{
  "_comment": "POST this to https://INDEXER_HOST:9200/wazuh-findings-v5-*/_search to count findings per rule over the last 7 days. Field names are Wazuh Common Schema. Note wazuh.rule.level is a STRING (informational, low, medium, high, critical), so a range query on it does nothing useful. Remove this _comment key before sending; OpenSearch rejects unknown top-level keys.",

  "size": 0,
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-7d"
      }
    }
  },
  "aggs": {
    "by_rule": {
      "terms": {
        "field": "wazuh.rule.title",
        "size": 50,
        "order": { "_count": "desc" }
      },
      "aggs": {
        "by_level": {
          "terms": { "field": "wazuh.rule.level" }
        },
        "distinct_agents": {
          "cardinality": { "field": "wazuh.agent.id" }
        },
        "by_integration": {
          "terms": { "field": "wazuh.integration.name", "size": 5 }
        }
      }
    }
  }
}