> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture Overview

> Understand the architectural design and components of Wazuh Dashboard Plugins

## Introduction

Wazuh Dashboard Plugins is a modular plugin-based system built on top of OpenSearch Dashboards. The architecture follows a multi-plugin design pattern where specialized plugins work together to provide comprehensive security monitoring, threat detection, and compliance capabilities.

## System Architecture

The Wazuh Dashboard Plugins system consists of three core plugins that work in harmony:

```mermaid theme={null}
graph TB
    OSD[OpenSearch Dashboards] --> WazuhCore[wazuh-core Plugin]
    OSD --> WazuhCheckUpdates[wazuh-check-updates Plugin]
    WazuhCore --> WazuhMain[wazuh Plugin]
    WazuhCheckUpdates --> WazuhMain
    WazuhMain --> WazuhServer[Wazuh Server API]
    WazuhMain --> OpenSearchIndexer[OpenSearch Indexer]
```

### Plugin Hierarchy

The plugins have a clear dependency hierarchy designed for modularity and separation of concerns:

> **wazuh-core**
>
> Foundation plugin providing core services, configuration management, API client, and security utilities

> **wazuh-check-updates**
>
> Utility plugin for managing update notifications and version checking

> **wazuh (main)**
>
> Primary UI plugin providing all security modules, dashboards, and user-facing features

## Core Components

### Client-Server Architecture

Each plugin implements a dual-sided architecture:

**Public (Browser)**

**Client-Side Components:**

* React-based UI components
* Application routing and navigation
* State management (Redux)
* Data visualization and dashboards
* Search bar and filtering
* Plugin lifecycle management

```typescript theme={null}
export class WazuhPlugin implements Plugin<WazuhSetup, WazuhStart> {
  public async setup(core: CoreSetup, plugins: WazuhSetupPlugins) {
    // Register applications
    // Configure UI services
    // Initialize interceptors
  }

  public start(core: CoreStart, plugins: WazuhStartPlugins) {
    // Set up runtime services
    // Initialize navigation
    // Configure data plugins
  }
}
```

**Server (Node.js)**

**Server-Side Components:**

* HTTP route handlers
* Wazuh API client integration
* Health check and initialization tasks
* Index pattern management
* Authentication and authorization
* Data processing and transformation

```typescript theme={null}
export class WazuhPlugin implements Plugin<WazuhPluginSetup, WazuhPluginStart> {
  public async setup(core: CoreSetup, plugins: PluginSetup) {
    // Register route handlers
    // Set up health checks
    // Configure index patterns
    // Initialize API clients
  }

  public async start(core: CoreStart, plugins: any) {
    // Start background jobs
    // Initialize queue processing
  }
}
```

## Plugin Details

### wazuh-core Plugin

**Manifest Configuration:**

```json theme={null}
{
  "id": "wazuhCore",
  "version": "5.0.0-00",
  "requiredPlugins": ["navigation", "opensearchDashboardsUtils"],
  "optionalPlugins": ["securityDashboards"],
  "server": true,
  "ui": true
}
```

**Key Responsibilities:**

* Configuration management through multiple providers
* Dashboard security integration
* Server API client for Wazuh REST API
* Host management for multi-cluster support
* Shared utilities and helpers

**Source Location:** `plugins/wazuh-core/`

### wazuh-check-updates Plugin

**Manifest Configuration:**

```json theme={null}
{
  "id": "wazuhCheckUpdates",
  "version": "5.0.0-00",
  "requiredPlugins": [
    "navigation",
    "opensearchDashboardsUtils",
    "opensearchDashboardsReact",
    "wazuhCore"
  ],
  "server": true,
  "ui": true
}
```

**Key Responsibilities:**

* Check for available updates
* Display update notifications
* Manage notification dismissal state

**Source Location:** `plugins/wazuh-check-updates/`

### wazuh (Main) Plugin

**Manifest Configuration:**

```json theme={null}
{
  "id": "wazuh",
  "version": "5.0.0-00",
  "requiredPlugins": [
    "navigation", "data", "dashboard", "embeddable",
    "discover", "inspector", "visualizations", "uiActions",
    "charts", "savedObjects", "opensearchDashboardsReact",
    "opensearchDashboardsUtils", "opensearchDashboardsLegacy",
    "wazuhCheckUpdates", "wazuhCore"
  ],
  "optionalPlugins": [
    "security", "securityDashboards", "searchguard",
    "telemetry", "notificationsDashboards", "alertingDashboards",
    "reportsDashboards"
  ],
  "server": true,
  "ui": true
}
```

**Key Responsibilities:**

* All security module UIs and dashboards
* Agent management interface
* Server management and configuration
* Security operations (RBAC, users, roles)
* Threat detection and compliance modules
* Sample data generation
* Report generation

