# zouaghi-firas/wazuh-cyber-insurance-saas architecture

> Architecture diagram of the GitHub repository zouaghi-firas/wazuh-cyber-insurance-saas, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zouaghi-firas/wazuh-cyber-insurance-saas
- Repository: https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas

## Overview

This repository is a Wazuh cyber-insurance multi-tenant proof of concept, not an application implementing its own alert-processing pipeline. Its documented workflow provisions organization VMs and a central Wazuh stack, configures and registers agents, simulates threats, and lets users inspect alerts under tenant and organization access controls. Relationships below follow the README; source excerpts were unavailable, so implementation-level calls and configuration details are not inferred.

Main entry points: [`wazuh-docker/docker-compose.yml`](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/docker-compose.yml) (Service definitions), [`wazuh-docker/configs/opensearch_dashboards.yml`](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/configs/opensearch_dashboards.yml) (OpenSearch Dashboard), [`wazuh-configs/agents`](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/wazuh-configs/agents) (Agent configs), [`simulate_threats`](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/simulate_threats) (Threat simulations)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_orgs["Organization endpoints"]
  node_sme(("SME users"))
  node_agent_config["Agent configs"]
  node_wazuh_agent["Wazuh agents"]
end

subgraph group_stack["Central security stack"]
  node_start["Stack startup<br/>[start.sh]"]
  node_compose["Service definitions<br/>[docker-compose.yml]"]
  node_manager_config["Manager config<br/>[ossec.conf]"]
  node_rules["Custom rules<br/>[custom_rules.xml]"]
  node_manager["Wazuh Manager"]
  node_opensearch[("OpenSearch")]
  node_dashboard["OpenSearch Dashboard"]
end

subgraph group_access["Tenant access"]
  node_tenant_defs["Tenant definitions"]
  node_access_setup["Roles and DLS"]
  node_org_labels["Organization labels"]
end

subgraph group_demo["Threat demonstrations"]
  node_demo_runner["Demo runner<br/>[demo_run.sh]"]
  node_threats["Threat simulations"]
end

node_sme -->|"uses configuration"| node_agent_config
node_agent_config -->|"configures"| node_wazuh_agent
node_wazuh_agent -->|"registers with"| node_manager
node_start -->|"starts services"| node_compose
node_compose -->|"deploys"| node_manager
node_compose -->|"deploys"| node_opensearch
node_compose -->|"deploys"| node_dashboard
node_manager_config -->|"configures"| node_manager
node_rules -.->|"provides rules"| node_manager
node_manager -.->|"stores alerts"| node_opensearch
node_opensearch -->|"feeds alerts"| node_dashboard
node_tenant_defs -->|"imports tenants"| node_dashboard
node_access_setup -->|"configures access"| node_dashboard
node_org_labels -->|"filters by"| node_access_setup
node_demo_runner -->|"runs simulations"| node_threats
node_threats -.->|"triggers detection"| node_wazuh_agent

click node_agent_config "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/wazuh-configs/agents"
click node_start "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/scripts/start.sh"
click node_compose "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/docker-compose.yml"
click node_manager_config "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/configs/ossec.conf"
click node_rules "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/configs/custom_rules.xml"
click node_dashboard "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/configs/opensearch_dashboards.yml"
click node_tenant_defs "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/wazuh-configs/tenants"
click node_demo_runner "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/demo_scripts/demo_run.sh"
click node_threats "https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/simulate_threats"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_sme,node_agent_config,node_wazuh_agent toneBlue
class node_start,node_compose,node_manager_config,node_rules,node_manager,node_opensearch,node_dashboard toneAmber
class node_tenant_defs,node_access_setup,node_org_labels toneMint
class node_demo_runner,node_threats toneRose
```

## Components

### Organization endpoints

- **SME users**
- [Agent configs](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/wazuh-configs/agents): `wazuh-configs/agents`
- **Wazuh agents**

### Central security stack

- [Stack startup](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/scripts/start.sh): `wazuh-docker/scripts/start.sh`
- [Service definitions](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/docker-compose.yml): `wazuh-docker/docker-compose.yml`
- [Manager config](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/configs/ossec.conf): `wazuh-docker/configs/ossec.conf`
- [Custom rules](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/configs/custom_rules.xml): `wazuh-docker/configs/custom_rules.xml`
- **Wazuh Manager**
- **OpenSearch**
- [OpenSearch Dashboard](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/wazuh-docker/configs/opensearch_dashboards.yml): `wazuh-docker/configs/opensearch_dashboards.yml`

### Tenant access

- [Tenant definitions](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/wazuh-configs/tenants): `wazuh-configs/tenants`
- **Roles and DLS**
- **Organization labels**

### Threat demonstrations

- [Demo runner](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/blob/main/demo_scripts/demo_run.sh): `demo_scripts/demo_run.sh`
- [Threat simulations](https://github.com/zouaghi-firas/wazuh-cyber-insurance-saas/tree/main/simulate_threats): `simulate_threats`

## Connections

- SME users → Agent configs: uses configuration (evidence: `README.md`)
- Agent configs → Wazuh agents: configures (evidence: `README.md`)
- Wazuh agents → Wazuh Manager: registers with (evidence: `README.md`)
- Stack startup → Service definitions: starts services (evidence: `README.md`)
- Service definitions → Wazuh Manager: deploys (evidence: `README.md`)
- Service definitions → OpenSearch: deploys (evidence: `README.md`)
- Service definitions → OpenSearch Dashboard: deploys (evidence: `README.md`)
- Manager config → Wazuh Manager: configures (evidence: `README.md`)
- Custom rules → Wazuh Manager: provides rules
- Wazuh Manager → OpenSearch: stores alerts
- OpenSearch → OpenSearch Dashboard: feeds alerts (evidence: `README.md`)
- Tenant definitions → OpenSearch Dashboard: imports tenants (evidence: `README.md`)
- Roles and DLS → OpenSearch Dashboard: configures access (evidence: `README.md`)
- Organization labels → Roles and DLS: filters by (evidence: `README.md`)
- Demo runner → Threat simulations: runs simulations (evidence: `README.md`)
- Threat simulations → Wazuh agents: triggers detection