Architecture Overview - Wazuh Dashboard Plugins

Introduction

Wazuh Dashboard Plugins is a modular plugin-based system built on top of OpenSearch Dashboards. The architecture follows a multi-plugin design pattern where specialized plugins work together to provide comprehensive security monitoring, threat detection, and compliance capabilities.

System Architecture

The Wazuh Dashboard Plugins system consists of three core plugins that work in harmony:

Plugin Hierarchy

The plugins have a clear dependency hierarchy designed for modularity and separation of concerns:

wazuh-core

Foundation plugin providing core services, configuration management, API client, and security utilities

wazuh-check-updates

Utility plugin for managing update notifications and version checking

wazuh (main)

Primary UI plugin providing all security modules, dashboards, and user-facing features

Core Components

Client-Server Architecture

Each plugin implements a dual-sided architecture:

Public (Browser)
Server (Node.js)

Client-Side Components:

React-based UI components
Application routing and navigation
State management (Redux)
Data visualization and dashboards
Search bar and filtering
Plugin lifecycle management

export class WazuhPlugin implements Plugin<WazuhSetup, WazuhStart> {
  public async setup(core: CoreSetup, plugins: WazuhSetupPlugins) {
    // Register applications
    // Configure UI services
    // Initialize interceptors
  }

  public start(core: CoreStart, plugins: WazuhStartPlugins) {
    // Set up runtime services
    // Initialize navigation
    // Configure data plugins
  }
}

Server-Side Components:

HTTP route handlers
Wazuh API client integration
Health check and initialization tasks
Index pattern management
Authentication and authorization
Data processing and transformation

export class WazuhPlugin implements Plugin<WazuhPluginSetup, WazuhPluginStart> {
  public async setup(core: CoreSetup, plugins: PluginSetup) {
    // Register route handlers
    // Set up health checks
    // Configure index patterns
    // Initialize API clients
  }

  public async start(core: CoreStart, plugins: any) {
    // Start background jobs
    // Initialize queue processing
  }
}

Plugin Details

wazuh-core Plugin

Manifest Configuration:

{
  "id": "wazuhCore",
  "version": "5.0.0-00",
  "requiredPlugins": ["navigation", "opensearchDashboardsUtils"],
  "optionalPlugins": ["securityDashboards"],
  "server": true,
  "ui": true
}

Key Responsibilities:

Configuration management through multiple providers
Dashboard security integration
Server API client for Wazuh REST API
Host management for multi-cluster support
Shared utilities and helpers

Source Location: plugins/wazuh-core/

wazuh-check-updates Plugin

Manifest Configuration:

{
  "id": "wazuhCheckUpdates",
  "version": "5.0.0-00",
  "requiredPlugins": [
    "navigation",
    "opensearchDashboardsUtils",
    "opensearchDashboardsReact",
    "wazuhCore"
  ],
  "server": true,
  "ui": true
}

Key Responsibilities:

Check for available updates
Display update notifications
Manage notification dismissal state

Source Location: plugins/wazuh-check-updates/

wazuh (Main) Plugin

Manifest Configuration:

{
  "id": "wazuh",
  "version": "5.0.0-00",
  "requiredPlugins": [
    "navigation", "data", "dashboard", "embeddable",
    "discover", "inspector", "visualizations", "uiActions",
    "charts", "savedObjects", "opensearchDashboardsReact",
    "opensearchDashboardsUtils", "opensearchDashboardsLegacy",
    "wazuhCheckUpdates", "wazuhCore"
  ],
  "optionalPlugins": [
    "security", "securityDashboards", "searchguard",
    "telemetry", "notificationsDashboards", "alertingDashboards",
    "reportsDashboards"
  ],
  "server": true,
  "ui": true
}

Key Responsibilities:

All security module UIs and dashboards
Agent management interface
Server management and configuration
Security operations (RBAC, users, roles)
Threat detection and compliance modules
Sample data generation
Report generation

Source Location: plugins/main/

Application Categories

The main plugin organizes applications into logical categories:

Category ID	Order	Purpose
`wz-category-home`	0	Home and overview dashboards
Explore	100	Data exploration and search
`wz-category-endpoint-security`	200	Endpoint protection modules
`wz-category-threat-intelligence`	300	Threat detection and analysis
`wz-category-security-operations`	400	Security operations and compliance
`wz-category-cloud-security`	500	Cloud service monitoring
`wz-category-agents-management`	600	Agent deployment and management
`wz-category-server-management`	700	Server configuration and logs
Indexer Management	9000	Index and data management

Data Flow

Event Processing Pipeline

Data Ingestion

Wazuh agents send events to the Wazuh Manager, which forwards them to OpenSearch Indexer

Indexing

Events are indexed into various index patterns based on event type (events, states, monitoring, statistics)

Visualization

Dashboard plugins query OpenSearch through the Data plugin API and render visualizations

API Interaction

User actions trigger API calls to Wazuh Server for management operations (agents, rules, decoders, etc.)

