Dashboards & Visualizations

Why Dashboards Matter

In Lessons 2.1 and 2.2, you learned what log sources feed the SIEM and how to read individual alerts. But a SOC analyst doesn't investigate alerts one at a time in a vacuum — you need the big picture. That's what dashboards give you.

A well-built dashboard is your situational awareness screen. It answers the questions you should be asking every 15 minutes during a shift:

• Are we under attack right now? (alert volume spike)
• What's being targeted? (top attacked hosts)
• Is anything broken? (agent health, data gaps)
• What's changed since last shift? (trend comparison)

Without a dashboard, you're staring at a list of individual alerts with no context. With a dashboard, you can spot a brute force campaign across 50 hosts in 2 seconds — something that would take 30 minutes scanning individual alerts.

SOC Reality: In most SOCs, the first thing an analyst does when sitting down for a shift is glance at the dashboard. If the graphs look normal, you start working your alert queue. If something looks wrong — a spike, a gap, a new pattern — that becomes your priority. The dashboard is your early warning system.

Click to enlarge

The Five Core Dashboard Widgets

Every SOC dashboard should include at minimum these five widgets. They represent the essential views that keep you aware of what's happening across your environment.

Widget 1: Alert Volume Over Time (Timeline)

This is the most important widget on any SOC dashboard. It shows alert count plotted against time — usually as a line chart or area chart with 5-minute or 15-minute buckets.

Widget 2: Alerts by Severity Distribution

A pie chart or donut chart showing the breakdown of alerts by severity level. This tells you instantly whether your queue is mostly noise or mostly fire.

In Wazuh terms:

• Low = levels 0-6
• Medium = levels 7-9
• High = levels 10-12
• Critical = levels 13-15

Widget 3: Top Attacked Hosts

A horizontal bar chart showing which agents (endpoints) are generating the most alerts. This immediately tells you where the action is.

Widget 4: Top Alert Rules (Rule Frequency)

A table or bar chart showing which Wazuh rules are firing most frequently. This tells you what types of events dominate your environment.

When a rule that's normally quiet suddenly appears in the top 10, that's your signal to investigate. Conversely, when a normally noisy rule disappears, something changed on that endpoint.

Widget 5: Agent Health & Status

A status panel showing which agents are active, disconnected, or never connected. This is your data integrity check.

Click to enlarge

Building a Dashboard in Wazuh

Wazuh uses OpenSearch Dashboards (the visualization layer) to create custom dashboards. Here's the conceptual workflow for building the SOC analyst dashboard described above.

Step 1: Understand Index Patterns

All Wazuh data is stored in indices following the pattern wazuh-alerts-*. When creating visualizations, you'll select this index pattern as your data source. Each document in the index is one alert — with all the fields you learned in Lesson 2.2 (rule.id, rule.level, agent.name, etc.).

Step 2: Choose the Right Visualization Type

Step 3: Apply Filters and Time Ranges

Dashboards should always have:

• Global time filter: Typically "Last 24 hours" for shift overview, "Last 1 hour" for active monitoring
• Auto-refresh: Set to 30 seconds or 1 minute during active monitoring
• Saved filters: Pre-configured filters for your most common queries (e.g., severity >= 10, specific agents)

Step 4: Arrange the Layout

The standard SOC dashboard layout follows the "attention hierarchy" — the most critical information should be at the top:

┌─────────────────────────────────────────────────────────────┐
│  ALERT VOLUME TIMELINE (full width — top position)          │
├───────────────────────────┬─────────────────────────────────┤
│  SEVERITY DISTRIBUTION    │  AGENT HEALTH STATUS            │
│  (pie/donut — left)       │  (status panel — right)         │
├───────────────────────────┼─────────────────────────────────┤
│  TOP ATTACKED HOSTS       │  TOP ALERT RULES                │
│  (bar chart — left)       │  (data table — right)           │
└───────────────────────────┴─────────────────────────────────┘

Reading Dashboards Like a Pro

Building a dashboard is only half the skill. Reading it — quickly, accurately, under pressure — is the other half. Here are the patterns that experienced SOC analysts recognize instantly.

Pattern 1: The Spike

A sudden, sharp increase in alert volume. Your immediate questions:

1. When did it start? Zoom into the timeline
2. What rule is firing? Check top rules widget — if one rule dominates, it's probably one source
3. Which hosts? If one host, it's targeted. If many hosts, it's a campaign or a scan
4. Is it real? Compare the rule to known false positive rules. A spike in rule 530 (agent heartbeat) is routine. A spike in rule 5551 (brute force) is an attack.

Pattern 2: The Gap

Alert volume drops to zero or near-zero unexpectedly. This is often more dangerous than a spike.

1. Which agents went silent? Check agent health
2. Is it a network issue? Check if multiple agents from the same subnet are affected
3. Did someone disable logging? Check for Event ID 1102 (audit log cleared) right before the gap
4. Is it maintenance? Check the change calendar — planned reboots cause expected gaps

Pattern 3: The New Normal

A gradual shift in baseline — maybe alert volume increased 20% over the past week. This is subtle and easy to miss.

1. What's contributing to the increase? Check top rules — is a new rule firing that wasn't before?
2. New infrastructure? Was a new server or application deployed?
3. New attack campaign? External scanners and botnets often ramp up gradually

Pattern 4: The Rotation

Periodic patterns that repeat on a schedule — daily, weekly, or monthly. These are usually benign.

1. Match to known schedules — backup jobs, patch cycles, vulnerability scans, batch processing
2. Unexpected rotations — malware beaconing at regular intervals (e.g., every 4 hours = possible C2)

SOC Shift Dashboard Workflow

Here's a practical workflow that experienced analysts follow during a shift:

Start of Shift (First 5 Minutes)

1. Open the dashboard — set time range to "Last 8 hours" to see the previous shift's activity
2. Check the timeline — any spikes or gaps during the previous shift?
3. Read the handoff notes — what did the previous analyst flag?
4. Check agent health — any disconnected agents?
5. Scan top rules — anything unusual in the top 10?

During Shift (Every 15-30 Minutes)

1. Glance at the timeline — compare current hour to the baseline
2. Check severity distribution — any increase in high/critical percentage?
3. Review top attacked hosts — any host that wasn't there before?
4. Auto-refresh should be running — if it stops, check your connection

End of Shift (Last 10 Minutes)

1. Screenshot the dashboard — attach to your shift report
2. Note anomalies — anything unusual that the next analyst should watch
3. Update handoff notes — ongoing investigations, pending escalations
4. Compare to baseline — was this shift busier or quieter than normal?

Click to enlarge

Key Metrics to Track Over Time

Beyond the live dashboard, mature SOCs track metrics over longer time periods (weekly, monthly) to identify trends and measure effectiveness.

Common Dashboard Mistakes