3 min read Intermediate 20.3k

Wazuh: open-source SIEM

Published on May 17, 2026 at 04:47 PM

Deploy Wazuh, the open-source SIEM platform combining HIDS, log management, intrusion detection, file integrity, vulnerability auditing, regulatory compliance. The free reference vs Splunk, QRadar, SentinelOne.

Introduction

Wazuh is an all-in-one security platform that continuously monitors your servers and endpoints:

HIDS (Host Intrusion Detection): detects abnormal behavior
Centralized logs: aggregation and analysis (syslog, app, audit)
FIM (File Integrity Monitoring): alerts on critical file changes
Vulnerability detection: identifies vulnerable packages (CVE)
Compliance: PCI-DSS, HIPAA, GDPR, NIST reports
MITRE ATT&CK: detections mapped to MITRE matrix

Architecture: Wazuh agents (Linux/Win/Mac) + central manager + web dashboard (Kibana-based).

Prerequisites

Dedicated VPS for manager (8 GB RAM, 4 vCPU, 50 GB SSD)
Ubuntu 22.04 / Debian 12 / Rocky 9
Root access
Agents: Linux / Windows / macOS

Step 1: All-in-one install

curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh
sudo bash wazuh-install.sh -a

Installs: Wazuh indexer (Opensearch), manager, dashboard, Filebeat. Takes 10-15 min.

End:

INFO: --- Summary ---
INFO: You can access the web interface https://<IP>
    User: admin
    Password: <generated>

Step 2: Dashboard access

Open https://VPS_IP. Accept self-signed cert. Login admin + password.

Step 3: Deploy an agent

On manager: Agents → Deploy new agent. For Linux Debian/Ubuntu:

curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.7.0-1_amd64.deb
sudo WAZUH_MANAGER='MANAGER_IP' WAZUH_AGENT_GROUP='default' dpkg -i ./wazuh-agent.deb
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

Agent appears as Active in seconds.

Step 4: First events

Simulate SSH brute force:

sshpass -p 'wrong' ssh -o StrictHostKeyChecking=no foo@localhost
sshpass -p 'wrong' ssh -o StrictHostKeyChecking=no foo@localhost
sshpass -p 'wrong' ssh -o StrictHostKeyChecking=no foo@localhost

Dashboard → Threat Hunting → Search sshd.

Step 5: File Integrity Monitoring (FIM)

On agent, /var/ossec/etc/ossec.conf:

<syscheck>
    <directories check_all="yes" report_changes="yes" realtime="yes">/etc/nginx</directories>
</syscheck>

sudo systemctl restart wazuh-agent

Any /etc/nginx/* change generates an event with diff.

Step 6: Vulnerability detection

On manager, ossec.conf:

<vulnerability-detector>
    <enabled>yes</enabled>
    <interval>5m</interval>
    <run_on_start>yes</run_on_start>
    <provider name="canonical">
        <enabled>yes</enabled>
        <os>jammy</os>
        <update_interval>1h</update_interval>
    </provider>
    <provider name="debian">
        <enabled>yes</enabled>
        <os>bookworm</os>
    </provider>
    <provider name="redhat">
        <enabled>yes</enabled>
    </provider>
    <provider name="nvd">
        <enabled>yes</enabled>
    </provider>
</vulnerability-detector>

sudo systemctl restart wazuh-manager

Modules → Vulnerabilities lists all vulnerable packages with CVE.

Step 7: Active Response

In manager ossec.conf:

<command>
    <name>firewall-drop</name>
    <executable>firewall-drop</executable>
    <timeout_allowed>yes</timeout_allowed>
</command>

<active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>5712</rules_id>
    <timeout>600</timeout>
</active-response>

Rule 5712 = SSH brute force. Wazuh auto-blocks attacker for 10 min via iptables.

Step 8: Custom rules

sudo nano /var/ossec/etc/rules/local_rules.xml

<group name="local,syslog,">
  <rule id="100001" level="12">
    <if_sid>550</if_sid>
    <field name="file">/etc/sudoers$</field>
    <description>CRITICAL: /etc/sudoers modified</description>
  </rule>
</group>

sudo systemctl restart wazuh-manager

Step 9: Audit and compliance

Preconfigured dashboards: PCI DSS, GDPR, HIPAA, NIST 800-53, TSC.

Modules → Regulatory compliance → choose. See compliance state per requirement.

Step 10: MITRE ATT&CK integration

Each Wazuh alert mapped to MITRE tactics/techniques.

Modules → MITRE ATT&CK → matrix view.

Step 11: Notifications

<global>
    <email_notification>yes</email_notification>
    <smtp_server>smtp.gmail.com</smtp_server>
    <email_from>[email protected]</email_from>
    <email_to>[email protected]</email_to>
</global>

<alerts>
    <log_alert_level>3</log_alert_level>
    <email_alert_level>12</email_alert_level>
</alerts>

Step 12: Sizing

100 agents: 8 GB RAM, 4 vCPU, 100 GB disk
1000 agents: 32 GB RAM, 16 vCPU, 500 GB disk (NVMe)

Configure retention in Stack Management → Index Management → ISM Policies.

Troubleshooting

Agent disconnected

telnet MANAGER_IP 1514
telnet MANAGER_IP 1515
sudo tail -f /var/ossec/logs/ossec.log

Dashboard timeout

Indexer still starting. Wait or increase RAM.

Too many alerts

Tune local_rules.xml to reduce level or ignore rules.

"Out of memory" on manager

Increase RAM. wazuh-indexer (Opensearch) is heavy.

Useful commands

sudo systemctl status wazuh-manager wazuh-indexer wazuh-dashboard
sudo /var/ossec/bin/manage_agents -l
sudo systemctl restart wazuh-manager
sudo tail -f /var/ossec/logs/ossec.log
sudo tail -f /var/ossec/logs/alerts/alerts.log
sudo /var/ossec/bin/wazuh-logtest

Conclusion

Wazuh replaces several tools (SIEM, HIDS, FIM, vuln scanner, compliance) in one open-source platform.

Going further:

Pair with Suricata for NIDS layer
Integrate with TheHive + Cortex for incident response
For large prod, consider Wazuh Cloud

Resources

Official docs: https://documentation.wazuh.com
GitHub: https://github.com/wazuh/wazuh
Demo: https://documentation.wazuh.com/current/getting-started/components/index.html
Community Slack: https://wazuh.com/community/