Creating a Unified Dashboard from Existing Wazuh Visualizations

[Dex Perry]

Hi Wazuh Team,

I’m currently building a custom dashboard within Wazuh Dashboards and had a few queries I hope you can help with.

I understand that Wazuh provides multiple default dashboards across modules such as Security Events, Vulnerability Detection, File Integrity Monitoring, etc. Additionally, I have imported a few dashboards after enabling certain plugins and have also created some custom dashboards of my own.

Now, I would like to create a single unified dashboard that brings together specific visualizations from various Wazuh module dashboards (like “Top 5 agents”, “Total vulnerabilities”, etc.) along with some of my own visualizations.

I understand that it is not possible to embed entire dashboards into one, but I am looking to include only individual components (visualizations) from the existing dashboards provided by Wazuh. However, I’m having difficulty locating and reusing these default visualizations in my new dashboard. How to access and reuse visualizations from Wazuh's default dashboards?

Any help or steps would be greatly appreciated.

Best regards,

[Bony V John]

Hi,

You can create custom visualizations similar to those available in the Wazuh Vulnerability module dashboard. However, it is not possible to directly copy the exact visualizations from the Wazuh Vulnerability module.

For example, if you want to create a "Top 5 Agents" visualization similar to the one in the Vulnerability module, follow these steps:

• From the Wazuh dashboard, click on the hamburger icon in the top-left corner.
• Navigate to: Explore > Visualize > Create Visualization > Data Table
• Select the index: wazuh-states-vulnerability
• Click Add Buckets > Split rows
• Configure the following parameters:
  • Aggregation: Terms
  • Field: agent.name
  • Custom label: Top 5 Agents
• Click the Update icon below to render the visualization.
• Click the Save icon at the top to save it.

You can follow a similar process in the Visualize section to create a "Total Vulnerabilities" visualization using suitable metrics like count or sum, based on your requirements.

• After creating the required visualizations:
• Go to: Explore > Dashboards > Create Dashboard
• Click the Add icon at the top to view all your saved visualizations.
• Select and arrange the visualizations as needed.
• Click the Save icon to save your custom dashboard.

You can also refer to the Wazuh Custom Dashboard documentation for more detailed information.  

I have created a sample custom dashboard for the Vulnerability module. I've attached the .ndjson file for that dashboard — you can import it and see if it meets your requirements.  

Below is a screenshot of how the custom dashboard looks:

[Dex Perry]

Hi Bony,

Thanks a lot for your clear and helpful response. The steps and the sample dashboard you shared made things much easier. I really appreciate your support!

Best,
Dex

[Dex Perry]

Hi Bony,

Hope you’re doing well.

I need some help setting up a custom dashboard for our weekly vulnerability reports. Specifically, I’m trying to visualize the rate at which vulnerabilities are added and resolved (velocity) on a weekly basis, as well as monthly trend lines showing how vulnerabilities have changed over the past 180 days.

Here’s what I’m trying to build:

• Weekly Velocity Graph – to show how many vulnerabilities were detected vs. resolved each week.

• Monthly Trend Line – to highlight how the total vulnerability count across systems has shifted month-over-month.

• Both visualizations should ideally use historical data and be clean enough to present to both SOC analysts and leadership.

• How to aggregate this data weekly and monthly in Wazuh Dashboards.

• Any sample visualizations or .ndjson dashboards that align with this use case.

Looking forward to your advice. Thanks in advance for your support!

Best regards,

[Dex Perry]

Hi Bony

Just wanted to check in regarding my earlier query about building visualizations for weekly vulnerability velocity and monthly trends (historical view up to 180 days). I understand you may be busy, but any pointers when you get a chance would be appreciated.

Looking forward to your response.

Best regards,

[Bony V John]

Hi,

Apologies for the late response.

Based on your requirement, I’ve created three visualizations that I believe will meet your expectations. I’ve attached the .ndjson file containing the visualizations, which you can import into your Wazuh dashboard to test and confirm they are working correctly.

• Two of the visualizations are based on vulnerability status:
  • One shows a graph of active vulnerabilities by agent ID.
  • The other shows the status of resolved vulnerabilities.
• The third is a time-based graph that illustrates the ratio of detected & resolved vulnerabilities over time.
• These visualizations are built using the wazuh-alerts index, which enables the use of historical data for accurate representation.

I've also included sample screenshots for your reference.

For more details on customizing dashboards, you can refer to the Wazuh custom dashboard creation documentation.

[Dex Perry]

Hi Bony,

Thank you for your response and for taking the time to create the custom visualizations — I really appreciate your support.

Best regards,