> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Analysis Workflows

> Master threat detection, analysis, and response workflows in Wazuh Dashboard with practical examples and best practices

## Overview

Effective threat analysis is crucial for maintaining security posture. This guide covers practical workflows for detecting, investigating, and responding to security threats using Wazuh Dashboard.

## Understanding Security Events

### Event Structure

Wazuh security events contain rich contextual information:

* **Rule Information**: Rule ID, level, description, and groups
* **Agent Details**: Agent ID, name, IP address, and OS
* **Event Data**: Source data including logs, alerts, and system information
* **MITRE ATT\&CK**: Mapped tactics and techniques (when applicable)
* **Compliance Mapping**: Regulatory framework references
* **GeoIP Data**: Geographic location information for network events

### Event Severity Levels

| Level | Severity | Use Case |
| - | - | - |
| 0-3 | Informational | Normal system activity |
| 4-7 | Low to Medium | Suspicious activity requiring review |
| 8-11 | High | Security incidents requiring action |
| 12-15 | Critical | Severe threats requiring immediate response |

## Threat Hunting Dashboard

### Accessing Threat Hunting

Navigate to **Threat Hunting** in the main menu to access comprehensive threat detection capabilities.

### Key Dashboard Sections

> **Alerts Overview**
>
> High-level metrics showing:
>
> * Total alerts over time period
> * Alert distribution by severity level
> * Top alerting agents
> * Most triggered rules
> * Alert trends and patterns
>
> **Best Practice**: Review this section daily to identify unusual spikes or patterns.

> **Top Security Events**
>
> Visualizations highlighting:
>
> * Most common attack types
> * Authentication failures
> * Network anomalies
> * File integrity violations
> * Malicious IP addresses
>
> **Use Case**: Quickly identify the most prevalent threats in your environment.

> **Events Timeline**
>
> Time-series visualization showing:
>
> * Alert volume over time
> * Event clustering
> * Anomaly detection
> * Correlation patterns
>
> **Tip**: Use the time picker to zoom in on suspicious time periods.

> **Detailed Events Table**
>
> Comprehensive event listing with:
>
> * Full event details
> * Sortable columns
> * Search and filter capabilities
> * Drill-down options
> * Export functionality

## Incident Investigation Workflow

**1. Identify the Alert**

Start with a high-severity alert or unusual pattern:

1. Open **Threat Hunting** dashboard
2. Filter by severity level >= 8
3. Review recent high-severity events
4. Identify alerts requiring investigation

```
rule.level:>=8
```

**2. Gather Initial Context**

Click on the alert to view details:

* **When**: Exact timestamp of the event
* **Where**: Affected agent and system
* **What**: Rule description and categorization
* **Why**: Rule logic that triggered the alert

Note key information:

* Agent ID and name
* Source IP addresses
* User accounts involved
* Files or processes affected

**3. Expand the Investigation**

Search for related events:

**By Agent**:

```
agent.id:"001" AND timestamp:[now-1h TO now]
```

**By Source IP**:

```
data.srcip:"192.168.1.100"
```

**By User**:

```
data.dstuser:"suspicious-account"
```

**By Rule Group**:

```
rule.groups:"authentication_failed"
```

**4. Analyze the Pattern**

Look for indicators of compromise:

* **Volume**: Unusual number of similar events
* **Timing**: Events clustered in short time periods
* **Sequence**: Ordered progression of attack stages
* **Scope**: Multiple agents or systems affected
* **Geography**: Connections from unusual locations

**5. Correlate with Other Data**

Check related modules:

* **File Integrity Monitoring**: Any file changes on the affected system?
* **Vulnerability Detection**: Are there known vulnerabilities on the agent?
* **MITRE ATT\&CK**: What tactics and techniques are involved?
* **System Inventory**: What applications are running?

**6. Document Findings**

Create a summary of your investigation:

* Affected systems and accounts
* Timeline of events
* Potential impact assessment
* Recommended actions

Use the **Export** feature to save relevant events.

