wazuh_registration_port: Optional[str] = Field()
57
+ customer_meta_wazuh_log_ingestion_port: Optional[str] = Field()
58
+ customer_meta_wazuh_auth_password: Optional[str] = Field(max_length=1024)
59
60
# Link back to Customers
61
customer: Optional["Customers"] = Relationship(back_populates="meta")
@@ -67,12 +67,12 @@ class CustomersMeta(SQLModel, table=True):
67
self.customer_name = customer_meta.customer_name
68
self.customer_meta_graylog_index = customer_meta.customer_meta_graylog_index
69
self.customer_meta_graylog_stream = customer_meta.customer_meta_graylog_stream
70
- self.customer_meta_influx_org = customer_meta.customer_meta_influx_org
71
- self.customer_meta_grafana_org = customer_meta.customer_meta_grafana_org
70
+ self.customer_meta_grafana_org_id = customer_meta.customer_meta_grafana_org_id
71
self.customer_meta_wazuh_group = customer_meta.customer_meta_wazuh_group
73
- self.index_retention = customer_meta.index_retention
74
- self.wazuh_registration_port = customer_meta.wazuh_registration_port
75
- self.wazuh_log_ingestion_port = customer_meta.wazuh_log_ingestion_port
72
+ self.customer_meta_index_retention = customer_meta.customer_meta_index_retention
73
+ self.customer_meta_wazuh_registration_port = customer_meta.customer_meta_wazuh_registration_port
74
+ self.customer_meta_wazuh_log_ingestion_port = customer_meta.customer_meta_wazuh_log_ingestion_port
75
+ self.customer_meta_wazuh_auth_password = customer_meta.customer_meta_wazuh_auth_password
76
77
78
class Agents(SQLModel, table=True):
backend/app/middleware/exception_handlers.py
+19
@@ -58,6 +58,7 @@ from fastapi import HTTPException
58
from fastapi import Request
59
from fastapi.exceptions import RequestValidationError
60
from fastapi.responses import JSONResponse
61
+from loguru import logger
62
from sqlalchemy.ext.asyncio import AsyncSession
63
64
from app.auth.utils import AuthHandler
@@ -110,3 +111,21 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
111
status_code=422,
112
content=ValidationErrorResponse(message=main_message, details=details).dict(),
113
)
114
+
115
+
116
+async def value_error_handler(request: Request, exc: ValueError):
117
+ error_message = str(exc)
118
+
119
+ async with AsyncSession(async_engine) as session:
120
+ logger_instance = Logger(session, AuthHandler())
121
+ user_id = await get_user_id_from_request(request, logger_instance)
122
+ await logger_instance.log_error(user_id, request, error_message)
123
+ await session.commit()
124
+
125
+ return JSONResponse(
126
+ status_code=400, # Bad Request
127
+ content={
128
+ "success": False,
129
+ "message": error_message,
130
+ },
131
+ )
backend/app/routers/customer_provisioning.py
new
+9
@@ -0,0 +1,9 @@
1
+from fastapi import APIRouter
2
+
3
+from app.customer_provisioning.routes.provision import customer_provisioning_router
4
+
5
+# Instantiate the APIRouter
6
+router = APIRouter()
7
+
8
+# Include the Shuffle related routes
9
+router.include_router(customer_provisioning_router, prefix="/customer_provisioning", tags=["Customer Provisioning"])
backend/app/routers/grafana.py
new
+9
@@ -0,0 +1,9 @@
1
+from fastapi import APIRouter
2
+
3
+from app.connectors.grafana.routes.dashboards import grafana_dashboards_router
4
+
5
+# Instantiate the APIRouter
6
+router = APIRouter()
7
+
8
+# Include the Shuffle related routes
9
+router.include_router(grafana_dashboards_router, prefix="/grafana", tags=["Grafana"])
backend/app/routers/influxdb.py
new
+9
@@ -0,0 +1,9 @@
1
+from fastapi import APIRouter
2
+
3
+from app.connectors.influxdb.routes.alerts import influxdb_alerts_router
4
+
5
+# Instantiate the APIRouter
6
+router = APIRouter()
7
+
8
+# Include the Shuffle related routes
9
+router.include_router(influxdb_alerts_router, prefix="/influxdb", tags=["InfluxDB"])
backend/app/utils.py
+12
@@ -1,6 +1,7 @@
1
from datetime import datetime
2
from datetime import timedelta
3
from enum import Enum
4
+from typing import Any
5
from typing import List
6
from typing import Optional
7
from typing import Union
@@ -20,6 +21,7 @@ from sqlalchemy.future import select
21
22
from app.auth.services.universal import find_user
23
from app.auth.utils import AuthHandler
24
+from app.db.all_models import Connectors
25
from app.db.db_session import Session
26
from app.db.db_session import engine
27
from app.db.db_session import get_session
@@ -452,3 +454,13 @@ async def purge_logs_by_time_range(time_range: TimeRangeModel, session: AsyncSes
454
def allowed_file(filename):
455
ALLOWED_EXTENSIONS = {"yaml", "txt"}
456
return "." in filename and filename.rsplit(".", 1)[1].lower() in ALLOWED_EXTENSIONS
457
+
458
+
459
+################## ! DATABASE UTILS ! ##################
460
+async def get_connector_attribute(connector_id: int, column_name: str, session: AsyncSession = Depends(get_session)) -> Optional[Any]:
461
+ result = await session.execute(select(Connectors).filter(Connectors.id == connector_id))
462
+ connector = result.scalars().first()
463
+
464
+ if connector:
465
+ return getattr(connector, column_name, None)
466
+ return None
backend/copilot.py
+8
@@ -15,16 +15,20 @@ from app.db.db_setup import ensure_scheduler_user
15
from app.db.db_setup import ensure_scheduler_user_removed
16
from app.middleware.exception_handlers import custom_http_exception_handler
17
from app.middleware.exception_handlers import validation_exception_handler
18
+from app.middleware.exception_handlers import value_error_handler
19
from app.middleware.logger import log_requests
20
from app.routers import agents
21
from app.routers import auth
22
from app.routers import connectors
23
from app.routers import cortex
24
+from app.routers import customer_provisioning
25
from app.routers import customers
26
from app.routers import dfir_iris
27
from app.routers import dnstwist
28
+from app.routers import grafana
29
from app.routers import graylog
30
from app.routers import healthcheck
31
+from app.routers import influxdb
32
from app.routers import logs
33
from app.routers import shuffle
34
from app.routers import smtp
@@ -57,6 +61,7 @@ app.middleware("http")(log_requests) # using the imported middleware
61
################## ! Exception Handlers ! ##################
62
app.add_exception_handler(HTTPException, custom_http_exception_handler)
63
app.add_exception_handler(RequestValidationError, validation_exception_handler)
64
+app.add_exception_handler(ValueError, value_error_handler)
65
66
67
################## ! INCLUDE ROUTES ! ##################
@@ -76,6 +81,9 @@ app.include_router(healthcheck.router)
81
app.include_router(smtp.router)
82
app.include_router(dnstwist.router)
83
app.include_router(logs.router)
84
+app.include_router(influxdb.router)
85
+app.include_router(grafana.router)
86
+app.include_router(customer_provisioning.router)
87
88
89
@app.on_event("startup")
backend/requirements.in
+2
@@ -9,6 +9,8 @@ dnstwist
9
elasticsearch7==7.10.1
10
environs
11
fastapi
12
+grafana-client
13
+influxdb-client[async]
14
libmagic
15
loguru
16
marshmallow-sqlalchemy
package-lock.json
+566
-256
@@ -89,12 +89,12 @@
89
"@types/bytes": "^3.1.4",
90
"@types/fs-extra": "^11.0.4",
91
"@types/inquirer": "^9.0.7",
92
- "@types/jsdom": "^21.1.5",
93
- "@types/lodash": "^4.14.201",
94
- "@types/node": "^20.9.0",
95
- "@types/validator": "^13.11.6",
96
- "@vitejs/plugin-vue": "^4.4.1",
97
- "@vitejs/plugin-vue-jsx": "^3.0.2",
92
+ "@types/jsdom": "^21.1.6",
93
+ "@types/lodash": "^4.14.202",
94
+ "@types/node": "^20.9.3",
95
+ "@types/validator": "^13.11.7",
96
+ "@vitejs/plugin-vue": "^4.5.0",
97
+ "@vitejs/plugin-vue-jsx": "^3.1.0",
98
"@vue-leaflet/vue-leaflet": "^0.10.1",
99
"@vue/eslint-config-prettier": "^8.0.0",
100
"@vue/eslint-config-typescript": "^12.0.0",
@@ -102,7 +102,7 @@
102
"@vue/tsconfig": "^0.4.0",
103
"autoprefixer": "^10.4.16",
104
"cypress": "^13.5.1",
105
- "eslint": "^8.53.0",
105
+ "eslint": "^8.54.0",
106
"eslint-plugin-cypress": "^2.15.1",
107
"eslint-plugin-vue": "^9.18.1",
108
"fs-extra": "^11.1.1",
@@ -114,15 +114,15 @@
114
"postcss": "^8.4.31",
115
"prettier": "^3.1.0",
116
"sass": "^1.69.5",
117
- "start-server-and-test": "^2.0.2",
117
+ "start-server-and-test": "^2.0.3",
118
"tailwind-config-viewer": "^1.7.3",
119
"tailwindcss": "^3.3.5",
120
"taze": "^0.12.0",
121
"ts-node": "^10.9.1",
122
- "typescript": "~5.2.2",
122
+ "typescript": "~5.3.2",
123
"unplugin-vue-components": "^0.25.2",
124
- "vite": "^4.5.0",
125
- "vite-svg-loader": "^4.0.0",
124
+ "vite": "^5.0.0",
125
+ "vite-svg-loader": "^5.1.0",
126
"vitest": "^0.34.6",
127
"vue-tsc": "^1.8.22"
128
},
@@ -197,12 +197,12 @@
197
}
198
},
199
"node_modules/@babel/code-frame": {
200
- "version": "7.22.13",
201
- "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.13.tgz",
202
- "integrity": "sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==",
200
+ "version": "7.23.4",
201
+ "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.23.4.tgz",
202
+ "integrity": "sha512-r1IONyb6Ia+jYR2vvIDhdWdlTGhqbBoFqLTQidzZ4kepUFH15ejXvFHxCVbtl7BOXIudsIubf4E81xeA3h3IXA==",
203
"dev": true,
204
"dependencies": {
205
- "@babel/highlight": "^7.22.13",
205
+ "@babel/highlight": "^7.23.4",
206
"chalk": "^2.4.2"
207
},
208
"engines": {
@@ -219,22 +219,22 @@
219
}
220
},
221
"node_modules/@babel/core": {
222
- "version": "7.22.20",
223
- "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.22.20.tgz",
224
- "integrity": "sha512-Y6jd1ahLubuYweD/zJH+vvOY141v4f9igNQAQ+MBgq9JlHS2iTsZKn1aMsb3vGccZsXI16VzTBw52Xx0DWmtnA==",
222
+ "version": "7.23.3",
223
+ "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.23.3.tgz",
224
+ "integrity": "sha512-Jg+msLuNuCJDyBvFv5+OKOUjWMZgd85bKjbICd3zWrKAo+bJ49HJufi7CQE0q0uR8NGyO6xkCACScNqyjHSZew==",
225
"dev": true,
226
"dependencies": {
227
"@ampproject/remapping": "^2.2.0",
228
"@babel/code-frame": "^7.22.13",
229
- "@babel/generator": "^7.22.15",
229
+ "@babel/generator": "^7.23.3",
230
"@babel/helper-compilation-targets": "^7.22.15",
231
- "@babel/helper-module-transforms": "^7.22.20",
232
- "@babel/helpers": "^7.22.15",
233
- "@babel/parser": "^7.22.16",
231
+ "@babel/helper-module-transforms": "^7.23.3",
232
+ "@babel/helpers": "^7.23.2",
233
+ "@babel/parser": "^7.23.3",
234
"@babel/template": "^7.22.15",
235
- "@babel/traverse": "^7.22.20",
236
- "@babel/types": "^7.22.19",
237
- "convert-source-map": "^1.7.0",
235
+ "@babel/traverse": "^7.23.3",
236
+ "@babel/types": "^7.23.3",
237
+ "convert-source-map": "^2.0.0",
238
"debug": "^4.1.0",
239
"gensync": "^1.0.0-beta.2",
240
"json5": "^2.2.3",
@@ -249,12 +249,12 @@
249
}
250
},
251
"node_modules/@babel/generator": {
252
- "version": "7.22.15",
253
- "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.22.15.tgz",
254
- "integrity": "sha512-Zu9oWARBqeVOW0dZOjXc3JObrzuqothQ3y/n1kUtrjCoCPLkXUwMvOo/F/TCfoHMbWIFlWwpZtkZVb9ga4U2pA==",
252
+ "version": "7.23.4",
253
+ "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.23.4.tgz",
254
+ "integrity": "sha512-esuS49Cga3HcThFNebGhlgsrVLkvhqvYDTzgjfFFlHJcIfLe5jFmRRfCQ1KuBfc4Jrtn3ndLgKWAKjBE+IraYQ==",
255
"dev": true,
256
"dependencies": {
257
- "@babel/types": "^7.22.15",
257
+ "@babel/types": "^7.23.4",
258
"@jridgewell/gen-mapping": "^0.3.2",
259
"@jridgewell/trace-mapping": "^0.3.17",
260
"jsesc": "^2.5.1"
@@ -324,13 +324,13 @@
324
}
325
},
326
"node_modules/@babel/helper-function-name": {
327
- "version": "7.22.5",
328
- "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.22.5.tgz",
329
- "integrity": "sha512-wtHSq6jMRE3uF2otvfuD3DIvVhOsSNshQl0Qrd7qC9oQJzHvOL4qQXlQn2916+CXGywIjpGuIkoyZRRxHPiNQQ==",
327
+ "version": "7.23.0",
328
+ "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.23.0.tgz",
329
+ "integrity": "sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==",
330
"dev": true,
331
"dependencies": {
332
- "@babel/template": "^7.22.5",
333
- "@babel/types": "^7.22.5"
332
+ "@babel/template": "^7.22.15",
333
+ "@babel/types": "^7.23.0"
334
},
335
"engines": {
336
"node": ">=6.9.0"
@@ -349,12 +349,12 @@
349
}
350
},
351
"node_modules/@babel/helper-member-expression-to-functions": {
352
- "version": "7.22.15",
353
- "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.22.15.tgz",
354
- "integrity": "sha512-qLNsZbgrNh0fDQBCPocSL8guki1hcPvltGDv/NxvUoABwFq7GkKSu1nRXeJkVZc+wJvne2E0RKQz+2SQrz6eAA==",
352
+ "version": "7.23.0",
353
+ "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.23.0.tgz",
354
+ "integrity": "sha512-6gfrPwh7OuT6gZyJZvd6WbTfrqAo7vm4xCzAXOusKqq/vWdKXphTpj5klHKNmRUU6/QRGlBsyU9mAIPaWHlqJA==",
355
"dev": true,
356
"dependencies": {
357
- "@babel/types": "^7.22.15"
357
+ "@babel/types": "^7.23.0"
358
},
359
"engines": {
360
"node": ">=6.9.0"
@@ -373,9 +373,9 @@
373
}
374
},
375
"node_modules/@babel/helper-module-transforms": {
376
- "version": "7.22.20",
377
- "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.22.20.tgz",
378
- "integrity": "sha512-dLT7JVWIUUxKOs1UnJUBR3S70YK+pKX6AbJgB2vMIvEkZkrfJDbYDJesnPshtKV4LhDOR3Oc5YULeDizRek+5A==",
376
+ "version": "7.23.3",
377
+ "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.23.3.tgz",
378
+ "integrity": "sha512-7bBs4ED9OmswdfDzpz4MpWgSrV7FXlc3zIagvLFjS5H+Mk7Snr21vQ6QwrsoCGMfNC4e4LQPdoULEt4ykz0SRQ==",
379
"dev": true,
380
"dependencies": {
381
"@babel/helper-environment-visitor": "^7.22.20",
@@ -466,9 +466,9 @@
466
}
467
},
468
"node_modules/@babel/helper-string-parser": {
469
- "version": "7.22.5",
470
- "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz",
471
- "integrity": "sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==",
469
+ "version": "7.23.4",
470
+ "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.23.4.tgz",
471
+ "integrity": "sha512-803gmbQdqwdf4olxrX4AJyFBV/RTr3rSmOj0rKwesmzlfhYNDEs+/iOcznzpNWlJlIlTJC2QfPFcHB6DlzdVLQ==",
472
"dev": true,
473
"engines": {
474
"node": ">=6.9.0"
@@ -493,23 +493,23 @@
493
}
494
},
495
"node_modules/@babel/helpers": {
496
- "version": "7.22.15",
497
- "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.22.15.tgz",
498
- "integrity": "sha512-7pAjK0aSdxOwR+CcYAqgWOGy5dcfvzsTIfFTb2odQqW47MDfv14UaJDY6eng8ylM2EaeKXdxaSWESbkmaQHTmw==",
496
+ "version": "7.23.4",
497
+ "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.23.4.tgz",
498
+ "integrity": "sha512-HfcMizYz10cr3h29VqyfGL6ZWIjTwWfvYBMsBVGwpcbhNGe3wQ1ZXZRPzZoAHhd9OqHadHqjQ89iVKINXnbzuw==",
499
"dev": true,
500
"dependencies": {
501
"@babel/template": "^7.22.15",
502
- "@babel/traverse": "^7.22.15",
503
- "@babel/types": "^7.22.15"
502
+ "@babel/traverse": "^7.23.4",
503
+ "@babel/types": "^7.23.4"
504
},
505
"engines": {
506
"node": ">=6.9.0"
507
}
508
},
509
"node_modules/@babel/highlight": {
510
- "version": "7.22.20",
511
- "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.20.tgz",
512
- "integrity": "sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg==",
510
+ "version": "7.23.4",
511
+ "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.23.4.tgz",
512
+ "integrity": "sha512-acGdbYSfp2WheJoJm/EBBBLh/ID8KDc64ISZ9DYtBmC8/Q204PZJLHyzeB5qMzJ5trcOkybd78M4x2KWsUq++A==",
513
"dev": true,
514
"dependencies": {
515
"@babel/helper-validator-identifier": "^7.22.20",
@@ -521,9 +521,9 @@
521
}
522
},
523
"node_modules/@babel/parser": {
524
- "version": "7.23.0",
525
- "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.0.tgz",
526
- "integrity": "sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw==",
524
+ "version": "7.23.4",
525
+ "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.4.tgz",
526
+ "integrity": "sha512-vf3Xna6UEprW+7t6EtOmFpHNAuxw3xqPZghy+brsnusscJRW5BMUzzHZc5ICjULee81WeUV2jjakG09MDglJXQ==",
527
"bin": {
528
"parser": "bin/babel-parser.js"
529
},
@@ -547,9 +547,9 @@
547
}
548
},
549
"node_modules/@babel/plugin-syntax-typescript": {
550
- "version": "7.22.5",
551
- "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.22.5.tgz",
552
- "integrity": "sha512-1mS2o03i7t1c6VzH6fdQ3OA8tcEIxwG18zIPRp+UY1Ihv6W+XZzBCVxExF9upussPXJ0xE9XRHwMoNs1ep/nRQ==",
550
+ "version": "7.23.3",
551
+ "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.23.3.tgz",
552
+ "integrity": "sha512-9EiNjVJOMwCO+43TqoTrgQ8jMwcAd0sWyXi9RPfIsLTj4R2MADDDQXELhffaUx/uJv2AYcxBgPwH6j4TIA4ytQ==",
553
"dev": true,
554
"dependencies": {
555
"@babel/helper-plugin-utils": "^7.22.5"
@@ -562,15 +562,15 @@
562
}
563
},
564
"node_modules/@babel/plugin-transform-typescript": {
565
- "version": "7.22.15",
566
- "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.22.15.tgz",
567
- "integrity": "sha512-1uirS0TnijxvQLnlv5wQBwOX3E1wCFX7ITv+9pBV2wKEk4K+M5tqDaoNXnTH8tjEIYHLO98MwiTWO04Ggz4XuA==",
565
+ "version": "7.23.4",
566
+ "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.23.4.tgz",
567
+ "integrity": "sha512-39hCCOl+YUAyMOu6B9SmUTiHUU0t/CxJNUmY3qRdJujbqi+lrQcL11ysYUsAvFWPBdhihrv1z0oRG84Yr3dODQ==",
568
"dev": true,
569
"dependencies": {
570
"@babel/helper-annotate-as-pure": "^7.22.5",
571
"@babel/helper-create-class-features-plugin": "^7.22.15",
572
"@babel/helper-plugin-utils": "^7.22.5",
573
- "@babel/plugin-syntax-typescript": "^7.22.5"
573
+ "@babel/plugin-syntax-typescript": "^7.23.3"
574
},
575
"engines": {
576
"node": ">=6.9.0"
@@ -605,19 +605,19 @@
605
}
606
},
607
"node_modules/@babel/traverse": {
608
- "version": "7.22.20",
609
- "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.22.20.tgz",
610
- "integrity": "sha512-eU260mPZbU7mZ0N+X10pxXhQFMGTeLb9eFS0mxehS8HZp9o1uSnFeWQuG1UPrlxgA7QoUzFhOnilHDp0AXCyHw==",
608
+ "version": "7.23.4",
609
+ "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.23.4.tgz",
610
+ "integrity": "sha512-IYM8wSUwunWTB6tFC2dkKZhxbIjHoWemdK+3f8/wq8aKhbUscxD5MX72ubd90fxvFknaLPeGw5ycU84V1obHJg==",
611
"dev": true,
612
"dependencies": {
613
- "@babel/code-frame": "^7.22.13",
614
- "@babel/generator": "^7.22.15",
613
+ "@babel/code-frame": "^7.23.4",
614
+ "@babel/generator": "^7.23.4",
615
"@babel/helper-environment-visitor": "^7.22.20",
616
- "@babel/helper-function-name": "^7.22.5",
616
+ "@babel/helper-function-name": "^7.23.0",
617
"@babel/helper-hoist-variables": "^7.22.5",
618
"@babel/helper-split-export-declaration": "^7.22.6",
619
- "@babel/parser": "^7.22.16",
620
- "@babel/types": "^7.22.19",
619
+ "@babel/parser": "^7.23.4",
620
+ "@babel/types": "^7.23.4",
621
"debug": "^4.1.0",
622
"globals": "^11.1.0"
623
},
@@ -626,13 +626,13 @@
626
}
627
},
628
"node_modules/@babel/types": {
629
- "version": "7.22.19",
630
- "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.22.19.tgz",
631
- "integrity": "sha512-P7LAw/LbojPzkgp5oznjE6tQEIWbp4PkkfrZDINTro9zgBRtI324/EYsiSI7lhPbpIQ+DCeR2NNmMWANGGfZsg==",
629
+ "version": "7.23.4",
630
+ "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.4.tgz",
631
+ "integrity": "sha512-7uIFwVYpoplT5jp/kVv6EF93VaJ8H+Yn5IczYiaAi98ajzjfoZfslet/e0sLh+wVBjb2qqIut1b0S26VSafsSQ==",
632
"dev": true,
633
"dependencies": {
634
- "@babel/helper-string-parser": "^7.22.5",
635
- "@babel/helper-validator-identifier": "^7.22.19",
634
+ "@babel/helper-string-parser": "^7.23.4",
635
+ "@babel/helper-validator-identifier": "^7.22.20",
636
"to-fast-properties": "^2.0.0"
637
},
638
"engines": {
@@ -1203,9 +1203,9 @@
1203
}
1204
},
1205
"node_modules/@eslint/js": {
1206
- "version": "8.53.0",
1207
- "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.53.0.tgz",
1208
- "integrity": "sha512-Kn7K8dx/5U6+cT1yEhpX1w4PCSg0M+XyRILPgvwcEBjerFWCwQj5sbr3/VmxqV0JGHCBCzyd6LxypEuehypY1w==",
1206
+ "version": "8.54.0",
1207
+ "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.54.0.tgz",
1208
+ "integrity": "sha512-ut5V+D+fOoWPgGGNj83GGjnntO39xDy6DWxO0wb7Jp3DcMX0TfIqdzHF85VTQkerdyGmuuMD9AKAo5KiNlf/AQ==",
1209
"dev": true,
1210
"engines": {
1211
"node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -2537,6 +2537,162 @@
2537
}
2538
}
2539
},
2540
+ "node_modules/@rollup/rollup-android-arm-eabi": {
2541
+ "version": "4.5.0",
2542
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.5.0.tgz",
2543
+ "integrity": "sha512-OINaBGY+Wc++U0rdr7BLuFClxcoWaVW3vQYqmQq6B3bqQ/2olkaoz+K8+af/Mmka/C2yN5j+L9scBkv4BtKsDA==",
2544
+ "cpu": [
2545
+ "arm"
2546
+ ],
2547
+ "dev": true,
2548
+ "optional": true,
2549
+ "os": [
2550
+ "android"
2551
+ ]
2552
+ },
2553
+ "node_modules/@rollup/rollup-android-arm64": {
2554
+ "version": "4.5.0",
2555
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.5.0.tgz",
2556
+ "integrity": "sha512-UdMf1pOQc4ZmUA/NTmKhgJTBimbSKnhPS2zJqucqFyBRFPnPDtwA8MzrGNTjDeQbIAWfpJVAlxejw+/lQyBK/w==",
2557
+ "cpu": [
2558
+ "arm64"
2559
+ ],
2560
+ "dev": true,
2561
+ "optional": true,
2562
+ "os": [
2563
+ "android"
2564
+ ]
2565
+ },
2566
+ "node_modules/@rollup/rollup-darwin-arm64": {
2567
+ "version": "4.5.0",
2568
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.5.0.tgz",
2569
+ "integrity": "sha512-L0/CA5p/idVKI+c9PcAPGorH6CwXn6+J0Ys7Gg1axCbTPgI8MeMlhA6fLM9fK+ssFhqogMHFC8HDvZuetOii7w==",
2570
+ "cpu": [
2571
+ "arm64"
2572
+ ],
2573
+ "dev": true,
2574
+ "optional": true,
2575
+ "os": [
2576
+ "darwin"
2577
+ ]
2578
+ },
2579
+ "node_modules/@rollup/rollup-darwin-x64": {
2580
+ "version": "4.5.0",
2581
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.5.0.tgz",
2582
+ "integrity": "sha512-QZCbVqU26mNlLn8zi/XDDquNmvcr4ON5FYAHQQsyhrHx8q+sQi/6xduoznYXwk/KmKIXG5dLfR0CvY+NAWpFYQ==",
2583
+ "cpu": [
2584
+ "x64"
2585
+ ],
2586
+ "dev": true,
2587
+ "optional": true,
2588
+ "os": [
2589
+ "darwin"
2590
+ ]
2591
+ },
2592
+ "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
2593
+ "version": "4.5.0",
2594
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.5.0.tgz",
2595
+ "integrity": "sha512-VpSQ+xm93AeV33QbYslgf44wc5eJGYfYitlQzAi3OObu9iwrGXEnmu5S3ilkqE3Pr/FkgOiJKV/2p0ewf4Hrtg==",
2596
+ "cpu": [
2597
+ "arm"
2598
+ ],
2599
+ "dev": true,
2600
+ "optional": true,
2601
+ "os": [
2602
+ "linux"
2603
+ ]
2604
+ },
2605
+ "node_modules/@rollup/rollup-linux-arm64-gnu": {
2606
+ "version": "4.5.0",
2607
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.5.0.tgz",
2608
+ "integrity": "sha512-OrEyIfpxSsMal44JpEVx9AEcGpdBQG1ZuWISAanaQTSMeStBW+oHWwOkoqR54bw3x8heP8gBOyoJiGg+fLY8qQ==",
2609
+ "cpu": [
2610
+ "arm64"
2611
+ ],
2612
+ "dev": true,
2613
+ "optional": true,
2614
+ "os": [
2615
+ "linux"
2616
+ ]
2617
+ },
2618
+ "node_modules/@rollup/rollup-linux-arm64-musl": {
