> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Modules

> Comprehensive overview of security monitoring and threat detection modules in Wazuh Dashboard Plugins

## Overview

Wazuh Dashboard Plugins provide a comprehensive suite of security modules organized into logical categories. Each module offers specialized dashboards, real-time monitoring, and detailed analytics for different aspects of security operations.

## Module Categories

Modules are organized into categories that align with security operations workflows:

> **Endpoint Security**
>
> Protection and monitoring for endpoints including malware detection, FIM, and configuration assessment

> **Threat Intelligence**
>
> Advanced threat detection using MITRE ATT\&CK, vulnerability scanning, and malware detection

> **Security Operations**
>
> Compliance frameworks (PCI DSS, GDPR, HIPAA, NIST), audit, and policy monitoring

> **Cloud Security**
>
> Multi-cloud monitoring for AWS, Azure, GCP, Office 365, and GitHub

> **Agent Management**
>
> Deploy, configure, and monitor Wazuh agents across your infrastructure

> **Server Management**
>
> Configure rules, decoders, groups, and manage cluster operations

## Endpoint Security Modules

### Configuration Assessment (SCA)

**Module ID:** `configuration-assessment`\
**Category:** Endpoint Security\
**Order:** 200

**Overview**

Security Configuration Assessment (SCA) performs automated audits of system configurations against security benchmarks and best practices.

**Key Features:**

* CIS benchmark compliance checks
* Custom policy definition support
* Policy compliance scoring
* Failed check remediation guidance
* Historical compliance trends

**Data Source:** `wazuh-states-sca*`

**Use Cases**

* **Compliance Auditing**: Verify systems meet security standards (CIS, STIG)
* **Configuration Drift**: Detect unauthorized configuration changes
* **Hardening Validation**: Confirm security hardening measures are applied
* **Policy Enforcement**: Ensure configurations match organizational policies

**Implementation**

```typescript theme={null}
// Application definition from applications.ts:59-85
export const configurationAssessment = {
  category: 'wz-category-endpoint-security',
  id: 'configuration-assessment',
  title: 'Configuration Assessment',
  description: 'Scan your assets as part of a configuration assessment audit.',
  order: 200,
  euiIconType: 'managementApp',
  showInOverviewApp: true,
  showInAgentMenu: true,
  redirectTo: () =>
    `/overview/?tab=sca&tabView=dashboard${agentIdParam}`,
};
```

### Malware Detection

**Module ID:** `malware-detection`\
**Category:** Endpoint Security\
**Order:** 201

**Overview**

Detects and analyzes malware infections through multiple detection engines including signature-based, behavioral, and integration with VirusTotal.

**Detection Methods:**

* File integrity monitoring anomalies
* Rootcheck detection
* VirusTotal integration
* YARA rule matching
* Behavioral analysis

**Data Source:** `wazuh-events*` (filtered by malware detection rules)

**Alert Types**

* **Malicious Files**: Detected through hash matching or scanning
* **Rootkits**: System-level malware detection
* **Trojans**: Backdoor and remote access tool detection
* **Ransomware**: Encryption and ransom note detection patterns
* **Suspicious Activity**: Behavioral indicators of compromise

### File Integrity Monitoring (FIM)

**Module ID:** `file-integrity-monitoring`\
**Category:** Endpoint Security\
**Order:** 202

**Overview**

Monitors file system changes in real-time to detect unauthorized modifications, additions, or deletions.

**Monitored Attributes:**

* File content (hash)
* Permissions and ownership
* Size and timestamps
* Windows registry keys and values (Windows)
* File attributes and ACLs

**Data Sources:**

* `wazuh-states-fim-files*` - File states
* `wazuh-states-fim-registry-keys*` - Registry keys (Windows)
* `wazuh-states-fim-registry-values*` - Registry values (Windows)

**Dashboards**

**Events Dashboard:**

* Real-time file change events
* Change type distribution (added, modified, deleted)
* Most active paths
* User attribution

**Inventory Dashboards:**

* Current file states
* Registry key inventory (Windows)
* Registry value inventory (Windows)
* File hash repository

**Implementation**

```typescript theme={null}
// Index pattern constants from constants.ts:86-91
export const WAZUH_FIM_PATTERN = 'wazuh-states-fim*';
export const WAZUH_FIM_FILES_PATTERN = 'wazuh-states-fim-files*';
export const WAZUH_FIM_REGISTRY_KEYS_PATTERN = 'wazuh-states-fim-registry-keys*';
export const WAZUH_FIM_REGISTRY_VALUES_PATTERN = 'wazuh-states-fim-registry-values*';
```

## Threat Intelligence Modules

### Vulnerability Detection

**Module ID:** `vulnerabilities`\
**Category:** Threat Intelligence\
**Order:** 300

> [!NOTE]
>
> **CVE Database Integration**: Continuously updated vulnerability database correlates installed packages with known CVEs.