## Common Threat Scenarios

### Brute Force Attack Detection

> **Scenario Overview**
>
> An attacker is attempting to guess passwords through repeated authentication attempts.
>
> **Indicators**:
>
> * Multiple authentication failures from same source
> * Short time interval between attempts
> * Targeting multiple user accounts

> **Investigation Steps**
>
> 1. **Identify the pattern**:
>    ```
>    rule.groups:"authentication_failed"
>    ```
>
> 2. **Find the source**:
>    * Check `data.srcip` field for attacking IP
>    * Review geographic origin in GeoIP visualization
>
> 3. **Assess the scope**:
>    * Count unique targeted usernames
>    * Calculate attempts per minute
>    * Check if any attempts succeeded
>
> 4. **Take action**:
>    * Block source IP at firewall
>    * Enable account lockout policies
>    * Force password reset for targeted accounts
>    * Enable MFA for affected services

### Malware Detection Response

> **Scenario Overview**
>
> Malware or potentially unwanted software detected on an endpoint.
>
> **Indicators**:
>
> * Malware detection alerts (rule.groups:"malware")
> * Suspicious process execution
> * Unauthorized file modifications
> * Unusual network connections

> **Investigation Steps**
>
> 1. **Isolate the affected system**:
>    * Identify the agent in alert details
>    * Consider network isolation
> 2. **Review detection details**:
>    ```
>    agent.id:"XXX" AND rule.groups:"malware"
>    ```
>    * Malware name and family
>    * File path and hash
>    * Detection method
> 3. **Check for lateral movement**:
>    * Search for same file hash on other agents
>    * Review network connections from affected host
>    * Check for similar processes across infrastructure
> 4. **Assess file integrity**:
>    * Navigate to **File Integrity Monitoring**
>    * Filter by affected agent
>    * Look for unauthorized changes
> 5. **Remediate**:
>    * Remove malicious files
>    * Scan system with anti-malware tools
>    * Review and close attack vector
>    * Update security controls

### Privilege Escalation Detection

> **Scenario Overview**
>
> User or process attempting to gain elevated privileges.
>
> **Indicators**:
>
> * Sudo usage alerts
> * Unauthorized privilege changes
> * Exploitation attempts
> * Unusual administrative actions

> **Investigation Steps**
>
> 1. **Identify the escalation attempt**:
>    ```
>    rule.groups:"privilege_escalation" OR rule.groups:"sudo"
>    ```
>
> 2. **Review user context**:
>    * Who initiated the action (data.dstuser)
>    * What command was executed
>    * From which system (agent)
>    * Success or failure status
>
> 3. **Check authorization**:
>    * Is this user authorized for sudo?
>    * Is the action within normal responsibilities?
>    * Was it expected or scheduled?
>
> 4. **Look for persistence mechanisms**:
>    * Check for new cron jobs
>    * Review startup scripts
>    * Examine user account changes
>    * Search for SSH key additions
>
> 5. **Respond accordingly**:
>    * If unauthorized: disable account, force password reset
>    * Review and update sudo policies
>    * Enable additional logging
>    * Investigate potential account compromise

## MITRE ATT\&CK Integration

### Understanding MITRE Mapping

Wazuh maps detected events to the MITRE ATT\&CK framework, providing standardized threat intelligence.

#### Accessing MITRE Dashboard

1. Navigate to **MITRE ATT\&CK** in the main menu
2. View the attack matrix with highlighted tactics and techniques
3. Click on tactics to see detected techniques
4. Click on techniques for detailed events

### MITRE-Based Investigation

**1. Start with Tactics**

Review which tactics are active in your environment:

* **Initial Access**: How attackers got in
* **Execution**: Code execution methods
* **Persistence**: How attackers maintain access
* **Privilege Escalation**: Elevation attempts
* **Defense Evasion**: Anti-detection techniques
* **Credential Access**: Password and credential theft
* **Discovery**: Network and system reconnaissance
* **Lateral Movement**: Spreading through network
* **Collection**: Data gathering
* **Exfiltration**: Data theft
* **Impact**: Destructive actions

**2. Drill into Techniques**

Click a tactic to see specific techniques detected:

* Number of events per technique
* Affected agents
* Recent occurrences
* Technique descriptions and mitigations

**3. Analyze Event Chains**

Look for technique sequences that indicate attack progression:

Example: Ransomware attack chain

1. Initial Access (T1566 - Phishing)
2. Execution (T1204 - User Execution)
3. Defense Evasion (T1562 - Impair Defenses)
4. Impact (T1486 - Data Encrypted for Impact)

**4. Apply Recommended Mitigations**

Each technique includes:

* Detection methods
* Mitigation strategies
* References to security controls
* Links to MITRE documentation

## Advanced Search Techniques

### Query Language Examples

**Find failed SSH logins**:

```
rule.groups:"sshd" AND rule.groups:"authentication_failed"
```

**Search for specific CVE**:

```
data.vulnerability.cve:"CVE-2024-1234"
```

**Events from external IPs**:

```
data.srcip:* AND NOT data.srcip:10.* AND NOT data.srcip:192.168.* AND NOT data.srcip:172.16.*
```