2619
+ "version": "4.5.0",
2620
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.5.0.tgz",
2621
+ "integrity": "sha512-1H7wBbQuE6igQdxMSTjtFfD+DGAudcYWhp106z/9zBA8OQhsJRnemO4XGavdzHpGhRtRxbgmUGdO3YQgrWf2RA==",
2622
+ "cpu": [
2623
+ "arm64"
2624
+ ],
2625
+ "dev": true,
2626
+ "optional": true,
2627
+ "os": [
2628
+ "linux"
2629
+ ]
2630
+ },
2631
+ "node_modules/@rollup/rollup-linux-x64-gnu": {
2632
+ "version": "4.5.0",
2633
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.5.0.tgz",
2634
+ "integrity": "sha512-FVyFI13tXw5aE65sZdBpNjPVIi4Q5mARnL/39UIkxvSgRAIqCo5sCpCELk0JtXHGee2owZz5aNLbWNfBHzr71Q==",
2635
+ "cpu": [
2636
+ "x64"
2637
+ ],
2638
+ "dev": true,
2639
+ "optional": true,
2640
+ "os": [
2641
+ "linux"
2642
+ ]
2643
+ },
2644
+ "node_modules/@rollup/rollup-linux-x64-musl": {
2645
+ "version": "4.5.0",
2646
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.5.0.tgz",
2647
+ "integrity": "sha512-eBPYl2sLpH/o8qbSz6vPwWlDyThnQjJfcDOGFbNjmjb44XKC1F5dQfakOsADRVrXCNzM6ZsSIPDG5dc6HHLNFg==",
2648
+ "cpu": [
2649
+ "x64"
2650
+ ],
2651
+ "dev": true,
2652
+ "optional": true,
2653
+ "os": [
2654
+ "linux"
2655
+ ]
2656
+ },
2657
+ "node_modules/@rollup/rollup-win32-arm64-msvc": {
2658
+ "version": "4.5.0",
2659
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.5.0.tgz",
2660
+ "integrity": "sha512-xaOHIfLOZypoQ5U2I6rEaugS4IYtTgP030xzvrBf5js7p9WI9wik07iHmsKaej8Z83ZDxN5GyypfoyKV5O5TJA==",
2661
+ "cpu": [
2662
+ "arm64"
2663
+ ],
2664
+ "dev": true,
2665
+ "optional": true,
2666
+ "os": [
2667
+ "win32"
2668
+ ]
2669
+ },
2670
+ "node_modules/@rollup/rollup-win32-ia32-msvc": {
2671
+ "version": "4.5.0",
2672
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.5.0.tgz",
2673
+ "integrity": "sha512-Al6quztQUrHwcOoU2TuFblUQ5L+/AmPBXFR6dUvyo4nRj2yQRK0WIUaGMF/uwKulvRcXkpHe3k9A8Vf93VDktA==",
2674
+ "cpu": [
2675
+ "ia32"
2676
+ ],
2677
+ "dev": true,
2678
+ "optional": true,
2679
+ "os": [
2680
+ "win32"
2681
+ ]
2682
+ },
2683
+ "node_modules/@rollup/rollup-win32-x64-msvc": {
2684
+ "version": "4.5.0",
2685
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.5.0.tgz",
2686
+ "integrity": "sha512-8kdW+brNhI/NzJ4fxDufuJUjepzINqJKLGHuxyAtpPG9bMbn8P5mtaCcbOm0EzLJ+atg+kF9dwg8jpclkVqx5w==",
2687
+ "cpu": [
2688
+ "x64"
2689
+ ],
2690
+ "dev": true,
2691
+ "optional": true,
2692
+ "os": [
2693
+ "win32"
2694
+ ]
2695
+ },
2696
"node_modules/@rushstack/eslint-patch": {
2697
"version": "1.5.1",
2698
"resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.5.1.tgz",
@@ -3268,9 +3424,9 @@
3424
}
3425
},
3426
"node_modules/@types/jsdom": {
3271
- "version": "21.1.5",
3272
- "resolved": "https://registry.npmjs.org/@types/jsdom/-/jsdom-21.1.5.tgz",
3273
- "integrity": "sha512-sBK/3YjS3uuPj+HzZyhB4GGTnFmk0mdyQfhzZ/sqs9ciyG41QJdZZdwcPa6OfW97OTNTwl5tBAsfEOm/dui9pQ==",
3427
+ "version": "21.1.6",
3428
+ "resolved": "https://registry.npmjs.org/@types/jsdom/-/jsdom-21.1.6.tgz",
3429
+ "integrity": "sha512-/7kkMsC+/kMs7gAYmmBR9P0vGTnOoLhQhyhQJSlXGI5bzTHp6xdo0TtKWQAsz6pmSAeVqKSbqeyP6hytqr9FDw==",
3430
"dev": true,
3431
"dependencies": {
3432
"@types/node": "*",
@@ -3299,9 +3455,9 @@
3455
"integrity": "sha512-CeVMX9EhVUW8MWnei05eIRks4D5Wscw/W9Byz1s3PA+yJvcdvq9SaDjiUKvRvEgjpdTyJMjQA43ae4KTwsvOPg=="
3456
},
3457
"node_modules/@types/lodash": {
3302
- "version": "4.14.201",
3303
- "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.201.tgz",
3304
- "integrity": "sha512-y9euML0cim1JrykNxADLfaG0FgD1g/yTHwUs/Jg9ZIU7WKj2/4IW9Lbb1WZbvck78W/lfGXFfe+u2EGfIJXdLQ=="
3458
+ "version": "4.14.202",
3459
+ "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.202.tgz",
3460
+ "integrity": "sha512-OvlIYQK9tNneDlS0VN54LLd5uiPCBOp7gS5Z0f1mjoJYBrtStzgmJBxONW3U6OZqdtNzZPmn9BS/7WI7BFFcFQ=="
3461
},
3462
"node_modules/@types/lodash-es": {
3463
"version": "4.17.9",
@@ -3340,9 +3496,9 @@
3496
"integrity": "sha512-AuHIyzR5Hea7ij0P9q7vx7xu4z0C28ucwjAZC0ja7JhINyCnOw8/DnvAPQQ9TfOlCtZAmCERKQX9+o1mgQhuOQ=="
3497
},
3498
"node_modules/@types/node": {
3343
- "version": "20.9.0",
3344
- "resolved": "https://registry.npmjs.org/@types/node/-/node-20.9.0.tgz",
3345
- "integrity": "sha512-nekiGu2NDb1BcVofVcEKMIwzlx4NjHlcjhoxxKBNLtz15Y1z7MYf549DFvkHSId02Ax6kGwWntIBPC3l/JZcmw==",
3499
+ "version": "20.9.3",
3500
+ "resolved": "https://registry.npmjs.org/@types/node/-/node-20.9.3.tgz",
3501
+ "integrity": "sha512-nk5wXLAXGBKfrhLB0cyHGbSqopS+nz0BUgZkUQqSHSSgdee0kssp1IAqlQOu333bW+gMNs2QREx7iynm19Abxw==",
3502
"dev": true,
3503
"dependencies": {
3504
"undici-types": "~5.26.4"
@@ -3425,9 +3581,9 @@
3581
"integrity": "sha512-ue/hDUpPjC85m+PM9OQDMZr3LywT+CT6mPsQq8OJtCLiERkGRcQUFvu9XASF5XWqyZFXbf15lvb3JFJ4dRLWPg=="
3582
},
3583
"node_modules/@types/validator": {
3428
- "version": "13.11.6",
3429
- "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.11.6.tgz",
3430
- "integrity": "sha512-HUgHujPhKuNzgNXBRZKYexwoG+gHKU+tnfPqjWXFghZAnn73JElicMkuSKJyLGr9JgyA8IgK7fj88IyA9rwYeQ==",
3584
+ "version": "13.11.7",
3585
+ "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.11.7.tgz",
3586
+ "integrity": "sha512-q0JomTsJ2I5Mv7dhHhQLGjMvX0JJm5dyZ1DXQySIUzU1UlwzB8bt+R6+LODUbz0UDIOvEzGc28tk27gBJw2N8Q==",
3587
"dev": true
3588
},
3589
"node_modules/@types/web-bluetooth": {
@@ -3740,33 +3896,33 @@
3896
"dev": true
3897
},
3898
"node_modules/@vitejs/plugin-vue": {
3743
- "version": "4.4.1",
3744
- "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-4.4.1.tgz",
3745
- "integrity": "sha512-HCQG8VDFDM7YDAdcj5QI5DvUi+r6xvo9LgvYdk7LSkUNwdpempdB5horkMSZsbdey9Ywsf5aaU8kEPw9M5kREA==",
3899
+ "version": "4.5.0",
3900
+ "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-4.5.0.tgz",
3901
+ "integrity": "sha512-a2WSpP8X8HTEww/U00bU4mX1QpLINNuz/2KMNpLsdu3BzOpak3AGI1CJYBTXcc4SPhaD0eNRUp7IyQK405L5dQ==",
3902
"dev": true,
3903
"engines": {
3904
"node": "^14.18.0 || >=16.0.0"
3905
},
3906
"peerDependencies": {
3751
- "vite": "^4.0.0",
3907
+ "vite": "^4.0.0 || ^5.0.0",
3908
"vue": "^3.2.25"
3909
}
3910
},
3911
"node_modules/@vitejs/plugin-vue-jsx": {
3756
- "version": "3.0.2",
3757
- "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue-jsx/-/plugin-vue-jsx-3.0.2.tgz",
3758
- "integrity": "sha512-obF26P2Z4Ogy3cPp07B4VaW6rpiu0ue4OT2Y15UxT5BZZ76haUY9guOsZV3uWh/I6xc+VeiW+ZVabRE82FyzWw==",
3912
+ "version": "3.1.0",
3913
+ "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue-jsx/-/plugin-vue-jsx-3.1.0.tgz",
3914
+ "integrity": "sha512-w9M6F3LSEU5kszVb9An2/MmXNxocAnUb3WhRr8bHlimhDrXNt6n6D2nJQR3UXpGlZHh/EsgouOHCsM8V3Ln+WA==",
3915
"dev": true,
3916
"dependencies": {
3761
- "@babel/core": "^7.22.10",
3762
- "@babel/plugin-transform-typescript": "^7.22.10",
3917
+ "@babel/core": "^7.23.3",
3918
+ "@babel/plugin-transform-typescript": "^7.23.3",
3919
"@vue/babel-plugin-jsx": "^1.1.5"
3920
},
3921
"engines": {
3922
"node": "^14.18.0 || >=16.0.0"
3923
},
3924
"peerDependencies": {
3769
- "vite": "^4.0.0",
3925
+ "vite": "^4.0.0 || ^5.0.0",
3926
"vue": "^3.0.0"
3927
}
3928
},
@@ -4716,13 +4872,14 @@
4872
"dev": true
4873
},
4874
"node_modules/axios": {
4719
- "version": "0.27.2",
4720
- "resolved": "https://registry.npmjs.org/axios/-/axios-0.27.2.tgz",
4721
- "integrity": "sha512-t+yRIyySRTp/wua5xEr+z1q60QmLq8ABsS5O9Me1AsE5dfKqgnCFzwiCZZ/cGNd1lq4/7akDWMxdhVlucjmnOQ==",
4875
+ "version": "1.6.2",
4876
+ "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.2.tgz",
4877
+ "integrity": "sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A==",
4878
"dev": true,
4879
"dependencies": {
4724
- "follow-redirects": "^1.14.9",
4725
- "form-data": "^4.0.0"
4880
+ "follow-redirects": "^1.15.0",
4881
+ "form-data": "^4.0.0",
4882
+ "proxy-from-env": "^1.1.0"
4883
}
4884
},
4885
"node_modules/axios/node_modules/form-data": {
@@ -4739,6 +4896,12 @@
4896
"node": ">= 6"
4897
}
4898
},
4899
+ "node_modules/axios/node_modules/proxy-from-env": {
4900
+ "version": "1.1.0",
4901
+ "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
4902
+ "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
4903
+ "dev": true
4904
+ },
4905
"node_modules/bail": {
4906
"version": "2.0.2",
4907
"resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
@@ -5555,9 +5718,9 @@
5718
}
5719
},
5720
"node_modules/convert-source-map": {
5558
- "version": "1.9.0",
5559
- "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
5560
- "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
5721
+ "version": "2.0.0",
5722
+ "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
5723
+ "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
5724
"dev": true
5725
},
5726
"node_modules/cookies": {
@@ -6838,15 +7001,15 @@
7001
}
7002
},
7003
"node_modules/eslint": {
6841
- "version": "8.53.0",
6842
- "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.53.0.tgz",
6843
- "integrity": "sha512-N4VuiPjXDUa4xVeV/GC/RV3hQW9Nw+Y463lkWaKKXKYMvmRiRDAtfpuPFLN+E1/6ZhyR8J2ig+eVREnYgUsiag==",
7004
+ "version": "8.54.0",
7005
+ "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.54.0.tgz",
7006
+ "integrity": "sha512-NY0DfAkM8BIZDVl6PgSa1ttZbx3xHgJzSNJKYcQglem6CppHyMhRIQkBVSSMaSRnLhig3jsDbEzOjwCVt4AmmA==",
7007
"dev": true,
7008
"dependencies": {
7009
"@eslint-community/eslint-utils": "^4.2.0",
7010
"@eslint-community/regexpp": "^4.6.1",
7011
"@eslint/eslintrc": "^2.1.3",
6849
- "@eslint/js": "8.53.0",
7012
+ "@eslint/js": "8.54.0",
7013
"@humanwhocodes/config-array": "^0.11.13",
7014
"@humanwhocodes/module-importer": "^1.0.1",
7015
"@nodelib/fs.walk": "^1.2.8",
@@ -13095,6 +13258,8 @@
13258
"resolved": "https://registry.npmjs.org/rollup/-/rollup-3.29.2.tgz",
13259
"integrity": "sha512-CJouHoZ27v6siztc21eEQGo0kIcE5D1gVPA571ez0mMYb25LGYGKnVNXpEj5MGlepmDWGXNjDB5q7uNiPHC11A==",
13260
"dev": true,
13261
+ "optional": true,
13262
+ "peer": true,
13263
"bin": {
13264
"rollup": "dist/bin/rollup"
13265
},
@@ -13721,9 +13886,9 @@
13886
"dev": true
13887
},
13888
"node_modules/start-server-and-test": {
13724
- "version": "2.0.2",
13725
- "resolved": "https://registry.npmjs.org/start-server-and-test/-/start-server-and-test-2.0.2.tgz",
13726
- "integrity": "sha512-4sGS2QmETUwqeBUqtTLP7OqXp3PdDnevaWlPlrFQgn8+7uCgVg4Do7/H/ZhAAVyvnL3DqKyANhnLgcgxrjhrMA==",
13889
+ "version": "2.0.3",
13890
+ "resolved": "https://registry.npmjs.org/start-server-and-test/-/start-server-and-test-2.0.3.tgz",
13891
+ "integrity": "sha512-QsVObjfjFZKJE6CS6bSKNwWZCKBG6975/jKRPPGFfFh+yOQglSeGXiNWjzgQNXdphcBI9nXbyso9tPfX4YAUhg==",
13892
"dev": true,
13893
"dependencies": {
13894
"arg": "^5.0.2",
@@ -13733,7 +13898,7 @@
13898
"execa": "5.1.1",
13899
"lazy-ass": "1.6.0",
13900
"ps-tree": "1.2.0",
13736
- "wait-on": "7.1.0"
13901
+ "wait-on": "7.2.0"
13902
},
13903
"bin": {
13904
"server-test": "src/bin/start.js",
@@ -15011,9 +15176,9 @@
15176
}
15177
},
15178
"node_modules/typescript": {
15014
- "version": "5.2.2",
15015
- "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.2.2.tgz",
15016
- "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==",
15179
+ "version": "5.3.2",
15180
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.2.tgz",
15181
+ "integrity": "sha512-6l+RyNy7oAHDfxC4FzSJcz9vnjTKxrLpDG5M2Vu4SHRVNg6xzqZp6LYSR9zjqQTu8DU/f5xwxUdADOkbrIX2gQ==",
15182
"devOptional": true,
15183
"bin": {
15184
"tsc": "bin/tsc",
@@ -15468,29 +15633,29 @@
15633
}
15634
},
15635
"node_modules/vite": {
15471
- "version": "4.5.0",
15472
- "resolved": "https://registry.npmjs.org/vite/-/vite-4.5.0.tgz",
15473
- "integrity": "sha512-ulr8rNLA6rkyFAlVWw2q5YJ91v098AFQ2R0PRFwPzREXOUJQPtFUG0t+/ZikhaOCDqFoDhN6/v8Sq0o4araFAw==",
15636
+ "version": "5.0.0",
15637
+ "resolved": "https://registry.npmjs.org/vite/-/vite-5.0.0.tgz",
15638
+ "integrity": "sha512-ESJVM59mdyGpsiNAeHQOR/0fqNoOyWPYesFto8FFZugfmhdHx8Fzd8sF3Q/xkVhZsyOxHfdM7ieiVAorI9RjFw==",
15639
"dev": true,
15640
"dependencies": {
15476
- "esbuild": "^0.18.10",
15477
- "postcss": "^8.4.27",
15478
- "rollup": "^3.27.1"
15641
+ "esbuild": "^0.19.3",
15642
+ "postcss": "^8.4.31",
15643
+ "rollup": "^4.2.0"
15644
},
15645
"bin": {
15646
"vite": "bin/vite.js"
15647
},
15648
"engines": {
15484
- "node": "^14.18.0 || >=16.0.0"
15649
+ "node": "^18.0.0 || >=20.0.0"
15650
},
15651
"funding": {
15652
"url": "https://github.com/vitejs/vite?sponsor=1"
15653
},
15654
"optionalDependencies": {
15490
- "fsevents": "~2.3.2"
15655
+ "fsevents": "~2.3.3"
15656
},
15657
"peerDependencies": {
15493
- "@types/node": ">= 14",
15658
+ "@types/node": "^18.0.0 || >=20.0.0",
15659
"less": "*",
15660
"lightningcss": "^1.21.0",
15661
"sass": "*",
@@ -15546,13 +15711,43 @@
15711
}
15712
},
15713
"node_modules/vite-svg-loader": {
15549
- "version": "4.0.0",
15550
- "resolved": "https://registry.npmjs.org/vite-svg-loader/-/vite-svg-loader-4.0.0.tgz",
15551
- "integrity": "sha512-0MMf1yzzSYlV4MGePsLVAOqXsbF5IVxbn4EEzqRnWxTQl8BJg/cfwIzfQNmNQxZp5XXwd4kyRKF1LytuHZTnqA==",
15714
+ "version": "5.1.0",
15715
+ "resolved": "https://registry.npmjs.org/vite-svg-loader/-/vite-svg-loader-5.1.0.tgz",
15716
+ "integrity": "sha512-M/wqwtOEjgb956/+m5ZrYT/Iq6Hax0OakWbokj8+9PXOnB7b/4AxESHieEtnNEy7ZpjsjYW1/5nK8fATQMmRxw==",
15717
"dev": true,
15718
"dependencies": {
15554
- "@vue/compiler-sfc": "^3.2.20",
15719
"svgo": "^3.0.2"
15720
+ },
15721
+ "peerDependencies": {
15722
+ "vue": ">=3.2.13"
15723
+ }
15724
+ },
15725
+ "node_modules/vite/node_modules/rollup": {
15726
+ "version": "4.5.0",
15727
+ "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.5.0.tgz",
15728
+ "integrity": "sha512-41xsWhzxqjMDASCxH5ibw1mXk+3c4TNI2UjKbLxe6iEzrSQnqOzmmK8/3mufCPbzHNJ2e04Fc1ddI35hHy+8zg==",
15729
+ "dev": true,
15730
+ "bin": {
15731
+ "rollup": "dist/bin/rollup"
15732
+ },
15733
+ "engines": {
15734
+ "node": ">=18.0.0",
15735
+ "npm": ">=8.0.0"
15736
+ },
15737
+ "optionalDependencies": {
15738
+ "@rollup/rollup-android-arm-eabi": "4.5.0",
15739
+ "@rollup/rollup-android-arm64": "4.5.0",
15740
+ "@rollup/rollup-darwin-arm64": "4.5.0",
15741
+ "@rollup/rollup-darwin-x64": "4.5.0",
15742
+ "@rollup/rollup-linux-arm-gnueabihf": "4.5.0",
15743
+ "@rollup/rollup-linux-arm64-gnu": "4.5.0",
15744
+ "@rollup/rollup-linux-arm64-musl": "4.5.0",
15745
+ "@rollup/rollup-linux-x64-gnu": "4.5.0",
15746
+ "@rollup/rollup-linux-x64-musl": "4.5.0",
15747
+ "@rollup/rollup-win32-arm64-msvc": "4.5.0",
15748
+ "@rollup/rollup-win32-ia32-msvc": "4.5.0",
15749
+ "@rollup/rollup-win32-x64-msvc": "4.5.0",
15750
+ "fsevents": "~2.3.2"
15751
}
15752
},
15753
"node_modules/vitest": {
@@ -15981,12 +16176,12 @@
16176
}
16177
},
16178
"node_modules/wait-on": {
15984
- "version": "7.1.0",
15985
- "resolved": "https://registry.npmjs.org/wait-on/-/wait-on-7.1.0.tgz",
15986
- "integrity": "sha512-U7TF/OYYzAg+OoiT/B8opvN48UHt0QYMi4aD3PjRFpybQ+o6czQF8Ig3SKCCMJdxpBrCalIJ4O00FBof27Fu9Q==",
16179
+ "version": "7.2.0",
16180
+ "resolved": "https://registry.npmjs.org/wait-on/-/wait-on-7.2.0.tgz",
16181
+ "integrity": "sha512-wCQcHkRazgjG5XoAq9jbTMLpNIjoSlZslrJ2+N9MxDsGEv1HnFoVjOCexL0ESva7Y9cu350j+DWADdk54s4AFQ==",
16182
"dev": true,
16183
"dependencies": {
15989
- "axios": "^0.27.2",
16184
+ "axios": "^1.6.1",
16185
"joi": "^17.11.0",
16186
"lodash": "^4.17.21",
16187
"minimist": "^1.2.8",
@@ -16439,12 +16634,12 @@
16634
"dev": true
16635
},
16636
"@babel/code-frame": {
16442
- "version": "7.22.13",
16443
- "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.13.tgz",
16444
- "integrity": "sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==",
16637
+ "version": "7.23.4",
16638
+ "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.23.4.tgz",
16639
+ "integrity": "sha512-r1IONyb6Ia+jYR2vvIDhdWdlTGhqbBoFqLTQidzZ4kepUFH15ejXvFHxCVbtl7BOXIudsIubf4E81xeA3h3IXA==",
16640
"dev": true,
16641
"requires": {
16447
- "@babel/highlight": "^7.22.13",
16642
+ "@babel/highlight": "^7.23.4",
16643
"chalk": "^2.4.2"
16644
}
16645
},
@@ -16455,22 +16650,22 @@
16650
"dev": true
16651
},
16652
"@babel/core": {
16458
- "version": "7.22.20",
16459
- "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.22.20.tgz",
16460
- "integrity": "sha512-Y6jd1ahLubuYweD/zJH+vvOY141v4f9igNQAQ+MBgq9JlHS2iTsZKn1aMsb3vGccZsXI16VzTBw52Xx0DWmtnA==",
16653
+ "version": "7.23.3",
16654
+ "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.23.3.tgz",
16655
+ "integrity": "sha512-Jg+msLuNuCJDyBvFv5+OKOUjWMZgd85bKjbICd3zWrKAo+bJ49HJufi7CQE0q0uR8NGyO6xkCACScNqyjHSZew==",
16656
"dev": true,
16657
"requires": {
16658
"@ampproject/remapping": "^2.2.0",
16659
"@babel/code-frame": "^7.22.13",
16465
- "@babel/generator": "^7.22.15",
16660
+ "@babel/generator": "^7.23.3",
16661
"@babel/helper-compilation-targets": "^7.22.15",
16467
- "@babel/helper-module-transforms": "^7.22.20",
16468
- "@babel/helpers": "^7.22.15",
16469
- "@babel/parser": "^7.22.16",
16662
+ "@babel/helper-module-transforms": "^7.23.3",
16663
+ "@babel/helpers": "^7.23.2",
16664
+ "@babel/parser": "^7.23.3",
16665
"@babel/template": "^7.22.15",
16471
- "@babel/traverse": "^7.22.20",
16472
- "@babel/types": "^7.22.19",
16473
- "convert-source-map": "^1.7.0",
16666
+ "@babel/traverse": "^7.23.3",
16667
+ "@babel/types": "^7.23.3",
16668
+ "convert-source-map": "^2.0.0",
16669
"debug": "^4.1.0",
16670
"gensync": "^1.0.0-beta.2",
16671
"json5": "^2.2.3",
@@ -16478,12 +16673,12 @@
16673
}
16674
},
16675
"@babel/generator": {
16481
- "version": "7.22.15",
16482
- "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.22.15.tgz",
16483
- "integrity": "sha512-Zu9oWARBqeVOW0dZOjXc3JObrzuqothQ3y/n1kUtrjCoCPLkXUwMvOo/F/TCfoHMbWIFlWwpZtkZVb9ga4U2pA==",
16676
+ "version": "7.23.4",
16677
+ "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.23.4.tgz",
16678
+ "integrity": "sha512-esuS49Cga3HcThFNebGhlgsrVLkvhqvYDTzgjfFFlHJcIfLe5jFmRRfCQ1KuBfc4Jrtn3ndLgKWAKjBE+IraYQ==",
16679
"dev": true,
16680
"requires": {
16486
- "@babel/types": "^7.22.15",
16681
+ "@babel/types": "^7.23.4",
16682
"@jridgewell/gen-mapping": "^0.3.2",
16683
"@jridgewell/trace-mapping": "^0.3.17",
16684
"jsesc": "^2.5.1"
@@ -16535,13 +16730,13 @@
16730
"dev": true
16731
},
16732
"@babel/helper-function-name": {
16538
- "version": "7.22.5",
16539
- "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.22.5.tgz",
16540
- "integrity": "sha512-wtHSq6jMRE3uF2otvfuD3DIvVhOsSNshQl0Qrd7qC9oQJzHvOL4qQXlQn2916+CXGywIjpGuIkoyZRRxHPiNQQ==",
16733
+ "version": "7.23.0",
16734
+ "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.23.0.tgz",
16735
+ "integrity": "sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==",
16736
"dev": true,
16737
"requires": {
16543
- "@babel/template": "^7.22.5",
16544
- "@babel/types": "^7.22.5"
16738
+ "@babel/template": "^7.22.15",
16739
+ "@babel/types": "^7.23.0"
16740
}
16741
},
16742
"@babel/helper-hoist-variables": {
@@ -16554,12 +16749,12 @@
16749
}
16750
},
16751
"@babel/helper-member-expression-to-functions": {
16557
- "version": "7.22.15",
16558
- "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.22.15.tgz",
16559
- "integrity": "sha512-qLNsZbgrNh0fDQBCPocSL8guki1hcPvltGDv/NxvUoABwFq7GkKSu1nRXeJkVZc+wJvne2E0RKQz+2SQrz6eAA==",
16752
+ "version": "7.23.0",
16753
+ "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.23.0.tgz",
16754
+ "integrity": "sha512-6gfrPwh7OuT6gZyJZvd6WbTfrqAo7vm4xCzAXOusKqq/vWdKXphTpj5klHKNmRUU6/QRGlBsyU9mAIPaWHlqJA==",
16755
"dev": true,
16756
"requires": {
16562
- "@babel/types": "^7.22.15"
16757
+ "@babel/types": "^7.23.0"
16758
}
16759
},
16760
"@babel/helper-module-imports": {
@@ -16572,9 +16767,9 @@
16767
}
16768
},
16769
"@babel/helper-module-transforms": {
16575
- "version": "7.22.20",
16576
- "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.22.20.tgz",
16577
- "integrity": "sha512-dLT7JVWIUUxKOs1UnJUBR3S70YK+pKX6AbJgB2vMIvEkZkrfJDbYDJesnPshtKV4LhDOR3Oc5YULeDizRek+5A==",
16770
+ "version": "7.23.3",
16771
+ "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.23.3.tgz",
16772
+ "integrity": "sha512-7bBs4ED9OmswdfDzpz4MpWgSrV7FXlc3zIagvLFjS5H+Mk7Snr21vQ6QwrsoCGMfNC4e4LQPdoULEt4ykz0SRQ==",
16773
"dev": true,
16774
"requires": {
16775
"@babel/helper-environment-visitor": "^7.22.20",
@@ -16638,9 +16833,9 @@
16833
}
16834
},
16835
"@babel/helper-string-parser": {
16641
- "version": "7.22.5",
16642
- "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz",
16643
- "integrity": "sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==",
16836
+ "version": "7.23.4",
16837
+ "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.23.4.tgz",
16838
+ "integrity": "sha512-803gmbQdqwdf4olxrX4AJyFBV/RTr3rSmOj0rKwesmzlfhYNDEs+/iOcznzpNWlJlIlTJC2QfPFcHB6DlzdVLQ==",
16839
"dev": true
16840
},
16841
"@babel/helper-validator-identifier": {
@@ -16656,20 +16851,20 @@
16851
"dev": true
16852
},
16853
"@babel/helpers": {
16659
- "version": "7.22.15",
16660
- "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.22.15.tgz",
16661
- "integrity": "sha512-7pAjK0aSdxOwR+CcYAqgWOGy5dcfvzsTIfFTb2odQqW47MDfv14UaJDY6eng8ylM2EaeKXdxaSWESbkmaQHTmw==",
16854
+ "version": "7.23.4",
16855
+ "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.23.4.tgz",
16856
+ "integrity": "sha512-HfcMizYz10cr3h29VqyfGL6ZWIjTwWfvYBMsBVGwpcbhNGe3wQ1ZXZRPzZoAHhd9OqHadHqjQ89iVKINXnbzuw==",
16857
"dev": true,
16858
"requires": {
16859
"@babel/template": "^7.22.15",
16665
- "@babel/traverse": "^7.22.15",
16666
- "@babel/types": "^7.22.15"
16860
+ "@babel/traverse": "^7.23.4",
16861
+ "@babel/types": "^7.23.4"
16862
}
16863
},
16864
"@babel/highlight": {
16670
- "version": "7.22.20",
16671
- "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.20.tgz",
16672
- "integrity": "sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg==",
16865
+ "version": "7.23.4",
16866
+ "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.23.4.tgz",
16867
+ "integrity": "sha512-acGdbYSfp2WheJoJm/EBBBLh/ID8KDc64ISZ9DYtBmC8/Q204PZJLHyzeB5qMzJ5trcOkybd78M4x2KWsUq++A==",
16868
"dev": true,
16869
"requires": {
16870
"@babel/helper-validator-identifier": "^7.22.20",
@@ -16678,9 +16873,9 @@
16873
}
16874
},
16875
"@babel/parser": {
16681
- "version": "7.23.0",
16682
- "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.0.tgz",
16683
- "integrity": "sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw=="
16876
+ "version": "7.23.4",
16877
+ "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.4.tgz",
