Overview
Wazuh Dashboard Plugins are built on the OpenSearch Dashboards plugin platform, which provides a standardized lifecycle and dependency management system. Each plugin is a self-contained module with defined setup, start, and stop phases.Plugin Lifecycle
Every plugin implements a consistent lifecycle with three main phases:Setup Phase
Occurs during OpenSearch Dashboards initialization. Plugins register routes, UI applications, and configure integrations.
Start Phase
Runs after all plugins have completed setup. Services become available, background jobs start, and the plugin is fully operational.
Plugin Manifest
Each plugin declares its metadata, dependencies, and capabilities inopensearch_dashboards.json:
The Three Core Plugins
1. wazuh-core: Foundation Services
The core plugin provides essential services used by other plugins.Public Plugin (Browser)
File:plugins/wazuh-core/public/plugin.ts
Configuration
Multi-provider configuration management with UI settings and initializer context
Dashboard Security
Security platform detection and integration utilities
Utilities
Shared helper functions and constants
Hooks
React hooks for accessing core services
Server Plugin (Node.js)
File:plugins/wazuh-core/server/plugin.ts
| Component | Purpose |
|---|---|
ManageHosts | Multi-cluster API host management |
ServerAPIClient | HTTP client for Wazuh Server API with user context |
Configuration | Server-side configuration aggregation |
DashboardSecurity | Security plugin integration |
2. wazuh-check-updates: Update Notifications
A lightweight plugin for managing update notifications. File:plugins/wazuh-check-updates/public/plugin.ts
- Components
- Services
UpdatesNotification: UI component for displaying update bannersDismissNotificationCheck: Component to check dismissal state
3. wazuh (Main): Complete Security Platform
The main plugin provides all user-facing features and security modules.Public Plugin
File:plugins/main/public/plugin.ts
Server Plugin
File:plugins/main/server/plugin.ts
Health Check System
The main plugin’s server implements extensive health checks during setup:Index Pattern Health Checks
Example fromplugins/main/server/plugin.ts (lines 261-296):
Events Index Patterns (10 patterns)
Events Index Patterns (10 patterns)
- System Activity Events
- Security Events
- Access Management Events
- Applications Events
- Other Events
- Network Activity Events
- Cloud Services Events (Generic, AWS, Azure, GCP)
States Index Patterns (20 patterns)
States Index Patterns (20 patterns)
- Vulnerabilities
- FIM (Files, Registry Keys, Registry Values)
- SCA (Security Configuration Assessment)
- Inventory (System, Hardware, Networks, Packages, Ports, Processes, Protocols, Users, Groups, Services, Interfaces, Hotfixes, Browser Extensions)
Operational Index Patterns (2 patterns)
Operational Index Patterns (2 patterns)
- Monitoring (Agent status and metrics)
- Statistics (Server performance data)
API Health Checks
API Health Checks
- Connection compatibility
- Run-as configuration validation
Saved Objects
Saved Objects
- Required dashboards and visualizations
Plugin Dependencies
Dependency Graph
Required vs Optional Dependencies
- Required
- Optional
Must be present for plugin to load:All plugins require:
navigation- Menu and navigation servicesopensearchDashboardsUtils- Common utilities
data- Search and aggregationsdashboard- Dashboard embeddingdiscover- Event explorationvisualizations- Chart renderingcharts- Chart configurationsavedObjects- Saved object managementwazuhCore- Foundation serviceswazuhCheckUpdates- Update notifications
Service Architecture
Public Services (Browser)
Services are made globally available through module-level setters:- Avoid prop drilling through deep component trees
- Access platform services from any component
- Testable through service mocking
Server Services (Node.js)
Services are provided through request context:Plugin Communication
Plugins communicate through:Direct API
Setup/start return values expose services to dependent plugins
Shared Context
Request context provides scoped service access
Events
Core event bus for lifecycle and state events
HTTP API
REST endpoints for cross-plugin communication
Development Workflow
Creating a New Plugin
Plugin Development Best Practices
Follow These Patterns:
- Use TypeScript interfaces for plugin contracts
- Implement proper error handling in all lifecycle methods
- Clean up resources in stop() method
- Use dependency injection for testability
- Keep plugins focused on single responsibilities
Related Pages
Architecture
Overall system architecture and design
Security Modules
Implemented security and monitoring features
Data Sources
Index patterns and data organization
Development Guide
Set up your development environment