Wazuh

Wazuh is a free, open-source security platform that combines SIEM and XDR. Sysadmins and small security teams use it for log analysis, intrusion detection, file integrity monitoring and vulnerability detection across servers, workstations and cloud workloads. A Wazuh download has two parts: the central components (server, indexer and dashboard) on Linux, and a lightweight agent on every endpoint you want to watch.

Wazuh began as a fork of OSSEC and keeps its rule-and-decoder approach. On top of that it adds an OpenSearch-based indexer, a web dashboard, an API and current threat-detection content. The manager and agent are licensed under GPL-2.0, and the indexer and dashboard under Apache-2.0. Wazuh Inc. earns its money from a hosted Wazuh Cloud service and from support, not from locked features.

Wazuh at a glance

What it does

• Collects and decodes logs from agents, syslog sources and cloud services, and matches them against thousands of built-in rules.
• Monitors file integrity (FIM): it records changes to files, permissions, owners and Windows registry keys, and can report them in real time.
• Detects vulnerable packages on agents by matching installed software against vulnerability feeds.
• Runs Security Configuration Assessment (SCA) policies, such as CIS benchmarks, and maps alerts to PCI DSS, HIPAA, GDPR, NIST 800-53 and MITRE ATT&CK.
• Triggers active response scripts, for example blocking a brute-forcing IP on the host firewall.
• Monitors AWS, Azure, Google Cloud, Microsoft 365 and GitHub through the server’s modules.
• Monitors network devices without an agent, via syslog or SSH.
• Provides a REST API (port 55000) for automation and integrations such as VirusTotal or ticketing systems.

How sysadmins use it

Enrol a Windows server

1. Copy the agent MSI that matches your manager version to the server. Agents must not be newer than the manager.
2. Install and enrol it from an elevated prompt, pointing it at your manager:

   msiexec.exe /i wazuh-agent-4.14.8-1.msi /q WAZUH_MANAGER="10.0.0.2"
   NET START WazuhSvc

3. Check that the agent shows as active under Agents in the dashboard. Files live in C:Program Files (x86)ossec-agent.

Enrol Linux servers from the package repository

1. Add the Wazuh GPG key and the repository, as the agent guide shows for APT, YUM, DNF or ZYpp.
2. Install with the deployment variable, then enable the service:

   # WAZUH_MANAGER="10.0.0.2" apt-get install wazuh-agent
   # systemctl daemon-reload
   # systemctl enable --now wazuh-agent

3. Disable the repository afterwards, so a routine apt upgrade cannot push the agent ahead of the manager.
4. On the manager, list connected agents with /var/ossec/bin/agent_control -l.

Watch a web root for changes

1. Edit the agent’s ossec.conf (/var/ossec/etc/ossec.conf on Linux) and add a directory inside the <syscheck> block:

   <syscheck>
     <directories realtime="yes" check_all="yes">/var/www</directories>
   </syscheck>

2. Restart the agent: systemctl restart wazuh-agent.
3. Change a test file and confirm that the event appears in the File Integrity Monitoring module.

Remove a decommissioned agent

1. Find its ID with agent_control -l on the manager.
2. Remove it with /var/ossec/bin/manage_agents -r <ID>, or from the dashboard’s agent list.

Install and first run

All-in-one server (lab or up to about 100 agents). On a supported Linux host, such as Ubuntu 22.04/24.04, RHEL 8/9/10 or Amazon Linux 2023, download the installation assistant wazuh-install.sh as described in the official Quickstart and run it with the all-in-one flag:

$ sudo bash ./wazuh-install.sh -a

The assistant prints the dashboard URL and the admin password. All generated passwords are stored in wazuh-install-files.tar, so keep that file safe. Expect a browser warning about the self-signed certificate until you install a trusted one.

• Sizing (vendor guidance): 4 vCPU, 8 GiB RAM and 50 GB of disk for 1–25 agents with 90 days of alerts. Use 8 vCPU, 8 GiB and 100–200 GB for 26–100 agents. Go distributed beyond that.
• Ports: 1514/TCP for agent events, 1515/TCP for enrolment, 55000/TCP for the API, 9200/TCP for the indexer and 443 for the dashboard. Open 1514 and 1515 from the agent networks.
• Agents: Windows from XP up to Windows 11 and Server 2022, with administrator rights. Linux needs root.
• Upgrades: the official Quickstart recommends disabling the Wazuh repositories after installation. Upgrade the indexer, server and dashboard together, then the agents.

Alternatives to a bare-metal install: the official OVA for VirtualBox or VMware, a Docker Compose deployment, or Kubernetes manifests.

Limitations

• The indexer is memory-hungry, and storage grows quickly with verbose Windows event logs. Plan retention before you onboard every server.
• Out of the box it produces a lot of low-value alerts. Expect to spend time tuning rules, decoders and alert levels.
• The central components run on Linux only. There is no native Windows server.
• Agent and manager versions must stay compatible, which makes upgrades a planned job rather than a click.
• It is not a full EDR replacement: it detects and responds with scripts, but it does not offer the kernel-level prevention of commercial endpoint suites.

Wazuh vs alternatives

OSSEC is the lighter ancestor with no indexer or dashboard of its own. Security Onion bundles network monitoring (Suricata, Zeek) with log search and suits teams that need packet-level visibility. Elastic Security and Splunk offer polished search and analytics but cost more as data volume grows. Many admins pair Wazuh with an infrastructure monitor such as Checkmk Community, which covers availability and performance, and with an asset inventory such as Open-AudIT.

FAQ

Is Wazuh free?

Yes. Wazuh is free and open source (GPL-2.0 and Apache-2.0), with no agent limit. The paid offers are the hosted Wazuh Cloud and commercial support.

Is Wazuh a SIEM?

Yes. It combines SIEM functions (log collection, correlation rules, dashboards, retention) with XDR-style endpoint detection and active response.

Is there a Wazuh download for Windows?

Only the agent runs on Windows; it is an MSI installer. The Wazuh server needs Linux, so on a Windows-only network run it in a VM from the official OVA or in Docker.

Does Wazuh work on Mac?

Yes, there is a Wazuh agent for macOS, on Intel and Apple silicon. The central components are not supported on macOS.

How do I install Wazuh with Docker?

Use the official Docker deployment from the Wazuh documentation (single-node or multi-node Compose files). Generate the certificates first, and raise vm.max_map_count on the host for the indexer.

Wazuh vs Splunk: which one?

Wazuh is free and agent-centric, with ready-made host security rules. Splunk is a commercial data platform with stronger search and analytics, licensed by data volume.

Wazuh vs OSSEC?

Wazuh forked from OSSEC and adds vulnerability detection, an indexer and dashboard, cloud modules, an API and far more active development.

Why does my Wazuh agent show as disconnected?

Usually TCP 1514 is blocked between the agent and the manager, the agent is newer than the manager, or the manager address in the agent’s ossec.conf is wrong. Check ossec.log on the agent.

Last checked against official sources: 1 October 2026 (developer website: wazuh.com). Versions and licence terms change — confirm on the developer's site before deploying in production.