16878
+ "integrity": "sha512-vf3Xna6UEprW+7t6EtOmFpHNAuxw3xqPZghy+brsnusscJRW5BMUzzHZc5ICjULee81WeUV2jjakG09MDglJXQ=="
16879
},
16880
"@babel/plugin-syntax-jsx": {
16881
"version": "7.22.5",
@@ -16692,24 +16887,24 @@
16887
}
16888
},
16889
"@babel/plugin-syntax-typescript": {
16695
- "version": "7.22.5",
16696
- "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.22.5.tgz",
16697
- "integrity": "sha512-1mS2o03i7t1c6VzH6fdQ3OA8tcEIxwG18zIPRp+UY1Ihv6W+XZzBCVxExF9upussPXJ0xE9XRHwMoNs1ep/nRQ==",
16890
+ "version": "7.23.3",
16891
+ "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.23.3.tgz",
16892
+ "integrity": "sha512-9EiNjVJOMwCO+43TqoTrgQ8jMwcAd0sWyXi9RPfIsLTj4R2MADDDQXELhffaUx/uJv2AYcxBgPwH6j4TIA4ytQ==",
16893
"dev": true,
16894
"requires": {
16895
"@babel/helper-plugin-utils": "^7.22.5"
16896
}
16897
},
16898
"@babel/plugin-transform-typescript": {
16704
- "version": "7.22.15",
16705
- "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.22.15.tgz",
16706
- "integrity": "sha512-1uirS0TnijxvQLnlv5wQBwOX3E1wCFX7ITv+9pBV2wKEk4K+M5tqDaoNXnTH8tjEIYHLO98MwiTWO04Ggz4XuA==",
16899
+ "version": "7.23.4",
16900
+ "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.23.4.tgz",
16901
+ "integrity": "sha512-39hCCOl+YUAyMOu6B9SmUTiHUU0t/CxJNUmY3qRdJujbqi+lrQcL11ysYUsAvFWPBdhihrv1z0oRG84Yr3dODQ==",
16902
"dev": true,
16903
"requires": {
16904
"@babel/helper-annotate-as-pure": "^7.22.5",
16905
"@babel/helper-create-class-features-plugin": "^7.22.15",
16906
"@babel/helper-plugin-utils": "^7.22.5",
16712
- "@babel/plugin-syntax-typescript": "^7.22.5"
16907
+ "@babel/plugin-syntax-typescript": "^7.23.3"
16908
}
16909
},
16910
"@babel/runtime": {
@@ -16732,31 +16927,31 @@
16927
}
16928
},
16929
"@babel/traverse": {
16735
- "version": "7.22.20",
16736
- "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.22.20.tgz",
16737
- "integrity": "sha512-eU260mPZbU7mZ0N+X10pxXhQFMGTeLb9eFS0mxehS8HZp9o1uSnFeWQuG1UPrlxgA7QoUzFhOnilHDp0AXCyHw==",
16930
+ "version": "7.23.4",
16931
+ "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.23.4.tgz",
16932
+ "integrity": "sha512-IYM8wSUwunWTB6tFC2dkKZhxbIjHoWemdK+3f8/wq8aKhbUscxD5MX72ubd90fxvFknaLPeGw5ycU84V1obHJg==",
16933
"dev": true,
16934
"requires": {
16740
- "@babel/code-frame": "^7.22.13",
16741
- "@babel/generator": "^7.22.15",
16935
+ "@babel/code-frame": "^7.23.4",
16936
+ "@babel/generator": "^7.23.4",
16937
"@babel/helper-environment-visitor": "^7.22.20",
16743
- "@babel/helper-function-name": "^7.22.5",
16938
+ "@babel/helper-function-name": "^7.23.0",
16939
"@babel/helper-hoist-variables": "^7.22.5",
16940
"@babel/helper-split-export-declaration": "^7.22.6",
16746
- "@babel/parser": "^7.22.16",
16747
- "@babel/types": "^7.22.19",
16941
+ "@babel/parser": "^7.23.4",
16942
+ "@babel/types": "^7.23.4",
16943
"debug": "^4.1.0",
16944
"globals": "^11.1.0"
16945
}
16946
},
16947
"@babel/types": {
16753
- "version": "7.22.19",
16754
- "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.22.19.tgz",
16755
- "integrity": "sha512-P7LAw/LbojPzkgp5oznjE6tQEIWbp4PkkfrZDINTro9zgBRtI324/EYsiSI7lhPbpIQ+DCeR2NNmMWANGGfZsg==",
16948
+ "version": "7.23.4",
16949
+ "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.4.tgz",
16950
+ "integrity": "sha512-7uIFwVYpoplT5jp/kVv6EF93VaJ8H+Yn5IczYiaAi98ajzjfoZfslet/e0sLh+wVBjb2qqIut1b0S26VSafsSQ==",
16951
"dev": true,
16952
"requires": {
16758
- "@babel/helper-string-parser": "^7.22.5",
16759
- "@babel/helper-validator-identifier": "^7.22.19",
16953
+ "@babel/helper-string-parser": "^7.23.4",
16954
+ "@babel/helper-validator-identifier": "^7.22.20",
16955
"to-fast-properties": "^2.0.0"
16956
}
16957
},
@@ -17084,9 +17279,9 @@
17279
}
17280
},
17281
"@eslint/js": {
17087
- "version": "8.53.0",
17088
- "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.53.0.tgz",
17089
- "integrity": "sha512-Kn7K8dx/5U6+cT1yEhpX1w4PCSg0M+XyRILPgvwcEBjerFWCwQj5sbr3/VmxqV0JGHCBCzyd6LxypEuehypY1w==",
17282
+ "version": "8.54.0",
17283
+ "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.54.0.tgz",
17284
+ "integrity": "sha512-ut5V+D+fOoWPgGGNj83GGjnntO39xDy6DWxO0wb7Jp3DcMX0TfIqdzHF85VTQkerdyGmuuMD9AKAo5KiNlf/AQ==",
17285
"dev": true
17286
},
17287
"@faker-js/faker": {
@@ -18099,6 +18294,90 @@
18294
"picomatch": "^2.3.1"
18295
}
18296
},
18297
+ "@rollup/rollup-android-arm-eabi": {
18298
+ "version": "4.5.0",
18299
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.5.0.tgz",
18300
+ "integrity": "sha512-OINaBGY+Wc++U0rdr7BLuFClxcoWaVW3vQYqmQq6B3bqQ/2olkaoz+K8+af/Mmka/C2yN5j+L9scBkv4BtKsDA==",
18301
+ "dev": true,
18302
+ "optional": true
18303
+ },
18304
+ "@rollup/rollup-android-arm64": {
18305
+ "version": "4.5.0",
18306
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.5.0.tgz",
18307
+ "integrity": "sha512-UdMf1pOQc4ZmUA/NTmKhgJTBimbSKnhPS2zJqucqFyBRFPnPDtwA8MzrGNTjDeQbIAWfpJVAlxejw+/lQyBK/w==",
18308
+ "dev": true,
18309
+ "optional": true
18310
+ },
18311
+ "@rollup/rollup-darwin-arm64": {
18312
+ "version": "4.5.0",
18313
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.5.0.tgz",
18314
+ "integrity": "sha512-L0/CA5p/idVKI+c9PcAPGorH6CwXn6+J0Ys7Gg1axCbTPgI8MeMlhA6fLM9fK+ssFhqogMHFC8HDvZuetOii7w==",
18315
+ "dev": true,
18316
+ "optional": true
18317
+ },
18318
+ "@rollup/rollup-darwin-x64": {
18319
+ "version": "4.5.0",
18320
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.5.0.tgz",
18321
+ "integrity": "sha512-QZCbVqU26mNlLn8zi/XDDquNmvcr4ON5FYAHQQsyhrHx8q+sQi/6xduoznYXwk/KmKIXG5dLfR0CvY+NAWpFYQ==",
18322
+ "dev": true,
18323
+ "optional": true
18324
+ },
18325
+ "@rollup/rollup-linux-arm-gnueabihf": {
18326
+ "version": "4.5.0",
18327
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.5.0.tgz",
18328
+ "integrity": "sha512-VpSQ+xm93AeV33QbYslgf44wc5eJGYfYitlQzAi3OObu9iwrGXEnmu5S3ilkqE3Pr/FkgOiJKV/2p0ewf4Hrtg==",
18329
+ "dev": true,
18330
+ "optional": true
18331
+ },
18332
+ "@rollup/rollup-linux-arm64-gnu": {
18333
+ "version": "4.5.0",
18334
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.5.0.tgz",
18335
+ "integrity": "sha512-OrEyIfpxSsMal44JpEVx9AEcGpdBQG1ZuWISAanaQTSMeStBW+oHWwOkoqR54bw3x8heP8gBOyoJiGg+fLY8qQ==",
18336
+ "dev": true,
18337
+ "optional": true
18338
+ },
18339
+ "@rollup/rollup-linux-arm64-musl": {
18340
+ "version": "4.5.0",
18341
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.5.0.tgz",
18342
+ "integrity": "sha512-1H7wBbQuE6igQdxMSTjtFfD+DGAudcYWhp106z/9zBA8OQhsJRnemO4XGavdzHpGhRtRxbgmUGdO3YQgrWf2RA==",
18343
+ "dev": true,
18344
+ "optional": true
18345
+ },
18346
+ "@rollup/rollup-linux-x64-gnu": {
18347
+ "version": "4.5.0",
18348
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.5.0.tgz",
18349
+ "integrity": "sha512-FVyFI13tXw5aE65sZdBpNjPVIi4Q5mARnL/39UIkxvSgRAIqCo5sCpCELk0JtXHGee2owZz5aNLbWNfBHzr71Q==",
18350
+ "dev": true,
18351
+ "optional": true
18352
+ },
18353
+ "@rollup/rollup-linux-x64-musl": {
18354
+ "version": "4.5.0",
18355
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.5.0.tgz",
18356
+ "integrity": "sha512-eBPYl2sLpH/o8qbSz6vPwWlDyThnQjJfcDOGFbNjmjb44XKC1F5dQfakOsADRVrXCNzM6ZsSIPDG5dc6HHLNFg==",
18357
+ "dev": true,
18358
+ "optional": true
18359
+ },
18360
+ "@rollup/rollup-win32-arm64-msvc": {
18361
+ "version": "4.5.0",
18362
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.5.0.tgz",
18363
+ "integrity": "sha512-xaOHIfLOZypoQ5U2I6rEaugS4IYtTgP030xzvrBf5js7p9WI9wik07iHmsKaej8Z83ZDxN5GyypfoyKV5O5TJA==",
18364
+ "dev": true,
18365
+ "optional": true
18366
+ },
18367
+ "@rollup/rollup-win32-ia32-msvc": {
18368
+ "version": "4.5.0",
18369
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.5.0.tgz",
18370
+ "integrity": "sha512-Al6quztQUrHwcOoU2TuFblUQ5L+/AmPBXFR6dUvyo4nRj2yQRK0WIUaGMF/uwKulvRcXkpHe3k9A8Vf93VDktA==",
18371
+ "dev": true,
18372
+ "optional": true
18373
+ },
18374
+ "@rollup/rollup-win32-x64-msvc": {
18375
+ "version": "4.5.0",
18376
+ "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.5.0.tgz",
18377
+ "integrity": "sha512-8kdW+brNhI/NzJ4fxDufuJUjepzINqJKLGHuxyAtpPG9bMbn8P5mtaCcbOm0EzLJ+atg+kF9dwg8jpclkVqx5w==",
18378
+ "dev": true,
18379
+ "optional": true
18380
+ },
18381
"@rushstack/eslint-patch": {
18382
"version": "1.5.1",
18383
"resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.5.1.tgz",
@@ -18584,9 +18863,9 @@
18863
}
18864
},
18865
"@types/jsdom": {
18587
- "version": "21.1.5",
18588
- "resolved": "https://registry.npmjs.org/@types/jsdom/-/jsdom-21.1.5.tgz",
18589
- "integrity": "sha512-sBK/3YjS3uuPj+HzZyhB4GGTnFmk0mdyQfhzZ/sqs9ciyG41QJdZZdwcPa6OfW97OTNTwl5tBAsfEOm/dui9pQ==",
18866
+ "version": "21.1.6",
18867
+ "resolved": "https://registry.npmjs.org/@types/jsdom/-/jsdom-21.1.6.tgz",
18868
+ "integrity": "sha512-/7kkMsC+/kMs7gAYmmBR9P0vGTnOoLhQhyhQJSlXGI5bzTHp6xdo0TtKWQAsz6pmSAeVqKSbqeyP6hytqr9FDw==",
18869
"dev": true,
18870
"requires": {
18871
"@types/node": "*",
@@ -18615,9 +18894,9 @@
18894
"integrity": "sha512-CeVMX9EhVUW8MWnei05eIRks4D5Wscw/W9Byz1s3PA+yJvcdvq9SaDjiUKvRvEgjpdTyJMjQA43ae4KTwsvOPg=="
18895
},
18896
"@types/lodash": {
18618
- "version": "4.14.201",
18619
- "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.201.tgz",
18620
- "integrity": "sha512-y9euML0cim1JrykNxADLfaG0FgD1g/yTHwUs/Jg9ZIU7WKj2/4IW9Lbb1WZbvck78W/lfGXFfe+u2EGfIJXdLQ=="
18897
+ "version": "4.14.202",
18898
+ "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.14.202.tgz",
18899
+ "integrity": "sha512-OvlIYQK9tNneDlS0VN54LLd5uiPCBOp7gS5Z0f1mjoJYBrtStzgmJBxONW3U6OZqdtNzZPmn9BS/7WI7BFFcFQ=="
18900
},
18901
"@types/lodash-es": {
18902
"version": "4.17.9",
@@ -18656,9 +18935,9 @@
18935
"integrity": "sha512-AuHIyzR5Hea7ij0P9q7vx7xu4z0C28ucwjAZC0ja7JhINyCnOw8/DnvAPQQ9TfOlCtZAmCERKQX9+o1mgQhuOQ=="
18936
},
18937
"@types/node": {
18659
- "version": "20.9.0",
18660
- "resolved": "https://registry.npmjs.org/@types/node/-/node-20.9.0.tgz",
18661
- "integrity": "sha512-nekiGu2NDb1BcVofVcEKMIwzlx4NjHlcjhoxxKBNLtz15Y1z7MYf549DFvkHSId02Ax6kGwWntIBPC3l/JZcmw==",
18938
+ "version": "20.9.3",
18939
+ "resolved": "https://registry.npmjs.org/@types/node/-/node-20.9.3.tgz",
18940
+ "integrity": "sha512-nk5wXLAXGBKfrhLB0cyHGbSqopS+nz0BUgZkUQqSHSSgdee0kssp1IAqlQOu333bW+gMNs2QREx7iynm19Abxw==",
18941
"dev": true,
18942
"requires": {
18943
"undici-types": "~5.26.4"
@@ -18741,9 +19020,9 @@
19020
"integrity": "sha512-ue/hDUpPjC85m+PM9OQDMZr3LywT+CT6mPsQq8OJtCLiERkGRcQUFvu9XASF5XWqyZFXbf15lvb3JFJ4dRLWPg=="
19021
},
19022
"@types/validator": {
18744
- "version": "13.11.6",
18745
- "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.11.6.tgz",
18746
- "integrity": "sha512-HUgHujPhKuNzgNXBRZKYexwoG+gHKU+tnfPqjWXFghZAnn73JElicMkuSKJyLGr9JgyA8IgK7fj88IyA9rwYeQ==",
19023
+ "version": "13.11.7",
19024
+ "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.11.7.tgz",
19025
+ "integrity": "sha512-q0JomTsJ2I5Mv7dhHhQLGjMvX0JJm5dyZ1DXQySIUzU1UlwzB8bt+R6+LODUbz0UDIOvEzGc28tk27gBJw2N8Q==",
19026
"dev": true
19027
},
19028
"@types/web-bluetooth": {
@@ -18946,20 +19225,20 @@
19225
"dev": true
19226
},
19227
"@vitejs/plugin-vue": {
18949
- "version": "4.4.1",
18950
- "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-4.4.1.tgz",
18951
- "integrity": "sha512-HCQG8VDFDM7YDAdcj5QI5DvUi+r6xvo9LgvYdk7LSkUNwdpempdB5horkMSZsbdey9Ywsf5aaU8kEPw9M5kREA==",
19228
+ "version": "4.5.0",
19229
+ "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-4.5.0.tgz",
19230
+ "integrity": "sha512-a2WSpP8X8HTEww/U00bU4mX1QpLINNuz/2KMNpLsdu3BzOpak3AGI1CJYBTXcc4SPhaD0eNRUp7IyQK405L5dQ==",
19231
"dev": true,
19232
"requires": {}
19233
},
19234
"@vitejs/plugin-vue-jsx": {
18956
- "version": "3.0.2",
18957
- "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue-jsx/-/plugin-vue-jsx-3.0.2.tgz",
18958
- "integrity": "sha512-obF26P2Z4Ogy3cPp07B4VaW6rpiu0ue4OT2Y15UxT5BZZ76haUY9guOsZV3uWh/I6xc+VeiW+ZVabRE82FyzWw==",
19235
+ "version": "3.1.0",
19236
+ "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue-jsx/-/plugin-vue-jsx-3.1.0.tgz",
19237
+ "integrity": "sha512-w9M6F3LSEU5kszVb9An2/MmXNxocAnUb3WhRr8bHlimhDrXNt6n6D2nJQR3UXpGlZHh/EsgouOHCsM8V3Ln+WA==",
19238
"dev": true,
19239
"requires": {
18961
- "@babel/core": "^7.22.10",
18962
- "@babel/plugin-transform-typescript": "^7.22.10",
19240
+ "@babel/core": "^7.23.3",
19241
+ "@babel/plugin-transform-typescript": "^7.23.3",
19242
"@vue/babel-plugin-jsx": "^1.1.5"
19243
}
19244
},
@@ -19646,13 +19925,14 @@
19925
"dev": true
19926
},
19927
"axios": {
19649
- "version": "0.27.2",
19650
- "resolved": "https://registry.npmjs.org/axios/-/axios-0.27.2.tgz",
19651
- "integrity": "sha512-t+yRIyySRTp/wua5xEr+z1q60QmLq8ABsS5O9Me1AsE5dfKqgnCFzwiCZZ/cGNd1lq4/7akDWMxdhVlucjmnOQ==",
19928
+ "version": "1.6.2",
19929
+ "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.2.tgz",
19930
+ "integrity": "sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A==",
19931
"dev": true,
19932
"requires": {
19654
- "follow-redirects": "^1.14.9",
19655
- "form-data": "^4.0.0"
19933
+ "follow-redirects": "^1.15.0",
19934
+ "form-data": "^4.0.0",
19935
+ "proxy-from-env": "^1.1.0"
19936
},
19937
"dependencies": {
19938
"form-data": {
@@ -19665,6 +19945,12 @@
19945
"combined-stream": "^1.0.8",
19946
"mime-types": "^2.1.12"
19947
}
19948
+ },
19949
+ "proxy-from-env": {
19950
+ "version": "1.1.0",
19951
+ "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
19952
+ "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
19953
+ "dev": true
19954
}
19955
}
19956
},
@@ -20248,9 +20534,9 @@
20534
"dev": true
20535
},
20536
"convert-source-map": {
20251
- "version": "1.9.0",
20252
- "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
20253
- "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
20537
+ "version": "2.0.0",
20538
+ "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
20539
+ "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
20540
"dev": true
20541
},
20542
"cookies": {
@@ -21224,15 +21510,15 @@
21510
"integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="
21511
},
21512
"eslint": {
21227
- "version": "8.53.0",
21228
- "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.53.0.tgz",
21229
- "integrity": "sha512-N4VuiPjXDUa4xVeV/GC/RV3hQW9Nw+Y463lkWaKKXKYMvmRiRDAtfpuPFLN+E1/6ZhyR8J2ig+eVREnYgUsiag==",
21513
+ "version": "8.54.0",
21514
+ "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.54.0.tgz",
21515
+ "integrity": "sha512-NY0DfAkM8BIZDVl6PgSa1ttZbx3xHgJzSNJKYcQglem6CppHyMhRIQkBVSSMaSRnLhig3jsDbEzOjwCVt4AmmA==",
21516
"dev": true,
21517
"requires": {
21518
"@eslint-community/eslint-utils": "^4.2.0",
21519
"@eslint-community/regexpp": "^4.6.1",
21520
"@eslint/eslintrc": "^2.1.3",
21235
- "@eslint/js": "8.53.0",
21521
+ "@eslint/js": "8.54.0",
21522
"@humanwhocodes/config-array": "^0.11.13",
21523
"@humanwhocodes/module-importer": "^1.0.1",
21524
"@nodelib/fs.walk": "^1.2.8",
@@ -25808,6 +26094,8 @@
26094
"resolved": "https://registry.npmjs.org/rollup/-/rollup-3.29.2.tgz",
26095
"integrity": "sha512-CJouHoZ27v6siztc21eEQGo0kIcE5D1gVPA571ez0mMYb25LGYGKnVNXpEj5MGlepmDWGXNjDB5q7uNiPHC11A==",
26096
"dev": true,
26097
+ "optional": true,
26098
+ "peer": true,
26099
"requires": {
26100
"fsevents": "~2.3.2"
26101
}
@@ -26275,9 +26563,9 @@
26563
"dev": true
26564
},
26565
"start-server-and-test": {
26278
- "version": "2.0.2",
26279
- "resolved": "https://registry.npmjs.org/start-server-and-test/-/start-server-and-test-2.0.2.tgz",
26280
- "integrity": "sha512-4sGS2QmETUwqeBUqtTLP7OqXp3PdDnevaWlPlrFQgn8+7uCgVg4Do7/H/ZhAAVyvnL3DqKyANhnLgcgxrjhrMA==",
26566
+ "version": "2.0.3",
26567
+ "resolved": "https://registry.npmjs.org/start-server-and-test/-/start-server-and-test-2.0.3.tgz",
26568
+ "integrity": "sha512-QsVObjfjFZKJE6CS6bSKNwWZCKBG6975/jKRPPGFfFh+yOQglSeGXiNWjzgQNXdphcBI9nXbyso9tPfX4YAUhg==",
26569
"dev": true,
26570
"requires": {
26571
"arg": "^5.0.2",
@@ -26287,7 +26575,7 @@
26575
"execa": "5.1.1",
26576
"lazy-ass": "1.6.0",
26577
"ps-tree": "1.2.0",
26290
- "wait-on": "7.1.0"
26578
+ "wait-on": "7.2.0"
26579
},
26580
"dependencies": {
26581
"execa": {
@@ -27209,9 +27497,9 @@
27497
}
27498
},
27499
"typescript": {
27212
- "version": "5.2.2",
27213
- "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.2.2.tgz",
27214
- "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==",
27500
+ "version": "5.3.2",
27501
+ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.2.tgz",
27502
+ "integrity": "sha512-6l+RyNy7oAHDfxC4FzSJcz9vnjTKxrLpDG5M2Vu4SHRVNg6xzqZp6LYSR9zjqQTu8DU/f5xwxUdADOkbrIX2gQ==",
27503
"devOptional": true
27504
},
27505
"typewise": {
@@ -27544,15 +27832,38 @@
27832
}
27833
},
27834
"vite": {
27547
- "version": "4.5.0",
27548
- "resolved": "https://registry.npmjs.org/vite/-/vite-4.5.0.tgz",
27549
- "integrity": "sha512-ulr8rNLA6rkyFAlVWw2q5YJ91v098AFQ2R0PRFwPzREXOUJQPtFUG0t+/ZikhaOCDqFoDhN6/v8Sq0o4araFAw==",
27835
+ "version": "5.0.0",
27836
+ "resolved": "https://registry.npmjs.org/vite/-/vite-5.0.0.tgz",
27837
+ "integrity": "sha512-ESJVM59mdyGpsiNAeHQOR/0fqNoOyWPYesFto8FFZugfmhdHx8Fzd8sF3Q/xkVhZsyOxHfdM7ieiVAorI9RjFw==",
27838
"dev": true,
27839
"requires": {
27840
"esbuild": "0.18.10",
27553
- "fsevents": "~2.3.2",
27554
- "postcss": "^8.4.27",
27555
- "rollup": "^3.27.1"
27841
+ "fsevents": "~2.3.3",
27842
+ "postcss": "^8.4.31",
27843
+ "rollup": "^4.2.0"
27844
+ },
27845
+ "dependencies": {
27846
+ "rollup": {
27847
+ "version": "4.5.0",
27848
+ "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.5.0.tgz",
27849
+ "integrity": "sha512-41xsWhzxqjMDASCxH5ibw1mXk+3c4TNI2UjKbLxe6iEzrSQnqOzmmK8/3mufCPbzHNJ2e04Fc1ddI35hHy+8zg==",
27850
+ "dev": true,
27851
+ "requires": {
27852
+ "@rollup/rollup-android-arm-eabi": "4.5.0",
27853
+ "@rollup/rollup-android-arm64": "4.5.0",
27854
+ "@rollup/rollup-darwin-arm64": "4.5.0",
27855
+ "@rollup/rollup-darwin-x64": "4.5.0",
27856
+ "@rollup/rollup-linux-arm-gnueabihf": "4.5.0",
27857
+ "@rollup/rollup-linux-arm64-gnu": "4.5.0",
27858
+ "@rollup/rollup-linux-arm64-musl": "4.5.0",
27859
+ "@rollup/rollup-linux-x64-gnu": "4.5.0",
27860
+ "@rollup/rollup-linux-x64-musl": "4.5.0",
27861
+ "@rollup/rollup-win32-arm64-msvc": "4.5.0",
27862
+ "@rollup/rollup-win32-ia32-msvc": "4.5.0",
27863
+ "@rollup/rollup-win32-x64-msvc": "4.5.0",
27864
+ "fsevents": "~2.3.2"
27865
+ }
27866
+ }
27867
}
27868
},
27869
"vite-node": {
@@ -27570,12 +27881,11 @@
27881
}
27882
},
27883
"vite-svg-loader": {
27573
- "version": "4.0.0",
27574
- "resolved": "https://registry.npmjs.org/vite-svg-loader/-/vite-svg-loader-4.0.0.tgz",
27575
- "integrity": "sha512-0MMf1yzzSYlV4MGePsLVAOqXsbF5IVxbn4EEzqRnWxTQl8BJg/cfwIzfQNmNQxZp5XXwd4kyRKF1LytuHZTnqA==",
27884
+ "version": "5.1.0",
27885
+ "resolved": "https://registry.npmjs.org/vite-svg-loader/-/vite-svg-loader-5.1.0.tgz",
27886
+ "integrity": "sha512-M/wqwtOEjgb956/+m5ZrYT/Iq6Hax0OakWbokj8+9PXOnB7b/4AxESHieEtnNEy7ZpjsjYW1/5nK8fATQMmRxw==",
27887
"dev": true,
27888
"requires": {
27578
- "@vue/compiler-sfc": "^3.2.20",
27889
"svgo": "^3.0.2"
27890
}
27891
},
@@ -27859,12 +28169,12 @@
28169
}
28170
},
28171
"wait-on": {
27862
- "version": "7.1.0",
27863
- "resolved": "https://registry.npmjs.org/wait-on/-/wait-on-7.1.0.tgz",
27864
- "integrity": "sha512-U7TF/OYYzAg+OoiT/B8opvN48UHt0QYMi4aD3PjRFpybQ+o6czQF8Ig3SKCCMJdxpBrCalIJ4O00FBof27Fu9Q==",
28172
+ "version": "7.2.0",
28173
+ "resolved": "https://registry.npmjs.org/wait-on/-/wait-on-7.2.0.tgz",
28174
+ "integrity": "sha512-wCQcHkRazgjG5XoAq9jbTMLpNIjoSlZslrJ2+N9MxDsGEv1HnFoVjOCexL0ESva7Y9cu350j+DWADdk54s4AFQ==",
28175
"dev": true,
28176
"requires": {
27867
- "axios": "^0.27.2",
28177
+ "axios": "^1.6.1",
28178
"joi": "^17.11.0",
28179
"lodash": "^4.17.21",
28180
"minimist": "^1.2.8",
package.json
+11
-11
@@ -109,12 +109,12 @@
109
"@types/bytes": "^3.1.4",
110
"@types/fs-extra": "^11.0.4",
111
"@types/inquirer": "^9.0.7",
112
- "@types/jsdom": "^21.1.5",
113
- "@types/lodash": "^4.14.201",
114
- "@types/node": "^20.9.0",
115
- "@types/validator": "^13.11.6",
116
- "@vitejs/plugin-vue": "^4.4.1",
117
- "@vitejs/plugin-vue-jsx": "^3.0.2",
112
+ "@types/jsdom": "^21.1.6",
113
+ "@types/lodash": "^4.14.202",
114
+ "@types/node": "^20.9.3",
115
+ "@types/validator": "^13.11.7",
116
+ "@vitejs/plugin-vue": "^4.5.0",
117
+ "@vitejs/plugin-vue-jsx": "^3.1.0",
118
"@vue-leaflet/vue-leaflet": "^0.10.1",
119
"@vue/eslint-config-prettier": "^8.0.0",
120
"@vue/eslint-config-typescript": "^12.0.0",
@@ -122,7 +122,7 @@
122
"@vue/tsconfig": "^0.4.0",
123
"autoprefixer": "^10.4.16",
124
"cypress": "^13.5.1",
125
- "eslint": "^8.53.0",
125
+ "eslint": "^8.54.0",
126
"eslint-plugin-cypress": "^2.15.1",
127
"eslint-plugin-vue": "^9.18.1",
128
"fs-extra": "^11.1.1",
@@ -134,15 +134,15 @@
134
"postcss": "^8.4.31",
135
"prettier": "^3.1.0",
136
"sass": "^1.69.5",
137
- "start-server-and-test": "^2.0.2",
137
+ "start-server-and-test": "^2.0.3",
138
"tailwind-config-viewer": "^1.7.3",
139
"tailwindcss": "^3.3.5",
140
"taze": "^0.12.0",
141
"ts-node": "^10.9.1",
142
- "typescript": "~5.2.2",
142
+ "typescript": "~5.3.2",
143
"unplugin-vue-components": "^0.25.2",
144
- "vite": "^4.5.0",
145
- "vite-svg-loader": "^4.0.0",
144
+ "vite": "^5.0.0",
145
+ "vite-svg-loader": "^5.1.0",
146
"vitest": "^0.34.6",
147
"vue-tsc": "^1.8.22"
148
},
src/api/index.ts
+9
-7
@@ -1,17 +1,19 @@
1
-import connectors from "./connectors"
2
-import indices from "./indices"
1
import agents from "./agents"
4
-import graylog from "./graylog"
2
import alerts from "./alerts"
3
import artifacts from "./artifacts"
4
import auth from "./auth"
5
+import connectors from "./connectors"
6
+import graylog from "./graylog"
7
+import indices from "./indices"
8
+import soc from "./soc"
9
10
export default {
10
- connectors,
11
- indices,
11
agents,
13
- graylog,
12
alerts,
13
artifacts,
16
- auth
14
+ auth,
15
+ connectors,
16
+ graylog,
17
+ indices,
18
+ soc
19
}
src/api/soc.ts
new
+101
@@ -0,0 +1,101 @@
1
+import { type FlaskBaseResponse } from "@/types/flask.d"
2
+import { HttpClient } from "./httpClient"
3
+import type { SocAlert } from "@/types/soc/alert.d"
4
+import type { SocCase, SocCaseExt } from "@/types/soc/case.d"
5
+import type { SocAsset, SocAssetsState } from "@/types/soc/asset.d"
6
+import type { SocNewNote, SocNote } from "@/types/soc/note.d"
