v2.0.2

Wazuh Alert Manager 2.0.2

Version 2.0.2 is the scale and reliability patch for the v2 workbench.

Reliability and scale

• Processes durable automation admissions in bounded batches with parallel,
  rule-affine execution lanes, fenced claims, retries and restart recovery.
• Coalesces matching alerts into their deduplicated case route before writing,
  preventing avoidable case-update contention during dense bursts.
• Uses exact queue, alert and reporting totals; no 2,000/10,000-hit sampling.
• Keeps case documents bounded while the paginated evidence family remains the
  exact source of linked-alert truth. Cases store an exact evidence_count and
  a bounded preview rather than growing without limit.
• Holds plugin startup readiness until owned index families are provisioned.

Cases and UI

• Adds pagination to linked alerts in the case flyout.
• Fixes case visibility and optimistic-concurrency races after automated or
  manual creation.
• Preserves deterministic case claims across generation rollover.

Benchmark result

The release was gated by clean 100,000-alert trials on Wazuh 4.14. Exact
ground-truth checks cover immediate rules, entity bursts, Boolean groups,
co-occurrence, status/assignment actions and 87,200 negative controls. The
published evidence records projection/drain timing, queue high-water marks,
storage, environment metadata and checksums. This single-node synthetic result
is reproducibility evidence, not a universal production-capacity claim.

Compatibility

Release assets are built independently for Wazuh 4.12, 4.13 and 4.14
(OpenSearch Dashboards 2.19.1, 2.19.2 and 2.19.5). Native Wazuh alert indices
remain read-only. Existing v1/v2 plugin data is migrated or retained safely.

Wazuh Alert Manager 2.0.1

Wazuh Alert Manager 2.0.1

This is the polished v2.0 release and the recommended installation target. It contains the complete v2.0 lifecycle, case/evidence, automation, UI, attack-graph, and exact-reporting work documented in the wiki.

Patch from 2.0.0

• Corrects the post-install rollback guidance for the piped one-line installer.
• Prints a valid copy-paste one-line rollback command.
• No lifecycle, automation, storage, or case behavior changed from 2.0.0.

Validation

• Built and tested inside the official Wazuh Dashboard trees for 4.12/OSD 2.19.1, 4.13/OSD 2.19.2, and 4.14/OSD 2.19.5.
• The public latest installer passed version detection, artifact download, SHA-256 verification, backup, install, dashboard restart, backend verification, and browser-route verification on Wazuh 4.14.
• Headed Chromium sign-in and Workbench smoke test passed after the public install.

See the project wiki for full installation, lifecycle, automation, RBAC, case/evidence, reporting, and troubleshooting guidance.

Wazuh Alert Manager 2.0.0

Wazuh Alert Manager 2.0.0

Version 2.0 turns the plugin into a bounded, upgrade-safe SOC workbench for
Wazuh 4.12–4.14. Matching release ZIPs are compiled inside the official Wazuh
Dashboard source trees for OpenSearch Dashboards 2.19.1, 2.19.2, and 2.19.5.

Highlights

• Plugin-owned rollover families for alerts, activity, cases, and evidence;
  native wazuh-alerts-* remains read-only.
• Reviewed retirement, guarded restore, archived-case reopen, evidence holds,
  and separately confirmed purge.
• Safe resumable migration from the legacy wazuh-alert-status single index.
• Exact, non-sampled operational reporting with write-time SLA fields and
  composite analyst pagination.
• Durable forward-only automation with immediate and correlated-burst triggers,
  constrained AND/OR entity expressions, case deduplication/routing, preview,
  revisions, safety caps, queue fencing, and dead-letter handling.
• Case evidence snapshots and trusted archive resolution prevent closed cases
  from pinning full operational alerts forever.
• Case and alert summaries, collapsible workbench cards, multi-select case
  severity/assignee filters, sticky navigation, corrected light-theme contrast,
  flyout-safe toasts, and expanded attack-path graph/timeline views.
• One-line version-detecting installer with mandatory SHA-256 verification,
  backup, runtime checks, and rollback.

