Wazuh is a free, open-source security platform that combines host-based intrusion detection (HIDS), log analysis, file integrity monitoring, vulnerability detection and compliance checks, with a web dashboard. It grew out of OSSEC. For teams with more than a handful of servers, it gives you a central place to see security events, instead of logging into each machine.

What Wazuh does

Capability Example
Log analysis Detects SSH brute force, sudo misuse, web attacks in Nginx logs
File integrity monitoring Alerts when /etc/passwd, binaries or web code change
Vulnerability detection Lists CVEs affecting installed packages per host
Configuration assessment CIS benchmark checks (SSH settings, permissions…)
Rootkit and malware checks Hidden processes, known rootkit files
Active response Automatically blocks an IP after an attack pattern (optional)
Compliance mapping PCI DSS, GDPR, HIPAA, NIST tags on alerts

Architecture

  • Wazuh agent — a light process on each monitored server. It collects logs, file hashes and inventory, and sends them encrypted to the manager.
  • Wazuh server (manager) — analyses events with rules and decoders, and generates alerts.
  • Wazuh indexer — stores alerts and events (based on OpenSearch).
  • Wazuh dashboard — the web UI (based on OpenSearch Dashboards).

For small deployments, all central components run on one server.

Sizing the central server

The indexer is the heavy part. A realistic minimum for an all-in-one setup monitoring up to ~25 agents is 4 vCPU and 8 GB RAM, with 50+ GB of SSD storage, depending on log volume and retention. Smaller instances run, but struggle. More agents or longer retention need more RAM and disk. See how much RAM a VPS needs.

Put the Wazuh server in a location close to your agents, and don’t expose the dashboard publicly. Access it over a VPN or an IP allow-list. See zero trust networking.

Install the central components

Wazuh provides an installation assistant for an all-in-one setup on a supported OS (Ubuntu, Debian, RHEL family):

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

(Check the official documentation for the current version path, and read the script before running it.)

At the end it prints the dashboard admin password. Store it in your password manager. The dashboard listens on port 443 of that server.

Firewall: agents connect to the manager on 1514/tcp (events) and 1515/tcp (enrolment). Allow those only from your servers’ IPs. The dashboard (443) should be reachable only by admins. See UFW.

Alternatively, run the official Docker Compose deployment.

Install agents on your servers

The dashboard generates the exact install command under Agents → Deploy new agent. It looks like this (Debian/Ubuntu):

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.x.x-1_amd64.deb
sudo WAZUH_MANAGER='10.0.0.20' WAZUH_AGENT_NAME='web1' dpkg -i ./wazuh-agent_4.x.x-1_amd64.deb
sudo systemctl enable --now wazuh-agent

The agent uses little CPU and around 50–100 MB of RAM. It appears in the dashboard within a minute.

Configure what agents watch

Agent configuration: /var/ossec/etc/ossec.conf. Better, use centralised configuration from the manager (agent groups) so you can manage all web servers at once.

Add your application logs:

<localfile>
  <log_format>apache</log_format>
  <location>/var/log/nginx/access.log</location>
</localfile>
<localfile>
  <log_format>syslog</log_format>
  <location>/var/log/nginx/error.log</location>
</localfile>

File integrity for a web root:

<syscheck>
  <directories check_all="yes" realtime="yes">/var/www/example.com/public</directories>
  <ignore type="sregex">/wp-content/(cache|uploads)/</ignore>
</syscheck>

Work with alerts

  • Security events show alerts by level (0–15). Levels 10+ deserve attention (multiple authentication failures, rootkit detection, integrity changes in system binaries).
  • Vulnerability detection lists CVEs per host. Use it to prioritise patches. See patch management.
  • Configuration assessment gives CIS-style checks with remediation hints, complementary to Lynis.

Send important alerts to Slack, email or PagerDuty via integrations, so you don’t depend on someone opening the dashboard.

Tuning

Out of the box, Wazuh can be noisy. Plan time to:

  • lower or silence rules that fire on normal activity (your deploy user’s sudo use, known cron jobs) with local rules in /var/ossec/etc/rules/local_rules.xml;
  • exclude volatile paths from integrity monitoring;
  • set index retention policies so the disk doesn’t fill up.

Wazuh vs simpler tools

Need Tool
1–3 servers, low effort Fail2Ban, AIDE, login alerts, Lynis
Central view of 5+ servers, compliance Wazuh
Network-level attack detection Suricata
Community IP blocklists CrowdSec

Related: server security monitoring and auditd.

  • Security
  • Monitoring
  • Self-Hosting