{"id": "dsl-m-dvwa", "type": "visualization", "attributes": {"title": "DVWA login attempts", "description": "", "visState": "{\"title\": \"DVWA login attempts\", \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"DVWA login attempts\"}}], \"params\": {\"addTooltip\": true, \"addLegend\": false, \"type\": \"metric\", \"metric\": {\"percentageMode\": false, \"useRanges\": false, \"colorSchema\": \"Green to Red\", \"metricColorMode\": \"None\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"labels\": {\"show\": true}, \"invertColors\": false, \"style\": {\"bgFill\": \"#000\", \"bgColor\": false, \"labelColor\": false, \"subText\": \"\", \"fontSize\": 48}}}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"rule.id:100001\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-m-brute", "type": "visualization", "attributes": {"title": "Brute-force detections", "description": "", "visState": "{\"title\": \"Brute-force detections\", \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Brute-force (rule 100002)\"}}], \"params\": {\"addTooltip\": true, \"addLegend\": false, \"type\": \"metric\", \"metric\": {\"percentageMode\": false, \"useRanges\": false, \"colorSchema\": \"Green to Red\", \"metricColorMode\": \"None\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"labels\": {\"show\": true}, \"invertColors\": false, \"style\": {\"bgFill\": \"#000\", \"bgColor\": false, \"labelColor\": false, \"subText\": \"\", \"fontSize\": 48}}}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"rule.id:100002\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-m-docker", "type": "visualization", "attributes": {"title": "Docker exec/run", "description": "", "visState": "{\"title\": \"Docker exec/run\", \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Docker exec (rule 100100)\"}}], \"params\": {\"addTooltip\": true, \"addLegend\": false, \"type\": \"metric\", \"metric\": {\"percentageMode\": false, \"useRanges\": false, \"colorSchema\": \"Green to Red\", \"metricColorMode\": \"None\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"labels\": {\"show\": true}, \"invertColors\": false, \"style\": {\"bgFill\": \"#000\", \"bgColor\": false, \"labelColor\": false, \"subText\": \"\", \"fontSize\": 48}}}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"rule.id:100100\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-m-nmap", "type": "visualization", "attributes": {"title": "Nmap scans (Suricata)", "description": "", "visState": "{\"title\": \"Nmap scans (Suricata)\", \"type\": \"metric\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {\"customLabel\": \"Nmap scans (sid 9000001)\"}}], \"params\": {\"addTooltip\": true, \"addLegend\": false, \"type\": \"metric\", \"metric\": {\"percentageMode\": false, \"useRanges\": false, \"colorSchema\": \"Green to Red\", \"metricColorMode\": \"None\", \"colorsRange\": [{\"from\": 0, \"to\": 10000}], \"labels\": {\"show\": true}, \"invertColors\": false, \"style\": {\"bgFill\": \"#000\", \"bgColor\": false, \"labelColor\": false, \"subText\": \"\", \"fontSize\": 48}}}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"data.alert.signature_id:9000001\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-timeline", "type": "visualization", "attributes": {"title": "Lab detection signals over time", "description": "Authored signals: rules 100001/100002/100100, Suricata nmap 9000001, FIM (syscheck).", "visState": "{\"title\": \"Lab detection signals over time\", \"type\": \"histogram\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"field\": \"timestamp\", \"useNormalizedOpenSearchInterval\": true, \"interval\": \"auto\", \"drop_partials\": false, \"min_doc_count\": 1, \"extended_bounds\": {}}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"group\", \"params\": {\"field\": \"rule.description\", \"orderBy\": \"1\", \"order\": \"desc\", \"size\": 8, \"otherBucket\": false, \"missingBucket\": false}}], \"params\": {\"type\": \"histogram\", \"grid\": {\"categoryLines\": false}, \"categoryAxes\": [{\"id\": \"CategoryAxis-1\", \"type\": \"category\", \"position\": \"bottom\", \"show\": true, \"scale\": {\"type\": \"linear\"}, \"labels\": {\"show\": true, \"filter\": true, \"truncate\": 100}, \"title\": {}}], \"valueAxes\": [{\"id\": \"ValueAxis-1\", \"name\": \"LeftAxis-1\", \"type\": \"value\", \"position\": \"left\", \"show\": true, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"labels\": {\"show\": true, \"rotate\": 0, \"filter\": false, \"truncate\": 