search

wazuh / wazuh-dashboard-plugins

Plugins for Wazuh Dashboard
https://wazuh.com/
GNU General Public License v2.0
424 stars 176 forks source link

Update dashboards #5818

Closed gdiazlo closed 10 months ago

gdiazlo commented 1 year ago

Description

Following the release of our integrations' documentation, we want to incorporate the new dashboards into our main application.

Functional requirements

Non-functional requirements

Implementation restrictions

Plan

Machi3mfl commented 1 year ago

Research

components involved in rendering visualizations in dashboards:

All these components are custom react components

sequenceDiagram

(some) Dashboard->>WzVisualize: use wz-visualize to render the visualizations
WzVisualize-->>KibanaVis: load the visualizations for the current dashboard
loop 
    KibanaVis->>KibanaVis: WzVisualize uses the KibanaVis depending on the number of vis defined for the dashboard
end
Note right of KibanaVis: The KibanaVis component receives the vis ID to get the vis definition

The dashboard configurations are defined in (public/components/visualize/visualizations.js)

For instance:

export const visualizations = {
  general: {
    rows: [
      {
        height: 360,
        vis: [
          {
            title: 'Alerts evolution - Top 5 agents',
            id: 'Wazuh-App-Overview-General-Alerts-evolution-Top-5-agents',
            width: 70
          },
          {
            title: 'Top MITRE ATT&CKS',
            id: 'Wazuh-App-Overview-General-Alerts-Top-Mitre',
            width: 40
          }
        ]
      }
    ]
  },
]

The visualizations are definitions are the server-side: /server/integration-files/visualizations

For instance (The security events dashboard - without agent pinned):


export default [
  {
    _id: 'Wazuh-App-Overview-General-Agents-status',
    _source: {
      title: 'Agents status',
      visState: JSON.stringify({
        title: 'Agents Status',
        type: 'histogram',
        params: {
          type: 'histogram',
          grid: { categoryLines: false, style: { color: '#eee' } },
          categoryAxes: [
            {
              id: 'CategoryAxis-1',
              type: 'category',
              position: 'bottom',
              show: true,
              style: {},
              scale: { type: 'linear' },
              labels: { show: true, filter: true, truncate: 100 },
              title: {},
            },
          ],
          valueAxes: [
            {
              id: 'ValueAxis-1',
              name: 'LeftAxis-1',
              type: 'value',
              position: 'left',
              show: true,
              style: {},
              scale: { type: 'linear', mode: 'normal' },
              labels: { show: true, rotate: 0, filter: false, truncate: 100 },
              title: { text: 'Count' },
            },
          ],
          seriesParams: [
            {
              show: true,
              mode: 'normal',
              type: 'line',
              drawLinesBetweenPoints: true,
              showCircles: true,
              interpolate: 'cardinal',
              lineWidth: 3.5,
              data: { id: '4', label: 'Unique count of id' },
              valueAxis: 'ValueAxis-1',
            },
          ],
          addTooltip: true,
          addLegend: true,
          legendPosition: 'right',
          times: [],
          addTimeMarker: false,
        },
        aggs: [
          {
            id: '2',
            enabled: true,
            type: 'date_histogram',
            interval: '1ms',
            schema: 'segment',
            params: {
              field: 'timestamp',
              interval: '1ms',
              customInterval: '2h',
              min_doc_count: 1,
              extended_bounds: {},
            },
          },
          {
            id: '3',
            enabled: true,
            type: 'terms',
            schema: 'group',
            params: { field: 'status', size: 5, order: 'desc', orderBy: '_term' },
          },
          {
            id: '4',
            enabled: true,
            type: 'cardinality',
            schema: 'metric',
            params: { field: 'id' },
          },
        ],
      }),
      uiStateJSON: JSON.stringify({
        vis: { colors: { active: UI_COLOR_AGENT_STATUS.active, disconnected: UI_COLOR_AGENT_STATUS.disconnected, pending: UI_COLOR_AGENT_STATUS.pending, never_connected: UI_COLOR_AGENT_STATUS.never_connected } },
      }),
      description: '',
      version: 1,
      kibanaSavedObjectMeta: {
        searchSourceJSON: JSON.stringify({
          index: 'wazuh-monitoring',
          filter: [],
          query: { query: '', language: 'lucene' },
        }),
      },
    },
    _type: 'visualization',
  },

Related docs

chantal-kelm commented 11 months ago
Section in Wazuh Web Name ID Section in monolith plugin Changes Design New dashboard
Endpoint security Security Configuration Assessment security-configuration-assessment Modules > Security Configuration Assessment RENAME Configuration assessment Design New dashboard
Endpoint security Policy monitoring policy-monitoring Modules > Policy monitoring RENAME to Malware detection (this is rootcheck now) Design New dashboard
Endpoint security Integrity monitoring integrity-monitoring Modules > Integrity monitoring RENAME to File integrity monitoring Design New dashboard
Endpoint security System auditing system-auditing Modules > System auditing DELETE
Endpoint security OpenSCAP openscap Modules > OpenSCAP DELETE
Endpoint security CIS-CAT ciscat Modules > CIS-CAT DELETE
Threat intelligence Security events security-events Modules > Security events RENAME Threat hunting Design New dashboard
Threat intelligence Vulnerabilities vulnerabilities Modules > Vulnerabilities RENAME to Vulnerability detection New dashboard
Threat intelligence MITRE ATT&CK mitre-attack Modules > MITRE ATT&CK
Threat intelligence Virustotal virustotal Modules > Virustotal
Security operations PCI DSS pci-dss Modules > PCI DSS Design New dashboard
Security operations GDPR gdpr Modules > GDPR
Security operations HIPAA hipaa Modules > HIPAA
Security operations NIST 800-53 nist-800-53 Modules > NIST 800-53
Security operations TSC tsc Modules > TSC
Security operations IT Hygiene it-hygiene Agents > {agent_id} -> Inventory
Security operations Osquery osquery Modules > Osquery DELETE
Cloud security AWS amazon-web-services Modules > AWS Design New dashboard
Cloud security Google Cloud google-cloud Modules > Google Cloud
Cloud security GitHub github Modules > GitHub
Cloud security Office365 office365 Modules > Office365
Cloud security Docker listener docker-listener Modules > Docker listener RENAME to Docker Design New dashboard
chantal-kelm commented 10 months ago

It has been decided to remove the new integrity monitoring, security events, Amazon AWS and PCI DSS dashboards for now, as we will continue to work on them in the future. We have also decided to add the top 5 images graph to the new docker dashboard.