Validation

• 32 Jest suites / 323 tests.
• Headed Playwright release bench: 11 passed, one prerequisite probe skipped,
  zero failures on Wazuh 4.14.7.
• The release workflow independently builds and tests the 4.12, 4.13, and 4.14
  source targets before publishing any tag.

Upgrade notes

Installation remains install-and-go. Provisioning and migration are idempotent
and run on plugin startup. Legacy indices are retained as read-only migration
inputs. Do not manually rename a ZIP for another dashboard version; install the
artifact whose OSD version exactly matches /usr/share/wazuh-dashboard/package.json.

See the wiki pages Installation, Lifecycle, Retention and RBAC,
Case Evidence and Case Lifecycle, Automation Rules, and Reporting for
full operational guidance.

Wazuh alert manager v1.5.1

v1.5.1

A small patch release on top of v1.5.0: it fixes a correctness race in single-tick burst correlation and ships a reliability benchmark / reproducibility kit. It contains everything in v1.5.0 (alert lifecycle, cases, automation rules, precedent & suggested alerts, reporting).

Fixed

• Single-tick burst correlation no longer misses. When an entire alert burst arrived within one sync interval, the automation engine could evaluate it before those alerts were search-refreshed in wazuh-alert-status, so the count raced the ~1 s refresh and a burst could be silently missed (and, because the alerts leave the next tick's window, never re-evaluated). The sync now refreshes the status index before running rule evaluation, making single-tick burst detection deterministic. (server/lib/sync_job.ts)

Added

• Reliability benchmark / reproducibility kit (benchmark/). Injects a tagged 1,082-alert synthetic corpus with known-correct outcomes through the real sync → automation path and measures the engine's actions, including false actions on benign filler alerts. See benchmark/README.md.

Verification

• Regression smoke: 16/16 passing on Wazuh 4.14.
• Reliability run: 1,082 / 1,082 alerts handled correctly, 0 false actions on 1,000 benign fillers.

Downloads (match the asset to your Wazuh version)

Wazuh	OpenSearch Dashboards	Asset
4.12	2.19.1	wazuhAlertManager-1.5.1-wazuh4.12.zip
4.13	2.19.2	wazuhAlertManager-1.5.1-wazuh4.13.zip
4.14	2.19.5	wazuhAlertManager-1.5.1-wazuh4.14.zip

Server code is identical across the three builds; only the target-version stamp
differs. Install/upgrade steps are unchanged — see the
wiki.

What's Changed

• Add citation metadata (CITATION.cff, .zenodo.json) and license field by @xrisbarney in #5
• Add Zenodo DOI badge by @xrisbarney in #6
• fixes to 1.5.1 by @xrisbarney in #7

Full Changelog: v1.5.0...v1.5.1

Wazuh alert manager v1.5.0

What's Changed

• Improved workbench, case management and automation rules by @xrisbarney in #4

Full Changelog: 1.4.0...v1.5.0

Improved — look & feel / smoothness

• One design system (public/design.ts): severity bands standardised on 12/7/4 (were contradicting across three files); lifecycle status given a cool colour ramp so EUI danger is reserved for genuinely high severity instead of being spent on every open row; one shared time formatter.
• Severity badges show label + level (colour is never the sole signal).
• Reports gets charts (@elastic/charts, no new dependency): alert-volume-per-day trend, status bar, case-severity bar — plus the honest denominators kept.
• Cases table is now sortable (the sort affordance was previously dead) with client pagination and severity badges.
• Dark-mode fix: removed a hardcoded panel colour in the bulk-actions bar.
• Fewer wasted fetches: the alerts view no longer double-fetches on Apply or dead-ends on a time-range change; the case flyout trusts the authoritative update response instead of reloading over it.
• Checkbox bug fixed: selecting an alert's checkbox no longer opens the detail flyout, so multi-select actually works. A row click still opens the flyout; clicking the checkbox, actions, or any control on the row does not.
• Metric tooltips: Reports' mean-time-to-assign / resolve / SLA tiles now carry info tooltips explaining exactly how each is measured (and that time-based metrics are sample-based).