**Overview**

Identifies vulnerabilities in installed software packages by correlating with CVE databases.

**Features:**

* Automated vulnerability scanning
* CVE severity scoring (CVSS)
* Affected package identification
* Patch availability tracking
* Vulnerability trending

**Data Source:** `wazuh-states-vulnerabilities*`

**Metrics**

* **Critical/High/Medium/Low**: Vulnerability count by severity
* **Top CVEs**: Most prevalent vulnerabilities
* **Affected Agents**: Systems with detected vulnerabilities
* **Package Vulnerabilities**: Vulnerable packages by count
* **Age of Vulnerabilities**: Time since CVE publication

**Index Pattern**

```typescript theme={null}
// From constants.ts:32-34
export const WAZUH_VULNERABILITIES_PATTERN = 'wazuh-states-vulnerabilities*';
export const WAZUH_INDEX_TYPE_VULNERABILITIES = 'vulnerabilities';
export const VULNERABILITY_IMPLICIT_CLUSTER_MODE_FILTER = 'wazuh.cluster.name';
```

### MITRE ATT\&CK

**Module ID:** `mitre-attack`\
**Category:** Threat Intelligence\
**Order:** 301

Maps detected security events to the MITRE ATT\&CK framework for threat intelligence and attack pattern analysis.

**Framework Coverage:**

* **Tactics**: High-level adversary goals (Initial Access, Execution, Persistence, etc.)
* **Techniques**: Methods to achieve tactical goals
* **Mitigations**: Recommended countermeasures
* **Kill Chain Analysis**: Attack progression visualization

**Data Source:** `wazuh-events*` (events tagged with MITRE ATT\&CK IDs)

### Docker Security

**Module ID:** `docker`\
**Category:** Threat Intelligence\
**Order:** 302

Monitors Docker containers and hosts for security events and configuration issues.

**Monitoring Capabilities:**

* Container lifecycle events
* Image vulnerability scanning
* Network activity monitoring
* Resource usage anomalies
* Docker daemon security events

## Security Operations Modules

### Regulatory Compliance

Multiple compliance framework modules help organizations meet regulatory requirements:

> **PCI DSS**
>
> **Module ID:** `pci-dss`\
> **Standard:** Payment Card Industry Data Security Standard
>
> **Coverage:**
>
> * 12 requirements mapping
> * Cardholder data protection
> * Network security controls
> * Access control measures
> * Security testing procedures
>
> **Dashboard:** Real-time requirement compliance status

> **GDPR**
>
> **Module ID:** `gdpr`\
> **Regulation:** General Data Protection Regulation
>
> **Coverage:**
>
> * Data processing activities
> * User consent tracking
> * Data subject rights
> * Breach notification
> * Privacy by design
>
> **Dashboard:** GDPR article compliance view

> **HIPAA**
>
> **Module ID:** `hipaa`\
> **Standard:** Health Insurance Portability and Accountability Act
>
> **Coverage:**
>
> * PHI access controls
> * Audit trail requirements
> * Integrity controls
> * Transmission security
> * Administrative safeguards
>
> **Dashboard:** HIPAA safeguard compliance

> **NIST 800-53**
>
> **Module ID:** `nist-800-53`\
> **Framework:** NIST Special Publication 800-53
>
> **Coverage:**
>
> * 18 control families
> * Risk management framework
> * Security control assessment
> * Continuous monitoring
> * Authorization processes
>
> **Dashboard:** Control family compliance status

> **TSC**
>
> **Module ID:** `tsc`\
> **Standard:** Trust Services Criteria
>
> **Coverage:**
>
> * Security (CC6)
> * Availability (A1)
> * Processing integrity (PI1)
> * Confidentiality (C1)
> * Privacy (P1-P8)
>
> **Dashboard:** TSC criteria compliance

### Audit and Policy Monitoring

**Module ID:** `policy-monitoring`\
**Category:** Security Operations

Monitors system audit logs and enforces security policies.

