Wazuh SIEM Installation Guide
A concise guide to installing the Wazuh SIEM platform. It covers the server setup and agent installation for Linux, Windows, and macOS.
Step 1: Introduction to Wazuh
Wazuh is an open-source SIEM and XDR platform. It offers host-based intrusion detection, log analysis, and file integrity monitoring. The system consists of a manager, a data stack, and agents on endpoints.
Step 2: Server Prerequisites
Use a fresh Linux server. Minimum requirements are 8 GB RAM, 4 CPU cores, and 50 GB of disk space. A stable internet connection is required for the installation script. The process needs root access.
Step 3: Run the Server Installation Script
Use the official Wazuh installation script for a quick setup. It automatically installs the Wazuh Manager, OpenSearch, and the dashboard. This example uses a clean Ubuntu server.
curl -sO https://packages.wazuh.com/4.4/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
Step 4: Access the Wazuh Dashboard
After the script completes, open a web browser and navigate to the IP address or hostname of your Wazuh server on port 443. This will take you to the dashboard's login page.
Step 5: Log in and Secure
The default login credentials are `admin` for both the username and password. You will be prompted to change the default password immediately. **It is crucial to change this for security.**
Step 6: Agents - General Concepts
Wazuh agents are installed on endpoints to collect system data, logs, and security events. They communicate with the Wazuh Manager on TCP port 1514. They must be configured with the manager's IP address to connect and send data.
Step 7: Linux Agent Installation
Use the official script to install a Wazuh agent on Linux. Replace `` with the actual IP address of your Wazuh server.
curl -sO https://packages.wazuh.com/4.4/wazuh-agent.sh && sudo bash ./wazuh-agent.sh -a <WAZUH_MANAGER_IP>
Step 8: Windows Agent Installation
Download the official `.msi` installer from the Wazuh website. Run the installer and a wizard will guide you through the process. Enter the Wazuh Manager's IP address when prompted during the installation.
Step 9: macOS Agent Installation
The easiest way to install on macOS is with the `.pkg` installer. You can also use Homebrew. After installation, you must manually edit `/Library/Ossec/etc/ossec.conf` to add your manager's IP.
Step 10: Verify the Agent Connection
To verify that your agents are connected, check the 'Agents' section in the Wazuh Dashboard. The agent's status should be 'Active'. You can also use the command-line tool on the manager to list all connected agents.
/var/ossec/bin/agent_control -l
