Wazuh: What It Is and How to Deploy It on a Single Linux VM

Target audience: Security engineers and blue teamers
Version: Wazuh 4.12 · Ubuntu 22.04 LTS
Read time: ~15 min

---

Table of Contents

1. What is Wazuh?
2. Core Capabilities
3. Architecture
4. Prerequisites and Hardware Requirements
5. All-in-One Installation
6. Enroll Your First Agent
7. Next Steps

---

What is Wazuh?

Wazuh is a free, open-source, enterprise-grade security platform built on the OSSEC HIDS lineage and extended into a full unified XDR and SIEM solution. It gives blue teams a single pane of glass for threat detection, log analysis, vulnerability assessment, file integrity monitoring, and compliance reporting — across Linux, Windows, macOS, cloud instances, and containers.

Unlike commercial SIEMs that lock features behind expensive licensing tiers, Wazuh ships all its core capabilities as open source under the GPLv2 and Apache 2.0 licenses. The codebase is actively maintained and, as of version 4.12 (May 2025), supports ARM architecture for all central components — making it a solid choice for both x86 and ARM-based lab and production environments.

---

Core Capabilities

Wazuh is not a single tool — it is a suite of tightly integrated detection and response capabilities:

Capability	Description
Log data analysis (SIEM engine)	Collects, normalises, and correlates events from agents and syslog sources. Decoders and rules map raw log lines to threat signals.
File Integrity Monitoring (FIM)	Detects changes to files, directories, registry keys, and permissions in real time. Version 4.12 adds eBPF-based FIM on Linux for lower overhead.
Vulnerability detection	Compares installed software inventory against NVD/CVE databases and enriches findings with CTI references.
Security Configuration Assessment (SCA)	Audits endpoints against CIS Benchmarks, STIG profiles, and custom hardening policies out of the box.
Active response	Executes automatic countermeasures — blocking IPs via iptables, killing processes, triggering custom scripts — when specific rules fire.
Threat intelligence integrations	Connects with VirusTotal, MISP, Shuffle, TheHive, and other platforms through native integrations and the REST API.
Regulatory compliance	Pre-built dashboards and rule mappings for PCI-DSS, HIPAA, NIST 800-53, GDPR, and TSC SOC2.

---

Architecture

A Wazuh deployment has three central components plus lightweight agents installed on monitored endpoints. Understanding these before you install will save you debugging time later.

Central Components

Wazuh Manager
Receives events from agents, runs them through the decoder/rule engine, triggers active-response actions, and generates alerts. Runs wazuh-analysisd, wazuh-remoted, and the REST API (port 55000).

Wazuh Indexer
An OpenSearch-based data store that persists and indexes all alerts. Queries, searches, and dashboard visualisations run against this component. Version 4.12 ships with OpenSearch 2.19.1.

Wazuh Dashboard
An OpenSearch Dashboards-based web UI. Surfaces security events, SCA results, vulnerability findings, compliance posture, and agent management in a browser (port 443).

Endpoint Component

Wazuh Agent
A lightweight daemon installed on monitored hosts. Collects logs, runs FIM scans, performs SCA checks, and relays everything to the Manager over TLS. Supports Linux, Windows, macOS, Solaris, AIX, and HP-UX.

All-in-one vs. distributed

In the all-in-one deployment covered in this article, the Manager, Indexer, and Dashboard all run on the same host. This is appropriate for labs and environments monitoring up to ~100 endpoints with 90 days of queryable alert data. Beyond that, a distributed multi-node cluster is recommended.

---

Prerequisites and Hardware Requirements

The Wazuh quickstart installer performs a health check at launch and will refuse to proceed if resources fall below minimums. Validate your VM before starting.

Spec	Minimum (lab)	Recommended (up to 100 agents)
CPU	4 vCPUs (x86_64, AMD64, or ARM64)	8+ vCPUs
RAM	8 GB	16 GB
Disk	50 GB	250 GB+ (90 days of alerts)
OS	Ubuntu 22.04/24.04 LTS, RHEL 8/9, CentOS 7/8, Amazon Linux 2/2023, Debian 10/11/12	← same
Network	Static IP or FQDN. Outbound HTTPS for package download.	← same

Root privileges required

Every command in this guide must run as root or with sudo. The install script will fail if permissions are insufficient.

Ensure curl is installed

# Ubuntu / Debian
sudo apt-get update
sudo apt-get install -y curl

# RHEL / CentOS
sudo yum install -y curl

---

All-in-One Installation

Wazuh provides an official installation assistant that automates the deployment of all three central components on a single host. This is the fastest and most reliable path — it handles TLS certificate generation and inter-component configuration automatically.