**Capabilities:**

* Linux audit system integration
* Windows audit policy monitoring
* Policy violation detection
* User activity auditing
* Privileged command tracking

## Cloud Security Modules

### Amazon Web Services (AWS)

**Module ID:** `aws`\
**Category:** Cloud Security\
**Order:** 500

**Services Monitored**

* **CloudTrail**: API activity and governance
* **GuardDuty**: Threat detection findings
* **IAM**: Identity and access management events
* **VPC Flow Logs**: Network traffic analysis
* **Config**: Resource configuration changes
* **WAF**: Web application firewall events
* **Inspector**: Vulnerability assessment findings

**Dashboard Metrics**

* Event distribution by AWS service
* Top event sources and names
* Geographic event distribution
* IAM policy changes
* Resource modification timeline
* Security group changes

**Data Source**

```typescript theme={null}
// From constants.ts:140-142
export const WAZUH_EVENTS_CLOUD_SERVICES_AWS_PATTERN =
  'wazuh-events-v5-cloud-services-aws*';
```

### Microsoft Azure

**Module ID:** `azure`\
**Category:** Cloud Security\
**Order:** 501

**Integration Points:**

* Azure Active Directory logs
* Azure Security Center alerts
* Activity logs
* Resource health events
* Policy compliance data

### Google Cloud Platform (GCP)

**Module ID:** `google-cloud`\
**Category:** Cloud Security\
**Order:** 502

**Monitoring:**

* Cloud Audit Logs
* Security Command Center
* IAM policy changes
* Compute Engine events
* Cloud Storage access

### Office 365

**Module ID:** `office-365`\
**Category:** Cloud Security\
**Order:** 503

**Tracked Activities:**

* Exchange mailbox access
* SharePoint file operations
* Azure AD sign-ins
* Teams activity
* OneDrive file sharing

### GitHub

**Module ID:** `github`\
**Category:** Cloud Security\
**Order:** 504

**Monitored Events:**

* Repository creation/deletion
* Branch protection changes
* Webhook configurations
* Organization membership
* Security alerts

## IT Hygiene (Inventory) Module

**Module ID:** `it-hygiene`\
**Category:** Endpoint Security\
**Order:** 203

> [!NOTE]
>
> IT Hygiene provides comprehensive visibility into system inventories and configurations across your infrastructure.

### Inventory Categories

The IT Hygiene module tracks multiple inventory types:

**System Inventories**

**System Information:**

* OS details and versions
* Hostname and architecture
* Kernel information

**Hardware:**

* CPU details
* Memory (total, free, used, usage %)
* Board manufacturer and serial

**Data Sources:**

* `wazuh-states-inventory-system*`
* `wazuh-states-inventory-hardware*`

**Network Inventories**

**Networks:**

* Network interfaces and addresses
* Gateway configurations
* DHCP settings

**Interfaces:**

* Interface names and types
* MAC addresses
* Traffic statistics (ingress/egress bytes)

**Protocols:**

* Network protocol usage
* Protocol configurations

**Listening Services:**

* Open ports and associated processes
* Service protocols
* Local/remote addresses

**Data Sources:**

* `wazuh-states-inventory-networks*`
* `wazuh-states-inventory-interfaces*`
* `wazuh-states-inventory-protocols*`
* `wazuh-states-inventory-ports*`

**Package Inventories**

**Packages:**

* Installed software packages
* Package versions and sizes
* Installation dates
* Package managers (RPM, DEB, etc.)

**Hotfixes (Windows):**

* Installed Windows updates
* Hotfix IDs and descriptions

**Browser Extensions:**

* Installed browser add-ons
* Extension versions and permissions

**Data Sources:**

* `wazuh-states-inventory-packages*`
* `wazuh-states-inventory-hotfixes*`
* `wazuh-states-inventory-browser-extensions*`

**User Inventories**

**Users:**

* System user accounts
* User IDs and group memberships

**Groups:**

* System groups
* Group IDs and members

**Data Sources:**

* `wazuh-states-inventory-users*`
* `wazuh-states-inventory-groups*`

**Process & Service Inventories**

**Processes:**

* Running processes
* Process IDs and parent PIDs
* Command lines and users

**Services (Windows):**

* Installed Windows services
* Service states and startup types

**Data Sources:**

* `wazuh-states-inventory-processes*`
* `wazuh-states-inventory-services*`

### Field Formatting

IT Hygiene applies special formatting to inventory fields:

```typescript theme={null}
// From plugin.ts:303-315
mapFieldsFormat({
  'destination.port': 'integer',
  'host.memory.free': 'bytes',
  'host.memory.total': 'bytes',
  'host.memory.used': 'bytes',
  'host.memory.usage': 'percent',
  'host.network.egress.bytes': 'bytes',
  'host.network.ingress.bytes': 'bytes',
  'package.size': 'bytes',
  'process.parent.pid': 'integer',
  'process.pid': 'integer',
  'source.port': 'integer',
})
```