7
+import type { SocUser } from "@/types/soc/user.d"
8
+
9
+export interface CasesFilter {
10
+ olderThan: number
11
+ unit: TimeUnit
12
+}
13
+
14
+type TimeUnit = "hours" | "days" | "weeks"
15
+
16
+export default {
17
+ getAlerts() {
18
+ return HttpClient.get<FlaskBaseResponse & { alerts: SocAlert[] }>(`/soc/alerts`)
19
+ },
20
+ getAlertsBookmark() {
21
+ return HttpClient.get<FlaskBaseResponse & { bookmarked_alerts: SocAlert[] }>(`/soc/alerts/bookmark`)
22
+ },
23
+ getAlertsByUser(userId: string) {
24
+ return HttpClient.get<FlaskBaseResponse & { alerts: SocAlert[] }>(`/soc/alerts/alerts_by_user/${userId}`)
25
+ },
26
+ addAlertBookmark(alertId: string) {
27
+ return HttpClient.post<FlaskBaseResponse & { alert: SocAlert }>(`/soc/alerts/bookmark/${alertId}`)
28
+ },
29
+ removeAlertBookmark(alertId: string) {
30
+ return HttpClient.delete<FlaskBaseResponse & { alert: SocAlert }>(`/soc/alerts/bookmark/${alertId}`)
31
+ },
32
+ getCases(payload?: string | CasesFilter) {
33
+ let apiMethod: "get" | "post" = "get"
34
+ let url = `/soc/cases`
35
+
36
+ if (payload) {
37
+ if (typeof payload === "string") {
38
+ url = `/soc/cases/${payload}`
39
+ } else {
40
+ apiMethod = "post"
41
+ url = `/soc/cases/older_than`
42
+ }
43
+ }
44
+
45
+ return HttpClient[apiMethod]<
46
+ FlaskBaseResponse & { cases?: SocCase[]; case?: SocCaseExt; cases_breached?: SocCase[] }
47
+ >(
48
+ url,
49
+ {},
50
+ apiMethod === "post" && typeof payload !== "string"
51
+ ? {
52
+ params: {
53
+ older_than: payload?.olderThan || 1,
54
+ time_unit: payload?.unit || "days"
55
+ }
56
+ // eslint-disable-next-line no-mixed-spaces-and-tabs
57
+ }
58
+ : undefined
59
+ )
60
+ },
61
+ getCasesOlder(payload: CasesFilter) {
62
+ return HttpClient.post<FlaskBaseResponse & { cases_breached: SocCase[] }>(
63
+ `/soc/cases/older_than`,
64
+ {},
65
+ {
66
+ params: {
67
+ older_than: payload.olderThan || 1,
68
+ time_unit: payload.unit || "days"
69
+ }
70
+ }
71
+ )
72
+ },
73
+ getAssetsByCase(caseId: string) {
74
+ return HttpClient.get<FlaskBaseResponse & { assets: SocAsset[]; state: SocAssetsState }>(
75
+ `/soc/assets/${caseId}`
76
+ )
77
+ },
78
+ getNotesByCase(caseId: string | number, payload: { searchTerm?: string }, signal?: AbortSignal) {
79
+ return HttpClient.get<FlaskBaseResponse & { notes: SocNote[] }>(`/soc/notes/${caseId}`, {
80
+ params: {
81
+ search_term: payload.searchTerm || "%"
82
+ },
83
+ signal
84
+ })
85
+ },
86
+ createCaseNote(caseId: string | number, payload?: { title?: string; content?: string }) {
87
+ return HttpClient.post<FlaskBaseResponse & { note: SocNewNote }>(`/soc/notes/${caseId}`, {
88
+ note_title: payload?.title || "",
89
+ note_content: payload?.content || ""
90
+ })
91
+ },
92
+ getUsers() {
93
+ return HttpClient.get<FlaskBaseResponse & { users: SocUser[] }>(`/soc/users`)
94
+ },
95
+ assignUserToAlert(alertId: string, userId: string) {
96
+ return HttpClient.post<FlaskBaseResponse & { alert: SocAlert }>(`/soc/users/assign/${alertId}/${userId}`)
97
+ },
98
+ removeUserAlertAssign(alertId: string, userId: string) {
99
+ return HttpClient.delete<FlaskBaseResponse & { alert: SocAlert }>(`/soc/users/assign/${alertId}/${userId}`)
100
+ }
101
+}
src/components/agents/OverviewSection.vue
+6
-27
@@ -1,10 +1,10 @@
1
<template>
2
<div class="overview-section">
3
<div class="property-group">
4
- <div v-for="item of propsSanitized" :key="item.key" class="property">
5
- <div class="key">{{ item.key }}</div>
6
- <div class="value">{{ item.val }}</div>
7
- </div>
4
+ <KVCard v-for="item of propsSanitized" :key="item.key">
5
+ <template #key>{{ item.key }}</template>
6
+ <template #value>{{ item.val ?? "-" }}</template>
7
+ </KVCard>
8
</div>
9
</div>
10
</template>
@@ -14,6 +14,7 @@ import { computed, toRefs } from "vue"
14
import dayjs from "@/utils/dayjs"
15
import { type Agent } from "@/types/agents.d"
16
import { useSettingsStore } from "@/stores/settings"
17
+import KVCard from "@/components/common/KVCard.vue"
18
19
const props = defineProps<{
20
agent: Agent
@@ -53,30 +54,8 @@ const formatDate = (date: string) => {
54
width: 100%;
55
display: grid;
56
@apply gap-2;
56
- grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
57
+ grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
58
grid-auto-flow: row dense;
58
-
59
- .property {
60
- border: var(--border-small-100);
61
- background-color: var(--bg-secondary-color);
62
- border-radius: var(--border-radius);
63
- overflow: hidden;
64
- flex-basis: 140px;
65
- flex-grow: 1;
66
-
67
- .key {
68
- border-bottom: var(--border-small-050);
69
- padding: 8px 12px;
70
- font-size: 12px;
71
- }
72
- .value {
73
- font-size: 14px;
74
- padding: 8px 12px;
75
- background-color: var(--bg-color);
76
- font-family: var(--font-family-mono);
77
- height: 100%;
78
- }
79
- }
59
}
60
61
@container (max-width: 500px) {
src/components/agents/VulnerabilityCard.vue
+8
-28
@@ -49,10 +49,10 @@
49
style="width: 90vw; max-width: 1000px"
50
>
51
<div class="vulnerability-property-group" v-if="vulnerabilitySanitized">
52
- <div v-for="item of vulnerabilitySanitized" :key="item.label" class="property">
53
- <div class="key">{{ item.label }}</div>
54
- <div class="value">{{ item.value ?? "-" }}</div>
55
- </div>
52
+ <KVCard v-for="item of vulnerabilitySanitized" :key="item.label">
53
+ <template #key>{{ item.label }}</template>
54
+ <template #value>{{ item.value ?? "-" }}</template>
55
+ </KVCard>
56
</div>
57
<div class="vulnerability-references">
58
<div class="title">External references</div>
@@ -72,6 +72,7 @@ import dayjs from "@/utils/dayjs"
72
import { cloneDeep } from "lodash"
73
import { NModal, NTooltip } from "naive-ui"
74
import Icon from "@/components/common/Icon.vue"
75
+import KVCard from "@/components/common/KVCard.vue"
76
import { useSettingsStore } from "@/stores/settings"
77
78
const ClockIcon = "carbon:time"
@@ -219,39 +220,18 @@ const showDialog = ref(false)
220
width: 100%;
221
display: grid;
222
box-sizing: border-box;
222
- @apply gap-5;
223
+ @apply gap-2;
224
grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
225
grid-auto-flow: row dense;
225
-
226
- .property {
227
- border: var(--border-small-100);
228
- background-color: var(--bg-secondary-color);
229
- border-radius: var(--border-radius);
230
- overflow: hidden;
231
- flex-basis: 140px;
232
- flex-grow: 1;
233
-
234
- .key {
235
- border-bottom: var(--border-small-050);
236
- padding: 8px 12px;
237
- font-size: 12px;
238
- }
239
- .value {
240
- font-size: 14px;
241
- padding: 8px 12px;
242
- background-color: var(--bg-color);
243
- font-family: var(--font-family-mono);
244
- height: 100%;
245
- }
246
- }
226
}
227
228
.vulnerability-references {
250
- @apply gap-5 mt-4;
229
+ @apply gap-5 mt-6;
230
overflow: hidden;
231
232
.list {
233
padding-left: 16px;
234
+ @apply mt-2;
235
236
li {
237
word-break: break-all;
src/components/alerts/Alert.vue
+50
-106
@@ -16,30 +16,38 @@
16
17
<div class="badges-box flex flex-wrap items-center gap-3">
18
<!--
19
- <div class="badge cursor">
20
- <Icon :name="InfoIcon" :size="14"></Icon>
21
- </div>
19
+ <Badge type="cursor">
20
+ <template #iconLeft>
21
+ <Icon :name="InfoIcon" :size="14"></Icon>
22
+ </template>
23
+ </Badge>
24
-->
23
- <div class="badge splitted">
24
- <span class="flex items-center gap-2">
25
+ <Badge type="splitted">
26
+ <template #iconLeft>
27
<Icon :name="TargetIcon" :size="13" class="!opacity-80"></Icon>
26
- Fired times
27
- </span>
28
- <span class="font-mono">{{ alert._source.rule_firedtimes }}</span>
29
- </div>
30
- <div class="badge" :class="{ active: alert._source.rule_mail }">
31
- <span>Rule mail</span>
32
- <Icon :name="alert._source.rule_mail ? MailIcon : DisabledIcon" :size="14"></Icon>
33
- </div>
28
+ </template>
29
+ <template #label>Fired times</template>
30
+ <template #value>{{ alert._source.rule_firedtimes }}</template>
31
+ </Badge>
32
+
33
+ <Badge :type="alert._source.rule_mail ? 'active' : 'muted'">
34
+ <template #iconRight>
35
+ <Icon :name="alert._source.rule_mail ? MailIcon : DisabledIcon" :size="14"></Icon>
36
+ </template>
37
+ <template #label>Rule mail</template>
38
+ </Badge>
39
+
40
<n-popover overlap placement="bottom-start">
41
<template #trigger>
36
- <div class="badge splitted cursor-help">
37
- <span class="flex items-center gap-2">
42
+ <Badge type="splitted" hint-cursor>
43
+ <template #iconLeft>
44
<Icon :name="AgentIcon" :size="13" class="!opacity-80"></Icon>
39
- Agent
40
- </span>
41
- <span>{{ alert._source.agent_name }} / {{ alert._source.agent_labels_customer }}</span>
42
- </div>
45
+ </template>
46
+ <template #label>Agent</template>
47
+ <template #value>
48
+ {{ alert._source.agent_name }} / {{ alert._source.agent_labels_customer }}
49
+ </template>
50
+ </Badge>
51
</template>
52
<div class="flex flex-col gap-1">
53
<div class="box">
@@ -49,6 +57,7 @@
57
@click="gotoAgentPage(alert._source.agent_id)"
58
>
59
{{ alert._source.agent_id }}
60
+ <Icon :name="LinkIcon" :size="13" class="relative top-0.5" />
61
</code>
62
</div>
63
<div class="box">
@@ -65,25 +74,25 @@
74
</div>
75
</div>
76
</n-popover>
68
- <div class="badge splitted">
69
- <span>syslog</span>
70
- <span>{{ alert._source.syslog_type }} / {{ alert._source.syslog_level }}</span>
71
- </div>
72
- <div class="badge splitted hide-on-small">
73
- <span>manager</span>
74
- <span>{{ alert._source.manager_name }}</span>
75
- </div>
76
- <div class="badge splitted hide-on-small">
77
- <span>decoder</span>
78
- <span>{{ alert._source.decoder_name }}</span>
79
- </div>
80
- <div class="badge splitted hide-on-small">
81
- <span>source</span>
82
- <span>{{ alert._source.source }}</span>
83
- </div>
77
+ <Badge type="splitted">
78
+ <template #label>syslog</template>
79
+ <template #value>{{ alert._source.syslog_type }} / {{ alert._source.syslog_level }}</template>
80
+ </Badge>
81
+ <Badge type="splitted" class="hide-on-small">
82
+ <template #label>manager</template>
83
+ <template #value>{{ alert._source.manager_name }}</template>
84
+ </Badge>
85
+ <Badge type="splitted" class="hide-on-small">
86
+ <template #label>decoder</template>
87
+ <template #value>{{ alert._source.decoder_name }}</template>
88
+ </Badge>
89
+ <Badge type="splitted" class="hide-on-small">
90
+ <template #label>source</template>
91
+ <template #value>{{ alert._source.source }}</template>
92
+ </Badge>
93
</div>
94
</div>
86
- <div class="actions-box flex flex-col justify-end">
95
+ <div class="actions-box flex flex-col justify-end" v-if="!hideActions">
96
<n-button type="primary" secondary v-if="alertUrl" tag="a" :href="alertUrl" target="_blank">
97
<template #icon><Icon :name="ViewIcon"></Icon></template>
98
View Alert
@@ -95,7 +104,7 @@
104
</div>
105
</div>
106
<div class="footer-box flex justify-between items-center gap-4">
98
- <div class="actions-box flex flex-col justify-end">
107
+ <div class="actions-box flex flex-col justify-end" v-if="!hideActions">
108
<n-button
109
type="primary"
110
secondary
@@ -135,6 +144,7 @@ import { NButton, NPopover, NModal } from "naive-ui"
144
import { useSettingsStore } from "@/stores/settings"
145
import dayjs from "@/utils/dayjs"
146
import Icon from "@/components/common/Icon.vue"
147
+import Badge from "@/components/common/Badge.vue"
148
import type { Alert } from "@/types/alerts.d"
149
import { SimpleJsonViewer } from "vue-sjv"
150
import "@/assets/scss/vuesjv-override.scss"
@@ -143,7 +153,7 @@ import Api from "@/api"
153
import { onBeforeMount, ref } from "vue"
154
import { useMessage } from "naive-ui/lib"
155
146
-const { alert } = defineProps<{ alert: Alert }>()
156
+const { alert, hideActions } = defineProps<{ alert: Alert; hideActions?: boolean }>()
157
158
const InfoIcon = "carbon:information"
159
const TargetIcon = "zondicons:target"
@@ -152,6 +162,7 @@ const DisabledIcon = "ph:minus-bold"
162
const MailIcon = "carbon:email"
163
const AgentIcon = "carbon:police"
164
const ViewIcon = "iconoir:eye-alt"
165
+const LinkIcon = "carbon:launch"
166
167
const message = useMessage()
168
const router = useRouter()
@@ -205,7 +216,7 @@ onBeforeMount(() => {
216
.id {
217
word-break: break-word;
218
color: var(--fg-secondary-color);
208
- line-height: 1;
219
+ line-height: 1.2;
220
221
&:hover {
222
color: var(--primary-color);
@@ -226,73 +237,6 @@ onBeforeMount(() => {
237
238
.badges-box {
239
margin-top: 16px;
229
-
230
- .badge {
231
- border-radius: var(--border-radius);
232
- border: var(--border-small-100);
233
- display: flex;
234
- align-items: center;
235
- font-size: 14px;
236
- padding: 0px 6px;
237
- height: 26px;
238
- line-height: 1;
239
- gap: 6px;
240
- transition: all 0.3s var(--bezier-ease);
241
-
242
- span,
243
- i {
244
- opacity: 0.5;
245
- }
246
-
247
- &.active {
248
- color: var(--primary-color);
249
- background-color: var(--primary-005-color);
250
-
251
- span,
252
- i {
253
- opacity: 1;
254
- }
255
-
256
- border-color: var(--primary-color);
257
- }
258
-
259
- &.cursor {
260
- cursor: pointer;
261
-
262
- i {
263
- opacity: 1;
264
- }
265
-
266
- &:hover {
267
- color: var(--primary-color);
268
- border-color: var(--primary-color);
269
- }
270
- }
271
-
272
- &.splitted {
273
- padding: 0px;
274
- gap: 0;
275
- overflow: hidden;
276
-
277
- span {
278
- padding: 0px 8px;
279
- height: 100%;
280
- line-height: 24px;
281
- opacity: 1;
282
-
283
- &:first-child {
284
- border-right: var(--border-small-100);
285
- background-color: var(--primary-005-color);
286
- }
287
- }
288
- }
289
- &.default {
290
- span,
291
- i {
292
- opacity: 1;
293
- }
294
- }
295
- }
240
}
241
}
242
}
src/components/alerts/AlertsSummary.vue
+3
@@ -6,6 +6,8 @@
6
<Icon :name="PlaceholderIcon" v-else :size="18" />
7
8
{{ alertsSummary.index_name }}
9
+
10
+ <Icon :name="LinkIcon" :size="14" />
11
</div>
12
<div class="total-alerts flex items-center flex-wrap justify-end">
13
<n-button
@@ -59,6 +61,7 @@ const { alertsSummary } = defineProps<{ alertsSummary: AlertsSummaryExt }>()
61
62
const ExpandIcon = "carbon:chevron-down"
63
const PlaceholderIcon = "ph:question"
64
+const LinkIcon = "carbon:launch"
65
66
const router = useRouter()
67
const showAllAlerts = ref(false)
src/components/artifacts/ArtifactsCommand.vue
+26
-49
@@ -52,29 +52,34 @@
52
</div>
53
<div class="grow flex items-center justify-end gap-2 flex-wrap-reverse">
54
<div class="badges-box flex gap-2 flex-wrap grow">
55
- <div class="badge" v-if="commandTime">
56
- <span class="flex flex-col justify-center">
57
- <n-tooltip trigger="hover">
58
- <template #trigger>
55
+ <n-tooltip trigger="hover" v-if="commandTime">
56
+ <template #trigger>
57
+ <Badge type="splitted" hint-cursor>
58
+ <template #iconLeft>
59
<Icon :name="TimeIcon"></Icon>
60
</template>
61
- Last request time / last response time
62
- </n-tooltip>
63
- </span>
64
- <span class="flex">
65
- {{ formatDate(commandTime) }}
66
-
67
- <n-spin :size="12" v-if="loading" class="ml-2" />
68
-
69
- {{ responseTime ? " / " + formatDate(responseTime) : "" }}
70
- </span>
71
- </div>
72
- <div class="badge" v-if="diffTime">
73
- <span class="flex flex-col justify-center">
61
+ <template #value>
62
+ <span class="flex">
63
+ {{ formatDate(commandTime) }}
64
+
65
+ <n-spin :size="12" v-if="loading" class="ml-2" />
66
+
67
+ {{ responseTime ? " / " + formatDate(responseTime) : "" }}
68
+ </span>
69
+ </template>
70
+ </Badge>
71
+ </template>
72
+ Last request time / last response time
73
+ </n-tooltip>
74
+
75
+ <Badge type="splitted" v-if="diffTime">
76
+ <template #iconLeft>
77
<Icon :name="StopWatchIcon" :size="15"></Icon>
75
- </span>
76
- <span>{{ diffTime }}</span>
77
- </div>
78
+ </template>
79
+ <template #value>
80
+ {{ diffTime }}
81
+ </template>
82
+ </Badge>
83
</div>
84
<n-button
85
size="small"
@@ -107,6 +112,7 @@ import { ref, onBeforeMount, toRefs, computed, nextTick } from "vue"
112
import { useMessage, NSpin, NButton, NEmpty, NSelect, NInput, NTooltip } from "naive-ui"
113
import Api from "@/api"
114
import CommandItem from "./CommandItem.vue"
115
+import Badge from "@/components/common/Badge.vue"
116
import type { Agent } from "@/types/agents.d"
117
import type { CommandRequest } from "@/api/artifacts"
118
import type { Artifact, CommandResult } from "@/types/artifacts.d"
@@ -281,35 +287,6 @@ onBeforeMount(() => {
287
288
<style lang="scss" scoped>
289
.artifacts-command {
284
- .badges-box {
285
- .badge {
286
- border-radius: var(--border-radius);
287
- border: var(--border-small-100);
288
- display: flex;
289
- align-items: center;
290
- font-size: 14px;
291
- height: 28px;
292
- line-height: 1;
293
- transition: all 0.3s var(--bezier-ease);
294
-
295
- padding: 0px;
296
- gap: 0;
297
- overflow: hidden;
298
-
299
- span {
300
- padding: 0px 8px;
301
- height: 100%;
302
- line-height: 26px;
303
- opacity: 1;
304
-
305
- &:first-child {
306
- border-right: var(--border-small-100);
307
- background-color: var(--primary-005-color);
308
- }
309
- }
310
- }
311
- }
312
-
290
.list {
291
container-type: inline-size;
292
min-height: 200px;
src/components/artifacts/CollectItem.vue
+12
-43
@@ -1,14 +1,14 @@
1
<template>
2
<div class="collect-item flex flex-wrap gap-2 p-2">
3
- <div class="property" v-for="prop of displayData" :key="prop.key" :class="{ 'hide-mobile': prop.hideMobile }">
4
- <div class="key">{{ prop.key }}</div>
5
- <div class="value">{{ prop.value }}</div>
6
- </div>
7
- <div class="property more" @click="showDetails = true">
8
- <div class="key">
9
- <Icon :name="MoreIcon" />
10
- </div>
11
- </div>
3
+ <KVCard v-for="prop of displayData" :key="prop.key" :class="{ 'hide-mobile': prop.hideMobile }">
4
+ <template #key>{{ prop.key }}</template>
5
+ <template #value>{{ prop.value }}</template>
6
+ </KVCard>
7
+ <KVCard class="more" @click="showDetails = true">
8
+ <template #value>
9
+ <div class="h-full w-full flex items-center text-center justify-center">view more...</div>
10
+ </template>
11
+ </KVCard>
12
13
<n-modal
14
v-model:show="showDetails"
@@ -28,12 +28,10 @@ import type { CollectResult } from "@/types/artifacts.d"
28
import dayjs from "@/utils/dayjs"
29
import { SimpleJsonViewer } from "vue-sjv"
30
import "@/assets/scss/vuesjv-override.scss"
31
+import KVCard from "@/components/common/KVCard.vue"
32
import { onBeforeMount, ref } from "vue"
33
import _isString from "lodash/isString"
34
import _isNumber from "lodash/isNumber"
34
-import Icon from "@/components/common/Icon.vue"
35
-
36
-const MoreIcon = "mdi:code-json"
35
36
interface Prop {
37
key: string
@@ -107,39 +105,10 @@ onBeforeMount(() => {
105
max-width: 100%;
106
overflow: hidden;
107
110
- .property {
111
- border: var(--border-small-100);
112
- background-color: var(--bg-secondary-color);
113
- border-radius: var(--border-radius);
114
- overflow: hidden;
115
- flex-basis: 140px;
116
- flex-grow: 1;
117
-
118
- .key {
119
- border-bottom: var(--border-small-050);
120
- padding: 8px 12px;
121
- font-size: 12px;
122
- }
123
- .value {
124
- font-size: 14px;
125
- padding: 8px 12px;
126
- background-color: var(--bg-color);
127
- font-family: var(--font-family-mono);
128
- height: 100%;
129
- }
130
-
108
+ .kv-card {
109
&.more {
110
cursor: pointer;
111
transition: all 0.2s;
134
- .key {
135
- border-bottom: none;
136
- font-size: 26px;
137
- text-align: center;
138
- height: 100%;
139
- display: flex;
140
- justify-content: center;
141
- align-items: center;
142
- }
112
113
&:hover {
114
border-color: var(--primary-color);
@@ -154,7 +123,7 @@ onBeforeMount(() => {
123
@container (max-width: 500px) {
124
flex-direction: column;
125
157
- .property {
126
+ .kv-card {
127
flex-basis: initial;
128
flex-grow: initial;
129
}
src/components/common/Badge.vue
new
+100
@@ -0,0 +1,100 @@
1
+<template>
2
+ <component
3
+ :is="!!href ? 'a' : 'div'"
4
+ class="badge"
5
+ :href="href"
6
+ :class="[type, color, { 'cursor-help': hintCursor, 'cursor-pointer': pointCursor }]"
7
+ >
8
+ <span v-if="$slots.label || $slots.iconLeft || $slots.iconRight" class="flex items-center gap-2">
9
+ <slot name="iconLeft"></slot>
10
+ <slot name="label"></slot>
11
+ <slot name="iconRight"></slot>
12
+ </span>
13
+ <span v-if="$slots.value">
14
+ <slot name="value"></slot>
15
+ </span>
16
+ </component>
17
+</template>
18
+
19
+<script setup lang="ts">
20
+const { type, hintCursor, pointCursor, color } = defineProps<{
21
+ type?: "splitted" | "muted" | "active" | "cursor"
22
+ hintCursor?: boolean
23
+ pointCursor?: boolean
24
+ color?: "danger" | "warning"
25
+ href?: string
26
+}>()
27
+</script>
28
+
29
+<style lang="scss" scoped>
30
+.badge {
31
+ border-radius: var(--border-radius);
32
+ border: var(--border-small-100);
33
+ display: flex;
34
+ align-items: center;
35
+ font-size: 14px;
36
+ padding: 0px 6px;
37
+ height: 26px;
38
+ line-height: 1;
39
+ gap: 6px;
40
+ transition: all 0.3s var(--bezier-ease);
41
+
42
+ &.muted {
43
+ span,
44
+ i {
45
+ opacity: 0.5;
46
+ }
47
+ }
48
+
49
+ &.active {
50
+ color: var(--primary-color);
51
+ background-color: var(--primary-005-color);
52
+ border-color: var(--primary-color);
53
+ }
54
+
55
+ &.cursor {
56
+ cursor: pointer;
57
+
58
+ &:hover {
59
+ color: var(--primary-color);
60
+ border-color: var(--primary-color);
61
+ }
62
+ }
63
+
64
+ &.splitted {
65
+ padding: 0px;
66
+ gap: 0;
67
+ overflow: hidden;
68
+
69
+ & > span {
70
+ padding: 0px 8px;
71
+ height: 100%;
72
+ line-height: 24px;
73
+
74
+ &:first-child {
75
+ border-right: var(--border-small-100);
76
+ background-color: var(--primary-005-color);
77
+ }
78
+ &:last-child {
79
+ font-family: var(--font-family-mono);
80
+ font-size: 0.9em;
81
+ }
82
+ }
83
+
84
+ &.danger {
85
+ & > span {
86
+ &:first-child {
87
+ background-color: var(--secondary4-opacity-010-color);
88
+ }
89
+ }
90
+ }
91
+ &.warning {
92
+ & > span {
93
+ &:first-child {
94
+ background-color: var(--secondary3-opacity-010-color);
95
+ }
96
+ }
97
+ }
98
+ }
99
+}
100
+</style>
src/components/common/KVCard.vue
new
+33
@@ -0,0 +1,33 @@
1
+<template>
2
+ <div class="kv-card">
3
+ <div class="key" v-if="$slots.key"><slot name="key"></slot></div>
4
+ <div class="value" v-if="$slots.value"><slot name="value"></slot></div>
