Main Plugin API - Wazuh Dashboard Plugins

The main plugin (wazuh) is the primary plugin that provides the Wazuh dashboard application, UI components, and server-side routes.

Plugin Class

WazuhPlugin

The main plugin class implementing the OpenSearch Dashboards plugin interface. Location: plugins/main/public/plugin.ts:51

export class WazuhPlugin
  implements Plugin<WazuhSetup, WazuhStart, WazuhSetupPlugins, WazuhStartPlugins>

Lifecycle Methods

setup()

Initializes the plugin during the setup phase. Signature:

public async setup(
  core: CoreSetup,
  plugins: WazuhSetupPlugins,
): Promise<WazuhSetup>

CoreSetup

required

OpenSearch Dashboards core services setup contract

WazuhSetupPlugins

required

Plugin dependencies available during setup

Show properties

UiActionsSetup

UI actions framework for registering triggers and actions

VisualizationsSetup

Visualizations plugin for chart rendering

DataPublicPluginSetup

Data plugin for search and queries

Navigation plugin for menu and breadcrumbs

TelemetryPluginSetup

Telemetry plugin for usage tracking

ChartsPluginStart

Charts plugin for color palettes and configurations

Returns: Promise<WazuhSetup> - Empty object (no public APIs exposed during setup)

Setup Tasks

During setup, the plugin:

Configures chart color palettes - Customizes the EUI palette for better visualization
Registers query languages - Enables WQL, Lucene, and DQL for search bars
Registers applications - Creates all Wazuh applications (Overview, Agents, etc.)
Registers navigation links - Adds Wazuh to the OpenSearch Dashboards menu

Example:

// Applications registered during setup
for (const app of Applications) {
  const { category, id, title, redirectTo, order } = app;
  
  core.application.register({
    id,
    title,
    order,
    mount: async (params: AppMountParameters) => {
      // Application mounting logic
    },
    category: Categories.find(
      ({ id: categoryID }) => categoryID === category,
    ),
  });
}

start()

Activates the plugin during the start phase. Signature:

public start(
  core: CoreStart,
  plugins: WazuhStartPlugins,
): WazuhStart

CoreStart

required

OpenSearch Dashboards core services start contract

WazuhStartPlugins

required

Plugin dependencies available during start

Show properties

DataPublicPluginStart

Data plugin instance for querying

Navigation services

VisualizationsStart

Visualizations rendering services

DiscoverStart

Discover plugin for event exploration

WazuhCorePluginStart

Wazuh Core plugin services

WazuhCheckUpdatesPluginStart

Update checking services

SecurityOssPluginStart

Security plugin (if available)

Returns: WazuhStart - Empty object (no public APIs exposed during start)

Start Tasks

During start, the plugin:

Sets global services - Makes core services available throughout the app
Hides security alerts - Disables OpenSearch security warnings
Initializes telemetry - Sets up usage tracking if enabled
Configures error handling - Establishes error orchestration

Example:

// Services set during start (available globally)
setCore(core);
setPlugins(plugins);
setHttp(core.http);
setToasts(core.notifications.toasts);
setDataPlugin(plugins.data);
setWazuhCorePlugin(plugins.wazuhCore);

Type Definitions

WazuhSetupPlugins

Plugins required during the setup phase. Location: plugins/main/public/types.ts:43

export type WazuhSetupPlugins = {
  uiActions: UiActionsSetup;
  visualizations: VisualizationsSetup;
  data: DataPublicPluginSetup;
  navigation: NavigationPublicPluginStart;
  telemetry: TelemetryPluginSetup;
  charts: ChartsPluginStart;
};

WazuhStartPlugins

Plugins required during the start phase. Location: plugins/main/public/types.ts:51

export type WazuhStartPlugins = {
  navigation: NavigationPublicPluginStart;
  data: DataPublicPluginStart;
  visualizations: VisualizationsStart;
  discover: DiscoverStart;
  charts: ChartsPluginStart;
  securityOss?: SecurityOssPluginStart;
  savedObjects: SavedObjectsStart;
  telemetry?: TelemetryPluginStart;
  wazuhCheckUpdates: WazuhCheckUpdatesPluginStart;
  wazuhCore: WazuhCorePluginStart;
  dashboard: DashboardStart;
};

AppDependencies

Context object passed to application components. Location: plugins/main/public/types.ts:37

export interface AppDependencies {
  core: CoreStart;
  plugins: AppPluginStartDependencies;
  params: AppMountParameters;
}

Server Plugin

The server-side plugin provides REST API routes and background jobs.

WazuhPlugin (Server)

Location: plugins/main/server/plugin.ts:177

export class WazuhPlugin implements Plugin<WazuhPluginSetup, WazuhPluginStart>

setup() (Server)

Signature:

public async setup(core: CoreSetup, plugins: PluginSetup)

Server setup tasks:

Registers route handler context - Adds wazuh context to request handlers
Adds security headers - Configures X-Frame-Options
Creates router - Sets up HTTP route handling
Registers health checks - Initializes index pattern and API checks
Configures notifications - Sets up notification channels if available

Example:

// Route handler context
core.http.registerRouteHandlerContext('wazuh', (context, request) => ({
  logger: this.logger.get(
    `${request.route.method.toUpperCase()} ${request.route.path}`,
  ),
  server: {
    info: serverInfo,
  },
  plugins,
  security: plugins.wazuhCore.dashboardSecurity,
  api: context.wazuh_core.api,
}));

start() (Server)

Signature:

public async start(core: CoreStart, plugins: any)

Server start tasks:

Initializes background jobs - Starts API initialization checks
Starts queue processing - Begins queue job runner
Loads global configuration - Retrieves server settings

Server Routes

The main plugin exposes several REST API route groups.