Request Flow Diagram

Integration Points

OpenSearch Dashboards Integration

The plugins integrate deeply with OpenSearch Dashboards platform services:

Data Plugin: Search, aggregations, index patterns
Visualizations Plugin: Chart rendering, saved visualizations
Dashboard Plugin: Dashboard embedding and rendering
Discover Plugin: Event exploration interface
Navigation Plugin: Menu and breadcrumb management
Security Dashboards: Authentication and RBAC integration

Wazuh Server API Integration

All management operations communicate with the Wazuh Server REST API:

Agent management (status, configuration, upgrades)
Rules and decoders management
Security configuration (users, roles, policies)
Cluster information and statistics
File integrity monitoring
Vulnerability detection data

Health Check System

The server plugin implements a comprehensive health check system that runs during startup:

Index Pattern Verification

Verifies and creates required index patterns for all data sources:

Events (all categories)
States (vulnerabilities, FIM, SCA, inventory)
Monitoring and statistics

API Connectivity

Tests connection to configured Wazuh Server API hosts and validates authentication

Run-As Configuration

Verifies that allow_run_as is enabled on the Wazuh API for proper user context switching

Saved Objects

Ensures required saved objects (dashboards, visualizations) are present

Notification Channels

Sets up default notification channels when Notifications plugin is available

Configuration Management

The wazuh-core plugin implements a multi-provider configuration system:

// Configuration providers
EConfigurationProviders {
  INITIALIZER_CONTEXT,      // Plugin configuration from opensearch_dashboards.yml
  PLUGIN_UI_SETTINGS,       // User settings from UI
}

Configuration flows through a ConfigurationStore that aggregates settings from multiple sources with proper precedence.

Security Architecture

Authentication Flow

Dashboard security plugin handles user authentication
wazuh-core creates scoped API clients per user session
API requests include user context for audit trail
Wazuh Server enforces RBAC policies

Authorization

Frontend: UI elements conditionally rendered based on user permissions
Backend: Route handlers validate user authorization before processing
API Level: Wazuh Server enforces resource-level permissions

Performance Considerations

Lazy Loading

Applications are dynamically imported only when mounted, reducing initial bundle size

Query Optimization

Search queries use aggregations and time-based filtering to minimize data transfer

Caching

Configuration and API responses are cached with configurable TTL (default 10s)

Background Jobs

Long-running tasks (monitoring, statistics) run in background queues

Extensibility

The architecture supports extension through:

Plugin System: Add new plugins that depend on wazuh-core
Module System: Register new security modules in the main plugin
Custom Visualizations: Add new visualization types through the Visualizations plugin
Route Extensions: Register custom API routes in server plugin

Plugin System

Deep dive into plugin lifecycle and development

Security Modules

Explore the security capabilities and modules

Data Sources

Learn about index patterns and data organization

Getting Started

Start developing with Wazuh Dashboard Plugins

Get Started

Core Concepts

Security Modules

Compliance

Cloud Integrations

Agent Management

Configuration

Development

​Introduction

​System Architecture

​Plugin Hierarchy

wazuh-core

wazuh-check-updates

wazuh (main)

​Core Components

​Client-Server Architecture

​Plugin Details

​wazuh-core Plugin

​wazuh-check-updates Plugin

​wazuh (Main) Plugin

​Application Categories

​Data Flow

​Event Processing Pipeline

​Request Flow Diagram

​Integration Points

​OpenSearch Dashboards Integration

​Wazuh Server API Integration

​Health Check System

​Configuration Management

​Security Architecture

​Authentication Flow

​Authorization

​Performance Considerations

Lazy Loading

Query Optimization

Caching

Background Jobs

​Extensibility

​Related Pages

Plugin System

Security Modules

Data Sources

Getting Started

Build docs developers (and LLMs) love

Introduction

System Architecture

Plugin Hierarchy

Core Components

Client-Server Architecture

Plugin Details

wazuh-core Plugin

wazuh-check-updates Plugin

wazuh (Main) Plugin

Application Categories

Data Flow

Event Processing Pipeline

Request Flow Diagram

Integration Points

OpenSearch Dashboards Integration

Wazuh Server API Integration

Health Check System

Configuration Management

Security Architecture

Authentication Flow

Authorization

Performance Considerations

Extensibility

Related Pages