Wazuh alert manager v1.5.0

What's Changed

• Improved workbench, case management and automation rules by @xrisbarney in #4

Full Changelog: 1.4.0...v1.5.0

Improved — look & feel / smoothness

• One design system (public/design.ts): severity bands standardised on 12/7/4 (were contradicting across three files); lifecycle status given a cool colour ramp so EUI danger is reserved for genuinely high severity instead of being spent on every open row; one shared time formatter.
• Severity badges show label + level (colour is never the sole signal).
• Reports gets charts (@elastic/charts, no new dependency): alert-volume-per-day trend, status bar, case-severity bar — plus the honest denominators kept.
• Cases table is now sortable (the sort affordance was previously dead) with client pagination and severity badges.
• Dark-mode fix: removed a hardcoded panel colour in the bulk-actions bar.
• Fewer wasted fetches: the alerts view no longer double-fetches on Apply or dead-ends on a time-range change; the case flyout trusts the authoritative update response instead of reloading over it.
• Checkbox bug fixed: selecting an alert's checkbox no longer opens the detail flyout, so multi-select actually works. A row click still opens the flyout; clicking the checkbox, actions, or any control on the row does not.
• Metric tooltips: Reports' mean-time-to-assign / resolve / SLA tiles now carry info tooltips explaining exactly how each is measured (and that time-based metrics are sample-based).

New — SOC workbench features

• Automation rules (Settings → Automation rules). A rule matches alerts (rule groups / rule IDs / agents / min level), fires on a trigger, and takes one or more actions:
  • Triggers: every matching alert (per-alert) or a burst on one entity (group by agent, source/destination IP, source/destination user, or process; fire once ≥ N land on one entity within a window).
  • Actions: open a case (burst only, de-duplicated per rule+entity and rate-limited), set status (auto-close routine noise, or move to In progress), and/or assign to an analyst (auto-assign). Status/assign work on either trigger.
  • Any-of / All-of per match section — All of means the entity must have seen every listed value within the window (co-occurrence, e.g. rule 5510 and 5516 on one host), verified exactly via aggregation; applies to groups, IDs, and agents.
  • Dry run on every rule shows what it would have done over the last 24h before you enable it.
  • Server: server/routes/rules.ts, server/lib/correlation*.ts; evaluated under the sync leader-lock (single writer). Provenance is recorded on every auto-action.
• Precedent lookup. The alert flyout opens with a "seen before" callout — how the same rule has been handled on the same host (open/in-progress/closed counts + how many escalated to a case), flagging likely-routine noise. Deterministic, no LLM. (/alerts/{id}/precedent)
• Suggested related alerts. The Related Alerts tab now ranks other alerts that share a host, source IP, user, or rule within ±24h, with the shared-entity reasons and one-click Link. (/alerts/{id}/suggested)
• Attack-path graph. Case attack-path tab renders a dependency-free entity graph (hosts / accounts / techniques, co-occurrence edges) with robust pan/zoom; kill-chain table included.
• Reporting is multi-tab (Overview + per-analyst Workload / Performance / Cases-by-analyst / Leaderboard), with donut status/severity breakdowns, a count-legend, and period-over-period ▲/▼ deltas on the KPI tiles (colour = better/worse).
• Navigation is a collapsible group: Workbench (Alerts / Cases / Settings) and Reporting; the plugin title sits in the breadcrumb bar like the Wazuh modules.
• In-progress is a first-class status for both alerts and cases; default views show Open + In progress.

What's Changed

• Improved workbench, case management and automation rules by @xrisbarney in #4

Full Changelog: 1.4.0...v1.5.0