New — SOC workbench features

• Automation rules (Settings → Automation rules). A rule matches alerts (rule groups / rule IDs / agents / min level), fires on a trigger, and takes one or more actions:
  • Triggers: every matching alert (per-alert) or a burst on one entity (group by agent, source/destination IP, source/destination user, or process; fire once ≥ N land on one entity within a window).
  • Actions: open a case (burst only, de-duplicated per rule+entity and rate-limited), set status (auto-close routine noise, or move to In progress), and/or assign to an analyst (auto-assign). Status/assign work on either trigger.
  • Any-of / All-of per match section — All of means the entity must have seen every listed value within the window (co-occurrence, e.g. rule 5510 and 5516 on one host), verified exactly via aggregation; applies to groups, IDs, and agents.
  • Dry run on every rule shows what it would have done over the last 24h before you enable it.
  • Server: server/routes/rules.ts, server/lib/correlation*.ts; evaluated under the sync leader-lock (single writer). Provenance is recorded on every auto-action.
• Precedent lookup. The alert flyout opens with a "seen before" callout — how the same rule has been handled on the same host (open/in-progress/closed counts + how many escalated to a case), flagging likely-routine noise. Deterministic, no LLM. (/alerts/{id}/precedent)
• Suggested related alerts. The Related Alerts tab now ranks other alerts that share a host, source IP, user, or rule within ±24h, with the shared-entity reasons and one-click Link. (/alerts/{id}/suggested)
• Attack-path graph. Case attack-path tab renders a dependency-free entity graph (hosts / accounts / techniques, co-occurrence edges) with robust pan/zoom; kill-chain table included.
• Reporting is multi-tab (Overview + per-analyst Workload / Performance / Cases-by-analyst / Leaderboard), with donut status/severity breakdowns, a count-legend, and period-over-period ▲/▼ deltas on the KPI tiles (colour = better/worse).
• Navigation is a collapsible group: Workbench (Alerts / Cases / Settings) and Reporting; the plugin title sits in the breadcrumb bar like the Wazuh modules.
• In-progress is a first-class status for both alerts and cases; default views show Open + In progress.

What's Changed

• Improved workbench, case management and automation rules by @xrisbarney in #4

Full Changelog: 1.4.0...v1.5.0

Wazuh alert manager v1.4.0

What's Changed

• Added size: 10000 in the _reindex by @adampielak in #1
• new features by @xrisbarney in #2
• fix case flow by @xrisbarney in #3

New Contributors

• @adampielak made their first contribution in #1
• @xrisbarney made their first contribution in #2

Full Changelog: v1.0.1...1.4.0

Highlights

This release turns the plugin into a full SOC alert-management workbench, and adds official support for Wazuh 4.12 and 4.13 alongside 4.14.

Case management

• Link an alert to an existing case, or create a new case from selected alerts — bidirectional, from either the alert or the case side.
• Case status/severity, assignment, and time-window filtering (created in last 24h/7d/30d/90d).
• Closing a case now warns before cascading closure to its still-open linked alerts, with per-alert opt-out.
• Multi-alert select: bulk status change, bulk assign, bulk add-to-case.

AI analysis

• Generate an AI-written summary for an individual alert or for a whole case (linked alerts + comments together).
• Supports OpenAI, Anthropic, DeepSeek, and Gemini. API keys encrypted at rest (AES-256-GCM).

Reporting

• SLA compliance, mean time to resolve, mean time to assign, and case metrics (open/closed, severity breakdown, mean time to close) for a selected time period.

Attack path (new)

• Kill-chain-ordered visualization of hosts/users/techniques across a case's linked alerts.

Platform / operations

• Multi-replica safe: a leader-lock ensures only one dashboard replica runs the background alert sync when scaled out (Kubernetes/Docker).
• New "Deploying on Docker/Kubernetes" docs, with a copy-pasteable Dockerfile.
• GitHub Actions CI: tagging a release now automatically builds and attaches plugin zips for all three supported Wazuh versions.
• UX polish: full-screen expandable detail flyouts, success toasts across all actions, nav icon fix.

Supported versions

Wazuh	OpenSearch Dashboards
4.12.x	2.19.1
4.13.x	2.19.2
4.14.x	2.19.5

Wazuh alert manager v1.0.1

Improved user interface

Wazuh alert manager v1.0.0

Initial release