wazuh-dashboard.ndjson

Dashboard consolidado (6 painéis sobre wazuh-alerts-*), importável em Stack Management > Saved Objects > Import no Wazuh Dashboard.

{"id": "viz-alerts-by-level", "type": "visualization", "attributes": {"title": "Alertas por Nivel", "visState": "{\"title\":\"Alertas por Nivel\",\"type\":\"histogram\",\"params\":{\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Contagem\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Contagem\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCirclesOnLines\":true,\"interpolate\":\"linear\",\"lineWidth\":2}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"rule.level\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":20,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}", "uiStateJSON": "{}", "description": "", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"index\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"kuery\"}}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "viz-top-rules", "type": "visualization", "attributes": {"title": "Top 10 Regras Disparadas", "visState": "{\"title\": \"Top 10 Regras Disparadas\", \"type\": \"table\", \"params\": {\"perPage\": 10, \"showPartialRows\": false, \"showMetricsAtAllLevels\": false, \"showTotal\": false, \"totalFunc\": \"sum\"}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"terms\", \"schema\": \"bucket\", \"params\": {\"field\": \"rule.description\", \"orderBy\": \"1\", \"order\": \"desc\", \"size\": 10, \"otherBucket\": false, \"otherBucketLabel\": \"Other\", \"missingBucket\": false, \"missingBucketLabel\": \"Missing\"}}]}", "uiStateJSON": "{}", "description": "", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"index\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"kuery\"}}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "viz-agents-by-os", "type": "visualization", "attributes": {"title": "Agentes por Grupo (Windows vs Linux)", "visState": "{\"title\": \"Agentes por Grupo (Windows vs Linux)\", \"type\": \"pie\", \"params\": {\"type\": \"pie\", \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"isDonut\": true, \"labels\": {\"show\": true, \"values\": true, \"last_level\": true, \"truncate\": 100}}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"filters\", \"schema\": \"segment\", \"params\": {\"filters\": [{\"input\": {\"query\": \"data.win.system.eventID: *\", \"language\": \"kuery\"}, \"label\": \"Windows\"}, {\"input\": {\"query\": \"NOT data.win.system.eventID: *\", \"language\": \"kuery\"}, \"label\": \"Linux\"}]}}]}", "uiStateJSON": "{}", "description": "", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"index\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"kuery\"}}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "viz-auth-failed-timeline", "type": "visualization", "attributes": {"title": "Falhas de Autenticacao ao Longo do Tempo (Windows vs Linux)", "visState": "{\"title\": \"Falhas de Autenticacao ao Longo do Tempo (Windows vs Linux)\", \"type\": \"line\", \"params\": {\"grid\": {\"categoryLines\": false}, \"categoryAxes\": [{\"id\": \"CategoryAxis-1\", \"type\": \"category\", \"position\": \"bottom\", \"show\": true, \"style\": {}, \"scale\": {\"type\": \"linear\"}, \"labels\": {\"show\": true, \"filter\": true, \"truncate\": 100}, \"title\": {}}], \"valueAxes\": [{\"id\": \"ValueAxis-1\", \"name\": \"LeftAxis-1\", \"type\": \"value\", \"position\": \"left\", \"show\": true, \"style\": {}, \"scale\": {\"type\": \"linear\", \"mode\": \"normal\"}, \"labels\": {\"show\": true, \"rotate\": 0, \"filter\": false, \"truncate\": 100}, \"title\": {\"text\": \"Contagem\"}}], \"seriesParams\": [{\"show\": true, \"type\": \"line\", \"mode\": \"normal\", \"data\": {\"label\": \"Contagem\", \"id\": \"1\"}, \"valueAxis\": \"ValueAxis-1\", \"drawLinesBetweenPoints\": true, \"showCirclesOnLines\": true, \"interpolate\": \"linear\", \"lineWidth\": 2}], \"addTooltip\": true, \"addLegend\": true, \"legendPosition\": \"right\", \"times\": [], \"addTimeMarker\": false}, \"aggs\": [{\"id\": \"1\", \"enabled\": true, \"type\": \"count\", \"schema\": \"metric\", \"params\": {}}, {\"id\": \"2\", \"enabled\": true, \"type\": \"date_histogram\", \"schema\": \"segment\", \"params\": {\"field\": \"timestamp\", \"timeRange\": {\"from\": \"now-24h\", \"to\": \"now\"}, \"useNormalizedEsInterval\": true, \"interval\": \"auto\", \"drop_partials\": false, \"min_doc_count\": 1, \"extended_bounds\": {}}}, {\"id\": \"3\", \"enabled\": true, \"type\": \"filters\", \"schema\": \"group\", \"params\": {\"filters\": [{\"input\": {\"query\": \"data.win.system.eventID: *\", \"language\": \"kuery\"}, \"label\": \"Windows\"}, {\"input\": {\"query\": \"NOT data.win.system.eventID: *\", \"language\": \"kuery\"}, \"label\": \"Linux\"}]}}]}", "uiStateJSON": "{}", "description": "", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"index\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[],\"query\":{\"query\":\"rule.groups: authentication_failed or rule.groups: authentication_failures\",\"language\":\"kuery\"}}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "viz-mitre-top", "type": "visualization", "attributes": {"title": "Top Tecnicas MITRE ATT&CK", "visState": "{\"title\":\"Top Tecnicas MITRE ATT&CK\",\"type\":\"horizontal_bar\",\"params\":{\"grid\":{\"categoryLines\":false},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"filter\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"BottomAxis-1\",\"type\":\"value\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Contagem\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Contagem\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCirclesOnLines\":true,\"interpolate\":\"linear\",\"lineWidth\":2}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"rule.mitre.id\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}", "uiStateJSON": "{}", "description": "", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"index\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"kuery\"}}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "viz-syscheck-changes", "type": "visualization", "attributes": {"title": "Alteracoes de Integridade de Arquivos (FIM)", "visState": "{\"title\":\"Alteracoes de Integridade de Arquivos (FIM)\",\"type\":\"table\",\"params\":{\"perPage\":10,\"showPartialRows\":false,\"showMetricsAtAllLevels\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"bucket\",\"params\":{\"field\":\"syscheck.path\",\"orderBy\":\"1\",\"order\":\"desc\",\"size\":10,\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}", "uiStateJSON": "{}", "description": "", "version": 1, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"index\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"filter\":[],\"query\":{\"query\":\"rule.groups: syscheck\",\"language\":\"kuery\"}}"}}, "references": [{"name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern", "id": "wazuh-alerts-*"}]}
{"id": "dash-windows-linux-monitoring", "type": "dashboard", "attributes": {"title": "Monitoramento Windows + Linux (Wazuh)", "hits": 0, "description": "Dashboard consolidado de seguranca para agentes Windows e Linux", "panelsJSON": "[{\"version\":\"2.19.0\",\"gridData\":{\"x\":0,\"y\":0,\"w\":16,\"h\":15,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{},\"panelRefName\":\"panel_1\"},{\"version\":\"2.19.0\",\"gridData\":{\"x\":16,\"y\":0,\"w\":16,\"h\":15,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{},\"panelRefName\":\"panel_2\"},{\"version\":\"2.19.0\",\"gridData\":{\"x\":32,\"y\":0,\"w\":16,\"h\":15,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{},\"panelRefName\":\"panel_3\"},{\"version\":\"2.19.0\",\"gridData\":{\"x\":0,\"y\":15,\"w\":24,\"h\":15,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{},\"panelRefName\":\"panel_4\"},{\"version\":\"2.19.0\",\"gridData\":{\"x\":24,\"y\":15,\"w\":24,\"h\":15,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{},\"panelRefName\":\"panel_5\"},{\"version\":\"2.19.0\",\"gridData\":{\"x\":0,\"y\":30,\"w\":48,\"h\":15,\"i\":\"6\"},\"panelIndex\":\"6\",\"embeddableConfig\":{},\"panelRefName\":\"panel_6\"}]", "optionsJSON": "{\"useMargins\":true,\"syncColors\":false,\"hidePanelTitles\":false}", "version": 1, "timeRestore": true, "timeTo": "now", "timeFrom": "now-24h", "refreshInterval": {"pause": false, "value": 30000}, "kibanaSavedObjectMeta": {"searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"}}, "references": [{"name": "panel_1", "type": "visualization", "id": "viz-alerts-by-level"}, {"name": "panel_2", "type": "visualization", "id": "viz-top-rules"}, {"name": "panel_3", "type": "visualization", "id": "viz-agents-by-os"}, {"name": "panel_4", "type": "visualization", "id": "viz-auth-failed-timeline"}, {"name": "panel_5", "type": "visualization", "id": "viz-mitre-top"}, {"name": "panel_6", "type": "visualization", "id": "viz-syscheck-changes"}]}

Cada linha do bloco acima é um objeto JSON independente (formato NDJSON). Para usar: copiar o bloco inteiro, colar em um arquivo .ndjson local e importar em Stack Management > Saved Objects > Import.