Wazuh
Wazuh security overview with tabs for severity, alerts, timeline, top lists, agents, vulnerabilities, file integrity and authentication failures.
One widget for a Wazuh deployment. Hover the widget to show the tab switcher at the top; on touch devices it stays visible. The selected tab is saved with the widget, so the board opens on the same tab next time. Use Visible tabs to offer only some tabs, or pick a single tab to pin the widget to one view and hide the switcher.
Legacy Wazuh widgets are not automatically converted and no longer load. Replace them with the consolidated Wazuh widget.
| Tab | Shows |
|---|---|
| Severity | Alerts in the time range split by severity, with the change against the previous period of equal length |
| Alerts | Recent alerts at or above a rule level with rule IDs, MITRE ATT&CK techniques, agent and source IP |
| Timeline | Stacked chart of alerts over time by severity |
| Top lists | Top rules, agents, source IPs or MITRE ATT&CK tactics and techniques by alert count |
| Agents | Agent status tiles and a sortable, reorderable and resizable agent table |
| Vulnerabilities | Vulnerability counts by severity, top CVEs and the most vulnerable agents |
| File integrity | Recent file integrity monitoring (syscheck) events |
| Auth failures | Failed logins and brute-force alerts per agent with sparklines and top source IPs |
Wazuh rule levels are grouped into four severities: low (0-6), medium (7-11), high (12-14) and critical (15 and above).
The Wazuh integration also feeds other widgets:
- Notifications lists recent high and critical alerts.
- Stats offers agent counts and 24-hour alert counts as metrics.
Supported Integrations
Requirements
Alerts, vulnerabilities and file integrity events come from the Wazuh indexer (wazuh-alerts-*, wazuh-states-vulnerabilities-*). The agents tab works with server API credentials alone, or with indexer credentials using the latest wazuh-monitoring-* snapshot. See the Wazuh integration for the credential options, certificates and the optional dashboard URL used for links.
Adding the widget
Add the widget from the board's Add board content menu in edit mode.
Configuration
Options that only affect one tab name that tab in their description.
| Name | Description | Values | Default value |
|---|---|---|---|
| Visible tabs | Tabs offered in the switcher. With a single tab the switcher is hidden, so the widget shows only that view. |
| All |
| Time range | Period used by the severity, alerts, timeline, top lists, file integrity and auth failures tabs. Agents and vulnerabilities always show the current state. |
| Last 24 hours |
| Minimum rule level (timeline and top lists) | Ignore alerts below this Wazuh rule level. | 0-16 | 0 |
| Show trend against the previous period | Severity tab: show the change against the period right before the selected one. | yes / no | yes |
| Show footer | Severity tab: show the previous total, the highest rule level and the indexer health. | yes / no | yes |
| Alerts: minimum rule level | Alerts tab: only list alerts at or above this Wazuh rule level. | 0-16 | 7 |
| Alerts: number of alerts | Alerts tab: number of alerts listed. | 1-100 | 25 |
| Show MITRE ATT&CK techniques | Alerts tab: show technique tags on each alert. | yes / no | yes |
| Show agent | Alerts tab. | yes / no | yes |
| Show source IP | Alerts tab. | yes / no | yes |
| Show rule ID | Alerts tab. | yes / no | no |
| Interval | Timeline tab: bucket size of the chart. Automatic picks one from the time range. |
| Automatic |
| Chart type | Timeline tab: stacked area or stacked bars. |
| Stacked area |
| Y axis scale | Timeline tab: square root keeps high and critical alerts visible next to thousands of low ones. |
| Linear |
| Show legend with totals | Timeline tab: show the totals per severity under the chart. | yes / no | yes |
| Rank | Top lists tab: what to rank by alert count. |
| Top rules |
| Top list entries | Top lists tab: number of entries. | 1-50 | 8 |
| Show bars | Top lists tab: show a bar per entry. | yes / no | yes |
| Show agents | Agents tab: the status filter applied when the board loads. The status tiles toggle it. |
| All agents |
| Sort by | Agents tab: initial sort column. Click a column header to sort, drag headers to reorder and drag edges to resize; the layout is saved with the widget. |
| Status |
| Agents: show Wazuh version column | Agents tab: outdated agents are highlighted. | yes / no | yes |
| Agents: show groups column | Agents tab. | yes / no | yes |
| Rank CVEs by | Vulnerabilities tab. |
| Highest score |
| CVE severity | Vulnerabilities tab: lowest severity listed. |
| All severities |
| Number of CVEs | Vulnerabilities tab: CVEs listed. | 1-50 | 8 |
| Number of agents | Vulnerabilities tab: most vulnerable agents listed. | 1-50 | 5 |
| Show most vulnerable agents | Vulnerabilities tab. | yes / no | yes |
| Events | File integrity tab: which syscheck events to list. |
| All events |
| File integrity events | File integrity tab: number of events. | 1-100 | 20 |
| Include Windows registry events | File integrity tab. | yes / no | yes |
| Authentication failure agents | Auth failures tab: number of agents listed. | 1-25 | 6 |
| Show top source IPs | Auth failures tab. | yes / no | yes |