TypeError in Microsoft Graph API Module

[diaa-abushaqra]

Bug Report: TypeError in Microsoft Graph API Module

Environment

• Wazuh Version: 4.14.1 (Released Nov 8, 2024)
• OpenSearch Dashboards Version: 2.19.3
• Operating System: Ubuntu/Debian (systemd)
• Browser: N/A (Server-side error)

Summary

TypeError occurs when accessing the Microsoft Graph API module dashboard, preventing users from viewing Microsoft Graph security events.

Error Message

TypeError: Cannot read properties of undefined (reading 'toLowerCase')

Stack Trace

Error: Cannot read properties of undefined (reading 'toLowerCase')
    at mn (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:7664)
    at Ay (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:23396)
    at wi (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:28869)
    at gi (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:28685)
    at zl (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:25892)
    at xi (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:27939)
    at ql (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:15738)
    at http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:62849
    at $l (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:63058)
    at bl (http://127.0.0.1:8080/app/wazuh?#/overview?tab=microsoftGraphAPI&tabView=dashboard:112:62821)

Steps to Reproduce

1. Navigate to Wazuh Dashboard at http://<wazuh-server>:8080/app/wazuh
2. Click on "Microsoft Graph API" from the menu OR navigate directly to /app/microsoft-graph-api
3. Observe the error in browser console and server logs

Expected Behavior

The Microsoft Graph API dashboard should load successfully, displaying security events and visualizations related to Microsoft Graph services.

Actual Behavior

The dashboard fails to load with a TypeError, and the error is logged in /var/log/wazuh-dashboard/wazuh-dashboard.log:

{"type":"log","@timestamp":"2026-01-10T22:40:46Z","tags":["error","plugins","wazuh"],"pid":6061,"message":"Error: Cannot read properties of undefined (reading 'toLowerCase')..."}

Component Affected

• Module: Microsoft Graph API (microsoftGraphAPI)
• Component: WazuhDiscoverComponent within EuiFlexGroup
• Location: Compiled JavaScript bundle (likely wazuh.chunk.*.js)

Root Cause Analysis

The error indicates that somewhere in the Microsoft Graph API module code, a .toLowerCase() method is being called on an undefined or null value. This likely occurs when:

• Processing API response data with missing or null string fields
• Handling configuration properties that aren't properly initialized
• String comparison/normalization without null checking

Suggested Fix

Add null/undefined checks before calling .toLowerCase():

Current (problematic) code pattern:

someVariable.toLowerCase()

Fixed code pattern:

someVariable?.toLowerCase()  // Optional chaining
// OR
(someVariable || '').toLowerCase()  // Default to empty string
// OR
someVariable && someVariable.toLowerCase()  // Explicit check

Workaround

Users can temporarily avoid this issue by not accessing the Microsoft Graph API module dashboard.

Additional Notes

• All other modules (Malware Detection, File Integrity, Threat Hunting, etc.) work correctly
• Wazuh Manager and Dashboard services are running normally
• Configuration files are valid and properly formatted
• This appears to be a code defect introduced in the Microsoft Graph API module implementation

Configuration Details

Wazuh Configuration (/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml):

• Default API host configured correctly
• SSL enabled
• RBAC enabled
• Custom branding configured

OpenSearch Dashboards (/etc/wazuh-dashboard/opensearch_dashboards.yml):

• SAML + basic authentication enabled
• SSL certificates configured
• Server running on port 8080

Impact

• Severity: Medium - The module is completely unusable
• Scope: Affects all users attempting to access Microsoft Graph API security events
• Affected Users: Any organization using Wazuh for Microsoft Graph API monitoring

Related Issues

None found in current GitHub issues (searched Jan 10, 2026)