Generated page. Written from IdaMilk/Ninja-Wazuh-Dashboard at commit c87d328 on 2026-07-28.
Ninja-Wazuh Dashboard
What is it?
A locally-run web dashboard that pulls from two IT platforms — Wazuh (SIEM, security monitoring) and NinjaOne (RMM, endpoint management) — and correlates their data into a single view of the endpoint fleet.
Its README calls itself the IT Operations Dashboard.
Purpose
Wazuh and NinjaOne each have their own console, each with a partial view. Wazuh knows about security events and agent health; NinjaOne knows about patch state, hardware and management status. Neither can tell you "which machines are managed but not reporting security events" — the gap where problems hide.
Correlating on the endpoint gives one list where coverage gaps are visible.
How it Works
A FastAPI backend holds one client module per upstream platform — wazuh_client.py, ninja_client.py, and indexer_client.py for the Wazuh indexer (OpenSearch) where event data lives. cache.py sits in front of them, which matters because both APIs are rate limited and a dashboard refresh would otherwise hammer them.
auth.py handles upstream authentication; user_auth.py handles dashboard login — two distinct concerns kept in separate modules. email_client.py sends alerts, db.py persists local state.
The frontend is React 18 with TypeScript, Vite, Tailwind and Recharts.
Tech Stack
| Layer | Technology |
|---|---|
| Backend | Python 3.11+, FastAPI, uvicorn |
| Frontend | React 18, TypeScript, Vite |
| Styling | Tailwind CSS |
| Charts | Recharts |
| Packaging | Docker, docker-compose |
Interfaces
| System | Direction | Purpose |
|---|---|---|
| Wazuh API | outbound | Agent status, security configuration |
| Wazuh Indexer (OpenSearch) | outbound | Security event queries |
| NinjaOne API | outbound | Endpoint management and inventory |
| SMTP | outbound | Alert email |
Operations
Docker-based, with Dockerfile and docker-compose.yml in the repository.
Credentials for both upstream platforms come from .env, documented in .env.example, and are never committed. These are high-value credentials — API access to a SIEM and an RMM together is effectively fleet-wide visibility and, depending on scope, control — so the deployment host and its .env deserve treatment as sensitive infrastructure.
Because responses are cached, a stale-looking dashboard is more likely a cache-expiry question than an upstream outage. Check cache.py TTLs before assuming Wazuh or NinjaOne is down.
Repository
| Repository | IdaMilk/Ninja-Wazuh-Dashboard |
| Primary language | TypeScript / Python |
| Files | 54 |
| Last activity | 2026-05-21 |
| Status | Active |
The only Python + React combination in the organisation, and one of only two Python projects alongside forklift-crash-detector.