5
+ </div>
6
+</template>
7
+
8
+<style lang="scss" scoped>
9
+.kv-card {
10
+ border: var(--border-small-100);
11
+ background-color: var(--bg-secondary-color);
12
+ border-radius: var(--border-radius);
13
+ overflow: hidden;
14
+ display: flex;
15
+ flex-direction: column;
16
+ flex-basis: 140px;
17
+ flex-grow: 1;
18
+
19
+ .key {
20
+ border-bottom: var(--border-small-050);
21
+ padding: 8px 12px;
22
+ font-size: 12px;
23
+ }
24
+ .value {
25
+ font-size: 14px;
26
+ padding: 8px 12px;
27
+ background-color: var(--bg-color);
28
+ font-family: var(--font-family-mono);
29
+ height: 100%;
30
+ flex-grow: 1;
31
+ }
32
+}
33
+</style>
src/components/graylog/Alerts/Item.vue
+18
-16
@@ -17,6 +17,7 @@
17
@click="gotoEventsPage(alertsEvent.event.event_definition_id)"
18
>
19
{{ alertsEvent.event.event_definition_id }}
20
+ <Icon :name="LinkIcon" :size="13" class="relative top-0.5" />
21
</code>
22
</div>
23
<div class="box">
@@ -34,6 +35,7 @@
35
@click="gotoIndicesPage(alertsEvent.index_name)"
36
>
37
{{ alertsEvent.index_name }}
38
+ <Icon :name="LinkIcon" :size="13" class="relative top-0.5" />
39
</code>
40
</div>
41
<div class="box">
@@ -52,7 +54,7 @@
54
</n-popover>
55
</div>
56
<div class="time">
55
- <n-popover overlap placement="bottom-end">
57
+ <n-popover overlap placement="top-end">
58
<template #trigger>
59
<div class="flex items-center gap-2 cursor-help">
60
<span>
@@ -61,15 +63,19 @@
63
<Icon :name="TimeIcon" :size="16"></Icon>
64
</div>
65
</template>
64
- <div class="flex flex-col gap-1">
65
- <div class="box">
66
- timestamp:
67
- <code>{{ formatDate(alertsEvent.event.timestamp) }}</code>
68
- </div>
69
- <div class="box">
70
- timestamp processing:
71
- <code>{{ formatDate(alertsEvent.event.timestamp_processing) }}</code>
72
- </div>
66
+ <div class="flex flex-col py-2 px-1">
67
+ <n-timeline>
68
+ <n-timeline-item
69
+ type="success"
70
+ title="Timestamp"
71
+ :time="formatDate(alertsEvent.event.timestamp)"
72
+ />
73
+ <n-timeline-item
74
+ v-if="alertsEvent.event.timestamp_processing"
75
+ title="Processing"
76
+ :time="formatDate(alertsEvent.event.timestamp_processing)"
77
+ />
78
+ </n-timeline>
79
</div>
80
</n-popover>
81
</div>
@@ -85,7 +91,7 @@
91
92
<script setup lang="ts">
93
import { type AlertsEventElement } from "@/types/graylog/alerts.d"
88
-import { NPopover } from "naive-ui"
94
+import { NPopover, NTimeline, NTimelineItem } from "naive-ui"
95
import { useSettingsStore } from "@/stores/settings"
96
import dayjs from "@/utils/dayjs"
97
import Icon from "@/components/common/Icon.vue"
@@ -99,6 +105,7 @@ const emit = defineEmits<{
105
106
const InfoIcon = "carbon:information"
107
const TimeIcon = "carbon:time"
108
+const LinkIcon = "carbon:launch"
109
110
const router = useRouter()
111
const dFormats = useSettingsStore().dateFormat
@@ -141,11 +148,6 @@ function gotoEventsPage(event_definition_id: string) {
148
color: var(--primary-color);
149
}
150
}
144
-
145
- .actionable {
146
- cursor: pointer;
147
- color: var(--primary-color);
148
- }
151
}
152
.main-box {
153
.content {
src/components/graylog/Inputs/Item.vue
+18
-56
@@ -14,19 +14,25 @@
14
<div class="title">{{ input.title }}</div>
15
<div class="name mb-2">{{ input.name }}</div>
16
<div class="badges-box flex flex-wrap items-center gap-3">
17
- <div class="badge cursor" @click="showDetails = true">
18
- <Icon :name="InfoIcon" :size="14"></Icon>
19
- </div>
20
- <div class="badge" :class="{ active: input.global }">
21
- <span>Global</span>
22
- <Icon :name="input.global ? GlobalIcon : DisabledIcon" :size="14"></Icon>
23
- </div>
17
+ <Badge type="cursor" @click="showDetails = true">
18
+ <template #iconLeft>
19
+ <Icon :name="InfoIcon" :size="14"></Icon>
20
+ </template>
21
+ </Badge>
22
+ <Badge :type="input.global ? 'active' : 'muted'">
23
+ <template #iconRight>
24
+ <Icon :name="input.global ? GlobalIcon : DisabledIcon" :size="14"></Icon>
25
+ </template>
26
+ <template #label>Global</template>
27
+ </Badge>
28
<n-tooltip trigger="hover" :disabled="!isRunning">
29
<template #trigger>
26
- <div class="badge" :class="{ active: isRunning, 'cursor-help': isRunning }">
27
- <span>Running</span>
28
- <Icon :name="isRunning ? TimeIcon : DisabledIcon" :size="14"></Icon>
29
- </div>
30
+ <Badge :type="isRunning ? 'active' : 'muted'" :hint-cursor="isRunning">
31
+ <template #iconRight>
32
+ <Icon :name="isRunning ? TimeIcon : DisabledIcon" :size="14"></Icon>
33
+ </template>
34
+ <template #label>Running</template>
35
+ </Badge>
36
</template>
37
{{ formatDate(input.started_at) }}
38
</n-tooltip>
@@ -112,6 +118,7 @@
118
<script setup lang="ts">
119
import { useSettingsStore } from "@/stores/settings"
120
import Icon from "@/components/common/Icon.vue"
121
+import Badge from "@/components/common/Badge.vue"
122
import dayjs from "@/utils/dayjs"
123
import { NModal, NButton, useMessage, NTooltip, NTabs, NTabPane } from "naive-ui"
124
import { computed, ref } from "vue"
@@ -212,51 +219,6 @@ function start() {
219
color: var(--fg-secondary-color);
220
font-size: 13px;
221
}
215
-
216
- .badges-box {
217
- .badge {
218
- border-radius: var(--border-radius);
219
- border: var(--border-small-100);
220
- display: flex;
221
- align-items: center;
222
- font-size: 14px;
223
- padding: 0px 6px;
224
- height: 26px;
225
- line-height: 1;
226
- gap: 6px;
227
- transition: all 0.3s var(--bezier-ease);
228
-
229
- span,
230
- i {
231
- opacity: 0.5;
232
- }
233
-
234
- &.active {
235
- color: var(--primary-color);
236
- background-color: var(--primary-005-color);
237
-
238
- span,
239
- i {
240
- opacity: 1;
241
- }
242
-
243
- border-color: var(--primary-color);
244
- }
245
-
246
- &.cursor {
247
- cursor: pointer;
248
-
249
- i {
250
- opacity: 1;
251
- }
252
-
253
- &:hover {
254
- color: var(--primary-color);
255
- border-color: var(--primary-color);
256
- }
257
- }
258
- }
259
- }
222
}
223
224
.footer-box {
src/components/graylog/Metrics/UncommittedEntries.vue
+3
@@ -14,6 +14,9 @@
14
</template>
15
16
<script setup lang="ts">
17
+// TODO: add a realtime chart
18
+// TODO: add goto grylog message page button
19
+
20
import Icon from "@/components/common/Icon.vue"
21
import { computed, toRefs } from "vue"
22
src/components/graylog/Pipelines/Rule.vue
+11
-11
@@ -10,7 +10,7 @@
10
</div>
11
</div>
12
<div class="time">
13
- <n-popover overlap placement="bottom-end">
13
+ <n-popover overlap placement="top-end">
14
<template #trigger>
15
<div class="flex items-center gap-2 cursor-help">
16
<span>
@@ -19,15 +19,15 @@
19
<Icon :name="TimeIcon" :size="16"></Icon>
20
</div>
21
</template>
22
- <div class="flex flex-col gap-1">
23
- <div class="box">
24
- created:
25
- <code>{{ formatDate(rule.created_at) }}</code>
26
- </div>
27
- <div class="box">
28
- modified:
29
- <code>{{ formatDate(rule.modified_at) }}</code>
30
- </div>
22
+ <div class="flex flex-col py-2 px-1">
23
+ <n-timeline>
24
+ <n-timeline-item type="success" title="Created" :time="formatDate(rule.created_at)" />
25
+ <n-timeline-item
26
+ v-if="rule.modified_at"
27
+ title="Modified"
28
+ :time="formatDate(rule.modified_at)"
29
+ />
30
+ </n-timeline>
31
</div>
32
</n-popover>
33
</div>
@@ -82,7 +82,7 @@
82
83
<script setup lang="ts">
84
import { ref, toRefs } from "vue"
85
-import { NModal, NInput, NPopover } from "naive-ui"
85
+import { NModal, NInput, NPopover, NTimeline, NTimelineItem } from "naive-ui"
86
import Icon from "@/components/common/Icon.vue"
87
import type { PipelineRule } from "@/types/graylog/pipelines.d"
88
import { useSettingsStore } from "@/stores/settings"
src/components/graylog/Pipelines/RulesList.vue
+1
@@ -100,6 +100,7 @@ onBeforeMount(() => {
100
container-type: inline-size;
101
box-sizing: border-box;
102
min-height: 200px;
103
+ padding-bottom: 50vh;
104
}
105
}
106
</style>
src/components/graylog/Streams/Item.vue
+24
-60
@@ -14,21 +14,29 @@
14
<div class="title">{{ stream.title }}</div>
15
<div class="description mb-2">{{ stream.description }}</div>
16
<div class="badges-box flex flex-wrap items-center gap-3">
17
- <div class="badge cursor" @click="showDetails = true">
18
- <Icon :name="InfoIcon" :size="14"></Icon>
19
- </div>
20
- <div class="badge" :class="{ active: !stream.disabled }">
21
- <span>Enabled</span>
22
- <Icon :name="stream.disabled ? DisabledIcon : EnabledIcon" :size="14"></Icon>
23
- </div>
24
- <div class="badge" :class="{ active: stream.is_default }">
25
- <span>Default</span>
26
- <Icon :name="stream.is_default ? EnabledIcon : DisabledIcon" :size="14"></Icon>
27
- </div>
28
- <div class="badge" :class="{ active: stream.is_editable }">
29
- <span>Editable</span>
30
- <Icon :name="stream.is_editable ? EnabledIcon : DisabledIcon" :size="14"></Icon>
31
- </div>
17
+ <Badge type="cursor" @click="showDetails = true">
18
+ <template #iconLeft>
19
+ <Icon :name="InfoIcon" :size="14"></Icon>
20
+ </template>
21
+ </Badge>
22
+ <Badge :type="stream.disabled ? 'muted' : 'active'">
23
+ <template #iconRight>
24
+ <Icon :name="stream.disabled ? DisabledIcon : EnabledIcon" :size="14"></Icon>
25
+ </template>
26
+ <template #label>Enabled</template>
27
+ </Badge>
28
+ <Badge :type="stream.is_default ? 'active' : 'muted'">
29
+ <template #iconRight>
30
+ <Icon :name="stream.is_default ? EnabledIcon : DisabledIcon" :size="14"></Icon>
31
+ </template>
32
+ <template #label>Default</template>
33
+ </Badge>
34
+ <Badge :type="stream.is_editable ? 'active' : 'muted'">
35
+ <template #iconRight>
36
+ <Icon :name="stream.is_editable ? EnabledIcon : DisabledIcon" :size="14"></Icon>
37
+ </template>
38
+ <template #label>Editable</template>
39
+ </Badge>
40
</div>
41
</div>
42
<div class="actions-box flex flex-col justify-end" v-if="stream.is_editable">
@@ -82,6 +90,7 @@
90
import { type Stream } from "@/types/graylog/stream.d"
91
import { useSettingsStore } from "@/stores/settings"
92
import Icon from "@/components/common/Icon.vue"
93
+import Badge from "@/components/common/Badge.vue"
94
import dayjs from "@/utils/dayjs"
95
import { NModal, NButton, useMessage } from "naive-ui"
96
import { ref, toRefs } from "vue"
@@ -176,51 +185,6 @@ function start() {
185
color: var(--fg-secondary-color);
186
font-size: 13px;
187
}
179
-
180
- .badges-box {
181
- .badge {
182
- border-radius: var(--border-radius);
183
- border: var(--border-small-100);
184
- display: flex;
185
- align-items: center;
186
- font-size: 14px;
187
- padding: 0px 6px;
188
- height: 26px;
189
- line-height: 1;
190
- gap: 6px;
191
- transition: all 0.3s var(--bezier-ease);
192
-
193
- span,
194
- i {
195
- opacity: 0.5;
196
- }
197
-
198
- &.active {
199
- color: var(--primary-color);
200
- background-color: var(--primary-005-color);
201
-
202
- span,
203
- i {
204
- opacity: 1;
205
- }
206
-
207
- border-color: var(--primary-color);
208
- }
209
-
210
- &.cursor {
211
- cursor: pointer;
212
-
213
- i {
214
- opacity: 1;
215
- }
216
-
217
- &:hover {
218
- color: var(--primary-color);
219
- border-color: var(--primary-color);
220
- }
221
- }
222
- }
223
- }
188
}
189
190
.footer-box {
src/components/indices/NodeAllocation.vue
+1
-1
@@ -67,7 +67,7 @@ const message = useMessage()
67
const indicesAllocation = ref<IndexAllocation[]>([])
68
const loading = ref(true)
69
70
-// TODO: decide with Taylor
70
+// TODO: to decide with Taylor
71
function getStatusPercent(percent: string | number | undefined | null) {
72
if (parseFloat(percent?.toString() || "") < 20) return "error"
73
if (parseFloat(percent?.toString() || "") < 40) return "warning"
src/components/soc/SocAlertItem.vue
new
+444
@@ -0,0 +1,444 @@
1
+<template>
2
+ <n-spin
3
+ :show="loading"
4
+ class="soc-alert-item flex flex-col gap-0"
5
+ :class="{ bookmarked: isBookmark, highlight }"
6
+ :id="'alert-' + alert.alert_id"
7
+ >
8
+ <div class="soc-alert-info px-5 py-3 flex flex-col gap-2">
9
+ <div class="header-box flex justify-between">
10
+ <div class="flex items-center gap-2 cursor-pointer">
11
+ <div class="id flex items-center gap-2 cursor-pointer" @click="showDetails = true">
12
+ <span>#{{ alert.alert_id }} - {{ alert.alert_uuid }}</span>
13
+ <Icon :name="InfoIcon" :size="16"></Icon>
14
+ </div>
15
+ <Icon
16
+ :name="isBookmark ? StarActiveIcon : StarIcon"
17
+ :size="16"
18
+ @click="toggleBookmark()"
19
+ class="toggler-bookmark"
20
+ :class="{ active: isBookmark }"
21
+ ></Icon>
22
+ </div>
23
+ <div class="time">
24
+ <n-popover overlap placement="top-end" style="max-height: 240px" scrollable>
25
+ <template #trigger>
26
+ <div class="flex items-center gap-2 cursor-help">
27
+ <span>
28
+ {{ formatDate(alert.alert_creation_time) }}
29
+ </span>
30
+ <Icon :name="TimeIcon" :size="16"></Icon>
31
+ </div>
32
+ </template>
33
+ <div class="flex flex-col py-2 px-1">
34
+ <SocAlertTimeline :alert="alert" />
35
+ </div>
36
+ </n-popover>
37
+ </div>
38
+ </div>
39
+ <div class="main-box">
40
+ <div class="content">
41
+ <div class="title">{{ alert.alert_title }}</div>
42
+ <div
43
+ class="description mb-2"
44
+ v-if="alert.alert_description && alert.alert_title !== alert.alert_description"
45
+ >
46
+ {{ alert.alert_description }}
47
+ </div>
48
+ </div>
49
+ </div>
50
+ <div class="badges-box flex flex-wrap items-center gap-3 mt-2">
51
+ <n-tooltip placement="top-start" trigger="hover">
52
+ <template #trigger>
53
+ <Badge type="splitted" hint-cursor>
54
+ <template #iconLeft>
55
+ <Icon :name="StatusIcon" :size="14"></Icon>
56
+ </template>
57
+ <template #label>Status</template>
58
+ <template #value>{{ alert.status?.status_name || "-" }}</template>
59
+ </Badge>
60
+ </template>
61
+ {{ alert.status.status_description }}
62
+ </n-tooltip>
63
+ <Badge type="splitted" :color="alert.severity?.severity_id === 5 ? 'danger' : undefined">
64
+ <template #iconLeft>
65
+ <Icon :name="SeverityIcon" :size="13"></Icon>
66
+ </template>
67
+ <template #label>Severity</template>
68
+ <template #value>{{ alert.severity?.severity_name || "-" }}</template>
69
+ </Badge>
70
+ <Badge type="splitted" class="hide-on-small">
71
+ <template #iconLeft>
72
+ <Icon :name="SourceIcon" :size="13"></Icon>
73
+ </template>
74
+ <template #label>Source</template>
75
+ <template #value>{{ alert.alert_source || "-" }}</template>
76
+ </Badge>
77
+ <Badge type="splitted" class="hide-on-small">
78
+ <template #iconLeft>
79
+ <Icon :name="CustomerIcon" :size="13"></Icon>
80
+ </template>
81
+ <template #label>Customer</template>
82
+ <template #value>{{ alert.customer?.customer_name || "-" }}</template>
83
+ </Badge>
84
+
85
+ <SocAssignUser :alert="alert" :users="users" v-slot="{ loading }" @updated="updateAlert">
86
+ <Badge type="active" class="cursor-pointer">
87
+ <template #iconLeft>
88
+ <n-spin :size="16" :show="loading">
89
+ <Icon :name="OwnerIcon" :size="16"></Icon>
90
+ </n-spin>
91
+ </template>
92
+ <template #label>Owner</template>
93
+ <template #value>{{ ownerName || "n/d" }}</template>
94
+ </Badge>
95
+ </SocAssignUser>
96
+
97
+ <Badge
98
+ v-if="alert.alert_source_link"
99
+ type="active"
100
+ :href="alert.alert_source_link"
101
+ target="_blank"
102
+ alt="Source link"
103
+ rel="nofollow noopener noreferrer"
104
+ >
105
+ <template #iconRight>
106
+ <Icon :name="LinkIcon" :size="14"></Icon>
107
+ </template>
108
+ <template #label>Source link</template>
109
+ </Badge>
110
+ </div>
111
+ <div class="footer-box flex justify-end items-center gap-3">
112
+ <div class="time">{{ formatDate(alert.alert_creation_time) }}</div>
113
+ </div>
114
+ </div>
115
+ <n-collapse>
116
+ <template #arrow>
117
+ <div class="mx-5 flex">
118
+ <Icon :name="ChevronIcon"></Icon>
119
+ </div>
120
+ </template>
121
+ <n-collapse-item>
122
+ <template #header>
123
+ <div class="py-3 -ml-2">Alert details</div>
124
+ </template>
125
+ <AlertItem :alert="alertObject" :hide-actions="true" class="-mt-4" />
126
+ </n-collapse-item>
127
+ </n-collapse>
128
+
129
+ <n-modal
130
+ v-model:show="showDetails"
131
+ preset="card"
132
+ content-style="padding:0px"
133
+ :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(550px, 90vh)', overflow: 'hidden' }"
134
+ :title="`#${alert.alert_id} - ${alert.alert_uuid}`"
135
+ :bordered="false"
136
+ segmented
137
+ >
138
+ <n-tabs type="line" animated justify-content="space-evenly">
139
+ <n-tab-pane name="Context" tab="Context" display-directive="show:lazy">
140
+ <div class="grid gap-2 soc-alert-context-grid p-7 pt-4">
141
+ <KVCard v-for="(value, key) of alert.alert_context" :key="key">
142
+ <template #key>{{ key }}</template>
143
+ <template #value>{{ value ?? "-" }}</template>
144
+ </KVCard>
145
+ </div>
146
+ </n-tab-pane>
147
+ <n-tab-pane name="Note" tab="Note" display-directive="show:lazy">
148
+ <div class="p-7 pt-4">
149
+ {{ alert.alert_note }}
150
+ </div>
151
+ </n-tab-pane>
152
+ <n-tab-pane name="Customer" tab="Customer" display-directive="show:lazy">
153
+ <div class="grid gap-2 soc-alert-context-grid p-7 pt-4">
154
+ <KVCard v-for="(value, key) of alert.customer" :key="key">
155
+ <template #key>{{ key }}</template>
156
+ <template #value>{{ value || "-" }}</template>
157
+ </KVCard>
158
+ </div>
159
+ </n-tab-pane>
160
+ <n-tab-pane name="Owner" tab="Owner" display-directive="show:lazy">
161
+ <div class="grid gap-2 px-7 pt-4">
162
+ <Badge
163
+ type="active"
164
+ style="max-width: 145px"
165
+ class="cursor-pointer"
166
+ @click="gotoUsersPage(ownerId)"
167
+ >
168
+ <template #iconRight>
169
+ <Icon :name="LinkIcon" :size="14"></Icon>
170
+ </template>
171
+ <template #label>Go to users page</template>
172
+ </Badge>
173
+ </div>
174
+ <div class="grid gap-2 soc-alert-context-grid p-7 pt-4">
175
+ <KVCard>
176
+ <template #key>user_login</template>
177
+ <template #value>
178
+ <SocAssignUser
179
+ :alert="alert"
180
+ :users="users"
181
+ v-slot="{ loading }"
182
+ @updated="updateAlert"
183
+ >
184
+ <div class="flex items-center gap-2 cursor-pointer text-primary-color">
185
+ <n-spin :size="16" :show="loading">
186
+ <Icon :name="EditIcon" :size="16"></Icon>
187
+ </n-spin>
188
+ <span>{{ ownerName || "Assign a user" }}</span>
189
+ </div>
190
+ </SocAssignUser>
191
+ </template>
192
+ </KVCard>
193
+ <KVCard v-if="alert.owner">
194
+ <template #key>user_name</template>
195
+ <template #value>
196
+ <span>#{{ alert.owner.id }}</span>
197
+ {{ alert.owner.user_name }}
198
+ </template>
199
+ </KVCard>
200
+ <KVCard v-if="alert.owner">
201
+ <template #key>user_email</template>
202
+ <template #value>
203
+ {{ alert.owner.user_email }}
204
+ </template>
205
+ </KVCard>
206
+ </div>
207
+ </n-tab-pane>
208
+ <n-tab-pane name="History" tab="History" display-directive="show:lazy">
209
+ <div class="p-7 pt-4">
210
+ <SocAlertTimeline :alert="alert" />
211
+ </div>
212
+ </n-tab-pane>
213
+ <n-tab-pane name="Details" tab="Details" display-directive="show:lazy">
214
+ <div class="p-7 pt-4">
215
+ <SimpleJsonViewer
216
+ class="vuesjv-override"
217
+ :model-value="socAlertDetail"
218
+ :initialExpandedDepth="1"
219
+ />
220
+ </div>
221
+ </n-tab-pane>
222
+ </n-tabs>
223
+ </n-modal>
224
+ </n-spin>
225
+</template>
226
+
227
+<script setup lang="ts">
228
+import AlertItem from "@/components/alerts/Alert.vue"
229
+import type { SocAlert } from "@/types/soc/alert.d"
230
+import type { Alert } from "@/types/alerts.d"
231
+import Icon from "@/components/common/Icon.vue"
232
+import Badge from "@/components/common/Badge.vue"
233
+import { computed, onBeforeMount, ref, toRefs } from "vue"
234
+import { SimpleJsonViewer } from "vue-sjv"
235
+import KVCard from "@/components/common/KVCard.vue"
236
+import SocAlertTimeline from "./SocAlertTimeline.vue"
237
+import SocAssignUser from "./SocAssignUser.vue"
238
+import "@/assets/scss/vuesjv-override.scss"
239
+import Api from "@/api"
240
+import { NCollapse, useMessage, NCollapseItem, NPopover, NModal, NTabs, NTabPane, NSpin, NTooltip } from "naive-ui"
241
+import { useSettingsStore } from "@/stores/settings"
242
+import dayjs from "@/utils/dayjs"
243
+import type { SocUser } from "@/types/soc/user.d"
244
+import { useRouter } from "vue-router"
245
+
246
+const emit = defineEmits<{
247
+ (e: "bookmark"): void
248
+}>()
249
+
250
+const props = defineProps<{
251
+ alert: SocAlert
252
+ isBookmark?: boolean
253
+ highlight?: boolean | null | undefined
254
+ users?: SocUser[]
255
+}>()
256
+const { alert, isBookmark, highlight, users } = toRefs(props)
257
+
258
+const ChevronIcon = "carbon:chevron-right"
259
+const InfoIcon = "carbon:information"
260
+const TimeIcon = "carbon:time"
261
+const LinkIcon = "carbon:launch"
262
+const StatusIcon = "fluent:status-20-regular"
263
+const SeverityIcon = "bi:shield-exclamation"
264
+const SourceIcon = "lucide:arrow-down-right-from-circle"
265
+const CustomerIcon = "carbon:user"
266
+const StarActiveIcon = "carbon:star-filled"
267
+const OwnerIcon = "carbon:user-military"
268
+const StarIcon = "carbon:star"
269
+const EditIcon = "uil:edit-alt"
270
+
271
+const showDetails = ref(false)
272
+const loading = ref(false)
273
+const router = useRouter()
274
+const message = useMessage()
275
+
276
+const alertObject = ref<Alert>({} as Alert)
277
+
278
+const ownerName = computed(() => alert.value.owner?.user_login)
279
+const ownerId = computed(() => alert.value.owner?.id)
280
+
281
+const socAlertDetail = computed<Partial<SocAlert>>(() => {
282
+ const clone: Partial<SocAlert> = JSON.parse(JSON.stringify(alert.value))
283
+
284
+ delete clone.alert_context
285
+ delete clone.alert_source_content
286
+ delete clone.customer
287
+ delete clone.modification_history
288
+ delete clone.alert_note
289
+ delete clone.alert_source_link
290
+
291
+ return clone
292
+})
293
+
294
+const dFormats = useSettingsStore().dateFormat
295
+
296
+function formatDate(timestamp: string | number, utc: boolean = true): string {
297
+ return dayjs(timestamp).utc(utc).format(dFormats.datetimesec)
298
+}
299
+
300
+function toggleBookmark() {
301
+ loading.value = true
302
+
303
+ const method = isBookmark.value ? "removeAlertBookmark" : "addAlertBookmark"
304
+
305
+ Api.soc[method](alert.value.alert_id.toString())
306
+ .then(res => {
307
+ if (res.data.success) {
308
+ emit("bookmark")
309
+ message.success(res.data?.message || "Stream started.")