Step 1 — Verify system resources

Before running the script, confirm your VM meets the minimum requirements. The installer runs its own health check, but catching issues early saves time.

# Check CPU count, RAM, and available disk space
nproc
free -h
df -h /

Step 2 — Download and run the installation assistant

This command fetches the official Wazuh installation script and executes an all-in-one deployment with the -a flag. Expect 10–20 minutes depending on your network and disk speed.

curl -sO https://packages.wazuh.com/4.12/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

The script will:

1. Add the official Wazuh GPG key and apt/yum repository
2. Install the Wazuh Indexer and initialise the OpenSearch security plugin
3. Install and configure the Wazuh Manager and REST API
4. Install the Wazuh Dashboard and configure HTTPS with self-signed certificates
5. Generate random credentials for all service accounts

Skipping the health check

If you're running a resource-constrained lab and want to proceed anyway, append -i to skip the health check:

sudo bash ./wazuh-install.sh -a -i

Step 3 — Retrieve your credentials

After a successful run, all passwords are stored inside a tar archive created by the installer. Print them with:

sudo tar -O -xvf wazuh-install-files.tar \
    wazuh-install-files/wazuh-passwords.txt

Look for the entry labelled admin — this is your Wazuh Dashboard login. Store these credentials in a password manager immediately.

Step 4 — Access the Wazuh Dashboard

Open a browser and navigate to your server's IP or hostname over HTTPS:

https://<YOUR-SERVER-IP>

Browser certificate warning

Your browser will flag a certificate warning because Wazuh uses a self-signed CA by default. Accept the exception for lab use, or configure a trusted CA certificate for production deployments.

Log in with username admin and the password retrieved in the previous step.

If you can see the Wazuh Dashboard welcome screen, the Indexer and Manager services are running and communicating correctly. ✅

Step 5 — Disable the Wazuh repository (post-install hardening)

Wazuh's documentation recommends disabling the package repository after installation to prevent unintended upgrades. All central components must share the exact same version number, and accidental upgrades will break your environment.

Perform this only after confirming the installation is working.

# Ubuntu / Debian
sudo sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
sudo apt-get update

# RHEL / CentOS
sudo sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

Downgrades not supported from 4.12

Version 4.12 upgrades the Wazuh Indexer to OpenSearch 2.19.1. Once upgraded to 4.12, you cannot revert to an earlier version. Repo pinning is especially important here.

---

Enroll Your First Agent

With the server stack running, the next step is enrolling an endpoint. The commands below register a Linux host with the Manager using your server's IP address.

Replace <WAZUH-MANAGER-IP> with the IP of your all-in-one server.

Ubuntu / Debian agent

# 1. Import the Wazuh GPG key
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \
    | gpg --no-default-keyring \
          --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg \
          --import
chmod 644 /usr/share/keyrings/wazuh.gpg

# 2. Add the repository
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] \
    https://packages.wazuh.com/4.x/apt/ stable main" \
    | sudo tee /etc/apt/sources.list.d/wazuh.list

# 3. Install the agent, pointing it at your manager
sudo apt-get update
WAZUH_MANAGER="<WAZUH-MANAGER-IP>" sudo apt-get install -y wazuh-agent

# 4. Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Within 30–60 seconds, the agent should appear in Agents → Summary in the Dashboard with status Active.

Dashboard-based enrollment

You can also deploy agents directly from the UI. Go to Agents Management → Summary → Deploy new agent and follow the wizard — it generates the exact install commands for your chosen OS and architecture.

Large-scale deployments

For environments with many hosts, use the WAZUH_MANAGER environment variable combined with configuration management tools like Ansible, Puppet, or Chef to deploy agents at scale without manual intervention.

---

Next Steps

You now have a running Wazuh stack with at least one enrolled agent. The platform is collecting events and running them through the default ruleset. The most impactful areas to configure next:

• Custom rules and decoders — Extend the detection rule base at /var/ossec/etc/rules/ with logic specific to your environment.
• Vulnerability scanning — Enable and tune the vulnerability-detection module to surface CVEs across all enrolled endpoints automatically.
• Security Configuration Assessment (SCA) — Run CIS Benchmark checks against Linux and Windows hosts to generate a hardening baseline score.
• Active response — Configure automatic blocking rules that trigger iptables or Windows Firewall entries on brute-force detections.
• SIEM integrations — Forward alerts to TheHive, Shuffle, or MISP to build a SOC automation pipeline on top of Wazuh detections.
• Compliance dashboards — Activate the PCI-DSS, HIPAA, or NIST 800-53 compliance modules built into the Dashboard.

Follow-up articles on LabProveHub will cover each of these in depth.

Official reference: Wazuh Documentation