**High severity events last hour**:

```
rule.level:>=10 AND timestamp:[now-1h TO now]
```

**Web attack patterns**:

```
rule.groups:"web" AND (rule.groups:"attack" OR rule.groups:"sqli" OR rule.groups:"xss")
```

**Combine multiple conditions**:

```
agent.name:"production-web-*" AND rule.level:>=8 AND rule.groups:"authentication_failed"
```

### Using Wildcards and Regex

**Wildcard search**:

```
data.dstuser:admin*
```

**Negation**:

```
NOT rule.groups:"syslog"
```

**Range queries**:

```
rule.level:[8 TO 12]
timestamp:[2026-03-01 TO 2026-03-04]
```

## Visualization Best Practices

### Creating Custom Visualizations

While Wazuh provides pre-built dashboards, you can create custom views:

> **Top Attacking IPs**
>
> Create a data table showing:
>
> * Source IP addresses
> * Count of events
> * Geographic location
> * Latest activity
>
> Sort by count to identify top offenders.

> **Alert Volume Heatmap**
>
> Visualize alert patterns:
>
> * By hour of day
> * By day of week
> * Identify attack windows
> * Plan monitoring coverage

> **Agent Security Score**
>
> Create metrics comparing:
>
> * Alert count per agent
> * Severity distribution
> * Vulnerability count
> * Compliance score
>
> Identify agents requiring attention.

## Response and Remediation

### Active Response Actions

Wazuh can execute automated responses:

* **Firewall blocks**: Automatically block attacking IPs
* **Process termination**: Kill malicious processes
* **Account lockout**: Disable compromised accounts
* **File quarantine**: Isolate suspicious files

> [!WARNING]
>
> Active responses can impact legitimate services. Test thoroughly in non-production environments and use with caution.

### Creating Response Playbooks

Document standard response procedures:

1. **Alert Triage Criteria**: What requires immediate attention?
2. **Escalation Paths**: Who to notify and when?
3. **Investigation Steps**: Standard investigation workflow
4. **Remediation Actions**: Approved response actions
5. **Documentation Requirements**: What to record

## Threat Intelligence Integration

### Using External Threat Feeds

Enhance detection with threat intelligence:

* **IP Reputation**: Known malicious IP addresses
* **File Hashes**: Malware signatures
* **Domain Reputation**: Suspicious domains
* **CVE Feeds**: Vulnerability intelligence

### Correlation with External Events

Consider external context:

* Recent vulnerability disclosures
* Active malware campaigns
* Sector-specific threats
* Geopolitical events

## Reporting and Metrics

### Key Security Metrics

Track these indicators:

> **Mean Time to Detect (MTTD)**
>
> How quickly are threats identified after occurrence?

> **Mean Time to Respond (MTTR)**
>
> How fast are incidents contained and remediated?

> **Alert Volume Trends**
>
> Is your security posture improving over time?

> **False Positive Rate**
>
> Are rules properly tuned to reduce noise?

### Exporting Investigation Data

Export events for further analysis:

1. Apply filters to show relevant events
2. Click **Export** button
3. Choose format:
   * **CSV**: For spreadsheet analysis
   * **JSON**: For programmatic processing
4. Include in incident reports

## Tips and Best Practices

> **Start Broad, Then Narrow**
>
> Begin investigations with wide time ranges and loose filters. Progressively narrow scope as you understand the incident.

> **Use Saved Searches**
>
> Save commonly used queries:
>
> * Daily security review searches
> * Compliance audit queries
> * Critical alert filters
> * Investigation templates

> **Monitor Alert Trends**
>
> Regular trend analysis helps identify:
>
> * Emerging threats
> * Rule tuning opportunities
> * Infrastructure changes
> * Attack pattern evolution

> **Correlate Across Modules**
>
> Don't investigate in isolation:
>
> * Check FIM for file changes
> * Review vulnerabilities for exposure
> * Examine system inventory
> * Consider compliance impacts

> **Document Everything**
>
> Maintain investigation notes:
>
> * Timeline of discovery
> * Evidence collected
> * Actions taken
> * Lessons learned

## Next Steps

* Learn about [Compliance Monitoring](/guides/compliance-monitoring) for regulatory requirements
* Review [Agent Deployment](/guides/agent-deployment) to expand coverage
* Explore [Getting Started](/guides/getting-started) for dashboard basics

> [!TIP]
>
> Practice threat hunting regularly, even when no incidents are apparent. Proactive hunting often discovers threats that passive monitoring misses.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.