Creating custom dashboards

Metric aggregation

Metric aggregation calculates metrics by aggregating data values. This contains the actual values of the metric to be calculated. Metric aggregation is typically represented on the Y-axis.

There are different types of metric aggregations as shown below:

1. Average: This is the average of a numeric field. It calculates the arithmetic mean of an existing set of data values. The Average is obtained by adding up all the data values and dividing its sum by the total count.

   

   Average aggregation helps in calculating the average duration of security incidents, average severity score of alerts, average response time to resolve incidents and more.

2. Count: This is the number of data values that match a query within the selected index pattern. It counts the number of data points in a set and provides the total count of a queried event.

   

   Count aggregation helps in determining the total number of security events, number of alerts triggered by a specific rule, the number of failed login attempts and more.

3. Max: This is the maximum value of a numeric field within a selected index pattern. Max identifies the highest value among a group of values.

   

   Max aggregation helps in identifying the maximum severity level of alerts, maximum CPU usage, the maximum number of failed login attempts within a given timeframe and more.

4. Median: This is the median value in a numeric field. Median determines the middle value in a sorted set of values within a selected index pattern by separating the higher half from the lower half of the data.

   

   Median aggregation helps to provide the middle value of event durations, helping to identify the typical or median response time.

5. Min: This is the minimum value in a numeric field set. Min identifies the lowest value among a group of values.

   

   Min aggregation helps in determining the minimum severity level of alerts, minimum disk space usage, the minimum number of successful logins and more.

6. Percentile Ranks: This is the ranking for values within a given numeric field in percentile. Percentile rank calculates the percentage of values below a specific value in a set and expresses how a given value compares to the distribution of the data.

   

   Percentile rank aggregation helps in assessing the relative severity of alerts in comparison to the entire dataset. This determines the percentile rank of a specific severity score.

7. Percentile: This aggregation changes numeric field values into percentile bands. Percentile identifies specific data values that correspond to specific percentiles. For example, the 90th percentile represents the value below which 90% of the data falls.

   

8. Standard Deviation: This measures the amount of variation in a set of numeric field values. It evaluates the average distance between each value and the mean value.

   

   Standard deviation aggregation can help identify changes in event durations. This provides insights into the volatility or stability of security events.

9. Sum: This is the total sum of a numeric field. Sum calculates the total sum of a set of values by adding up all the values in the dataset within a selected index pattern.

   

   Sum aggregation helps in determining the total count of specific event types, the total number of successful logins, the total disk space used and more.

10. Top Hit: This aggregation identifies the top data point based on a specified criteria or sort order. Top hit is commonly used to extract specific information from the dataset based on the top metric.

    

    Top hit aggregation helps in extracting key information from security events, such as retrieving the most recent log entry for a particular host or user.

11. Unique Count: This is the count of unique values within a designated field. It counts the number of unique or distinct values in a set. Unique count disregards any duplicate event and provides the count of unique values.

    

    Unique count aggregation helps in determining the number of distinct IP addresses accessing a system, the number of unique users triggering alerts, the count of unique event types and more.

Bucket aggregation

This is used to determine the type of information we are trying to get from the dataset. The bucket aggregation determines how the data is segmented or grouped such as by date. It is typically represented on the X-axis.

These are the following types of bucket aggregations for a pie chart:

1. Date Histogram: This aggregation is used to display a numeric field and organize that using the date.

   

2. Date Range: This aggregation is used to report the values within a date range which we can specify.

   

3. Filters: This aggregation is used to apply filters on data.

   

4. Histogram: This aggregation is used for numeric fields, where we can provide the integer interval for the selected field.

   

5. IPv4 Range: This aggregation provides us with the option to set the range using IPv4 addresses.

   

6. Range: This aggregation is used to provide the range of numeric field values.

   

7. Significant Terms: This aggregation returns interesting or unusual occurrences of terms in a set.

   

8. Terms: This aggregation enables us to pick the top or bottom n elements of the selected field.

   

Both the Y-axis and the X-axis are used to plot the data points on a visualization chart.

Creating a Bar chart

Horizontal Bar: This is a type of bar chart where rectangular bars are displayed horizontally. The length or width of each bar corresponds to a particular value. This allows an easy comparison between different data points. Horizontal bar charts are often used to visualize data that has distinct categories or to show rankings.

1. From the Visualize tab, click Create Visualization, select the Horizontal bar visualization format and use wazuh-alerts-* as the index pattern name.

