Wazuh is the most widely adopted open-source cybersecurity platform, unifying XDR and SIEM in a single solution. It analyzes security data across endpoints, clouds, and networks to detect threats, respond to incidents, and ensure compliance. The architecture relies on three central components: the indexer for storage, the server for analysis, and the dashboard for visualization. Agents run on monitored endpoints to collect logs, file changes, and inventory data. This setup allows organizations to strengthen their security posture through continuous monitoring and automation without licensing fees.
Sizing Your Infrastructure
Hardware requirements depend heavily on the number of agents and their average events per second (EPS). Windows agents typically generate more events than Linux systems, though Linux Audit can be very noisy if enabled. For an all-in-one deployment supporting up to 25 agents, the recommended specs are 4 vCPU, 8 GiB of RAM, and 50 GB of storage for 90 days of indexed alerts. If you plan to keep full archives for threat hunting, size your storage based on your own measured volume rather than these baseline figures. A common mistake is running the Elastic Stack and the Wazuh Manager on the same node, which causes performance interference; separating them onto different nodes is highly recommended.
The quickstart guide simplifies installation by providing scripts that handle certificate creation, node installation, and cluster initialization. You must update your APT repository before starting and switch to root or a high-privileged user. After executing the installation assistant, copy the provided credentials from the terminal and navigate to https://your_server_ip in your browser. If the dashboard fails to load, the issue is likely attributed to the indexer, so increase system resources and perform a quick reboot. Once accessible, the interface displays pre-built dashboards for security events, vulnerabilities, and configuration assessments.
Deploying Agents and Tuning Rules
Deploying agents is straightforward via the dashboard wizard. Select the agent platform, enter the Wazuh server IP address, and assign a name. The system generates a command for the target machine; on Windows, run this PowerShell script as administrator, while on Linux, execute the provided bash command. Verify the service status to confirm the agent is connected. Lightweight and universal, these agents provide prevention, detection, and response capabilities on almost any operating system.
| Component | Role |
|---|---|
| Indexer | Stores and indexes alerts |
| Server | Analyzes data and manages agents |
| Dashboard | Visualizes security data |
Detection rules are XML files where custom IDs range from 100000 to 120000 to prevent upgrades from overwriting your work. Each rule should include a sample that must fire and one that must not, tagged with a MITRE ATT&CK technique ID. Measure precision carefully; a rule raising 300 alerts a day with 4% true positives drops to 45 alerts at 26.7% precision once known-good tools are excluded by exact path. File Integrity Monitoring (FIM) helps meet regulatory standards like PCI DSS and NIST by tracking changes in content, permissions, and ownership. Vulnerability detection correlates software inventory with continuously updated CVE databases to identify flaws before attackers exploit them.
Do not rely solely on default configurations for new operating systems. If you install a newer Ubuntu version, Wazuh may lack a suitable CIS benchmark, leaving the Security Configuration Assessment block empty. Modifying compatibility conditions does not create a valid benchmark for that specific OS version, so incorrect compliance checking will result. Is this acceptable for production environments? No, it is not. Ensure you have technical support to perform manual functions and operations, as proper implementation prevents database and disk issues that arise from collecting large amounts of logging data.