## Module Organization

### Application Order Convention

From the source code documentation:

```typescript theme={null}
/* Applications
Convention: the order of each application must according to the order of the category
that is included.

Example:
Category order of the application: 100
Application order: one of 100-199 range: 100, 101, 102, etc...
*/

/* Categories ID
Wazuh:
Home: 0
Explore: 100
Endpoint security: 200
Threat intelligence: 300
Security operations: 400
Cloud security: 500
Agents management: 600
Server management: 700
Indexer management: 9000
*/
```

### Module Visibility

Each module defines where it appears:

```typescript theme={null}
export const moduleExample = {
  // ...
  showInOverviewApp: true,    // Appears in overview module list
  showInAgentMenu: true,      // Appears in agent detail view
};
```

## Event Categorization

Events are categorized into specialized index patterns for optimized querying:

> **System Activity**
>
> `wazuh-events-v5-system-activity*`
>
> Process execution, system calls, kernel events

> **Security Events**
>
> `wazuh-events-v5-security*`
>
> Authentication, authorization, security violations

> **Access Management**
>
> `wazuh-events-v5-access-management*`
>
> User authentication, authorization, access control

> **Applications**
>
> `wazuh-events-v5-applications*`
>
> Application-specific events and logs

> **Network Activity**
>
> `wazuh-events-v5-network-activity*`
>
> Network connections, traffic, firewall events

> **Other Events**
>
> `wazuh-events-v5-other*`
>
> Uncategorized or miscellaneous events

## Module Constants

From `constants.ts:507-526`:

```typescript theme={null}
export enum WAZUH_MODULES_ID {
  SECURITY_EVENTS = 'general',
  INTEGRITY_MONITORING = 'fim',
  AMAZON_WEB_SERVICES = 'aws',
  OFFICE_365 = 'office',
  GOOGLE_CLOUD_PLATFORM = 'gcp',
  POLICY_MONITORING = 'pm',
  SECURITY_CONFIGURATION_ASSESSMENT = 'sca',
  AUDITING = 'azure-audit',
  VULNERABILITIES = 'vuls',
  DOCKER = 'docker',
  MITRE_ATTACK = 'mitre',
  PCI_DSS = 'pci',
  HIPAA = 'hipaa',
  NIST_800_53 = 'nist',
  TSC = 'tsc',
  VIRUSTOTAL = 'virustotal',
  GDPR = 'gdpr',
  GITHUB = 'github',
}
```

## Dashboard Architecture

Each module typically provides:

1. **Overview Dashboard**: High-level metrics and trends
2. **Events Dashboard**: Real-time event stream and filtering
3. **Inventory Dashboard**: Current state data (where applicable)
4. **Agent-Specific Views**: Per-agent details and metrics

**Dashboard ID Convention:**

```typescript theme={null}
// Overview dashboards
export const MODULE_DASHBOARD_ID = 'module-overview-dashboard';

// Agent-specific dashboards
export const MODULE_AGENT_DASHBOARD_ID = 'module-pinned-agent-dashboard';

// Inventory dashboards
export const MODULE_INVENTORY_ID = 'module-inventory-dashboard';
```

## Data Source Filters

Modules apply controlled filters to focus on relevant data:

```typescript theme={null}
// From constants.ts:550-583
export const DATA_SOURCE_FILTER_CONTROLLED_EXCLUDE_SERVER = 'hidden-exclude-server';
export const DATA_SOURCE_FILTER_CONTROLLED_PINNED_AGENT = 'pinned-agent';
export const DATA_SOURCE_FILTER_CONTROLLED_CLUSTER_MANAGER = 'cluster-manager';
export const DATA_SOURCE_FILTER_CONTROLLED_REGULATORY_COMPLIANCE_REQUIREMENT =
  'hidden-regulatory-compliance-requirement';
export const DATA_SOURCE_FILTER_CONTROLLED_VULNERABILITIES_RULE_GROUP =
  'vulnerabilities-rule-group';
export const DATA_SOURCE_FILTER_CONTROLLED_MITRE_ATTACK_RULE =
  'mitre-attack-rule';
export const DATA_SOURCE_FILTER_CONTROLLED_AWS_RULE_GROUP = 'aws-rule-group';
export const DATA_SOURCE_FILTER_CONTROLLED_AZURE_RULE_GROUP = 'azure-rule-group';
export const DATA_SOURCE_FILTER_CONTROLLED_FIM_RULE_GROUP = 'fim-rule-group';
// ... and more
```

## Related Pages

> **[Architecture](./architecture)**
>
> System architecture and component overview

> **[Data Sources](./data-sources)**
>
> Index patterns and data organization details

> **[Plugin System](./plugins)**
>
> Plugin lifecycle and development

> **[API Reference](../api-reference)**
>
> Module APIs and interfaces


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.