type: visualization

title: SOC Active Custom Rules - Events Over Time

type: histogram

legendPosition: right

scale: linear

type: count

schema: metric

schema: segment

interval: auto

description: Timeline for active SOC production custom rules (1103xx, 1104xx, 1105xx)

query: rule.groups: soc_prod*

type: index-pattern


title: SOC Active Custom Rules - Rule Map

title: SOC Active Custom Rules - Rule Map

type: table

type: terms

schema: bucket

order: desc

description: Rule ID, description, and count in one table

query: rule.groups: soc_prod*


title: SOC Active Custom Rules - Severity

title: SOC Active Custom Rules - Severity

type: pie

description: Severity distribution for active custom rules

query: rule.groups: soc_prod*


title: SOC Active Custom Rules - Decoder Coverage

description: Decoder coverage for active custom rule hits

query: rule.groups: soc_prod*


type: dashboard

title: SOC Active Custom Rules Overview

description: Dashboard for active Wazuh SOC production custom rules (110301-110523)