# Screenshots

These come from the running stack. Bring it up with `./scripts/deploy.sh`, enroll an

agent, and fire a test alert, then capture the shots below. Drop the files in this

directory with the names listed and they'll render in the main README.

Capture at a consistent width (1280-1440), and annotate the call-out in each shot

(a red circle/arrow is enough).

Captured from the running lab (detection layer):

- `01-wazuh-threat-hunting.png` - Threat Hunting dashboard with the SSH brute-force

  alerts and their MITRE ATT&CK breakdown.

- `02-wazuh-agent.png` - the enrolled Linux endpoint, active and reporting in.

Still to capture from the SOAR side, once the workflow is imported and a case has run

through it:

| File | Where | Annotate |

|------|-------|----------|

| `03-shuffle-workflow.png` | Shuffle → the imported `Wazuh -> TheHive Enrichment` workflow canvas | the enrichment → scoring → case-creation path |

| `04-shuffle-run.png` | Shuffle → a finished run of that workflow | the VirusTotal/OTX result feeding the severity score |

| `05-thehive-case.png` | TheHive → the auto-created case | the severity, the MITRE tags, and the attached IOC observable |

## Triggering a test alert

The quickest way to get a case end-to-end without waiting for real activity:

```bash

# from an enrolled endpoint, make a DNS lookup / connection to a value

# you've placed in one of the CTI lists, e.g. cdn-jquery-min.net

# or replay a sample brute-force against SSH to trip rule 100200

```

That fires a level-12 rule, which hits the integration, which runs the Shuffle

workflow, which opens the TheHive case - giving you shots 01 through 04 from a single

event.