310
+ } else {
311
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
312
+ }
313
+ })
314
+ .catch(err => {
315
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
316
+ })
317
+ .finally(() => {
318
+ loading.value = false
319
+ })
320
+}
321
+
322
+function updateAlert(alertUpdated: SocAlert) {
323
+ const ownerObject = alertUpdated.owner
324
+ const modificationHistory = alertUpdated.modification_history
325
+
326
+ alert.value.owner = ownerObject
327
+ alert.value.modification_history = modificationHistory
328
+}
329
+
330
+function gotoUsersPage(userId?: string | number) {
331
+ router.push(`/soc/users${userId ? "?user_id=" + userId : ""}`).catch(() => {})
332
+}
333
+
334
+onBeforeMount(() => {
335
+ alertObject.value = {
336
+ _index: "",
337
+ _id: alert.value.alert_context.alert_id,
338
+ _source: alert.value.alert_source_content
339
+ } as Alert
340
+})
341
+</script>
342
+
343
+<style lang="scss" scoped>
344
+.soc-alert-item {
345
+ border-radius: var(--border-radius);
346
+ background-color: var(--bg-color);
347
+ transition: all 0.2s var(--bezier-ease);
348
+ border: var(--border-small-050);
349
+
350
+ .soc-alert-info {
351
+ border-bottom: var(--border-small-050);
352
+
353
+ .header-box {
354
+ font-family: var(--font-family-mono);
355
+ font-size: 13px;
356
+ .id {
357
+ word-break: break-word;
358
+ color: var(--fg-secondary-color);
359
+ line-height: 1.2;
360
+
361
+ &:hover {
362
+ color: var(--primary-color);
363
+ }
364
+ }
365
+
366
+ .toggler-bookmark {
367
+ &.active {
368
+ color: var(--primary-color);
369
+ }
370
+ &:hover {
371
+ color: var(--primary-color);
372
+ }
373
+ }
374
+ .time {
375
+ color: var(--fg-secondary-color);
376
+
377
+ &:hover {
378
+ color: var(--primary-color);
379
+ }
380
+ }
381
+ }
382
+
383
+ .main-box {
384
+ .content {
385
+ word-break: break-word;
386
+
387
+ .description {
388
+ color: var(--fg-secondary-color);
389
+ font-size: 13px;
390
+ }
391
+ }
392
+ }
393
+
394
+ .footer-box {
395
+ font-family: var(--font-family-mono);
396
+ font-size: 13px;
397
+ margin-top: 10px;
398
+ display: none;
399
+
400
+ .time {
401
+ text-align: right;
402
+ color: var(--fg-secondary-color);
403
+ }
404
+ }
405
+ }
406
+
407
+ &.bookmarked {
408
+ background-color: var(--primary-005-color);
409
+ box-shadow: 0px 0px 0px 1px inset var(--primary-030-color);
410
+ }
411
+
412
+ &:hover,
413
+ &.highlight {
414
+ box-shadow: 0px 0px 0px 1px inset var(--primary-color);
415
+ }
416
+
417
+ @container (max-width: 650px) {
418
+ .soc-alert-info {
419
+ .header-box {
420
+ .time {
421
+ display: none;
422
+ }
423
+ }
424
+ .badges-box {
425
+ .badge {
426
+ &.hide-on-small {
427
+ display: none;
428
+ }
429
+ }
430
+ }
431
+ .footer-box {
432
+ display: flex;
433
+ }
434
+ }
435
+ }
436
+}
437
+</style>
438
+
439
+<style lang="scss">
440
+.soc-alert-context-grid {
441
+ grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
442
+ grid-auto-flow: row dense;
443
+}
444
+</style>
src/components/soc/SocAlertTimeline.vue
new
+53
@@ -0,0 +1,53 @@
1
+<template>
2
+ <n-timeline>
3
+ <n-timeline-item
4
+ v-for="(item, $index) of history"
5
+ :type="$index === 0 ? 'success' : undefined"
6
+ :key="item.label"
7
+ :title="item.label"
8
+ :time="item.timeString"
9
+ :line-type="$index === history.length - 2 ? 'dashed' : undefined"
10
+ />
11
+ </n-timeline>
12
+</template>
13
+
14
+<script setup lang="ts">
15
+import { useSettingsStore } from "@/stores/settings"
16
+import type { SocAlert } from "@/types/soc/alert.d"
17
+import dayjs from "@/utils/dayjs"
18
+import { onBeforeMount, ref } from "vue"
19
+import _toNumber from "lodash/toSafeInteger"
20
+import { NTimeline, NTimelineItem } from "naive-ui"
21
+
22
+const { alert } = defineProps<{ alert: SocAlert }>()
23
+
24
+const dFormats = useSettingsStore().dateFormat
25
+
26
+const history = ref<
27
+ {
28
+ timeString: string
29
+ label: string
30
+ }[]
31
+>([])
32
+
33
+function formatDate(timestamp: string | number, utc: boolean = true): string {
34
+ return dayjs(timestamp).utc(utc).format(dFormats.datetimesec)
35
+}
36
+
37
+onBeforeMount(() => {
38
+ history.value.push({
39
+ timeString: formatDate(alert.alert_source_event_time),
40
+ label: "Source event"
41
+ })
42
+
43
+ if (Object.keys(alert.modification_history).length) {
44
+ for (const key in alert.modification_history) {
45
+ const item = alert.modification_history[key]
46
+ history.value.push({
47
+ timeString: formatDate(_toNumber(key) * 1000, false),
48
+ label: item.action + ` [${item.user}]`
49
+ })
50
+ }
51
+ }
52
+})
53
+</script>
src/components/soc/SocAlertsList.vue
new
+219
@@ -0,0 +1,219 @@
1
+<template>
2
+ <div class="soc-alerts-list">
3
+ <div class="header mb-4 flex gap-2">
4
+ <span>
5
+ Total:
6
+ <strong class="font-mono">{{ totalAlerts }}</strong>
7
+ </span>
8
+ <span>/</span>
9
+ <span>
10
+ Bookmarked:
11
+ <strong class="font-mono">{{ bookmarksList.length }}</strong>
12
+ </span>
13
+ </div>
14
+ <n-spin :show="loadingAlerts">
15
+ <div class="list">
16
+ <template v-if="list.length">
17
+ <SocAlertItem
18
+ v-for="alert of list"
19
+ :key="alert.id"
20
+ :alert="alert.item"
21
+ class="mb-2"
22
+ :is-bookmark="alert.isBookmark"
23
+ :users="usersList"
24
+ :highlight="alert.id.toString() === highlight"
25
+ @bookmark="switchAlert(alert.id, alert.isBookmark)"
26
+ />
27
+ </template>
28
+ <template v-else>
29
+ <n-empty description="No items found" class="justify-center h-48" v-if="!loading" />
30
+ </template>
31
+ </div>
32
+ </n-spin>
33
+ </div>
34
+</template>
35
+
36
+<script setup lang="ts">
37
+import { ref, onBeforeMount, computed, watch, toRefs, nextTick } from "vue"
38
+import { useMessage, NSpin, NEmpty } from "naive-ui"
39
+import Api from "@/api"
40
+import SocAlertItem from "./SocAlertItem.vue"
41
+import type { SocAlert } from "@/types/soc/alert.d"
42
+import _uniqBy from "lodash/uniqBy"
43
+import type { SocUser } from "@/types/soc/user.d"
44
+
45
+const props = defineProps<{ highlight: string | null | undefined }>()
46
+const { highlight } = toRefs(props)
47
+
48
+const message = useMessage()
49
+const loadingBookmarks = ref(false)
50
+const loadingAlerts = ref(false)
51
+const bookmarksList = ref<SocAlert[]>([])
52
+const alertsList = ref<SocAlert[]>([])
53
+const usersList = ref<SocUser[]>([])
54
+
55
+const list = computed(() => {
56
+ const list = [
57
+ ...bookmarksList.value.map(o => ({ item: o, id: o.alert_id, isBookmark: true })),
58
+ ...alertsList.value.map(o => ({ item: o, id: o.alert_id, isBookmark: false }))
59
+ ]
60
+ return _uniqBy(list, o => o.id)
61
+})
62
+
63
+const loading = computed<boolean>(() => {
64
+ return loadingBookmarks.value || loadingAlerts.value
65
+})
66
+
67
+const totalAlerts = computed<number>(() => {
68
+ return list.value.length || 0
69
+})
70
+
71
+function switchAlert(alertId: number, isBookmark: boolean) {
72
+ const fromList = isBookmark ? bookmarksList : alertsList
73
+ const toList = isBookmark ? alertsList : bookmarksList
74
+
75
+ const alert = fromList.value.find(o => o.alert_id === alertId)
76
+ fromList.value = fromList.value.filter(o => o.alert_id !== alertId)
77
+
78
+ if (alert) {
79
+ toList.value.push(alert)
80
+ }
81
+
82
+ load(true)
83
+}
84
+
85
+function getAlerts(silent?: boolean) {
86
+ if (!silent) {
87
+ loadingAlerts.value = true
88
+ }
89
+
90
+ Api.soc
91
+ .getAlerts()
92
+ .then(res => {
93
+ if (res.data.success) {
94
+ alertsList.value = res.data?.alerts || []
95
+ } else {
96
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
97
+ }
98
+ })
99
+ .catch(err => {
100
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
101
+ })
102
+ .finally(() => {
103
+ loadingAlerts.value = false
104
+ })
105
+}
106
+
107
+function getBookmarks(silent?: boolean) {
108
+ if (!silent) {
109
+ loadingBookmarks.value = true
110
+ }
111
+
112
+ Api.soc
113
+ .getAlertsBookmark()
114
+ .then(res => {
115
+ if (res.data.success) {
116
+ bookmarksList.value = res.data.bookmarked_alerts || []
117
+ } else {
118
+ message.error(res.data?.message || "An error occurred. Please try again later.")
119
+ }
120
+ })
121
+ .catch(err => {
122
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
123
+ })
124
+ .finally(() => {
125
+ loadingBookmarks.value = false
126
+ })
127
+}
128
+
129
+function getUsers() {
130
+ Api.soc
131
+ .getUsers()
132
+ .then(res => {
133
+ if (res.data.success) {
134
+ usersList.value = res.data?.users || []
135
+ } else {
136
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
137
+ }
138
+ })
139
+ .catch(err => {
140
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
141
+ })
142
+}
143
+
144
+function load(silent?: boolean) {
145
+ getAlerts(silent)
146
+ getBookmarks(silent)
147
+
148
+ if (!usersList.value.length) {
149
+ getUsers()
150
+ }
151
+}
152
+
153
+function scrollToAlert(id: string) {
154
+ const element = document.getElementById(`alert-${id}`)
155
+ const scrollContent = document.querySelector("#main > .n-scrollbar > .n-scrollbar-container") as HTMLElement
156
+
157
+ if (element && scrollContent) {
158
+ const wrap: HTMLElement = scrollContent
159
+ const middle = element.offsetTop - wrap.offsetHeight / 2
160
+ scrollContent?.scrollTo({ top: middle, behavior: "smooth" })
161
+ }
162
+}
163
+
164
+watch(loading, val => {
165
+ if (!val) {
166
+ nextTick(() => {
167
+ setTimeout(() => {
168
+ if (highlight.value) {
169
+ scrollToAlert(highlight.value)
170
+ }
171
+ }, 300)
172
+ })
173
+ }
174
+})
175
+
176
+watch(highlight, val => {
177
+ if (val) {
178
+ nextTick(() => {
179
+ setTimeout(() => {
180
+ scrollToAlert(val)
181
+ })
182
+ })
183
+ }
184
+})
185
+
186
+onBeforeMount(() => {
187
+ load()
188
+})
189
+</script>
190
+
191
+<style lang="scss" scoped>
192
+.soc-alerts-list {
193
+ .list {
194
+ container-type: inline-size;
195
+ min-height: 200px;
196
+
197
+ .soc-alert-item {
198
+ animation: soc-alert-item-fade 0.3s forwards;
199
+ opacity: 0;
200
+
201
+ @for $i from 0 through 30 {
202
+ &:nth-child(#{$i}) {
203
+ animation-delay: $i * 0.05s;
204
+ }
205
+ }
206
+
207
+ @keyframes soc-alert-item-fade {
208
+ from {
209
+ opacity: 0;
210
+ transform: translateY(10px);
211
+ }
212
+ to {
213
+ opacity: 1;
214
+ }
215
+ }
216
+ }
217
+ }
218
+}
219
+</style>
src/components/soc/SocAssignUser.vue
new
+127
@@ -0,0 +1,127 @@
1
+<template>
2
+ <n-popselect
3
+ v-model:value="userSelected"
4
+ v-model:show="ownerListVisible"
5
+ :options="usersOptions"
6
+ :disabled="loadingUsers"
7
+ size="medium"
8
+ scrollable
9
+ >
10
+ <slot :loading="loadingUsers" />
11
+ </n-popselect>
12
+</template>
13
+
14
+<script setup lang="ts">
15
+import type { SocAlert } from "@/types/soc/alert.d"
16
+import { computed, onBeforeMount, ref, toRefs } from "vue"
17
+import Api from "@/api"
18
+import { useMessage, NPopselect } from "naive-ui"
19
+import type { SocUser } from "@/types/soc/user.d"
20
+import { watch } from "vue"
21
+
22
+const props = defineProps<{
23
+ alert: SocAlert
24
+ users?: SocUser[]
25
+}>()
26
+const { alert, users } = toRefs(props)
27
+
28
+const emit = defineEmits<{
29
+ (e: "updated", value: SocAlert): void
30
+}>()
31
+
32
+const loadingUsers = ref(false)
33
+const message = useMessage()
34
+
35
+const ownerListVisible = ref(false)
36
+const ownerId = computed(() => alert.value.owner?.id)
37
+const usersOptions = ref<
38
+ {
39
+ label: string
40
+ value: number
41
+ }[]
42
+>([])
43
+const userSelected = ref<number | null>(null)
44
+
45
+function getUsers() {
46
+ loadingUsers.value = true
47
+
48
+ Api.soc
49
+ .getUsers()
50
+ .then(res => {
51
+ if (res.data.success) {
52
+ const usersList = res.data?.users || []
53
+ parseUsers(usersList)
54
+ } else {
55
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
56
+ }
57
+ })
58
+ .catch(err => {
59
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
60
+ })
61
+ .finally(() => {
62
+ loadingUsers.value = false
63
+ })
64
+}
65
+
66
+function assignUser() {
67
+ if (userSelected.value !== ownerId.value) {
68
+ loadingUsers.value = true
69
+
70
+ const method = userSelected.value ? "assignUserToAlert" : "removeUserAlertAssign"
71
+ const userId = userSelected.value ? userSelected.value : ownerId.value || 0
72
+
73
+ Api.soc[method](alert.value.alert_id.toString(), userId.toString())
74
+ .then(res => {
75
+ if (res.data.success) {
76
+ emit("updated", res.data.alert)
77
+ } else {
78
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
79
+ }
80
+ })
81
+ .catch(err => {
82
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
83
+ })
84
+ .finally(() => {
85
+ loadingUsers.value = false
86
+ })
87
+ }
88
+}
89
+
90
+function parseUsers(users: SocUser[]) {
91
+ usersOptions.value = users.map(o => ({ label: "#" + o.user_id + " • " + o.user_login, value: o.user_id }))
92
+
93
+ usersOptions.value.push({
94
+ label: "- Set default owner -",
95
+ value: 0
96
+ })
97
+}
98
+
99
+watch(
100
+ () => users?.value,
101
+ val => {
102
+ if (val !== undefined && val.length) {
103
+ parseUsers(val)
104
+ }
105
+ }
106
+)
107
+
108
+watch(userSelected, () => {
109
+ assignUser()
110
+})
111
+
112
+watch(ownerListVisible, val => {
113
+ if (val && !usersOptions.value.length) {
114
+ getUsers()
115
+ }
116
+})
117
+
118
+onBeforeMount(() => {
119
+ if (ownerId.value) {
120
+ userSelected.value = ownerId.value
121
+ }
122
+
123
+ if (users?.value?.length) {
124
+ parseUsers(users.value)
125
+ }
126
+})
127
+</script>
src/components/soc/SocCaseAssetLink.vue
new
+147
@@ -0,0 +1,147 @@
1
+<template>
2
+ <div class="soc-asset-link">
3
+ <div class="flex flex-col gap-2 px-5 py-4 pb-2">
4
+ <div class="header-box flex justify-between">
5
+ <div class="flex items-center gap-2 cursor-helper">
6
+ <div class="id flex items-center gap-2">
7
+ <span>{{ link.case_name }}</span>
8
+ </div>
9
+ </div>
10
+ </div>
11
+ <div class="main-box flex justify-between gap-4">
12
+ <div class="content">
13
+ <div class="description mt-2" v-if="link.asset_description">{{ link.asset_description }}</div>
14
+
15
+ <div class="badges-box flex flex-wrap items-center gap-3 mt-4">
16
+ <Badge type="splitted">
17
+ <template #label>Case open date</template>
18
+ <template #value>{{ formatDate(link.case_open_date) }}</template>
19
+ </Badge>
20
+ <Badge type="splitted">
21
+ <template #label>Asset id</template>
22
+ <template #value>{{ link.asset_id }}</template>
23
+ </Badge>
24
+ <Badge type="splitted">
25
+ <template #label>Compromise status</template>
26
+ <template #value>{{ link.asset_compromise_status_id || "-" }}</template>
27
+ </Badge>
28
+ </div>
29
+ </div>
30
+ </div>
31
+ </div>
32
+ <n-collapse @item-header-click="showSocCase($event.expanded)">
33
+ <template #arrow>
34
+ <div class="mx-5 flex">
35
+ <Icon :name="ChevronIcon"></Icon>
36
+ </div>
37
+ </template>
38
+ <n-collapse-item>
39
+ <template #header>
40
+ <div class="py-3 -ml-2">SOC Case details</div>
41
+ </template>
42
+ <div style="min-height: 50px">
43
+ <n-spin :show="loadingCase">
44
+ <SocCaseItem :case-data="socCase" v-if="socCase" :embedded="true" class="py-2 -mt-4" />
45
+ <template v-else>
46
+ <n-empty
47
+ description="No Case found"
48
+ class="justify-center h-28 -mt-4"
49
+ v-if="!loadingCase"
50
+ />
51
+ </template>
52
+ </n-spin>
53
+ </div>
54
+ </n-collapse-item>
55
+ </n-collapse>
56
+ </div>
57
+</template>
58
+
59
+<script setup lang="ts">
60
+import Icon from "@/components/common/Icon.vue"
61
+import Badge from "@/components/common/Badge.vue"
62
+import { ref } from "vue"
63
+import "@/assets/scss/vuesjv-override.scss"
64
+import Api from "@/api"
65
+import { useMessage, NSpin, NCollapse, NEmpty, NCollapseItem } from "naive-ui"
66
+import { useSettingsStore } from "@/stores/settings"
67
+import dayjs from "@/utils/dayjs"
68
+import type { SocAssetLink } from "@/types/soc/asset.d"
69
+import type { SocCase } from "@/types/soc/case.d"
70
+import SocCaseItem from "./SocCaseItem.vue"
71
+
72
+const { link } = defineProps<{ link: SocAssetLink }>()
73
+
74
+const ChevronIcon = "carbon:chevron-right"
75
+
76
+const socCase = ref<SocCase | null>(null)
77
+const loadingCase = ref(false)
78
+const message = useMessage()
79
+
80
+const dFormats = useSettingsStore().dateFormat
81
+
82
+function formatDate(timestamp: string | number | Date, utc: boolean = true): string {
83
+ return dayjs(timestamp).utc(utc).format(dFormats.date)
84
+}
85
+
86
+function showSocCase(show: boolean) {
87
+ if (show && !socCase.value) {
88
+ getSocCase(link.case_id.toString())
89
+ }
90
+}
91
+
92
+function getSocCase(caseId: string) {
93
+ loadingCase.value = true
94
+
95
+ Api.soc
96
+ .getCases(caseId)
97
+ .then(res => {
98
+ if (res.data.success) {
99
+ socCase.value = (res.data?.case as unknown as SocCase) || null
100
+ } else {
101
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
102
+ }
103
+ })
104
+ .catch(err => {
105
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
106
+ })
107
+ .finally(() => {
108
+ loadingCase.value = false
109
+ })
110
+}
111
+</script>
112
+
113
+<style lang="scss" scoped>
114
+.soc-asset-link {
115
+ border-radius: var(--border-radius);
116
+ background-color: var(--bg-secondary-color);
117
+ transition: all 0.2s var(--bezier-ease);
118
+ border: var(--border-small-050);
119
+ container-type: inline-size;
120
+
121
+ .header-box {
122
+ font-family: var(--font-family-mono);
123
+ font-size: 13px;
124
+ .id {
125
+ word-break: break-word;
126
+ color: var(--fg-secondary-color);
127
+ line-height: 1.2;
128
+
129
+ &:hover {
130
+ color: var(--primary-color);
131
+ }
132
+ }
133
+ }
134
+
135
+ .main-box {
136
+ word-break: break-word;
137
+
138
+ .description {
139
+ font-size: 13px;
140
+ }
141
+ }
142
+
143
+ &:hover {
144
+ box-shadow: 0px 0px 0px 1px inset var(--primary-color);
145
+ }
146
+}
147
+</style>
src/components/soc/SocCaseAssetsItem.vue
new
+188
@@ -0,0 +1,188 @@
1
+<template>
2
+ <div class="soc-asset-item">
3
+ <div class="flex flex-col gap-2 px-5 py-4">
4
+ <div class="header-box flex justify-between">
5
+ <div class="flex items-center gap-2">
6
+ <div class="id flex items-center gap-2 cursor-pointer" @click="showDetails = true">
7
+ <span>#{{ asset.asset_id }} - {{ asset.asset_uuid }}</span>
8
+ <Icon :name="InfoIcon" :size="16"></Icon>
9
+ </div>
10
+ </div>
11
+ </div>
12
+ <div class="main-box flex justify-between gap-4">
13
+ <div class="content">
14
+ <div class="title" v-html="asset.asset_name"></div>
15
+ <div class="description mt-2" v-if="asset.asset_description">{{ excerpt }}</div>
16
+
17
+ <div class="badges-box flex flex-wrap items-center gap-3 mt-4">
18
+ <Badge type="splitted">
19
+ <template #label>Status</template>
20
+ <template #value>{{ asset.analysis_status }}</template>
21
+ </Badge>
22
+ <Badge type="splitted">
23
+ <template #label>Type</template>
24
+ <template #value>{{ asset.asset_type }}</template>
25
+ </Badge>
26
+ <Badge type="splitted" v-for="tag of tags" :key="tag.key">
27
+ <template #label>{{ tag.key }}</template>
28
+ <template #value v-if="tag.value !== undefined">{{ tag.value || "-" }}</template>
29
+ </Badge>
30
+ </div>
31
+ </div>
32
+ </div>
33
+ </div>
34
+
35
+ <n-modal
36
+ v-model:show="showDetails"
37
+ preset="card"
38
+ content-style="padding:0px"
39
+ :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(600px, 90vh)', overflow: 'hidden' }"
40
+ :title="`#${asset.asset_id} - ${asset.asset_uuid}`"
41
+ :bordered="false"
42
+ segmented
43
+ >
44
+ <n-tabs type="line" animated justify-content="space-evenly">
45
+ <n-tab-pane name="Info" tab="Info" display-directive="show">
46
+ <div class="grid gap-2 soc-case-context-grid p-7 pt-4" v-if="properties">
47
+ <KVCard v-for="(value, key) of properties" :key="key">
48
+ <template #key>{{ key }}</template>
49
+ <template #value>{{ value || "-" }}</template>
50
+ </KVCard>
51
+ </div>
52
+ </n-tab-pane>
53
+ <n-tab-pane name="Description" tab="Description" display-directive="show">
54
+ <div class="p-7 pt-4">
55
+ <n-input
56
+ :value="asset.asset_description"
57
+ type="textarea"
58
+ readonly
59
+ placeholder="Empty"
60
+ :autosize="{
61
+ minRows: 3,
62
+ maxRows: 10
63
+ }"
64
+ />
65
+ </div>
66
+ </n-tab-pane>
67
+ <n-tab-pane name="Link" tab="Link" display-directive="show:lazy">
68
+ <div v-if="asset.link?.length" class="px-4 flex flex-col gap-2">
69
+ <SocCaseAssetLink
70
+ v-for="link of asset.link"
71
+ :key="link.case_id + '-' + link.asset_id"
72
+ :link="link"
73
+ />
74
+ </div>
75
+ <template v-else>
76
+ <n-empty description="No items found" class="justify-center h-48" />
77
+ </template>
78
+ </n-tab-pane>
79
+ </n-tabs>
80
+ </n-modal>
81
+ </div>
82
+</template>
83
+
84
+<script setup lang="ts">
85
+import Icon from "@/components/common/Icon.vue"
86
+import KVCard from "@/components/common/KVCard.vue"
87
+import Badge from "@/components/common/Badge.vue"
88
+import SocCaseAssetLink from "./SocCaseAssetLink.vue"
89
+import { computed, ref } from "vue"
90
+import "@/assets/scss/vuesjv-override.scss"
91
+import { NModal, NTabs, NTabPane, NInput } from "naive-ui"
92
+import _omit from "lodash/omit"
93
+import _split from "lodash/split"
94
+import _upperFirst from "lodash/upperFirst"
95
+import type { SocAsset } from "@/types/soc/asset.d"
96
+
97
+const { asset } = defineProps<{ asset: SocAsset }>()
98
+
99
+const InfoIcon = "carbon:information"
100
+
101
+const showDetails = ref(false)
102
+
103
+const excerpt = computed(() => {
104
+ const text = asset.asset_description
105
+ const truncated = text.split(" ").slice(0, 30).join(" ")
106
+
107
+ return truncated + (truncated !== text ? "..." : "")
108
+})
109
+
110
+const tags = computed<{ key: string; value?: string }[]>(() => {
111
+ if (!asset?.asset_tags) {
112
+ return []
113
+ }
114
+
115
+ return _split(asset.asset_tags, ",")
116
+ .filter(o => !!o)
117
+ .map(o => {
118
+ const chunks = _split(o, ":")
119
+
120
+ return {
121
+ key: _upperFirst(chunks[0]),
122
+ value: chunks[1] || undefined
123
+ }
124
+ })
125
+})
126
+
127
+const properties = computed(() => {
128
+ return _omit(asset, ["asset_description", "link"])
129
+})
130
+</script>
131
+
132
+<style lang="scss" scoped>
133
+.soc-asset-item {
134
+ border-radius: var(--border-radius);
135
+ background-color: var(--bg-secondary-color);
136
+ transition: all 0.2s var(--bezier-ease);
137
+ border: var(--border-small-050);
138
+
139
+ .header-box {
140
+ font-family: var(--font-family-mono);
141
+ font-size: 13px;
142
+ .id {
143
+ word-break: break-word;
144
+ color: var(--fg-secondary-color);
145
+ line-height: 1.2;
146
+
147
+ &:hover {
148
+ color: var(--primary-color);
149
+ }
150
+ }
151
+
152
+ .toggler-bookmark {
153
+ &.active {
154
+ color: var(--primary-color);
155
+ }
156
+ &:hover {
157
+ color: var(--primary-color);
158
+ }
159
+ }
160
+ .time {
161
+ color: var(--fg-secondary-color);
162
+
163
+ &:hover {
164
+ color: var(--primary-color);
165
+ }
166
+ }
167
+ }
168
+
169
+ .main-box {
170
+ word-break: break-word;
171
+
172
+ .description {
173
+ color: var(--fg-secondary-color);
174
+ font-size: 13px;
175
+ }
176
+ }
177
+
178
+ &:hover {
179
+ box-shadow: 0px 0px 0px 1px inset var(--primary-color);
180
+ }
181
+}
182
+</style>
183
+<style lang="scss">
184
+.soc-case-context-grid {
185
+ grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
186
+ grid-auto-flow: row dense;
187
+}
188
+</style>
src/components/soc/SocCaseAssetsList.vue
new
+73
@@ -0,0 +1,73 @@
1
+<template>
2
+ <div class="soc-assets-list">
3
+ <n-spin :show="loadingAssets" style="min-height: 50px">
4
+ <div class="flex flex-col gap-2 px-7 py-4 pb-0">
5
+ <div class="box" v-if="assetsState">
6
+ State:
7
+ <code>{{ assetsState.object_state }}</code>
8
+ </div>
9
+ <div class="box" v-if="assetsState">
10
+ Last update:
11
+ <code>{{ formatDateTime(assetsState.object_last_update) }}</code>
12
+ </div>
13
+ </div>
14
+ <div v-if="assetsList?.length" class="p-7 flex flex-col gap-2">
15
+ <SocCaseAssetsItem v-for="asset of assetsList" :key="asset.asset_id" :asset="asset" />
16
+ </div>
17
+ <template v-else>
18
+ <n-empty description="No items found" class="justify-center h-48" v-if="!loadingAssets" />
19
+ </template>
20
+ </n-spin>
21
+ </div>
22
+</template>
23
+
24
+<script setup lang="ts">
25
+import { ref } from "vue"
26
+import SocCaseAssetsItem from "./SocCaseAssetsItem.vue"
27
+import "@/assets/scss/vuesjv-override.scss"
28
+import Api from "@/api"
29
+import { useMessage, NSpin, NEmpty } from "naive-ui"
30
+import { useSettingsStore } from "@/stores/settings"
31
+import dayjs from "@/utils/dayjs"
32
+import type { SocAsset, SocAssetsState } from "@/types/soc/asset.d"
33
+import { onBeforeMount } from "vue"
34
+
35
+const { caseId } = defineProps<{ caseId: string | number }>()
36
+
37
+const loadingAssets = ref(false)
38
+const message = useMessage()
39
+
40
+const assetsList = ref<SocAsset[] | null>(null)
41
+const assetsState = ref<SocAssetsState | null>(null)
42
+
43
+const dFormats = useSettingsStore().dateFormat
44
+
45
+function formatDateTime(timestamp: string | number | Date, utc: boolean = true): string {
46
+ return dayjs(timestamp).utc(utc).format(dFormats.datetimesec)
47
+}
48
+
49
+function getAssets() {
50
+ loadingAssets.value = true
51
+
52
+ Api.soc
53
+ .getAssetsByCase(caseId.toString())
54
+ .then(res => {
55
+ if (res.data.success) {
56
+ assetsList.value = res.data?.assets || null
57
+ assetsState.value = res.data?.state || null
58
+ } else {
59
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
60
+ }
