Wazuh alert manager v1.4.0

What's Changed

• Added size: 10000 in the _reindex by @adampielak in #1
• new features by @xrisbarney in #2
• fix case flow by @xrisbarney in #3

New Contributors

• @adampielak made their first contribution in #1
• @xrisbarney made their first contribution in #2

Full Changelog: v1.0.1...1.4.0

Highlights

This release turns the plugin into a full SOC alert-management workbench, and adds official support for Wazuh 4.12 and 4.13 alongside 4.14.

Case management

• Link an alert to an existing case, or create a new case from selected alerts — bidirectional, from either the alert or the case side.
• Case status/severity, assignment, and time-window filtering (created in last 24h/7d/30d/90d).
• Closing a case now warns before cascading closure to its still-open linked alerts, with per-alert opt-out.
• Multi-alert select: bulk status change, bulk assign, bulk add-to-case.

AI analysis

• Generate an AI-written summary for an individual alert or for a whole case (linked alerts + comments together).
• Supports OpenAI, Anthropic, DeepSeek, and Gemini. API keys encrypted at rest (AES-256-GCM).

Reporting

• SLA compliance, mean time to resolve, mean time to assign, and case metrics (open/closed, severity breakdown, mean time to close) for a selected time period.

Attack path (new)

• Kill-chain-ordered visualization of hosts/users/techniques across a case's linked alerts.

Platform / operations

• Multi-replica safe: a leader-lock ensures only one dashboard replica runs the background alert sync when scaled out (Kubernetes/Docker).
• New "Deploying on Docker/Kubernetes" docs, with a copy-pasteable Dockerfile.
• GitHub Actions CI: tagging a release now automatically builds and attaches plugin zips for all three supported Wazuh versions.
• UX polish: full-screen expandable detail flyouts, success toasts across all actions, nav icon fix.

Supported versions

Wazuh	OpenSearch Dashboards
4.12.x	2.19.1
4.13.x	2.19.2
4.14.x	2.19.5