Skip to main content
The main plugin (wazuh) is the primary plugin that provides the Wazuh dashboard application, UI components, and server-side routes.

​
Plugin Class

​
WazuhPlugin

The main plugin class implementing the OpenSearch Dashboards plugin interface. Location: plugins/main/public/plugin.ts:51 
export class WazuhPlugin
  implements Plugin<WazuhSetup, WazuhStart, WazuhSetupPlugins, WazuhStartPlugins>

​
Lifecycle Methods

​
setup()

Initializes the plugin during the setup phase. Signature: 
public async setup(
  core: CoreSetup,
  plugins: WazuhSetupPlugins,
): Promise<WazuhSetup>
​
core
CoreSetup
required
OpenSearch Dashboards core services setup contract
​
plugins
WazuhSetupPlugins
required
Plugin dependencies available during setup
Returns: Promise<WazuhSetup> - Empty object (no public APIs exposed during setup)

​
Setup Tasks

During setup, the plugin:
  1. Configures chart color palettes - Customizes the EUI palette for better visualization
  2. Registers query languages - Enables WQL, Lucene, and DQL for search bars
  3. Registers applications - Creates all Wazuh applications (Overview, Agents, etc.)
  4. Registers navigation links - Adds Wazuh to the OpenSearch Dashboards menu
Example: 
// Applications registered during setup
for (const app of Applications) {
  const { category, id, title, redirectTo, order } = app;
  
  core.application.register({
    id,
    title,
    order,
    mount: async (params: AppMountParameters) => {
      // Application mounting logic
    },
    category: Categories.find(
      ({ id: categoryID }) => categoryID === category,
    ),
  });
}

​
start()

Activates the plugin during the start phase. Signature: 
public start(
  core: CoreStart,
  plugins: WazuhStartPlugins,
): WazuhStart
​
core
CoreStart
required
OpenSearch Dashboards core services start contract
​
plugins
WazuhStartPlugins
required
Plugin dependencies available during start
Returns: WazuhStart - Empty object (no public APIs exposed during start)

​
Start Tasks

During start, the plugin:
  1. Sets global services - Makes core services available throughout the app
  2. Hides security alerts - Disables OpenSearch security warnings
  3. Initializes telemetry - Sets up usage tracking if enabled
  4. Configures error handling - Establishes error orchestration
Example: 
// Services set during start (available globally)
setCore(core);
setPlugins(plugins);
setHttp(core.http);
setToasts(core.notifications.toasts);
setDataPlugin(plugins.data);
setWazuhCorePlugin(plugins.wazuhCore);

​
Type Definitions

​
WazuhSetupPlugins

Plugins required during the setup phase. Location: plugins/main/public/types.ts:43 
export type WazuhSetupPlugins = {
  uiActions: UiActionsSetup;
  visualizations: VisualizationsSetup;
  data: DataPublicPluginSetup;
  navigation: NavigationPublicPluginStart;
  telemetry: TelemetryPluginSetup;
  charts: ChartsPluginStart;
};

​
WazuhStartPlugins

Plugins required during the start phase. Location: plugins/main/public/types.ts:51 
export type WazuhStartPlugins = {
  navigation: NavigationPublicPluginStart;
  data: DataPublicPluginStart;
  visualizations: VisualizationsStart;
  discover: DiscoverStart;
  charts: ChartsPluginStart;
  securityOss?: SecurityOssPluginStart;
  savedObjects: SavedObjectsStart;
  telemetry?: TelemetryPluginStart;
  wazuhCheckUpdates: WazuhCheckUpdatesPluginStart;
  wazuhCore: WazuhCorePluginStart;
  dashboard: DashboardStart;
};

​
AppDependencies

Context object passed to application components. Location: plugins/main/public/types.ts:37 
export interface AppDependencies {
  core: CoreStart;
  plugins: AppPluginStartDependencies;
  params: AppMountParameters;
}

​
Server Plugin

The server-side plugin provides REST API routes and background jobs.

