Project Overview
FoogleTech designed and delivered a next-generation Security Operations Centre (SOC) dashboard in Grafana, integrating Wazuh v4.10.0 for SIEM and endpoint monitoring, TheHive for case management, Cortex for automated response, Elasticsearch for log storage, and MISP for threat intelligence — providing security teams with real-time threat visibility, automated alert-to-case escalation, and accelerated incident response from a single unified dashboard.
The Engineering Challenge
- Security monitoring data was siloed across multiple tools — Wazuh alerts, TheHive cases, and Elasticsearch logs each required separate logins and context-switching, causing analysts to lose critical time during live threat events.
- Manual alert triage was the primary bottleneck — analysts had to individually review each Wazuh alert, decide whether to escalate, and manually create a TheHive case — a process taking 15–30 minutes per incident.
- Upgrading to Wazuh v4.10.0 required realigning existing dashboard queries as several API endpoints and log field names changed between versions.
- The SOC needed threat intelligence correlation — raw Wazuh alerts needed contextualisation against known IOCs from MISP before analysts acted, to reduce false positive investigation time.
Our Solution
- FoogleTech built a unified Grafana dashboard embedding real-time Wazuh alert data, TheHive case views, and Elasticsearch log queries in a single interface — eliminating tool context-switching during incident response.
- Automated alert-to-case creation was implemented using Cortex and REST API integration — qualifying alerts automatically trigger TheHive case creation with pre-populated alert context and MISP IOC correlation, reducing manual case creation from 30 minutes to seconds.
- Custom Grafana visualisations were developed: circle charts by alert severity, live data tables for agent health, and embedded TheHive case panels — all aligned with Wazuh v4.10.0's updated API schema.
- MISP threat intelligence integration automatically queries for known IOCs matching source IPs, file hashes, and domains in Wazuh alerts — surfacing threat context directly in Grafana panels and TheHive cases.
Results & Outcomes
- Unified SOC dashboard providing real-time visibility across Wazuh, Elasticsearch, and TheHive in a single Grafana interface — eliminating multi-tool context-switching during live incidents.
- Automated alert-to-case escalation reducing TheHive case creation from 30 minutes of manual work to seconds of automated processing.
- MISP threat intelligence correlation operational — analysts acting on context-enriched alerts rather than raw log data, reducing false-positive investigation time.
- Dashboard successfully migrated and aligned to Wazuh v4.10.0 with zero functionality regression.
Why Next-Gen Grafana SOC Security Dashboard Chose FoogleTech Software
FoogleTech Software is a specialist engineering company with over a decade of expertise in AI, embedded systems, IoT, and full-stack software development — serving product teams and enterprises across Cybersecurity and beyond. Our engineers don't just write code — they understand the domain, the constraints, and the real-world pressures that ship deadlines create. For Next-Gen Grafana SOC Security Dashboard, that meant deploying a pre-vetted team with direct experience in Grafana, Wazuh v4.10.0, TheHive, reducing ramp-up time from months to days and delivering production-quality work from the first sprint.
Every FoogleTech engagement starts with a structured discovery phase, follows a disciplined agile delivery model with daily engineering syncs, and ends with complete documentation handover — so your in-house team owns the outcome. No black boxes, no lock-in.