How zouaghi-firas/wazuh-cyber-insurance-saas works
This repository is a Wazuh cyber-insurance multi-tenant proof of concept, not an application implementing its own alert-processing pipeline. Its documented workflow provisions organization VMs and a central Wazuh stack, configures and registers agents, simulates threats, and lets users inspect alerts under tenant and organization access controls. Relationships below follow the README; source excerpts were unavailable, so implementation-level calls and configuration details are not inferred.
Main entry points: docker-compose.yml Service definitions · opensearch_dashboards.yml OpenSearch Dashboard · agents Agent configs · simulate_threats Threat simulations
Components 15
Organization endpoints
- SME users
- Agent configs
wazuh-configs/agents - Wazuh agents
Central security stack
- Stack startup
wazuh-docker/scripts/start.sh - Service definitions
wazuh-docker/docker-compose.yml - Manager config
wazuh-docker/configs/ossec.conf - Custom rules
wazuh-docker/configs/custom_rules.xml - Wazuh Manager
- OpenSearch
- OpenSearch Dashboard
wazuh-docker/configs/opensearch_dashboards.yml
Tenant access
- Tenant definitions
wazuh-configs/tenants - Roles and DLS
- Organization labels
Threat demonstrations
- Demo runner
demo_scripts/demo_run.sh - Threat simulations
simulate_threats
Connections 16
- SME users → Agent configs: uses configuration
README.md - Agent configs → Wazuh agents: configures
README.md - Wazuh agents → Wazuh Manager: registers with
README.md - Stack startup → Service definitions: starts services
README.md - Service definitions → Wazuh Manager: deploys
README.md - Service definitions → OpenSearch: deploys
README.md - Service definitions → OpenSearch Dashboard: deploys
README.md - Manager config → Wazuh Manager: configures
README.md - Custom rules → Wazuh Manager: provides rules
- Wazuh Manager → OpenSearch: stores alerts
- OpenSearch → OpenSearch Dashboard: feeds alerts
README.md - Tenant definitions → OpenSearch Dashboard: imports tenants
README.md - Roles and DLS → OpenSearch Dashboard: configures access
README.md - Organization labels → Roles and DLS: filters by
README.md - Demo runner → Threat simulations: runs simulations
README.md - Threat simulations → Wazuh agents: triggers detection