type: visualization

title: Proposal Appendix A+B - Events Over Time

type: histogram

legendPosition: right

scale: linear

type: count

schema: metric

schema: segment

interval: auto

description: Combined Appendix A and B simulated events

query: rule.groups: soc_prod*

type: index-pattern


title: Proposal Appendix A vs B

title: Proposal Appendix A vs B

type: pie

type: filters

query: rule.groups: appendix_a

label: Appendix A

query: rule.groups: appendix_b

label: Appendix B

description: Split by Appendix A and B markers

query: rule.groups: soc_prod*


title: Proposal Appendix A+B - Top Rules

title: Proposal Appendix A+B - Top Rules

type: table

type: terms

schema: bucket

order: desc

description: Top matched Wazuh rules for Appendix A+B simulations

query: rule.groups: soc_prod*


title: Proposal Appendix A+B - Severity

title: Proposal Appendix A+B - Severity

description: Severity distribution for Appendix A+B simulations

query: rule.groups: soc_prod*


title: Proposal Appendix A+B - Use Case Items

title: Proposal Appendix A+B - Use Case Items

query: rule.id: 110301

query: rule.id: 110302

query: rule.id: 110311

query: rule.id: 110312

query: rule.id: 110313

query: rule.id: 110314

query: rule.id: 110315

query: rule.id: 110316

query: rule.id: 110317

query: rule.id: 110318

query: rule.id: 110319

query: rule.id: 110320

query: rule.id: 110331

query: rule.id: 110332

query: rule.id: 110333

query: rule.id: 110334

query: rule.id: 110335

query: rule.id: 110341

query: rule.id: 110342

query: rule.id: 110343

query: rule.id: __no_rule__

query: rule.id: __no_rule__

query: rule.id: 110346

query: rule.id: __no_rule__

query: rule.id: 110348

query: rule.id: 110349

query: rule.id: 110350

query: rule.id: 110353

query: rule.id: 110352

query: rule.id: 110354

query: rule.id: __no_rule__

query: rule.id: __no_rule__

query: rule.id: __no_rule__

query: rule.id: __no_rule__

query: rule.id: __no_rule__

query: rule.id: 110359

query: rule.id: __no_rule__

query: rule.id: 110361

query: rule.id: 110362

query: rule.id: 110361

query: rule.id: 110362

query: rule.id: 110401

query: rule.id: 110402

query: rule.id: 110403

query: rule.id: 110411

query: rule.id: 110421

query: rule.id: 110422

query: rule.id: 110423

query: rule.id: 110424

query: rule.id: 110425

query: rule.id: 110426

description: Table for each Appendix A+B use-case item. Click + on a row to filter logs.

query: rule.groups: soc_prod*


type: dashboard

title: SOC Proposal Appendix A+B Overview

description: Combined dashboard for Appendix A and B simulation logs