Wazuh API Routes

Location: plugins/main/server/routes/wazuh-api.ts

POST /api/check-stored-api

Validates a stored API configuration.

string

required

API host ID to check

string

Previous ID if changed

Response:

{
  statusCode: 200,
  data: {
    status: 'connected' | 'disconnected',
    version: string,
    cluster: {
      enabled: boolean,
      name?: string
    }
  }
}

POST /api/check-api

Validates API credentials without storing them.

string

required

Wazuh API URL

number

required

API port number

string

required

API username

string

required

API password

Authenticates with a configured API host.

string

required

API host ID

boolean

default:false

Force token refresh

Response:

{
  token: string,
  idHost: string
}

POST /api/request

Proxies a request to the Wazuh API.

string

required

API host ID

string

required

HTTP method (GET, POST, PUT, DELETE)

string

required

API endpoint path

object

Request payload

Example:

// Client request
const response = await fetch('/api/request', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    id: 'default',
    method: 'GET',
    path: '/agents',
    body: {}
  })
});

POST /api/csv

Exports API response data as CSV.

string

required

API host ID

string

required

API endpoint path

object

Query filters

GET /api/routes

Returns available Wazuh API routes for the Dev Tools console. Response:

{
  routes: Array<{
    method: string,
    path: string,
    description: string
  }>
}

Host Management Routes

Location: plugins/main/server/routes/wazuh-hosts.ts

GET /hosts/apis

Retrieve all configured API hosts.

POST /hosts/apis

Add a new API host configuration.

PUT /hosts/apis/:id

Update an existing API host.

DELETE /hosts/apis/:id

Remove an API host configuration.

Elasticsearch Routes

Location: plugins/main/server/routes/wazuh-elastic.ts

GET /elastic/known-fields/:pattern

Get known fields for an index pattern.

GET /elastic/visualizations

Retrieve visualization saved objects.

POST /elastic/index-patterns

Create or update index patterns.

Utility Routes

Location: plugins/main/server/routes/wazuh-utils/ui-logs.ts

POST /utils/logs/ui

Log client-side errors to the server.

string

required

Log level (info, error, warning)

string

required

Log message

string

Source location in UI

Global Services

The plugin exposes global services through the kibana-services module. Location: plugins/main/public/kibana-services.ts

import {
  getCore,
  getHttp,
  getToasts,
  getDataPlugin,
  getUiSettings,
  getChrome,
  getSavedObjects,
  getWazuhCorePlugin,
} from './kibana-services';

// Example usage
const http = getHttp();
const response = await http.post('/api/request', {
  body: JSON.stringify({ method: 'GET', path: '/agents' })
});

Wazuh Core API

Shared services and configuration

Components

Reusable UI components

API Console

Interactive API testing

Server Architecture

Server-side architecture guide

​Plugin Class

​WazuhPlugin

​Lifecycle Methods

​setup()

​Setup Tasks

​start()

​Start Tasks

​Type Definitions

​WazuhSetupPlugins

​WazuhStartPlugins

​AppDependencies

​Server Plugin

​WazuhPlugin (Server)

​setup() (Server)

​start() (Server)

​Server Routes

​Wazuh API Routes

​POST /api/check-stored-api

​POST /api/check-api

​POST /api/login

​POST /api/request

​POST /api/csv

​GET /api/routes

​Host Management Routes

​GET /hosts/apis

​POST /hosts/apis

​PUT /hosts/apis/:id

​DELETE /hosts/apis/:id

​Elasticsearch Routes

​GET /elastic/known-fields/:pattern

​GET /elastic/visualizations

​POST /elastic/index-patterns

​Utility Routes

​POST /utils/logs/ui

​Global Services

​Related Resources

Wazuh Core API

Components

API Console

Server Architecture

Plugin Class

WazuhPlugin

Lifecycle Methods

setup()

Setup Tasks

start()

Start Tasks

Type Definitions

WazuhSetupPlugins

WazuhStartPlugins

AppDependencies

Server Plugin

WazuhPlugin (Server)

setup() (Server)

start() (Server)

Server Routes

Wazuh API Routes

POST /api/check-stored-api

POST /api/check-api

POST /api/login

POST /api/request

POST /api/csv

GET /api/routes

Host Management Routes

GET /hosts/apis

POST /hosts/apis

PUT /hosts/apis/:id

DELETE /hosts/apis/:id

Elasticsearch Routes

GET /elastic/known-fields/:pattern

GET /elastic/visualizations

POST /elastic/index-patterns

Utility Routes

POST /utils/logs/ui

Global Services

Related Resources