61
+ })
62
+ .catch(err => {
63
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
64
+ })
65
+ .finally(() => {
66
+ loadingAssets.value = false
67
+ })
68
+}
69
+
70
+onBeforeMount(() => {
71
+ getAssets()
72
+})
73
+</script>
src/components/soc/SocCaseItem.vue
new
+386
@@ -0,0 +1,386 @@
1
+<template>
2
+ <div class="soc-case-item" :class="{ embedded }">
3
+ <div class="flex flex-col gap-2 px-5 py-3">
4
+ <div class="header-box flex justify-between">
5
+ <div class="flex items-center gap-2">
6
+ <div class="id flex items-center gap-2 cursor-pointer" @click="showDetails = true">
7
+ <span>{{ caseData.case_uuid }}</span>
8
+ <Icon :name="InfoIcon" :size="16"></Icon>
9
+ </div>
10
+ </div>
11
+ <div class="time">
12
+ <n-popover overlap placement="top-end">
13
+ <template #trigger>
14
+ <div class="flex items-center gap-2 cursor-help">
15
+ <span>
16
+ {{ formatDate(caseData.case_open_date) }}
17
+ </span>
18
+ <Icon :name="TimeIcon" :size="16"></Icon>
19
+ </div>
20
+ </template>
21
+ <div class="flex flex-col py-2 px-1">
22
+ <n-timeline>
23
+ <n-timeline-item
24
+ type="success"
25
+ :title="`Open [${caseData.opened_by}]`"
26
+ :time="formatDate(caseData.case_open_date)"
27
+ />
28
+ <n-timeline-item
29
+ v-if="caseData.case_close_date"
30
+ title="Close date"
31
+ :time="formatDate(caseData.case_close_date)"
32
+ />
33
+ </n-timeline>
34
+ </div>
35
+ </n-popover>
36
+ </div>
37
+ </div>
38
+ <div class="main-box flex justify-between gap-4">
39
+ <div class="content">
40
+ <div class="title" v-html="caseData.case_name"></div>
41
+ <div class="description mt-2" v-if="caseData.case_description">{{ excerpt }}</div>
42
+
43
+ <div class="badges-box flex flex-wrap items-center gap-3 mt-4">
44
+ <Badge type="splitted" :color="caseData.state_name === StateName.Open ? 'warning' : undefined">
45
+ <template #iconLeft>
46
+ <Icon :name="StatusIcon" :size="14"></Icon>
47
+ </template>
48
+ <template #label>State</template>
49
+ <template #value>{{ caseData.state_name }}</template>
50
+ </Badge>
51
+ <Badge type="splitted">
52
+ <template #iconLeft>
53
+ <Icon :name="OwnerIcon" :size="16"></Icon>
54
+ </template>
55
+ <template #label>Owner</template>
56
+ <template #value>{{ caseData.owner }}</template>
57
+ </Badge>
58
+ <Badge type="splitted">
59
+ <template #iconLeft>
60
+ <Icon :name="CustomerIcon" :size="13"></Icon>
61
+ </template>
62
+ <template #label>Client</template>
63
+ <template #value>{{ caseData.client_name || "-" }}</template>
64
+ </Badge>
65
+ <Badge
66
+ v-if="caseData.case_soc_id"
67
+ type="active"
68
+ @click="gotoSocAlert(caseData.case_soc_id)"
69
+ class="cursor-pointer"
70
+ >
71
+ <template #iconRight>
72
+ <Icon :name="LinkIcon" :size="14"></Icon>
73
+ </template>
74
+ <template #label>Alert #{{ caseData.case_soc_id }}</template>
75
+ </Badge>
76
+ </div>
77
+ </div>
78
+ </div>
79
+ <div class="footer-box flex justify-end items-center gap-3">
80
+ <div class="time">{{ formatDate(caseData.case_open_date) }}</div>
81
+ </div>
82
+ </div>
83
+
84
+ <n-modal
85
+ v-model:show="showDetails"
86
+ preset="card"
87
+ content-style="padding:0px"
88
+ :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(550px, 90vh)', overflow: 'hidden' }"
89
+ :title="caseData.case_uuid"
90
+ :bordered="false"
91
+ segmented
92
+ >
93
+ <n-tabs type="line" animated justify-content="space-evenly">
94
+ <n-tab-pane name="Info" tab="Info" display-directive="show">
95
+ <n-spin :show="loadingDetails">
96
+ <div class="px-7 py-4" v-if="extendedInfo">
97
+ <div class="flex gap-2 mb-2" v-if="tags.length">
98
+ <code v-for="tag of tags" :key="tag">{{ tag }}</code>
99
+ </div>
100
+ <div>{{ extendedInfo.case_name }}</div>
101
+ </div>
102
+ <div class="flex flex-col gap-2 px-7 py-4" v-if="extendedInfo">
103
+ <div class="box">
104
+ soc id:
105
+ <code
106
+ class="cursor-pointer text-primary-color"
107
+ @click="gotoSocAlert(caseData.case_soc_id)"
108
+ >
109
+ #{{ caseData.case_soc_id }}
110
+ <Icon :name="LinkIcon" :size="13" class="relative top-0.5" />
111
+ </code>
112
+ </div>
113
+ <div class="box" v-if="extendedInfo?.protagonists && extendedInfo?.protagonists.length">
114
+ protagonists:
115
+ <code v-for="protagonist of extendedInfo.protagonists" :key="protagonist" class="mr-2">
116
+ {{ protagonist }}
117
+ </code>
118
+ </div>
119
+ </div>
120
+ <div class="grid gap-2 soc-case-context-grid p-7 pt-4" v-if="properties">
121
+ <KVCard v-for="(value, key) of properties" :key="key">
122
+ <template #key>{{ key }}</template>
123
+ <template #value>{{ value || "-" }}</template>
124
+ </KVCard>
125
+ </div>
126
+ </n-spin>
127
+ </n-tab-pane>
128
+ <n-tab-pane name="Description" tab="Description" display-directive="show">
129
+ <div class="p-7 pt-4">
130
+ <n-input
131
+ :value="caseData.case_description"
132
+ type="textarea"
133
+ readonly
134
+ placeholder="Empty"
135
+ :autosize="{
136
+ minRows: 3,
137
+ maxRows: 10
138
+ }"
139
+ />
140
+ </div>
141
+ </n-tab-pane>
142
+ <n-tab-pane name="History" tab="History" display-directive="show:lazy">
143
+ <n-spin :show="loadingDetails">
144
+ <div class="p-7 pt-4">
145
+ <SocCaseTimeline :caseData="extendedInfo" v-if="extendedInfo" />
146
+ </div>
147
+ </n-spin>
148
+ </n-tab-pane>
149
+ <n-tab-pane name="Assets" tab="Assets" display-directive="show:lazy">
150
+ <SocCaseAssetsList :case-id="caseData.case_id" />
151
+ </n-tab-pane>
152
+ <n-tab-pane name="Notes" tab="Notes" display-directive="show:lazy">
153
+ <div class="px-4">
154
+ <n-collapse display-directive="show" v-model:expanded-names="noteFormVisible">
155
+ <template #arrow>
156
+ <div class="mx-4 flex">
157
+ <Icon :name="AddIcon"></Icon>
158
+ </div>
159
+ </template>
160
+ <n-collapse-item name="1">
161
+ <template #header>
162
+ <div class="py-3 -ml-2">New note</div>
163
+ </template>
164
+ <div class="p-3 pt-0 -mt-2">
165
+ <SocCaseNoteForm
166
+ :case-id="caseData.case_id"
167
+ @close="noteFormVisible = []"
168
+ @added="updateNotes = true"
169
+ />
170
+ </div>
171
+ </n-collapse-item>
172
+ </n-collapse>
173
+ </div>
174
+ <n-divider class="!my-2" />
175
+ <SocCaseNotesList :case-id="caseData.case_id" v-model:requested="updateNotes" />
176
+ </n-tab-pane>
177
+ </n-tabs>
178
+ </n-modal>
179
+ </div>
180
+</template>
181
+
182
+<script setup lang="ts">
183
+import Icon from "@/components/common/Icon.vue"
184
+import KVCard from "@/components/common/KVCard.vue"
185
+import Badge from "@/components/common/Badge.vue"
186
+import { computed, ref, watch } from "vue"
187
+import SocCaseTimeline from "./SocCaseTimeline.vue"
188
+import SocCaseAssetsList from "./SocCaseAssetsList.vue"
189
+import SocCaseNoteForm from "./SocCaseNoteForm.vue"
190
+import SocCaseNotesList from "./SocCaseNotesList.vue"
191
+import "@/assets/scss/vuesjv-override.scss"
192
+import Api from "@/api"
193
+import {
194
+ useMessage,
195
+ NPopover,
196
+ NSpin,
197
+ NTimeline,
198
+ NTimelineItem,
199
+ NModal,
200
+ NTabs,
201
+ NTabPane,
202
+ NDivider,
203
+ NInput,
204
+ NCollapse,
205
+ NCollapseItem
206
+} from "naive-ui"
207
+import { useSettingsStore } from "@/stores/settings"
208
+import dayjs from "@/utils/dayjs"
209
+import { type SocCase, StateName, type SocCaseExt } from "@/types/soc/case.d"
210
+import _omit from "lodash/omit"
211
+import _split from "lodash/split"
212
+import { useRouter } from "vue-router"
213
+
214
+const { caseData, embedded } = defineProps<{ caseData: SocCase; embedded?: boolean }>()
215
+
216
+const TimeIcon = "carbon:time"
217
+const InfoIcon = "carbon:information"
218
+const CustomerIcon = "carbon:user"
219
+const LinkIcon = "carbon:launch"
220
+const OwnerIcon = "carbon:user-military"
221
+const StatusIcon = "fluent:status-20-regular"
222
+const AddIcon = "carbon:add-alt"
223
+
224
+const showDetails = ref(false)
225
+const loadingDetails = ref(false)
226
+const message = useMessage()
227
+const router = useRouter()
228
+const noteFormVisible = ref([])
229
+const updateNotes = ref(false)
230
+
231
+const extendedInfo = ref<SocCaseExt | null>(null)
232
+
233
+const dFormats = useSettingsStore().dateFormat
234
+
235
+const excerpt = computed(() => {
236
+ const text = caseData.case_description
237
+ const truncated = text.split(" ").slice(0, 30).join(" ")
238
+
239
+ return truncated + (truncated !== text ? "..." : "")
240
+})
241
+
242
+const tags = computed<string[]>(() => {
243
+ if (!extendedInfo?.value?.case_tags) {
244
+ return []
245
+ }
246
+
247
+ return _split(extendedInfo.value?.case_tags, ",").map(o => "#" + o)
248
+})
249
+
250
+const properties = computed(() => {
251
+ return _omit(extendedInfo.value, [
252
+ "case_description",
253
+ "case_name",
254
+ "case_soc_id",
255
+ "case_tags",
256
+ "case_uuid",
257
+ "close_date",
258
+ "initial_date",
259
+ "modification_history",
260
+ "open_by_user",
261
+ "open_by_user_id",
262
+ "open_date",
263
+ "protagonists"
264
+ ])
265
+})
266
+
267
+function formatDate(timestamp: string | number | Date, utc: boolean = true): string {
268
+ return dayjs(timestamp).utc(utc).format(dFormats.date)
269
+}
270
+
271
+function gotoSocAlert(socId: string) {
272
+ router.push(`/soc/alerts?id=${socId}`).catch(() => {})
273
+}
274
+
275
+function getDetails() {
276
+ loadingDetails.value = true
277
+
278
+ Api.soc
279
+ .getCases(caseData.case_id.toString())
280
+ .then(res => {
281
+ if (res.data.success) {
282
+ extendedInfo.value = res.data?.case || null
283
+ } else {
284
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
285
+ }
286
+ })
287
+ .catch(err => {
288
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
289
+ })
290
+ .finally(() => {
291
+ loadingDetails.value = false
292
+ })
293
+}
294
+
295
+watch(showDetails, val => {
296
+ if (val && !extendedInfo.value) {
297
+ getDetails()
298
+ }
299
+})
300
+</script>
301
+
302
+<style lang="scss" scoped>
303
+.soc-case-item {
304
+ &:not(.embedded) {
305
+ border-radius: var(--border-radius);
306
+ background-color: var(--bg-color);
307
+ border: var(--border-small-050);
308
+ }
309
+ border-top: var(--border-small-050);
310
+ transition: all 0.2s var(--bezier-ease);
311
+
312
+ .header-box {
313
+ font-family: var(--font-family-mono);
314
+ font-size: 13px;
315
+ .id {
316
+ word-break: break-word;
317
+ color: var(--fg-secondary-color);
318
+ line-height: 1.2;
319
+
320
+ &:hover {
321
+ color: var(--primary-color);
322
+ }
323
+ }
324
+
325
+ .toggler-bookmark {
326
+ &.active {
327
+ color: var(--primary-color);
328
+ }
329
+ &:hover {
330
+ color: var(--primary-color);
331
+ }
332
+ }
333
+ .time {
334
+ color: var(--fg-secondary-color);
335
+
336
+ &:hover {
337
+ color: var(--primary-color);
338
+ }
339
+ }
340
+ }
341
+
342
+ .main-box {
343
+ word-break: break-word;
344
+
345
+ .description {
346
+ color: var(--fg-secondary-color);
347
+ font-size: 13px;
348
+ }
349
+ }
350
+
351
+ .footer-box {
352
+ font-family: var(--font-family-mono);
353
+ font-size: 13px;
354
+ margin-top: 10px;
355
+ display: none;
356
+
357
+ .time {
358
+ text-align: right;
359
+ color: var(--fg-secondary-color);
360
+ }
361
+ }
362
+
363
+ &:not(.embedded) {
364
+ &:hover {
365
+ box-shadow: 0px 0px 0px 1px inset var(--primary-color);
366
+ }
367
+ }
368
+
369
+ @container (max-width: 650px) {
370
+ .header-box {
371
+ .time {
372
+ display: none;
373
+ }
374
+ }
375
+ .footer-box {
376
+ display: flex;
377
+ }
378
+ }
379
+}
380
+</style>
381
+<style lang="scss">
382
+.soc-case-context-grid {
383
+ grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
384
+ grid-auto-flow: row dense;
385
+}
386
+</style>
src/components/soc/SocCaseNote.vue
new
+204
@@ -0,0 +1,204 @@
1
+<template>
2
+ <div class="soc-case-note">
3
+ <div class="flex flex-col gap-2 px-5 py-4">
4
+ <div class="header-box flex justify-between">
5
+ <div class="flex items-center gap-2">
6
+ <div class="id flex items-center gap-2 cursor-pointer" @click="showDetails = true">
7
+ <span>#{{ note.note_id }} - {{ note.note_details.note_uuid }}</span>
8
+ <Icon :name="InfoIcon" :size="16"></Icon>
9
+ </div>
10
+ </div>
11
+ <div class="time">
12
+ <n-popover overlap placement="top-end">
13
+ <template #trigger>
14
+ <div class="flex items-center gap-2 cursor-help">
15
+ <span>
16
+ {{ formatDateTime(note.note_details.note_creationdate) }}
17
+ </span>
18
+ <Icon :name="TimeIcon" :size="16"></Icon>
19
+ </div>
20
+ </template>
21
+ <div class="flex flex-col py-2 px-1">
22
+ <SocCaseNoteTimeline :note="note" />
23
+ </div>
24
+ </n-popover>
25
+ </div>
26
+ </div>
27
+ <div class="main-box flex justify-between gap-4">
28
+ <div class="content">
29
+ <div class="title" v-html="note.note_title"></div>
30
+ <div class="description mt-2" v-if="note.note_details.note_content">{{ excerpt }}</div>
31
+
32
+ <!--
33
+ <div class="badges-box flex flex-wrap items-center gap-3 mt-4">
34
+ <Badge type="splitted">
35
+ <template #label>Status</template>
36
+ <template #value>{{ asset.analysis_status }}</template>
37
+ </Badge>
38
+ <Badge type="splitted">
39
+ <template #label>Type</template>
40
+ <template #value>{{ asset.asset_type }}</template>
41
+ </Badge>
42
+ <Badge type="splitted" v-for="tag of tags" :key="tag.key">
43
+ <template #label>{{ tag.key }}</template>
44
+ <template #value v-if="tag.value !== undefined">{{ tag.value || "-" }}</template>
45
+ </Badge>
46
+ </div>
47
+ -->
48
+ </div>
49
+ </div>
50
+ <div class="footer-box flex justify-end items-center gap-3">
51
+ <div class="time">{{ formatDateTime(note.note_details.note_creationdate) }}</div>
52
+ </div>
53
+ </div>
54
+
55
+ <n-modal
56
+ v-model:show="showDetails"
57
+ preset="card"
58
+ content-style="padding:0px"
59
+ :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(600px, 90vh)', overflow: 'hidden' }"
60
+ :title="`#${note.note_id} - ${note.note_details.note_uuid}`"
61
+ :bordered="false"
62
+ segmented
63
+ >
64
+ <n-tabs type="line" animated justify-content="space-evenly">
65
+ <n-tab-pane name="Info" tab="Info" display-directive="show">
66
+ <div class="grid gap-2 soc-case-context-grid p-7 pt-4" v-if="properties">
67
+ <KVCard v-for="(value, key) of properties" :key="key">
68
+ <template #key>{{ key }}</template>
69
+ <template #value>{{ value || "-" }}</template>
70
+ </KVCard>
71
+ </div>
72
+ </n-tab-pane>
73
+ <n-tab-pane name="Content" tab="Content" display-directive="show">
74
+ <div class="p-7 pt-4">
75
+ <n-input
76
+ :value="note.note_details.note_content"
77
+ type="textarea"
78
+ readonly
79
+ placeholder="Empty"
80
+ :autosize="{
81
+ minRows: 3,
82
+ maxRows: 10
83
+ }"
84
+ />
85
+ </div>
86
+ </n-tab-pane>
87
+ <n-tab-pane name="History" tab="History" display-directive="show:lazy">
88
+ <div class="p-7 pt-4">
89
+ <SocCaseNoteTimeline :note="note" />
90
+ </div>
91
+ </n-tab-pane>
92
+ </n-tabs>
93
+ </n-modal>
94
+ </div>
95
+</template>
96
+
97
+<script setup lang="ts">
98
+import Icon from "@/components/common/Icon.vue"
99
+import KVCard from "@/components/common/KVCard.vue"
100
+import SocCaseNoteTimeline from "./SocCaseNoteTimeline.vue"
101
+import { computed, ref } from "vue"
102
+import "@/assets/scss/vuesjv-override.scss"
103
+import { NModal, NTabs, NTabPane, NInput, NPopover } from "naive-ui"
104
+import _omit from "lodash/omit"
105
+import type { SocNote } from "@/types/soc/note.d"
106
+import { useSettingsStore } from "@/stores/settings"
107
+import dayjs from "@/utils/dayjs"
108
+
109
+const { note } = defineProps<{ note: SocNote }>()
110
+
111
+const InfoIcon = "carbon:information"
112
+const TimeIcon = "carbon:time"
113
+
114
+const showDetails = ref(false)
115
+const dFormats = useSettingsStore().dateFormat
116
+
117
+function formatDateTime(timestamp: string | number | Date, utc: boolean = true): string {
118
+ return dayjs(timestamp).utc(utc).format(dFormats.datetimesec)
119
+}
120
+
121
+const excerpt = computed(() => {
122
+ const text = note.note_details.note_content
123
+ const truncated = text.split(" ").slice(0, 30).join(" ")
124
+
125
+ return truncated + (truncated !== text ? "..." : "")
126
+})
127
+
128
+const properties = computed(() => {
129
+ return _omit(note.note_details, ["note_content", "custom_attributes", "note_creationdate", "note_lastupdate"])
130
+})
131
+</script>
132
+
133
+<style lang="scss" scoped>
134
+.soc-case-note {
135
+ border-radius: var(--border-radius);
136
+ background-color: var(--bg-secondary-color);
137
+ transition: all 0.2s var(--bezier-ease);
138
+ border: var(--border-small-050);
139
+
140
+ .header-box {
141
+ font-family: var(--font-family-mono);
142
+ font-size: 13px;
143
+ .id {
144
+ word-break: break-word;
145
+ color: var(--fg-secondary-color);
146
+ line-height: 1.2;
147
+
148
+ &:hover {
149
+ color: var(--primary-color);
150
+ }
151
+ }
152
+
153
+ .time {
154
+ color: var(--fg-secondary-color);
155
+
156
+ &:hover {
157
+ color: var(--primary-color);
158
+ }
159
+ }
160
+ }
161
+
162
+ .main-box {
163
+ word-break: break-word;
164
+
165
+ .description {
166
+ color: var(--fg-secondary-color);
167
+ font-size: 13px;
168
+ }
169
+ }
170
+
171
+ .footer-box {
172
+ font-family: var(--font-family-mono);
173
+ font-size: 13px;
174
+ margin-top: 10px;
175
+ display: none;
176
+
177
+ .time {
178
+ text-align: right;
179
+ color: var(--fg-secondary-color);
180
+ }
181
+ }
182
+
183
+ &:hover {
184
+ box-shadow: 0px 0px 0px 1px inset var(--primary-color);
185
+ }
186
+
187
+ @container (max-width: 650px) {
188
+ .header-box {
189
+ .time {
190
+ display: none;
191
+ }
192
+ }
193
+ .footer-box {
194
+ display: flex;
195
+ }
196
+ }
197
+}
198
+</style>
199
+<style lang="scss">
200
+.soc-case-context-grid {
201
+ grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
202
+ grid-auto-flow: row dense;
203
+}
204
+</style>
src/components/soc/SocCaseNoteForm.vue
new
+73
@@ -0,0 +1,73 @@
1
+<template>
2
+ <n-spin class="soc-notes-form" :show="loading">
3
+ <div class="flex flex-col gap-2">
4
+ <n-input v-model:value="title" placeholder="Title..." clearable />
5
+ <n-input
6
+ v-model:value="content"
7
+ type="textarea"
8
+ clearable
9
+ placeholder="Content..."
10
+ :autosize="{
11
+ minRows: 3,
12
+ maxRows: 10
13
+ }"
14
+ />
15
+ <div class="flex gap-2 justify-end">
16
+ <n-button :disabled="loading" @click="clear(true)" secondary class="!w-32">Close</n-button>
17
+ <n-button :disabled="loading || !title" @click="addNote()" secondary type="primary" class="!w-32">
18
+ Submit
19
+ </n-button>
20
+ </div>
21
+ </div>
22
+ </n-spin>
23
+</template>
24
+
25
+<script setup lang="ts">
26
+import { ref } from "vue"
27
+import "@/assets/scss/vuesjv-override.scss"
28
+import Api from "@/api"
29
+import { useMessage, NSpin, NInput, NButton } from "naive-ui"
30
+import type { SocNewNote } from "@/types/soc/note.d"
31
+
32
+const { caseId } = defineProps<{ caseId: string | number }>()
33
+
34
+const emit = defineEmits<{
35
+ (e: "close"): void
36
+ (e: "added", value: SocNewNote): void
37
+}>()
38
+
39
+const loading = ref(false)
40
+const message = useMessage()
41
+const title = ref("")
42
+const content = ref("")
43
+
44
+function clear(close?: boolean) {
45
+ title.value = ""
46
+ content.value = ""
47
+
48
+ if (close) {
49
+ emit("close")
50
+ }
51
+}
52
+
53
+function addNote() {
54
+ loading.value = true
55
+
56
+ Api.soc
57
+ .createCaseNote(caseId.toString(), { title: title.value, content: content.value })
58
+ .then(res => {
59
+ if (res.data.success) {
60
+ emit("added", res.data.note)
61
+ clear()
62
+ } else {
63
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
64
+ }
65
+ })
66
+ .catch(err => {
67
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
68
+ })
69
+ .finally(() => {
70
+ loading.value = false
71
+ })
72
+}
73
+</script>
src/components/soc/SocCaseNoteTimeline.vue
new
+50
@@ -0,0 +1,50 @@
1
+<template>
2
+ <n-timeline>
3
+ <n-timeline-item
4
+ v-for="(item, $index) of history"
5
+ :type="$index === 0 ? 'success' : undefined"
6
+ :key="item.label"
7
+ :title="item.label"
8
+ :time="item.timeString"
9
+ :line-type="$index === history.length - 2 ? 'dashed' : undefined"
10
+ />
11
+ </n-timeline>
12
+</template>
13
+
14
+<script setup lang="ts">
15
+import { useSettingsStore } from "@/stores/settings"
16
+import dayjs from "@/utils/dayjs"
17
+import { onBeforeMount, ref } from "vue"
18
+import type { SocNote } from "@/types/soc/note.d"
19
+import { NTimeline, NTimelineItem } from "naive-ui"
20
+
21
+const { note } = defineProps<{ note: SocNote }>()
22
+
23
+const dFormats = useSettingsStore().dateFormat
24
+
25
+const history = ref<
26
+ {
27
+ timeString: string
28
+ label: string
29
+ }[]
30
+>([])
31
+
32
+function formatDate(timestamp: string | number | Date, utc: boolean = true): string {
33
+ return dayjs(timestamp).utc(utc).format(dFormats.datetimesec)
34
+}
35
+
36
+onBeforeMount(() => {
37
+ if (note.note_details.note_creationdate) {
38
+ history.value.push({
39
+ timeString: formatDate(note.note_details.note_creationdate, false),
40
+ label: "Created"
41
+ })
42
+ }
43
+ if (note.note_details.note_lastupdate) {
44
+ history.value.push({
45
+ timeString: formatDate(note.note_details.note_lastupdate, false),
46
+ label: "Updated"
47
+ })
48
+ }
49
+})
50
+</script>
src/components/soc/SocCaseNotesList.vue
new
+87
@@ -0,0 +1,87 @@
1
+<template>
2
+ <div class="soc-notes-list">
3
+ <div class="px-7 pt-4">
4
+ <n-input v-model:value="notesFilter" placeholder="Search notes..." clearable />
5
+ </div>
6
+ <n-spin :show="loadingNotes" style="min-height: 100px">
7
+ <div v-if="notesList?.length" class="p-7 pt-3 flex flex-col gap-2" style="container-type: inline-size">
8
+ <SocCaseNote v-for="note of notesList" :key="note.note_id" :note="note" />
9
+ </div>
10
+ <template v-else>
11
+ <n-empty description="No items found" class="justify-center h-48" v-if="!loadingNotes" />
12
+ </template>
13
+ </n-spin>
14
+ </div>
15
+</template>
16
+
17
+<script setup lang="ts">
18
+import { ref, watch, onBeforeMount } from "vue"
19
+import SocCaseNote from "./SocCaseNote.vue"
20
+import "@/assets/scss/vuesjv-override.scss"
21
+import Api from "@/api"
22
+import { useMessage, NSpin, NInput, NEmpty } from "naive-ui"
23
+import type { SocNote } from "@/types/soc/note.d"
24
+import { refDebounced } from "@vueuse/core"
25
+import { toRefs } from "vue"
26
+
27
+const requested = defineModel<boolean | undefined>("requested", { default: false })
28
+
29
+const props = defineProps<{ caseId: string | number }>()
30
+const { caseId } = toRefs(props)
31
+
32
+const loadingNotes = ref(false)
33
+const message = useMessage()
34
+const notesFilter = ref("")
35
+const notesFilterDebounced = refDebounced(notesFilter, 1000)
36
+let abortControllerNotes: AbortController | null = null
37
+
38
+const notesList = ref<SocNote[] | null>(null)
39
+
40
+function getNotes() {
41
+ loadingNotes.value = true
42
+
43
+ abortControllerNotes = new AbortController()
44
+
45
+ Api.soc
46
+ .getNotesByCase(
47
+ caseId.value.toString(),
48
+ { searchTerm: notesFilterDebounced.value || "" },
49
+ abortControllerNotes.signal
50
+ )
51
+ .then(res => {
52
+ if (res.data.success) {
53
+ notesList.value = res.data?.notes || null
54
+ } else {
55
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
56
+ }
57
+ })
58
+ .catch(err => {
59
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
60
+ })
61
+ .finally(() => {
62
+ loadingNotes.value = false
63
+ })
64
+}
65
+
66
+watch(notesFilterDebounced, () => {
67
+ if (abortControllerNotes !== null) {
68
+ abortControllerNotes?.abort()
69
+ }
70
+
71
+ setTimeout(() => {
72
+ getNotes()
73
+ }, 300)
74
+})
75
+
76
+watch(requested, val => {
77
+ if (val) {
78
+ getNotes()
79
+ }
80
+
81
+ requested.value = false
82
+})
83
+
84
+onBeforeMount(() => {
85
+ getNotes()
86
+})
87
+</script>
src/components/soc/SocCaseTimeline.vue
new
+48
@@ -0,0 +1,48 @@
1
+<template>
2
+ <n-timeline>
3
+ <n-timeline-item
4
+ v-for="(item, $index) of history"
5
+ :type="$index === 0 ? 'success' : undefined"
6
+ :key="item.label"
7
+ :title="item.label"
8
+ :time="item.timeString"
9
+ :line-type="$index === history.length - 2 ? 'dashed' : undefined"
10
+ />
11
+ </n-timeline>
12
+</template>
13
+
14
+<script setup lang="ts">
15
+import { useSettingsStore } from "@/stores/settings"
16
+import type { SocCaseExt } from "@/types/soc/case.d"
17
+import dayjs from "@/utils/dayjs"
18
+import { onBeforeMount, ref } from "vue"
19
+import _toNumber from "lodash/toSafeInteger"
20
+import { NTimeline, NTimelineItem } from "naive-ui"
21
+
22
+const { caseData } = defineProps<{ caseData: SocCaseExt }>()
23
+
24
+const dFormats = useSettingsStore().dateFormat
25
+
26
+const history = ref<
27
+ {
28
+ timeString: string
29
+ label: string
30
+ }[]
31
+>([])
32
+
33
+function formatDate(timestamp: string | number, utc: boolean = true): string {
34
+ return dayjs(timestamp).utc(utc).format(dFormats.datetimesec)
35
+}
36
+
37
+onBeforeMount(() => {
38
+ if (Object.keys(caseData.modification_history).length) {
39
+ for (const key in caseData.modification_history) {
40
+ const item = caseData.modification_history[key]
41
+ history.value.push({
42
+ timeString: formatDate(_toNumber(key) * 1000, false),
43
+ label: item.action + ` [${item.user}]`
44
+ })
45
+ }
46
+ }
47
+})
48
+</script>
src/components/soc/SocCasesList.vue
new
+250
@@ -0,0 +1,250 @@
1
+<template>
2
+ <div class="soc-cases-list">
3
+ <div class="header flex items-center justify-end gap-2" ref="header">
4
+ <div class="info grow flex gap-2">
5
+ <n-popover overlap placement="bottom-start">
6
+ <template #trigger>