100}, \"title\": {\"text\": \"Count\"}}], \"seriesParams\": [{\"show\": true, \"type\": \"histogram\", \"mode\": \"stacked\", \"data\": {\"label\": \"Count\", \"id\": \"1\"}, \"valueAxis\": \"ValueAxis-1\", \"drawLinesBetweenPoints\": true, \"showCircles\": true}], \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"times\": [], \"addTimeMarker\": false, \"labels\": {\"show\": false}}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"rule.id:(100001 or 100002 or 100100) or data.alert.signature_id:9000001 or rule.groups:syscheck\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-severity", "type": "visualization", "attributes": {"title": "Alerts by severity level", "description": "All alerts grouped by rule.level (Wazuh default field).", "visState": "{\"title\": \"Alerts by severity level\", \"type\": \"histogram\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"rule.level\", \"orderBy\": \"_key\", \"order\": \"asc\", \"size\": 16, \"otherBucket\": false, \"missingBucket\": false}}], \"params\": {\"type\": \"histogram\", \"grid\": {\"categoryLines\": false}, \"categoryAxes\": [{\"id\": \"CategoryAxis-1\", \"type\": \"category\", \"position\": \"bottom\", \"show\": true, \"scale\": {\"type\": \"linear\"}, \"labels\": {\"show\": true, \"filter\": true, \"truncate\": 100}, \"title\": {\"text\": \"rule.level\"}}], \"valueAxes\": [{\"id\": \"ValueAxis-1\", \"name\": \"LeftAxis-1\", \"type\": \"value\", \"position\": \"left\", \"show\": true, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"labels\": {\"show\": true, \"rotate\": 0, \"filter\": false, \"truncate\": 100}, \"title\": {\"text\": \"Count\"}}], \"seriesParams\": [{\"show\": true, \"type\": \"histogram\", \"mode\": \"stacked\", \"data\": {\"label\": \"Count\", \"id\": \"1\"}, \"valueAxis\": \"ValueAxis-1\", \"drawLinesBetweenPoints\": true, \"showCircles\": true}], \"addTooltip\": true, \"addLegend\": false, \"legendPosition\": \"right\", \"times\": [], \"addTimeMarker\": false, \"labels\": {\"show\": true}}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-topagents", "type": "visualization", "attributes": {"title": "Alerts by agent", "description": "", "visState": "{\"title\": \"Alerts by agent\", \"type\": \"pie\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"segment\", \"params\": {\"field\": \"agent.name\", \"orderBy\": \"1\", \"order\": \"desc\", \"size\": 10, \"otherBucket\": true, \"otherBucketLabel\": \"Other\", \"missingBucket\": false}}], \"params\": {\"type\": \"pie\", \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"isDonut\": true, \"labels\": {\"show\": false, \"values\": true, \"last_level\": true, \"truncate\": 100}}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-topgroups", "type": "visualization", "attributes": {"title": "Top rule groups", "description": "", "visState": "{\"title\": \"Top rule groups\", \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"rule.groups\", \"orderBy\": \"1\", \"order\": \"desc\", \"size\": 15, \"otherBucket\": false, \"missingBucket\": false}}], \"params\": {\"perPage\": 10, \"showPartialRows\": false, \"showMetricsAtAllLevels\": false, \"showTotal\": false, \"totalFunc\": \"sum\", \"percentageCol\": \"\"}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-authfail", "type": "visualization", "attributes": {"title": "Authentication failures", "description": "Wazuh default auth-failure detections (sshd, pam, etc).", "visState": "{\"title\": \"Authentication failures\", \"type\": \"area\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"field\": \"timestamp\", \"useNormalizedOpenSearchInterval\": true, \"interval\": \"auto\", \"drop_partials\": false, \"min_doc_count\": 1, \"extended_bounds\": {}}}], \"params\": {\"type\": \"area\", \"grid\": {\"categoryLines\": false}, \"categoryAxes\": [{\"id\": \"CategoryAxis-1\", \"type\": \"category\", \"position\": \"bottom\", \"show\": true, \"scale\": {\"type\": \"linear\"}, \"labels\": {\"show\": true, \"filter\": true, \"truncate\": 100}, \"title\": {}}], \"valueAxes\": [{\"id\": \"ValueAxis-1\", \"name\": \"LeftAxis-1\", \"type\": \"value\", \"position\": \"left\", \"show\": true, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"labels\": {\"show\": true, \"rotate\": 0, \"filter\": false, \"truncate\": 100}, \"title\": {\"text\": \"Count\"}}], \"seriesParams\": [{\"show\": true, \"type\": \"area\", \"mode\": \"stacked\", \"data\": {\"label\": \"Count\", \"id\": \"1\"}, \"valueAxis\": \"ValueAxis-1\", \"drawLinesBetweenPoints\": true, \"showCircles\": true, \"interpolate\": \"linear\"}], \"addTooltip\": true, \"addLegend\": false, \"times\": [], \"addTimeMarker\": false}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"rule.groups:authentication_failed or