Lab 2.3 — Build a SOC Dashboard

Lab Overview

The Scenario

Your SOC manager says: "We've been running Wazuh for a week, but nobody's built dashboards yet. Everyone's reading alerts one by one. I need you to build our first operational dashboard — something I can pull up in our morning standup and show the team: what happened overnight, which systems are hottest, and who's attacking us."

You have 505 alerts from a realistic 24-hour period. Your job is to build 4 visualizations that answer the questions every SOC team asks every day.

Part 1: Severity Distribution — "How Bad Is It?"

The first thing any SOC lead wants to know is the overall threat level. You'll build a pie chart showing alert distribution by severity.

Step 1: Open the Visualization Builder

1. In the Wazuh Dashboard, click Visualize (compass icon) in the left sidebar
2. Click Create new visualization
3. Select Pie Chart
4. Choose the wazuh-alerts-* index pattern as your data source

Step 2: Configure the Severity Breakdown

1. Under Buckets, click Add > Split Slices
2. Aggregation: Terms
3. Field: rule.level
4. Order By: Count
5. Size: 15 (to capture all severity levels)
6. Click the ▶ Play button to generate the chart

Step 3: Interpret the Results

You should see a pie chart with slices for each severity level present in your data. Record:

Step 4: Save the Visualization

Click Save and name it: SOC - Severity Distribution

Part 2: Alert Heatmap by Agent — "Who's Under Attack?"

Next, you need to see which systems are generating the most alerts and at what severity. A heatmap is perfect for this.

Click to enlarge

Step 1: Create the Heatmap

1. Create a new visualization: Data Table (we'll build a heatmap-style table)
2. Source: wazuh-alerts-* index

Step 2: Configure Rows and Columns

1. Under Metrics, keep Count as the metric
2. Under Buckets, add Split Rows:
   • Aggregation: Terms
   • Field: agent.name
   • Size: 10
3. Add another Split Rows sub-bucket:
   • Sub-Aggregation: Range
   • Field: rule.level
   • Ranges: 0-3 (Info), 4-7 (Low), 8-11 (Medium), 12-15 (Critical)
4. Click ▶ Play

Step 3: Analyze the Agent Distribution

Your table should show each agent with alert counts per severity range:

Key questions to answer:

• Which agent has the most critical alerts?
• Which agent is the "noisiest" (most total alerts)?
• Is there an agent with zero critical alerts? (That might be normal, or it might mean monitoring gaps.)

Step 4: Save

Save as: SOC - Agent Severity Matrix

Part 3: Top Attackers — "Who Is Hitting Us?"

Every SOC needs a "Top Talkers" panel showing which external IPs are generating the most alerts. This helps you identify persistent attackers, botnets, and scanning campaigns.

Step 1: Create a Horizontal Bar Chart

1. Create new visualization: Horizontal Bar
2. Source: wazuh-alerts-*

Step 2: Configure the Top Attackers View

1. Y-Axis (Metrics): Count
2. X-Axis (Buckets): Terms
   • Field: data.srcip
   • Size: 10
   • Order: Descending by count
3. Click ▶ Play

Step 3: Identify the Attackers

You should see the most active source IPs in your environment. From the pre-loaded data, expect to see:

Step 4: Save

Save as: SOC - Top Source IPs

Part 4: Attack Timeline — "When Did It Happen?"

The most powerful dashboard panel is the timeline. It shows alert volume over time, revealing attack waves, quiet periods, and the moment an incident began.

Step 1: Create a Line Chart

1. Create new visualization: Line Chart (or Area Chart for better visual impact)
2. Source: wazuh-alerts-*

Step 2: Configure the Timeline

1. Y-Axis (Metrics): Count
2. X-Axis (Buckets): Date Histogram
   • Field: timestamp
   • Minimum Interval: Minute (or Auto)
3. Add Split Series to color-code by severity:
   • Sub-Aggregation: Range
   • Field: rule.level
   • Ranges: 0-7 (Low), 8-11 (Medium), 12-15 (Critical)
4. Click ▶ Play

Step 3: Read the Timeline

Your timeline should show alert activity over the 24-hour period. Look for:

1. Spikes — Sudden increases in alert volume indicate attack phases
2. Color shifts — Periods where critical (red) alerts appear signal high-severity incidents
3. Quiet periods — Gaps in alerting could mean the attack stopped, or monitoring was disrupted

Record the key events you observe:

TIMELINE OBSERVATIONS:
Spike 1: [time] — [what rule/agent caused the spike]
Spike 2: [time] — [what rule/agent caused the spike]
Quiet period: [time range] — [possible explanation]

Step 4: Save

Save as: SOC - Alert Timeline

Part 5: Assemble the Unified Dashboard

Now combine all 4 visualizations into a single dashboard.

Step 1: Create the Dashboard

1. Click Dashboard in the left sidebar
2. Click Create new dashboard
3. Click Add (top menu bar)

Step 2: Add Your Panels

Add each saved visualization:

1. SOC - Severity Distribution (top-left)
2. SOC - Agent Severity Matrix (top-right)
3. SOC - Top Source IPs (bottom-left)
4. SOC - Alert Timeline (bottom, full-width)

Step 3: Arrange the Layout

Drag panels to create a logical flow:

• Top row: Overview (severity pie + agent matrix) — answers "How bad?" and "Where?"
• Bottom row: Detail (top IPs + timeline) — answers "Who?" and "When?"

Step 4: Save the Dashboard

Save as: SOC Morning Standup Dashboard

Part 6: Dashboard Briefing

Write a 3-paragraph briefing as if you're presenting this dashboard in a morning standup:

Paragraph 1 — Threat Level: Summarize the severity distribution. What percentage of alerts are critical? Is this normal?

Paragraph 2 — Hottest Systems: Which agents are taking the most heat? What types of attacks are they facing?

Paragraph 3 — Action Items: Based on the top attackers and timeline, what are the top 3 things the SOC team should focus on today?

Deliverable Checklist

Before completing the lab, ensure you have:

• Severity Distribution Pie Chart — saved as SOC - Severity Distribution
• Agent Severity Matrix — saved as SOC - Agent Severity Matrix
• Top Source IPs Bar Chart — saved as SOC - Top Source IPs
• Alert Timeline — saved as SOC - Alert Timeline
• Unified Dashboard — all 4 panels combined in SOC Morning Standup Dashboard
• Dashboard Briefing — 3-paragraph standup summary

What's Next

In Lab 2.4 — Hunt by Query, you'll go beyond dashboards and learn to write custom search queries in Wazuh. Dashboards show you the big picture — queries let you drill into specific hypotheses and hunt for threats that dashboards might miss.