wazuh-alerts-4.x-*


Question: data.vulnerability.severity : "Critical"

Question: data.vulnerability.severity : "High"

Question: data.vulnerability.severity : "Medium"

Question: data.vulnerability.severity : "Low"

Top 5 values of data.vulnerability.severity

Alert severity

Top 3 values of data.vulnerability.severity

Vulnerabilities heat map

Events

wazuh-vulnerabilities-v1.0


Question: rule.level >= 12

rule.groups : "authentication_failed" or "win_authentication_failed" or "authentication_failures"

Question: rule.groups : "authentication_failed" or "win_authentication_failed" or "authentication_failures"

Question: rule.groups: "authentication_success"

Alerts evolution - Top 5 agents

Top Mitre

Top Mitre ATT&K tactics

Security alerts

wazuh-security-events-v1.0


PCI DSS requirements

Requirements by agent

PCI DSS

Recent events

wazuh-pci-dss-v1.0


Question: rule.groups : "rootcheck"

Emotet malware activity

Question: rule.groups : "rootcheck"

Rootkits activity over time

Question: rule.groups : "rootcheck"

Security alerts

wazuh-malware-detection-v1.0


Alert groups

Question: rule.groups : "audit"

Events

Security alerts

wazuh-incident-response-v1.0


Top 5 events

Events by source over time

Events

wazuh-docker-listener-v1.0


Question: rule.groups : "amazon"

Events by source over time

Sources

e

Events

wazuh-amazon-aws-v1.0