**Source Location:** `plugins/main/`

## Application Categories

The main plugin organizes applications into logical categories:

| Category ID | Order | Purpose |
| - | - | - |
| `wz-category-home` | 0 | Home and overview dashboards |
| Explore | 100 | Data exploration and search |
| `wz-category-endpoint-security` | 200 | Endpoint protection modules |
| `wz-category-threat-intelligence` | 300 | Threat detection and analysis |
| `wz-category-security-operations` | 400 | Security operations and compliance |
| `wz-category-cloud-security` | 500 | Cloud service monitoring |
| `wz-category-agents-management` | 600 | Agent deployment and management |
| `wz-category-server-management` | 700 | Server configuration and logs |
| Indexer Management | 9000 | Index and data management |

## Data Flow

### Event Processing Pipeline

**1. Data Ingestion**

Wazuh agents send events to the Wazuh Manager, which forwards them to OpenSearch Indexer

**2. Indexing**

Events are indexed into various index patterns based on event type (events, states, monitoring, statistics)

**3. Visualization**

Dashboard plugins query OpenSearch through the Data plugin API and render visualizations

**4. API Interaction**

User actions trigger API calls to Wazuh Server for management operations (agents, rules, decoders, etc.)

### Request Flow Diagram

```mermaid theme={null}
sequenceDiagram
    participant User
    participant WazuhUI
    participant WazuhPlugin
    participant WazuhCore
    participant WazuhAPI
    participant OpenSearch

    User->>WazuhUI: View Dashboard
    WazuhUI->>WazuhPlugin: Request Data
    WazuhPlugin->>WazuhCore: Get Configuration
    WazuhCore-->>WazuhPlugin: Config
    WazuhPlugin->>OpenSearch: Query Events
    OpenSearch-->>WazuhPlugin: Event Data
    WazuhPlugin->>WazuhAPI: Get Agent Status
    WazuhAPI-->>WazuhPlugin: Agent Info
    WazuhPlugin-->>WazuhUI: Render Dashboard
    WazuhUI-->>User: Display Data
```

## Integration Points

### OpenSearch Dashboards Integration

The plugins integrate deeply with OpenSearch Dashboards platform services:

* **Data Plugin**: Search, aggregations, index patterns
* **Visualizations Plugin**: Chart rendering, saved visualizations
* **Dashboard Plugin**: Dashboard embedding and rendering
* **Discover Plugin**: Event exploration interface
* **Navigation Plugin**: Menu and breadcrumb management
* **Security Dashboards**: Authentication and RBAC integration

### Wazuh Server API Integration

All management operations communicate with the Wazuh Server REST API:

* Agent management (status, configuration, upgrades)
* Rules and decoders management
* Security configuration (users, roles, policies)
* Cluster information and statistics
* File integrity monitoring
* Vulnerability detection data

## Health Check System

The server plugin implements a comprehensive health check system that runs during startup:

> **Index Pattern Verification**
>
> Verifies and creates required index patterns for all data sources:
>
> * Events (all categories)
> * States (vulnerabilities, FIM, SCA, inventory)
> * Monitoring and statistics

> **API Connectivity**
>
> Tests connection to configured Wazuh Server API hosts and validates authentication

> **Run-As Configuration**
>
> Verifies that `allow_run_as` is enabled on the Wazuh API for proper user context switching

> **Saved Objects**
>
> Ensures required saved objects (dashboards, visualizations) are present

> **Notification Channels**
>
> Sets up default notification channels when Notifications plugin is available

## Configuration Management

The wazuh-core plugin implements a multi-provider configuration system:

```typescript theme={null}
// Configuration providers
EConfigurationProviders {
  INITIALIZER_CONTEXT,      // Plugin configuration from opensearch_dashboards.yml
  PLUGIN_UI_SETTINGS,       // User settings from UI
}
```

Configuration flows through a `ConfigurationStore` that aggregates settings from multiple sources with proper precedence.

## Security Architecture

### Authentication Flow

1. Dashboard security plugin handles user authentication
2. wazuh-core creates scoped API clients per user session
3. API requests include user context for audit trail
4. Wazuh Server enforces RBAC policies

### Authorization

* **Frontend**: UI elements conditionally rendered based on user permissions
* **Backend**: Route handlers validate user authorization before processing
* **API Level**: Wazuh Server enforces resource-level permissions

## Performance Considerations

> **Lazy Loading**
>
> Applications are dynamically imported only when mounted, reducing initial bundle size

> **Query Optimization**
>
> Search queries use aggregations and time-based filtering to minimize data transfer

> **Caching**
>
> Configuration and API responses are cached with configurable TTL (default 10s)

> **Background Jobs**
>
> Long-running tasks (monitoring, statistics) run in background queues

## Extensibility

The architecture supports extension through:

* **Plugin System**: Add new plugins that depend on wazuh-core
* **Module System**: Register new security modules in the main plugin
* **Custom Visualizations**: Add new visualization types through the Visualizations plugin
* **Route Extensions**: Register custom API routes in server plugin

## Related Pages

> **[Plugin System](./plugins)**
>
> Deep dive into plugin lifecycle and development

> **[Security Modules](./security-modules)**
>
> Explore the security capabilities and modules

> **[Data Sources](./data-sources)**
>
> Learn about index patterns and data organization

> **[Getting Started](../getting-started)**
>
> Start developing with Wazuh Dashboard Plugins


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.