   

2. In the Data section, on the Y-axis of Metrics, set the following value:

   • Aggregation = Count

3. Add a X-axis in Bucket and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

   • Order = Descending

   • Size = 10

4. Click the Update button.

   

5. Click the upper-right Save button and assign a title to save the visualization.

Vertical Bar: This is a type of bar chart where the bars are displayed vertically, with the length or height of each bar representing a particular value. Vertical bar charts are suitable for comparing data across different categories. They are commonly used to display rankings, comparisons, or distribution of values.

1. From the Visualize tab, select the Vertical Bar visualization format and use wazuh-alerts-* as the index pattern name.

   

2. In the Data section, on the Y-axis of Metrics, set the following value:

   • Aggregation = Count

3. Add a X-axis in Bucket and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

   • Order = Descending

   • Size = 10

4. Click the Update button.

   

5. Click the upper-right Save button and assign a title to save the visualization.

Creating a Pie chart

1. From the Visualize tab, click Create Visualization, select the Pie visualization format and use wazuh-alerts-* as the index pattern name.

   

2. In the Data section, on the Slice size of Metrics, set the following value:

   • Aggregation = Count

3. Add a Split slices in Bucket and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

   • Order = Descending

   • Size = 10

4. In the Options section, customize the Pie chart by toggling on show label.

5. Click the Update button.

   

6. Click the upper-right Save button and assign a title to save the visualization.

Creating a Area chart

1. From the Visualize tab, click Create Visualization, select the area visualization format, and use wazuh-alerts-* as the index pattern name.

   

2. On the Y-axis of Metrics, set the following values:

   • Aggregation = Max

   • Field = data.memory.used_bytes

3. Add another Y-axis in Metric and set the following values:

   • Aggregation = Max

   • Field = data.memory.available_bytes

4. Add an X-axis in Bucket and set the following values:

   • Aggregation = Date Histogram

   • Field = timestamp

5. Click the Update button.

   

6. Click the upper-right Save button and assign a title to save the visualization.

Creating a Line chart

1. From the Visualize tab, click Create Visualization, select the Line visualization format and use wazuh-alerts-* as the index pattern name.

2. On the Y-axis, in Metrics, set the following values:

   • Aggregation = Max

   • Field = data.memory.usage_%

3. Add an X-axis in Buckets and set the following values:

   • Aggregation = Date Histogram

   • Field = timestamp

   • Minimum interval = Minute

4. Click the Update button.

   

5. Click the upper-right Save button and assign a title to save the visualization.

Creating a Heat Map

1. From the Visualize tab, click Create Visualization, select the Heat Map visualization format and use wazuh-alerts-* as the index pattern name.

   

2. On the Y-axis, in Metrics, set the following value:

   • Aggregation = Count

3. Add an X-axis in Buckets and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

   • Order = Descending

   • Size = 5

4. Add a Y-axis in Buckets and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.techniques

   • Order by = Metric: Count

   • Order = Descending

   • Size = 5

5. Click the Update button.

   

Creating a Data table

1. From the Visualize tab, click Create Visualization, select the Data Table visualization format and use wazuh-alerts-* as the index pattern name.

2. On the Metric in Metrics data, set the following values:

   • Aggregation = Max

   • Field = data.disk_used_bytes

3. Add an additional metric

   • Aggregation = Max

   • Field = data.disk_free_bytes

4. Click the Update button.

   

5. Click the upper-right Save button and assign a title to save the visualization.

Creating a Metric

1. From the Visualize tab, click Create Visualization, select the Metric visualization format and use wazuh-alerts-* as the index pattern name.

2. On the Metric in Metrics data, set the following values:

   • Aggregation = Max

   • Field = data.memory_usage_%

3. Click the Update button.

   

4. Click the upper-right Save button and assign a title to save the visualization.

Creating a Goal

1. From the Visualize tab, click Create Visualization, select the Goal visualization format and use wazuh-alerts-* as the index pattern name.

2. On the Metric in Data, set the following values:

   • Aggregation = Max

   • Field = data.sca.passed

3. Add a Split group in Buckets and set the following values:

   • Aggregation = Terms

   • Field = data.sca.total_checks

4. In the Options section, customize the Ranges to match the range of existing sca rules.

   

5. Click the Update button.

   

6. Click the upper-right Save button and assign a title to save the visualization.

Creating a Gauge

1. From the Visualize tab, click Create Visualization, select the Gauge visualization format and use wazuh-alerts-* as the index pattern name.

2. On the Metric in Metrics data, set the following values:

   • Aggregation = Max

   • Field = data.disk_usage_%

3. Click the Update button.

   

4. Click the upper-right Save button and assign a title to save the visualization.

Creating a Coordinate map

1. From the Visualize tab, click Create Visualization, select the Coordinate Map visualization format and use wazuh-alerts-* as the index pattern name.

