For small and medium enterprises (SMEs), building a robust Security Operations Center (SOC) has traditionally been an expensive dream. Proprietary Security Information and Event Management (SIEM) systems and Extended Detection and Response (XDR) tools are famous for their steep license fees, complex pricing based on gigabytes ingested, and vendor lock-in.

However, the open-source security ecosystem has matured dramatically. Leading this charge is Wazuh, a free, open-source security monitoring platform that successfully unifies both SIEM and XDR capabilities into a single cohesive system. Widely recognized by security professionals globally and a multiple award winner, Wazuh provides real-time monitoring, integrity auditing, active threat response, and continuous regulatory compliance checks without restrictive licensing barriers.

In this comprehensive guide, we will break down Wazuh’s modern architecture, detail its hardware requirements, provide a step-by-step deployment procedure, build a custom detection rule, and address crucial security updates.

---

Understanding Wazuh's All-In-One Architecture

Before executing any deployment scripts, you must understand how the gears of this platform turn. Wazuh utilizes a distributed model consisting of three central components and a universal lightweight endpoint agent:

1. Wazuh Indexer: A highly scalable, full-text search and analytics engine. Based on OpenSearch, it parses, indexes, and securely stores the telemetry alerts sent from the manager. 2. Wazuh Server (Manager): The brain of your operations. It analyzes received data against a massive out-of-the-box ruleset, processes threat intelligence (such as MITRE ATT&CK mappings), triggers alerts, and manages agent configurations remotely. 3. Wazuh Dashboard: The centralized, intuitive web interface. It provides pre-built visualization workflows for compliance (PCI-DSS, HIPAA, GDPR), vulnerability hunting, file integrity monitoring, and cloud-native events. 4. Wazuh Agent: A high-performance, low-footprint agent installed directly on Windows, macOS, Linux, and cloud workloads. It monitors system calls, inspects logs, tracks file changes, and enforces active response actions.

---

Infrastructure and Hardware Sizing Guidelines

An All-in-One deployment places the Indexer, Server, and Dashboard on the same host. This setup is highly cost-effective and perfectly handles monitoring environments of up to 100 endpoints.

The following hardware sizing table outlines the official baseline requirements for a 90-day data retention window:

| Monitored Endpoints (Agents) | Recommended CPU | Recommended RAM | Minimum Storage (90 Days) | | :--- | :--- | :--- | :--- | | 1 to 25 | 4 vCPUs | 8 GiB | 50 GB SSD | | 25 to 50 | 8 vCPUs | 8 GiB | 100 GB SSD | | 50 to 100 | 8 vCPUs | 8 GiB | 200 GB SSD |

Note: For deployments exceeding 100 endpoints, we highly recommend separating the Indexer, Server, and Dashboard into a multi-node cluster configuration to prevent operational bottlenecks.

---

Step-by-Step Installation: Getting Your SIEM Up and Running

For this installation, we will use a clean virtual machine running Ubuntu 22.04 LTS or Ubuntu 24.04 LTS with root privileges.

Step 1: System Preparation

Ensure your operating system is up to date and clean up unnecessary default packages: ```bash sudo apt-get update && sudo apt-get upgrade -y sudo apt-get install curl tar unzip -y ```

Step 2: Running the Unified Assistant

Wazuh provides a single command install helper that handles certificates generation, installs the central elements, and secures the basic configurations: ```bash curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh sudo bash wazuh-install.sh -a ``` The script will run for approximately 5 to 10 minutes depending on your internet connection speed.

Step 3: Record Administrative Credentials

Upon completion, the installer output will display the administrator login credentials: ```text Wazuh installation finished. Username: admin Password: <Randomly_Generated_Password> ``` Make sure to save this password immediately in a secure vault. You can now access your SIEM by opening a browser and navigating to `https://<YOUR_SERVER_IP>`.

---

Hands-On: Engineering a Custom Security Detection Rule

Once you deploy the agent on a Linux server, Wazuh collects syslog alerts out-of-the-box. However, enterprise environments require custom detection logic.

Let's configure a custom rule that fires a high-severity alert whenever someone runs an unauthorized `sudo` command on a monitored endpoint.

Step 1: Edit the Local Rules File

On your Wazuh Server, open the local custom rules configuration: ```bash sudo nano /var/ossec/etc/rules/local_rules.xml ```

Step 2: Inject the Detection Logic

Add the following XML block inside the `<group name="local, syslog, ss_rules,">` section: ```xml <group name="syslog,sudo,"> <!-- Parent Rule 5402 detects failed sudo attempts --> <rule id="100002" level="10"> <if_sid>5402</if_sid> <match>user NOT in sudoers</match> <description>Suspicious Activity: Unauthorized user attempted sudo execution</description> <mitre> <id>T1078</id> </mitre> </rule> </group> ```

Step 3: Test and Apply the Changes

Validate the rule configuration and restart the Wazuh manager to apply the changes: ```bash sudo /var/ossec/bin/wazuh-control restart ``` Now, if a non-sudo user on an enrolled client machine runs `sudo su`, Wazuh will immediately capture the attempt, classify it as a Level 10 (High Alert) security event, map it to MITRE T1078 (Valid Accounts), and surface it on your central Dashboard.

---

Critical Hardening Best Practices

While Wazuh provides incredible security, leaving your SIEM unhardened is a major risk. Keep these essential security habits in mind:

---