wazuh-documentation VS wazuh-ruleset

First of all, the Wazuh dashboard, created from Kibana, is an individual package, and as so, could be replaced by another package, and this could be not based on Kibana. Depending on the features you are missing in the default Wazuh dashboard, maybe it would be better to use a simpler solution. One options is to just create new visualizations from inside the installed dashboard. Another option would be creating a different package with the modifications you see fit. - For the first option, here you have a tutorial, as it has not yet been added to the documentation: https://github.com/wazuh/wazuh-documentation/issues/5511 - For the second option, all code to create the packages is located in https://github.com/wazuh/wazuh-packages. If none of this solutions is enough for your problem, the APIs you would need to control in your custom dashboards are the ones for the Wazuh server and the Wazuh indexer: - Wazuh API(accessed by port 55000): https://documentation.wazuh.com/current/user-manual/api/index.html#restful-api - Indexer API(accessed by port 9200): https://www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html

You can store both alerts and events ( archive logs ) in Wazuh Indexer. (https://github.com/wazuh/wazuh-documentation/issues/4433)

Thank you u/granth515 for your feedback! We have created this issue to add this information.

Yes, now you should create custom alerts for those events according to your needs. I should not recommend activating the logall option in a production environment. This will take up a lot of your disk space with duplicated events. However, if you want to see archives in Elasticsearch is necessary to follow these steps https://github.com/wazuh/wazuh-documentation/issues/4433.

In this repository https://github.com/wazuh/wazuh-ruleset you can find the decoders and rules that wazuh-manager has by default (all these files are being migrated to the repository wazuh/wazuh https://github.com/wazuh/wazuh).