7
+ <div class="bg-color border-radius">
8
+ <n-button size="small" class="!cursor-help">
9
+ <template #icon>
10
+ <Icon :name="InfoIcon"></Icon>
11
+ </template>
12
+ </n-button>
13
+ </div>
14
+ </template>
15
+ <div class="flex flex-col gap-2">
16
+ <div class="box">
17
+ Total :
18
+ <code>{{ total }}</code>
19
+ </div>
20
+ </div>
21
+ </n-popover>
22
+ </div>
23
+ <n-pagination
24
+ v-model:page="currentPage"
25
+ v-model:page-size="pageSize"
26
+ :page-slot="pageSlot"
27
+ :show-size-picker="showSizePicker"
28
+ :page-sizes="pageSizes"
29
+ :item-count="total"
30
+ :simple="simpleMode"
31
+ />
32
+ <n-popover
33
+ :show="showFilters"
34
+ trigger="manual"
35
+ overlap
36
+ placement="right"
37
+ style="padding-left: 0; padding-right: 0"
38
+ >
39
+ <template #trigger>
40
+ <div class="bg-color border-radius">
41
+ <n-badge :show="filtered" dot type="success" :offset="[-4, 0]">
42
+ <n-button size="small" @click="showFilters = true">
43
+ <template #icon>
44
+ <Icon :name="FilterIcon"></Icon>
45
+ </template>
46
+ </n-button>
47
+ </n-badge>
48
+ </div>
49
+ </template>
50
+ <div class="py-1 flex flex-col gap-2">
51
+ <div class="px-3">
52
+ <small>Cases older then:</small>
53
+ </div>
54
+ <div class="px-3">
55
+ <n-input-group>
56
+ <n-select
57
+ v-model:value="filters.unit"
58
+ :options="timeOptions"
59
+ placeholder="Time unit"
60
+ clearable
61
+ class="!w-28"
62
+ />
63
+ <n-input-number
64
+ v-model:value="filters.olderThan"
65
+ clearable
66
+ placeholder="Time"
67
+ class="!w-32"
68
+ />
69
+ </n-input-group>
70
+ </div>
71
+ <div class="px-3 flex justify-end gap-2">
72
+ <n-button size="small" @click="showFilters = false" secondary>Close</n-button>
73
+ <n-button size="small" @click="getData()" type="primary" secondary>Submit</n-button>
74
+ </div>
75
+ </div>
76
+ </n-popover>
77
+ </div>
78
+ <n-spin :show="loading">
79
+ <div class="list my-3">
80
+ <template v-if="casesList.length">
81
+ <SocCaseItem
82
+ v-for="caseData of itemsPaginated"
83
+ :key="caseData.case_id"
84
+ :caseData="caseData"
85
+ class="mb-2"
86
+ />
87
+ </template>
88
+ <template v-else>
89
+ <n-empty description="No items found" class="justify-center h-48" v-if="!loading" />
90
+ </template>
91
+ </div>
92
+ </n-spin>
93
+ <div class="footer flex justify-end">
94
+ <n-pagination
95
+ v-model:page="currentPage"
96
+ :page-size="pageSize"
97
+ :item-count="total"
98
+ :page-slot="6"
99
+ v-if="itemsPaginated.length > 3"
100
+ />
101
+ </div>
102
+ </div>
103
+</template>
104
+
105
+<script setup lang="ts">
106
+import { ref, onBeforeMount, computed, watch } from "vue"
107
+import {
108
+ useMessage,
109
+ NSpin,
110
+ NPopover,
111
+ NButton,
112
+ NEmpty,
113
+ NSelect,
114
+ NPagination,
115
+ NInputGroup,
116
+ NBadge,
117
+ NInputNumber
118
+} from "naive-ui"
119
+import Api from "@/api"
120
+import _cloneDeep from "lodash/cloneDeep"
121
+import _orderBy from "lodash/orderBy"
122
+import Icon from "@/components/common/Icon.vue"
123
+import { useResizeObserver } from "@vueuse/core"
124
+import type { CasesFilter } from "@/api/soc"
125
+import type { DateFormatted, SocCase } from "@/types/soc/case.d"
126
+import SocCaseItem from "./SocCaseItem.vue"
127
+import dayjs from "@/utils/dayjs"
128
+
129
+const message = useMessage()
130
+const loading = ref(false)
131
+const showFilters = ref(false)
132
+const casesList = ref<SocCase[]>([])
133
+
134
+const pageSize = ref(25)
135
+const currentPage = ref(1)
136
+const simpleMode = ref(false)
137
+const showSizePicker = ref(true)
138
+const pageSizes = [10, 25, 50, 100]
139
+const header = ref()
140
+const pageSlot = ref(8)
141
+
142
+const itemsPaginated = computed(() => {
143
+ const from = (currentPage.value - 1) * pageSize.value
144
+ const to = currentPage.value * pageSize.value
145
+
146
+ const list = _orderBy(
147
+ casesList.value.map(o => {
148
+ o.case_open_date = dayjs(o.case_open_date).format("YYYY/MM/DD") as DateFormatted
149
+ return o
150
+ }),
151
+ ["case_open_date"],
152
+ ["desc"]
153
+ )
154
+
155
+ return list.slice(from, to)
156
+})
157
+
158
+const FilterIcon = "carbon:filter-edit"
159
+const InfoIcon = "carbon:information"
160
+
161
+const total = computed<number>(() => {
162
+ return casesList.value.length || 0
163
+})
164
+
165
+const filters = ref<Partial<CasesFilter>>({})
166
+const lastFilters = ref<Partial<CasesFilter>>({})
167
+
168
+const filtered = computed<boolean>(() => {
169
+ return !!filters.value.unit && !!filters.value.olderThan
170
+})
171
+
172
+const timeOptions = [
173
+ { label: "Hours", value: "hours" },
174
+ { label: "Days", value: "days" },
175
+ { label: "Weeks", value: "weeks" }
176
+]
177
+
178
+watch(showFilters, val => {
179
+ if (!val) {
180
+ filters.value = _cloneDeep(lastFilters.value)
181
+ }
182
+})
183
+
184
+function getData() {
185
+ showFilters.value = false
186
+ loading.value = true
187
+
188
+ lastFilters.value = _cloneDeep(filters.value)
189
+
190
+ Api.soc
191
+ .getCases(filtered?.value ? (lastFilters.value as CasesFilter) : undefined)
192
+ .then(res => {
193
+ if (res.data.success) {
194
+ casesList.value = res.data?.cases || res.data?.cases_breached || []
195
+ } else {
196
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
197
+ }
198
+ })
199
+ .catch(err => {
200
+ casesList.value = []
201
+
202
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
203
+ })
204
+ .finally(() => {
205
+ loading.value = false
206
+ })
207
+}
208
+
209
+useResizeObserver(header, entries => {
210
+ const entry = entries[0]
211
+ const { width } = entry.contentRect
212
+
213
+ pageSlot.value = width < 650 ? 5 : 8
214
+ simpleMode.value = width < 450
215
+})
216
+
217
+onBeforeMount(() => {
218
+ getData()
219
+})
220
+</script>
221
+
222
+<style lang="scss" scoped>
223
+.soc-cases-list {
224
+ .list {
225
+ container-type: inline-size;
226
+ min-height: 200px;
227
+
228
+ .soc-case-item {
229
+ animation: soc-case-item-fade 0.3s forwards;
230
+ opacity: 0;
231
+
232
+ @for $i from 0 through 30 {
233
+ &:nth-child(#{$i}) {
234
+ animation-delay: $i * 0.05s;
235
+ }
236
+ }
237
+
238
+ @keyframes soc-case-item-fade {
239
+ from {
240
+ opacity: 0;
241
+ transform: translateY(10px);
242
+ }
243
+ to {
244
+ opacity: 1;
245
+ }
246
+ }
247
+ }
248
+ }
249
+}
250
+</style>
src/components/soc/SocUserAlerts.vue
new
+74
@@ -0,0 +1,74 @@
1
+<template>
2
+ <n-spin :show="loadingAlerts" :size="14">
3
+ <div class="flex alert-list items-center gap-3" v-if="!loadingAlerts">
4
+ <strong>{{ alertsList.length }}</strong>
5
+ <div class="flex flex-wrap gap-2">
6
+ <n-tooltip v-for="alert of alertsList" :key="alert.alert_id">
7
+ <template #trigger>
8
+ <code class="alert-btn" @click="gotoSocAlert(alert.alert_id)">#{{ alert.alert_id }}</code>
9
+ </template>
10
+ {{ alert.alert_title }}
11
+ </n-tooltip>
12
+ </div>
13
+ </div>
14
+ </n-spin>
15
+</template>
16
+
17
+<script setup lang="ts">
18
+import type { SocAlert } from "@/types/soc/alert.d"
19
+import { onBeforeMount, ref } from "vue"
20
+import Api from "@/api"
21
+import { useMessage, NTooltip, NSpin } from "naive-ui"
22
+import { useRouter } from "vue-router"
23
+
24
+const { userId } = defineProps<{
25
+ userId: string | number
26
+}>()
27
+
28
+const loadingAlerts = ref(false)
29
+const alertsList = ref<SocAlert[]>([])
30
+const router = useRouter()
31
+const message = useMessage()
32
+
33
+function gotoSocAlert(socId: string | number) {
34
+ router.push(`/soc/alerts?id=${socId}`).catch(() => {})
35
+}
36
+
37
+function getAlerts() {
38
+ loadingAlerts.value = true
39
+
40
+ Api.soc
41
+ .getAlertsByUser(userId.toString())
42
+ .then(res => {
43
+ if (res.data.success) {
44
+ alertsList.value = res.data?.alerts || []
45
+ } else {
46
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
47
+ }
48
+ })
49
+ .catch(err => {
50
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
51
+ })
52
+ .finally(() => {
53
+ loadingAlerts.value = false
54
+ })
55
+}
56
+
57
+onBeforeMount(() => {
58
+ getAlerts()
59
+})
60
+</script>
61
+
62
+<style lang="scss" scoped>
63
+.alert-list {
64
+ max-width: 200px;
65
+ .alert-btn {
66
+ cursor: pointer;
67
+ text-decoration: underline;
68
+
69
+ &:hover {
70
+ color: var(--primary-color);
71
+ }
72
+ }
73
+}
74
+</style>
src/components/soc/SocUsersList.vue
new
+146
@@ -0,0 +1,146 @@
1
+<template>
2
+ <div class="soc-users-list">
3
+ <n-spin :show="loadingUsers">
4
+ <n-scrollbar x-scrollable style="width: 100%">
5
+ <n-table :bordered="false" class="min-w-max">
6
+ <thead>
7
+ <tr>
8
+ <th>ID</th>
9
+ <th>Login</th>
10
+ <th>Name</th>
11
+ <th>Active</th>
12
+ <th style="max-width: 300px">Alerts</th>
13
+ </tr>
14
+ </thead>
15
+ <tbody>
16
+ <tr
17
+ v-for="user of usersList"
18
+ :key="user.user_id"
19
+ :class="{ highlight: highlight === user.user_id.toString() }"
20
+ >
21
+ <td>
22
+ <div class="flex gap-3 items-center">
23
+ <span>#{{ user.user_id }}</span>
24
+ <n-tooltip trigger="hover">
25
+ <template #trigger>
26
+ <Icon :name="InfoIcon" :size="16" class="cursor-help"></Icon>
27
+ </template>
28
+ {{ user.user_uuid }}
29
+ </n-tooltip>
30
+ </div>
31
+ </td>
32
+ <td>
33
+ {{ user.user_login }}
34
+ </td>
35
+ <td>
36
+ {{ user.user_name }}
37
+ </td>
38
+ <td>
39
+ <strong
40
+ class="active-field"
41
+ :class="{ success: user.user_active, warning: !user.user_active }"
42
+ >
43
+ {{ user.user_active ? "Yes" : "No" }}
44
+ </strong>
45
+ </td>
46
+ <td style="max-width: 300px">
47
+ <SocUserAlerts :user-id="user.user_id" />
48
+ </td>
49
+ </tr>
50
+ </tbody>
51
+ </n-table>
52
+ </n-scrollbar>
53
+ </n-spin>
54
+ </div>
55
+</template>
56
+
57
+<script setup lang="ts">
58
+import { ref, onBeforeMount, toRefs } from "vue"
59
+import { useMessage, NTable, NTooltip, NScrollbar, NSpin } from "naive-ui"
60
+import Icon from "@/components/common/Icon.vue"
61
+import SocUserAlerts from "./SocUserAlerts.vue"
62
+import Api from "@/api"
63
+import type { SocAlert } from "@/types/soc/alert.d"
64
+import type { SocUser } from "@/types/soc/user.d"
65
+
66
+const props = defineProps<{ highlight: string | null | undefined }>()
67
+const { highlight } = toRefs(props)
68
+
69
+const InfoIcon = "carbon:information"
70
+
71
+const message = useMessage()
72
+const loadingAlerts = ref(false)
73
+const loadingUsers = ref(false)
74
+const usersList = ref<SocUser[]>([])
75
+const alertsList = ref<SocAlert[]>([])
76
+
77
+function getUsers() {
78
+ loadingUsers.value = true
79
+
80
+ Api.soc
81
+ .getUsers()
82
+ .then(res => {
83
+ if (res.data.success) {
84
+ usersList.value = res.data?.users || []
85
+ } else {
86
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
87
+ }
88
+ })
89
+ .catch(err => {
90
+ usersList.value = []
91
+
92
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
93
+ })
94
+ .finally(() => {
95
+ loadingUsers.value = false
96
+ })
97
+}
98
+
99
+function getAlerts() {
100
+ loadingAlerts.value = true
101
+
102
+ Api.soc
103
+ .getAlerts()
104
+ .then(res => {
105
+ if (res.data.success) {
106
+ alertsList.value = res.data?.alerts || []
107
+ } else {
108
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
109
+ }
110
+ })
111
+ .catch(err => {
112
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
113
+ })
114
+ .finally(() => {
115
+ loadingAlerts.value = false
116
+ })
117
+}
118
+
119
+onBeforeMount(() => {
120
+ getUsers()
121
+ getAlerts()
122
+})
123
+</script>
124
+
125
+<style lang="scss" scoped>
126
+.soc-users-list {
127
+ border-radius: var(--border-radius);
128
+ overflow: hidden;
129
+ .active-field {
130
+ &.success {
131
+ color: var(--success-color);
132
+ }
133
+ &.warning {
134
+ color: var(--warning-color);
135
+ }
136
+ }
137
+
138
+ .highlight {
139
+ td {
140
+ border-top: 1px solid var(--primary-030-color);
141
+ border-bottom: 1px solid var(--primary-030-color);
142
+ background-color: var(--primary-005-color);
143
+ }
144
+ }
145
+}
146
+</style>
src/components/tables/Base.vue
+4
-5
@@ -94,11 +94,6 @@
94
<script lang="ts" setup>
95
import { NTable, NImage, NProgress, NTag, NButton, NPopselect } from "naive-ui"
96
import Icon from "@/components/common/Icon.vue"
97
-
98
-const DeleteIcon = "carbon:delete"
99
-const MenuIcon = "carbon:overflow-menu-vertical"
100
-const DownloadIcon = "carbon:cloud-download"
101
-
97
import dayjs from "@/utils/dayjs"
98
import { faker } from "@faker-js/faker"
99
import { ref, toRefs } from "vue"
@@ -114,6 +109,10 @@ const props = withDefaults(
109
)
110
const { rows, showActions, showDate } = toRefs(props)
111
112
+const DeleteIcon = "carbon:delete"
113
+const MenuIcon = "carbon:overflow-menu-vertical"
114
+const DownloadIcon = "carbon:cloud-download"
115
+
116
const stock = [
117
{
118
name: "In stock",
src/layouts/common/Navbar/items.tsx
+46
@@ -140,6 +140,52 @@ export default function getItems(mode: "vertical" | "horizontal", collapsed: boo
140
key: "Artifacts",
141
icon: renderIcon(BlankIcon)
142
},
143
+ {
144
+ label: "SOC",
145
+ key: "SOC",
146
+ icon: renderIcon(BlankIcon),
147
+ children: [
148
+ {
149
+ label: () =>
150
+ h(
151
+ RouterLink,
152
+ {
153
+ to: {
154
+ name: "Soc-Alerts"
155
+ }
156
+ },
157
+ { default: () => "Alerts" }
158
+ ),
159
+ key: "Soc-Alerts"
160
+ },
161
+ {
162
+ label: () =>
163
+ h(
164
+ RouterLink,
165
+ {
166
+ to: {
167
+ name: "Soc-Cases"
168
+ }
169
+ },
170
+ { default: () => "Cases" }
171
+ ),
172
+ key: "Soc-Cases"
173
+ },
174
+ {
175
+ label: () =>
176
+ h(
177
+ RouterLink,
178
+ {
179
+ to: {
180
+ name: "Soc-Users"
181
+ }
182
+ },
183
+ { default: () => "Users" }
184
+ ),
185
+ key: "Soc-Users"
186
+ }
187
+ ]
188
+ },
189
{
190
type: "divider"
191
},
src/router/index.ts
+31
-3
@@ -48,19 +48,19 @@ const router = createRouter({
48
path: "management",
49
name: "Graylog-Management",
50
component: () => import("@/views/socfortress/graylog/Management.vue"),
51
- meta: { title: "Management" }
51
+ meta: { title: "Graylog Management" }
52
},
53
{
54
path: "metrics",
55
name: "Graylog-Metrics",
56
component: () => import("@/views/socfortress/graylog/Metrics.vue"),
57
- meta: { title: "Metrics" }
57
+ meta: { title: "Graylog Metrics" }
58
},
59
{
60
path: "pipelines",
61
name: "Graylog-Pipelines",
62
component: () => import("@/views/socfortress/graylog/Pipelines.vue"),
63
- meta: { title: "Pipelines" }
63
+ meta: { title: "Graylog Pipelines" }
64
}
65
]
66
},
@@ -76,6 +76,34 @@ const router = createRouter({
76
component: () => import("@/views/socfortress/Artifacts.vue"),
77
meta: { title: "Artifacts", auth: true, roles: UserRole.All }
78
},
79
+ {
80
+ path: "/soc",
81
+ redirect: "/soc/alerts",
82
+ meta: {
83
+ auth: true,
84
+ roles: UserRole.All
85
+ },
86
+ children: [
87
+ {
88
+ path: "alerts",
89
+ name: "Soc-Alerts",
90
+ component: () => import("@/views/socfortress/soc/Alerts.vue"),
91
+ meta: { title: "SOC Alerts" }
92
+ },
93
+ {
94
+ path: "cases",
95
+ name: "Soc-Cases",
96
+ component: () => import("@/views/socfortress/soc/Cases.vue"),
97
+ meta: { title: "SOC Cases" }
98
+ },
99
+ {
100
+ path: "users",
101
+ name: "Soc-Users",
102
+ component: () => import("@/views/socfortress/soc/Users.vue"),
103
+ meta: { title: "SOC Users" }
104
+ }
105
+ ]
106
+ },
107
108
// DEMO PAGES ==========================================================
109
src/types/alerts.d.ts
+5
-3
@@ -30,11 +30,11 @@ export interface Alert {
30
_index: string
31
_id: string
32
_score: null
33
- _source: AlertSource
33
+ _source: AlertSourceContent
34
sort: Timestamp[]
35
}
36
37
-export interface AlertSource {
37
+export interface AlertSourceContent {
38
agent_id: string
39
agent_ip_city_name?: string
40
agent_ip_country_code?: string
@@ -253,7 +253,9 @@ export enum AlertSourceDataLogsourceCategory {
253
254
export enum AlertSourceDataLogsourceProduct {
255
Sigma = "sigma",
256
- Windows = "windows"
256
+ Windows = "windows",
257
+ Osquery = "osquery",
258
+ Sysmon = "sysmon"
259
}
260
261
export enum AlertSourceDataStatus {
src/types/soc/alert.d.ts
new
+100
@@ -0,0 +1,100 @@
1
+import type { AlertSourceContent } from "../alerts"
2
+
3
+export interface SocAlert {
4
+ alert_classification_id: string | null
5
+ alert_context: AlertContext
6
+ alert_creation_time: string
7
+ alert_customer_id: number
8
+ alert_description: string
9
+ alert_id: number
10
+ alert_note: null | string
11
+ alert_owner_id: number | null
12
+ alert_resolution_status_id: string | null
13
+ alert_severity_id: number
14
+ alert_source_content: AlertSourceContent
15
+ alert_source_event_time: string
16
+ alert_source_link: null | string
17
+ alert_source_ref: string | null
18
+ alert_source: AlertSource
19
+ alert_status_id: number
20
+ alert_tags: null | string
21
+ alert_title: string
22
+ alert_uuid: string
23
+ assets: any[]
24
+ cases: any[]
25
+ classification: string | null
26
+ comments: any[]
27
+ customer: Customer
28
+ iocs: any[]
29
+ modification_history: { [key: string]: ModificationHistory }
30
+ owner: Owner | null
31
+ resolution_status: string | null
32
+ severity: Severity
33
+ status: Status
34
+}
35
+
36
+type IPAddress = `${number}.${number}.${number}.${number}`
37
+
38
+export interface AlertContext {
39
+ alert_id: string
40
+ alert_level: number
41
+ alert_name: string
42
+ asset_ip: IPAddress
43
+ asset_name: string
44
+ asset_type: number
45
+ customer_id?: string
46
+ process_id: string
47
+ rule_id: string
48
+ rule_mitre_id: string
49
+ rule_mitre_tactic: string
50
+ rule_mitre_technique: string
51
+}
52
+
53
+export enum AlertSource {
54
+ CoPilot = "CoPilot",
55
+ Wazuh = "Wazuh"
56
+}
57
+
58
+export interface Customer {
59
+ customer_description: null | string
60
+ custom_attributes: { [key: string]: any } | null
61
+ creation_date: string
62
+ customer_sla: null | string
63
+ customer_name: string
64
+ last_update_date: string
65
+ client_uuid: string
66
+ customer_id: number
67
+}
68
+
69
+export interface ModificationHistory {
70
+ user: string
71
+ user_id: number
72
+ action: string
73
+}
74
+
75
+export interface Owner {
76
+ id: number
77
+ user_login: string
78
+ user_name: string
79
+ user_email: string
80
+}
81
+
82
+export interface Severity {
83
+ severity_description: string
84
+ severity_name: SeverityNameEnum
85
+ severity_id: number
86
+}
87
+
88
+export enum SeverityNameEnum {
89
+ High = "High"
90
+}
91
+
92
+export interface Status {
93
+ status_description: string
94
+ status_name: StatusName
95
+ status_id: number
96
+}
97
+
98
+export enum StatusName {
99
+ Assigned = "Assigned"
100
+}
src/types/soc/asset.d.ts
new
+36
@@ -0,0 +1,36 @@
1
+export interface SocAsset {
2
+ analysis_status: string
3
+ analysis_status_id: number
4
+ asset_compromise_status_id: number
5
+ asset_description: string
6
+ asset_domain: string
7
+ asset_icon_compromised: string
8
+ asset_icon_not_compromised: string
9
+ asset_id: number
10
+ asset_ip: string
11
+ asset_name: string
12
+ asset_tags: string
13
+ asset_type: string
14
+ asset_type_id: number
15
+ asset_uuid: string
16
+ ioc_links: null | string
17
+ link: SocAssetLink[]
18
+}
19
+type DateDay = number
20
+type DateMonth = number
21
+type DateYear = number
22
+type DayFormatted = `${DateYear}-${DateMonth}-${DateDay}`
23
+
24
+export interface SocAssetLink {
25
+ case_name: string
26
+ case_open_date: DayFormatted
27
+ asset_description: string
28
+ asset_compromise_status_id: number | null
29
+ asset_id: number
30
+ case_id: number
31
+}
32
+
33
+export interface SocAssetsState {
34
+ object_last_update: string | Date
35
+ object_state: number
36
+}
src/types/soc/case.d.ts
new
+65
@@ -0,0 +1,65 @@
1
+export interface SocCase {
2
+ access_level: number
3
+ case_close_date: DateFormatted
4
+ case_description: string
5
+ case_id: number
6
+ case_name: string
7
+ case_open_date: DateFormatted
8
+ case_soc_id: string
9
+ case_uuid: string
10
+ classification: string | null
11
+ classification_id: number | null
12
+ client_name: string
13
+ opened_by: string
14
+ opened_by_user_id: number
15
+ owner: string
16
+ owner_id: number
17
+ state_id: number
18
+ state_name: StateName
19
+}
20
+
21
+type DateDay = number
22
+type DateMonth = number
23
+type DateYear = number
24
+export type DateFormatted = `${DateMonth}/${DateDay}/${DateYear}`
25
+type DayFormatted = `${DateYear}-${DateMonth}-${DateDay}`
26
+
27
+export enum StateName {
28
+ Closed = "Closed",
29
+ Open = "Open"
30
+}
31
+
32
+export interface SocCaseExt {
33
+ case_description: string
34
+ case_id: number
35
+ case_name: string
36
+ case_soc_id: string
37
+ case_tags: string
38
+ case_uuid: string
39
+ classification: string | null
40
+ classification_id: number | null
41
+ close_date: DayFormatted
42
+ custom_attributes: string | null
43
+ customer_id: number
44
+ customer_name: string
45
+ initial_date: Date | string
46
+ modification_history: { [key: string]: ModificationHistory }
47
+ open_by_user: string
48
+ open_by_user_id: number
49
+ open_date: DayFormatted
50
+ owner: string
51
+ owner_id: number
52
+ protagonists: string[]
53
+ reviewer: string | null
54
+ reviewer_id: number | null
55
+ state_id: number
56
+ state_name: StateName
57
+ status_id: number
58
+ status_name: string
59
+}
60
+
61
+export interface ModificationHistory {
62
+ action: string
63
+ user: string
64
+ user_id: number
65
+}
src/types/soc/note.d.ts
new
+28
@@ -0,0 +1,28 @@
1
+export interface SocNote {
2
+ note_details: NoteDetails
3
+ note_id: number
4
+ note_title: string
5
+}
6
+
7
+export interface NoteDetails {
8
+ custom_attributes: { [key: string]: any }
9
+ group_id: number
10
+ group_title: string
11
+ group_uuid: string
12
+ note_content: string
13
+ note_creationdate: string | Date
14
+ note_id: number
15
+ note_lastupdate: string | Date
16
+ note_title: string
17
+ note_uuid: string
18
+}
19
+
20
+export interface SocNewNote {
21
+ custom_attributes: { [key: string]: any }
22
+ note_content: string
23
+ note_creationdate: string | Date
24
+ note_id: number
25
+ note_lastupdate: string | Date
26
+ note_title: string
27
+ note_uuid: string
28
+}
src/types/soc/user.d.ts
new
+7
@@ -0,0 +1,7 @@
1
+export interface SocUser {
2
+ user_active: boolean
3
+ user_id: number
4
+ user_login: string
5
+ user_name: string
6
+ user_uuid: string
7
+}
src/utils/dayjs.ts
+2
-2
@@ -4,12 +4,12 @@ import locale_en from "dayjs/locale/en.js"
4
import customParseFormat from "dayjs/plugin/customParseFormat"
5
import duration from "dayjs/plugin/duration"
6
import relativeTime from "dayjs/plugin/relativeTime"
7
+import utc from "dayjs/plugin/utc"
8
/*
9
import isSameOrAfter from "dayjs/plugin/isSameOrAfter"
9
-import utc from "dayjs/plugin/utc"
10
dayjs.extend(isSameOrAfter)
11
-dayjs.extend(utc)
11
*/
12
+dayjs.extend(utc)
13
dayjs.extend(relativeTime)
14
dayjs.extend(duration)
15
dayjs.extend(customParseFormat)
src/views/socfortress/Agents.vue
+18
-9
@@ -17,14 +17,23 @@
17
<n-spin class="w-full h-full overflow-hidden flex flex-col" :show="loadingAgents">
18
<n-scrollbar class="grow">
19
<div class="agents-list flex flex-grow flex-col gap-3">
20
- <AgentCard
21
- v-for="agent in agentsFiltered"
22
- :key="agent.agent_id"
23
- :agent="agent"
24
- show-actions
25
- @delete="syncAgents()"
26
- @click="gotoAgentPage(agent)"
27
- />
20
+ <template v-if="agentsFiltered.length">
21
+ <AgentCard
22
+ v-for="agent in agentsFiltered"
23
+ :key="agent.agent_id"
24
+ :agent="agent"
25
+ show-actions
26
+ @delete="syncAgents()"
27
+ @click="gotoAgentPage(agent)"
28
+ />
29
+ </template>
30
+ <template v-else>
31
+ <n-empty
32
+ description="No items found"
33
+ class="justify-center h-48"
34
+ v-if="!loadingAgents"
35
+ />
36
+ </template>
37
</div>
38
</n-scrollbar>
39
</n-spin>
@@ -41,7 +50,7 @@ import AgentToolbar from "@/components/agents/AgentToolbar.vue"
50
import { isAgentOnline } from "@/components/agents/utils"
51
import Api from "@/api"
52
import { useRouter } from "vue-router"
44
-import { useMessage, NSpin, NScrollbar } from "naive-ui"
53
+import { useMessage, NSpin, NScrollbar, NEmpty } from "naive-ui"
54
import _debounce from "lodash/debounce"
55
56
const message = useMessage()
src/views/socfortress/soc/Alerts.vue
new
+21
@@ -0,0 +1,21 @@
1
+<template>
2
+ <div class="page">
3
+ <SocAlertsList :highlight="highlight" />
4
+ </div>
5
+</template>
6
+
7
+<script setup lang="ts">
8
+import SocAlertsList from "@/components/soc/SocAlertsList.vue"
9
+import { onBeforeMount, ref } from "vue"
10
+import { useRoute } from "vue-router"
11
+
12
+const route = useRoute()
13
+
14
+const highlight = ref<string | undefined>(undefined)
15
+
16
+onBeforeMount(() => {
17
+ if (route.query?.id) {
18
+ highlight.value = route.query.id.toString()
19
+ }
20
+})
21
+</script>
src/views/socfortress/soc/Cases.vue
new
+9
@@ -0,0 +1,9 @@
1
+<template>
2
+ <div class="page">
3
+ <SocCasesList />
4
+ </div>
5
+</template>
6
+
7
+<script setup lang="ts">
8
+import SocCasesList from "@/components/soc/SocCasesList.vue"
9
+</script>
src/views/socfortress/soc/Users.vue
new
+21
@@ -0,0 +1,21 @@
1
+<template>
2
+ <div class="page">
3
+ <SocUsersList :highlight="highlight" />
4
+ </div>
5
+</template>
6
+
7
+<script setup lang="ts">
8
+import SocUsersList from "@/components/soc/SocUsersList.vue"
9
+import { onBeforeMount, ref } from "vue"
10
+import { useRoute } from "vue-router"
11
+
12
+const route = useRoute()
13
+
14
+const highlight = ref<string | undefined>(undefined)
15
+
16
+onBeforeMount(() => {
17
+ if (route.query?.user_id) {
18
+ highlight.value = route.query.user_id.toString()
19
+ }
20
+})
21
+</script>