rule.groups:authentication_failures\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-search-signals", "type": "search", "attributes": {"title": "Lab signal events", "description": "Raw events for the authored detection signals.", "hits": 0, "columns": ["agent.name", "rule.id", "rule.level", "rule.description", "data.srcip", "data.alert.signature"], "sort": [["timestamp", "desc"]], "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"rule.id:(100001 or 100002 or 100100) or data.alert.signature_id:9000001 or rule.groups:syscheck\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-signals-table", "type": "visualization", "attributes": {"title": "Lab signal events (table)", "description": "", "visState": "{\"title\": \"Lab signal events (table)\", \"type\": \"table\", \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"rule.description\", \"orderBy\": \"1\", \"order\": \"desc\", \"size\": 20, \"otherBucket\": false, \"missingBucket\": false}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"agent.name\", \"orderBy\": \"1\", \"order\": \"desc\", \"size\": 5, \"otherBucket\": false, \"missingBucket\": false}}], \"params\": {\"perPage\": 10, \"showPartialRows\": false, \"showMetricsAtAllLevels\": false, \"showTotal\": false, \"totalFunc\": \"sum\", \"percentageCol\": \"\"}}", "uiStateJSON": "{}", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"rule.id:(100001 or 100002 or 100100) or data.alert.signature_id:9000001 or rule.groups:syscheck\", \"language\": \"kuery\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dsl-dashboard", "type": "dashboard", "attributes": {"title": "DevSecOps Lab \u2014 Detection Signals", "description": "Authored signals (DVWA brute force 100001/100002, docker exec 100100, Suricata nmap 9000001, FIM tamper) plus high-value default Wazuh panels.", "hits": 0, "panelsJSON": "[{\"version\": \"2.13.0\", \"gridData\": {\"x\": 0, \"y\": 0, \"w\": 12, \"h\": 8, \"i\": \"1\"}, \"panelIndex\": \"1\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_1\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 12, \"y\": 0, \"w\": 12, \"h\": 8, \"i\": \"2\"}, \"panelIndex\": \"2\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_2\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 24, \"y\": 0, \"w\": 12, \"h\": 8, \"i\": \"3\"}, \"panelIndex\": \"3\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_3\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 36, \"y\": 0, \"w\": 12, \"h\": 8, \"i\": \"4\"}, \"panelIndex\": \"4\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_4\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 0, \"y\": 8, \"w\": 32, \"h\": 15, \"i\": \"5\"}, \"panelIndex\": \"5\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_5\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 32, \"y\": 8, \"w\": 16, \"h\": 15, \"i\": \"6\"}, \"panelIndex\": \"6\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_6\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 0, \"y\": 23, \"w\": 16, \"h\": 15, \"i\": \"7\"}, \"panelIndex\": \"7\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_7\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 16, \"y\": 23, \"w\": 16, \"h\": 15, \"i\": \"8\"}, \"panelIndex\": \"8\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_8\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 32, \"y\": 23, \"w\": 16, \"h\": 15, \"i\": \"9\"}, \"panelIndex\": \"9\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_9\"}, {\"version\": \"2.13.0\", \"gridData\": {\"x\": 0, \"y\": 38, \"w\": 48, \"h\": 15, \"i\": \"10\"}, \"panelIndex\": \"10\", \"embeddableConfig\": {}, \"panelRefName\": \"panel_10\"}]", "optionsJSON": "{\"useMargins\": true, \"hidePanelTitles\": false}", "version": 1, "timeRestore": true, "timeTo": "now", "timeFrom": "now-7d", "refreshInterval": {"pause": true, "value": 0}, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\": {\"query\": \"\", \"language\": \"kuery\"}, \"filter\": []}"}}, "references": [{"name": "panel_1", "type": "visualization", "id": "dsl-m-dvwa"}, {"name": "panel_2", "type": "visualization", "id": "dsl-m-brute"}, {"name": "panel_3", "type": "visualization", "id": "dsl-m-docker"}, {"name": "panel_4", "type": "visualization", "id": "dsl-m-nmap"}, {"name": "panel_5", "type": "visualization", "id": "dsl-timeline"}, {"name": "panel_6", "type": "visualization", "id": "dsl-severity"}, {"name": "panel_7", "type": "visualization", "id": "dsl-topagents"}, {"name": "panel_8", "type": "visualization", "id": "dsl-topgroups"}, {"name": "panel_9", "type": "visualization", "id": "dsl-authfail"}, {"name": "panel_10", "type": "visualization", "id": "dsl-signals-table"}]}