   

2. On the Metric in Data, set the following values:

   • Aggregation = Count

3. Add a Geo coordinate in Buckets and set the following values:

   • Aggregation = Geohash

   • Field = OriginLocation

4. Click the Update button.

   

5. Click the upper-right Save button and assign a title to save the visualization.

Create region map

1. From the Visualize tab, click Create Visualization, select the Region Map visualization format and use wazuh-alerts-* as the index pattern name.

   

2. On the Metric in Data, set the following values:

   • Aggregation = Count

3. Add a Shape field in Buckets and set the following values:

   • Aggregation = Terms

   • Field = DestCountry

   • Order by = Metric: Count

   • Order = Descending

4. Click the Update button.

   

5. Click the upper-right Save button and assign a title to save the visualization.

Creating a Visualization Builder

1. From the Visualize tab, click Create Visualization, select the VisBuilder visualization format and use wazuh-alerts-* as the index pattern name.

   

   Drag a field to the configuration panel to generate a visualization.

2. On the Y-axis set aggregation to count.

3. On an X-axis place rule.mitre.technique.

4. On the split series place rule.mitre.tactics.

   

Creating a TSVB

1. From the Visualize tab, select the TSVB visualization format.

   

2. On the Metric in Data, set the following values:

   • Aggregation = Count

   • Group by = Terms

   • By = rule.mitre.tactic

   

Creating a tag cloud

1. From the Visualize tab, click Create Visualization, select the Tag cloud visualization format and use wazuh-alerts-* as the index pattern name.

   

2. On the Metric in Metrics data, set the following value:

   • Tag size = Count

3. Add a new Tag in Bucket data and set the following values:

   • Aggregation = Terms

   • Field = rule.mitre.tactic

   • Order by = Metric: Count

4. Click the Update button.

   

5. Click the upper-right Save button and assign a title to save the visualization.

Creating a markdown

From the Visualize tab, click Create Visualization, select the Markdown visualization format and use wazuh-alerts-* as the index pattern name.

After that, we need to do the following:

1. On the Data tab, add the text content in the given text-area.

2. On the Options tab, Increase or decrease the font using the controller.

3. Click on the Update button to show the markdown:

   

4. Click the upper-right Save button and assign a title to save the visualization.

Creating controls

1. From the Visualize tab, click Create Visualization, select the Controls visualization format.

   

2. Add a new Options list and set the control Label as Mitre tactic.

3. Choose a source for the chart. Here we selected wazuh-alerts-* as the index to use.

4. Select the field rule.mitre.tactic.

5. Add a new Range slider and set the control Label as Quantity.

6. Select wazuh-alerts-* as the index to use.

7. Select the field rule.level.

8. Click the Update button.

   

9. Click the upper-right Save button and assign a title to save the visualization.

Creating a Gantt chart

1. From the Visualize tab, click Create Visualization, select the Gantt Chart visualization format and use wazuh-alerts-* as the index pattern name.

   

2. Choose a source for the chart. Here we selected wazuh-alerts-* as the index to use.

3. On the Metric in Metrics data, under Event, select a log data.

4. On the Start time field for the Event, select a timestamp field for the start of a schedule. This is the timestamp used for the beginning of the selected Event.

5. On the Duration field for the Event, select a time interval field for the Event duration. This is the amount of time that is added to the start time.

6. On the Results field, select the number of events that will be shown on the chart. The events will be sequenced based on the Start time, from the earliest to the latest.

7. To adjust the colors, axis labels and time format, navigate to the Panel settings.

8. Click the Update button.

9. Click the upper-right Save button and assign a title to save the visualization.

Hover over a bar to see the duration of that event.

Creating Timeline

1. From the Visualize tab, click Create Visualization, select the Timeline visualization format.

   

2. Choose a source for the chart. In the Timeline expression windows, within .es(*). The expression .es(*) is a wildcard value that represents all the indexes currently within the ThreatLockDown indexer, combined together. Here we selected wazuh-alerts-* as the index to use.

   .es(index=wazuh-alerts-*)
   

   

   Where:

   • Index represents the data storage unit containing the data to be used for visualization.

   • Interval represents the time duration between data points or events.

   • Timefield represents a specific field in a dataset that holds timestamp or time information for each data point.

   • Metric represents the quantitative measure to be used from the data.

   • Offset is used to adjust the time displayed on the timeline for aligning with specific events.

   • opensearchDashboards represents a platform that provides a web-based interface for visualizing and exploring real-time data.

   • Q represents a query or set of queries used to filter and retrieve specific data for display.

   • Split represents the function that divides or groups data into segments based on a specified parameter for visualization and analysis.

   A sample query:

   .es(index=wazuh-alerts-*, timefield=@timestamp, metric=count:request).aggregate(function=avg)