{
  "_comment": "Query-level Alerting monitor for Wazuh 5.0 findings. POST this body to _plugins/_alerting/monitors on the indexer. Monitor structure is from the OpenSearch Alerting API documentation; index name and field names are from the Wazuh 5.0-beta documentation. Replace REPLACE_WITH_NOTIFICATION_CHANNEL_ID with the config id of a channel created in the Notifications module.",
  "type": "monitor",
  "name": "wazuh-high-severity-security-findings",
  "monitor_type": "query_level_monitor",
  "enabled": true,
  "schedule": {
    "period": {
      "interval": 5,
      "unit": "MINUTES"
    }
  },
  "inputs": [
    {
      "search": {
        "indices": [
          "wazuh-findings-v5-security"
        ],
        "query": {
          "size": 5,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{period_end}}||-5m",
                      "lte": "{{period_end}}",
                      "format": "epoch_millis"
                    }
                  }
                },
                {
                  "terms": {
                    "wazuh.rule.level": [
                      "high",
                      "critical"
                    ]
                  }
                }
              ]
            }
          }
        }
      }
    }
  ],
  "triggers": [
    {
      "name": "high-or-critical-finding-present",
      "severity": "1",
      "condition": {
        "script": {
          "source": "ctx.results[0].hits.total.value > 0",
          "lang": "painless"
        }
      },
      "actions": [
        {
          "name": "notify-channel",
          "destination_id": "REPLACE_WITH_NOTIFICATION_CHANNEL_ID",
          "subject_template": {
            "source": "Wazuh: {{ctx.results.0.hits.total.value}} high or critical findings"
          },
          "message_template": {
            "source": "Monitor {{ctx.monitor.name}} matched {{ctx.results.0.hits.total.value}} findings between {{ctx.periodStart}} and {{ctx.periodEnd}} UTC. Trigger: {{ctx.trigger.name}}. Severity: {{ctx.trigger.severity}}."
          },
          "throttle_enabled": true,
          "throttle": {
            "value": 30,
            "unit": "MINUTES"
          }
        }
      ]
    }
  ]
}