{
  "_comment": [
    "Noise budget query for Wazuh 5.0. Top 50 rules by finding count over",
    "seven days, with the distinct-agent count that tells you WHICH kind of",
    "noise you are looking at.",
    "",
    "Run as:  GET /wazuh-findings-v5-*/_search",
    "from Indexer management > Dev Tools, or against the indexer API on 9200.",
    "Remove this _comment key first.",
    "",
    "Reading the result:",
    "  high count + few distinct_agents  -> a misbehaving endpoint, fix the source",
    "  high count + most of the estate   -> the rule does not suit you, exclude or relevel",
    "  moderate + steady + never actioned-> real but low value, drop it from alerting",
    "  new entry at the top              -> something changed, find the change first",
    "",
    "wazuh.rule.level is aggregated with `terms`, not `range`: it is a STRING",
    "in 5.0 (informational, low, medium, high, critical), not the 0-15 integer",
    "from 4.x.",
    "",
    "Fields used, all confirmed for 5.0:",
    "  wazuh.rule.id     rule identifier",
    "  wazuh.rule.title  rule title (was rule.description in 4.x)",
    "  wazuh.rule.level  severity string (was the integer rule.level)",
    "  wazuh.agent.id    agent identifier",
    "  wazuh.agent.name  agent name",
    "",
    "Companion to https://maheshtata.com/wazuh/wazuh-false-positives/"
  ],
  "size": 0,
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-7d",
        "lt": "now"
      }
    }
  },
  "aggs": {
    "by_rule": {
      "terms": {
        "field": "wazuh.rule.id",
        "size": 50,
        "order": { "_count": "desc" }
      },
      "aggs": {
        "title": {
          "terms": { "field": "wazuh.rule.title", "size": 1 }
        },
        "level": {
          "terms": { "field": "wazuh.rule.level", "size": 5 }
        },
        "distinct_agents": {
          "cardinality": { "field": "wazuh.agent.id" }
        },
        "top_agents": {
          "terms": { "field": "wazuh.agent.name", "size": 5 }
        },
        "per_day": {
          "date_histogram": { "field": "@timestamp", "calendar_interval": "1d" }
        }
      }
    },
    "by_level": {
      "terms": { "field": "wazuh.rule.level", "size": 5 }
    }
  }
}