type: visualization

title: DVWA login attempts

title: DVWA login attempts

type: metric

type: count

schema: metric

customLabel: DVWA login attempts

colorSchema: Green to Red

type: index-pattern


title: Brute-force detections

title: Brute-force detections

customLabel: Brute-force (rule 100002)


title: Docker exec/run

title: Docker exec/run

customLabel: Docker exec (rule 100100)


title: Nmap scans (Suricata)

title: Nmap scans (Suricata)

customLabel: Nmap scans (sid 9000001)


title: Lab detection signals over time

description: Authored signals: rules 100001/100002/100100, Suricata nmap 9000001, FIM (syscheck).

title: Lab detection signals over time

type: histogram

schema: segment

field: timestamp

interval: auto

type: terms

schema: group

order: desc

type: category

position: bottom

type: linear

type: value

position: left

mode: normal

text: Count

mode: stacked

label: Count

legendPosition: right

query: rule.id:(100001 or 100002 or 100100) or data.alert.signature_id:9000001 or rule.groups:syscheck


title: Alerts by severity level

description: All alerts grouped by rule.level (Wazuh default field).

title: Alerts by severity level

order: asc

text: rule.level

text: Count


title: Alerts by agent

title: Alerts by agent

type: pie

otherBucketLabel: Other


title: Top rule groups

title: Top rule groups

type: table

schema: bucket

totalFunc: sum


title: Authentication failures

description: Wazuh default auth-failure detections (sshd, pam, etc).

title: Authentication failures

type: area

text: Count

interpolate: linear

query: rule.groups:authentication_failed or rule.groups:authentication_failures


type: search

title: Lab signal events

description: Raw events for the authored detection signals.

sort: timestamp desc

query: rule.id:(100001 or 100002 or 100100) or data.alert.signature_id:9000001 or rule.groups:syscheck


title: Lab signal events (table)

title: Lab signal events (table)

query: rule.id:(100001 or 100002 or 100100) or data.alert.signature_id:9000001 or rule.groups:syscheck


type: dashboard

title: DevSecOps Lab — Detection Signals

description: Authored signals (DVWA brute force 100001/100002, docker exec 100100, Suricata nmap 9000001, FIM tamper) plus high-value default Wazuh panels.

timeTo: now