​
WazuhPlugin (Server)

Location: plugins/main/server/plugin.ts:177 
export class WazuhPlugin implements Plugin<WazuhPluginSetup, WazuhPluginStart>

​
setup() (Server)

Signature: 
public async setup(core: CoreSetup, plugins: PluginSetup)
Server setup tasks:
  1. Registers route handler context - Adds wazuh context to request handlers
  2. Adds security headers - Configures X-Frame-Options
  3. Creates router - Sets up HTTP route handling
  4. Registers health checks - Initializes index pattern and API checks
  5. Configures notifications - Sets up notification channels if available
Example: 
// Route handler context
core.http.registerRouteHandlerContext('wazuh', (context, request) => ({
  logger: this.logger.get(
    `${request.route.method.toUpperCase()} ${request.route.path}`,
  ),
  server: {
    info: serverInfo,
  },
  plugins,
  security: plugins.wazuhCore.dashboardSecurity,
  api: context.wazuh_core.api,
}));

​
start() (Server)

Signature: 
public async start(core: CoreStart, plugins: any)
Server start tasks:
  1. Initializes background jobs - Starts API initialization checks
  2. Starts queue processing - Begins queue job runner
  3. Loads global configuration - Retrieves server settings

​
Server Routes

The main plugin exposes several REST API route groups.

​
Wazuh API Routes

Location: plugins/main/server/routes/wazuh-api.ts

​
POST /api/check-stored-api

Validates a stored API configuration.
​
id
string
required
API host ID to check
​
idChanged
string
Previous ID if changed
Response: 
{
  statusCode: 200,
  data: {
    status: 'connected' | 'disconnected',
    version: string,
    cluster: {
      enabled: boolean,
      name?: string
    }
  }
}

​
POST /api/check-api

Validates API credentials without storing them.
​
url
string
required
Wazuh API URL
​
port
number
required
API port number
​
username
string
required
API username
​
password
string
required
API password

​
POST /api/login

Authenticates with a configured API host.
​
idHost
string
required
API host ID
​
force
boolean
default:false
Force token refresh
Response: 
{
  token: string,
  idHost: string
}

​
POST /api/request

Proxies a request to the Wazuh API.
​
id
string
required
API host ID
​
method
string
required
HTTP method (GET, POST, PUT, DELETE)
​
path
string
required
API endpoint path
​
body
object
Request payload
Example: 
// Client request
const response = await fetch('/api/request', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    id: 'default',
    method: 'GET',
    path: '/agents',
    body: {}
  })
});

​
POST /api/csv

Exports API response data as CSV.
​
id
string
required
API host ID
​
path
string
required
API endpoint path
​
filters
object
Query filters

​
GET /api/routes

Returns available Wazuh API routes for the Dev Tools console. Response: 
{
  routes: Array<{
    method: string,
    path: string,
    description: string
  }>
}

​
Host Management Routes

Location: plugins/main/server/routes/wazuh-hosts.ts

​
GET /hosts/apis

Retrieve all configured API hosts.

​
POST /hosts/apis

Add a new API host configuration.

​
PUT /hosts/apis/:id

Update an existing API host.

​
DELETE /hosts/apis/:id

Remove an API host configuration.

​
Elasticsearch Routes

Location: plugins/main/server/routes/wazuh-elastic.ts

​
GET /elastic/known-fields/:pattern

Get known fields for an index pattern.

​
GET /elastic/visualizations

Retrieve visualization saved objects.

​
POST /elastic/index-patterns

Create or update index patterns.

​
Utility Routes

Location: plugins/main/server/routes/wazuh-utils/ui-logs.ts

​
POST /utils/logs/ui

Log client-side errors to the server.
​
level
string
required
Log level (info, error, warning)
​
message
string
required
Log message
​
location
string
Source location in UI

​
Global Services

The plugin exposes global services through the kibana-services module. Location: plugins/main/public/kibana-services.ts 
import {
  getCore,
  getHttp,
  getToasts,
  getDataPlugin,
  getUiSettings,
  getChrome,
  getSavedObjects,
  getWazuhCorePlugin,
} from './kibana-services';

// Example usage
const http = getHttp();
const response = await http.post('/api/request', {
  body: JSON.stringify({ method: 'GET', path: '/agents' })
});

Wazuh Core API

Shared services and configuration

Components

Reusable UI components

API Console

Interactive API testing

Server Architecture

Server-side architecture guide