Enterprise security monitoring has traditionally been reserved for organizations with six-figure IT budgets. Commercial Security Information and Event Management (SIEM) platforms often bill based on data ingestion volume (gigabytes per day) or total endpoint counts, creating massive cost barriers for small-to-medium businesses, educational institutions, and homelab security researchers.

Wazuh bridges this gap as a free, open-source Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platform. Originally derived from the OSSEC project in 2015, Wazuh has evolved into an enterprise-grade security stack capable of unifying log analysis, endpoint telemetry, vulnerability management, and automated incident response.

---

Understanding the Wazuh Architecture

To deploy Wazuh effectively, it is essential to understand its decoupled, modular architecture. The platform consists of four primary components working in tandem:

1. Wazuh Agent: A lightweight cross-platform daemon installed on monitored endpoints (Linux, Windows, macOS, Solaris, AIX). It collects system logs, monitors file system changes, performs configuration auditing, and communicates back to the central server via an encrypted TLS channel. 2. Wazuh Server: The central brain that processes telemetry sent by agents. It runs the manager component, parses logs using specialized decoders and rulesets, triggers real-time alerts, and executes active responses when malicious activity is detected. 3. Wazuh Indexer: A highly scalable, full-text search and analytics engine based on OpenSearch. It indexes and stores processed alert data, allowing security analysts to query millions of events within milliseconds. 4. Wazuh Dashboard: A web-based graphical user interface built on OpenSearch Dashboards. It provides customized visualizations, threat hunting query tools, compliance reporting dashboards, and management interfaces for endpoints and rule configurations.

---

Core Security Capabilities

Wazuh delivers multi-layered protection across cloud, hybrid, and on-premises environments:

---

System Hardware Sizing Requirements

While Wazuh software is completely free under the GPLv2 and Apache 2.0 open-source licenses, hardware resources must be allocated based on telemetry volume. The official minimum hardware recommendations for single-host deployments (where the Manager, Indexer, and Dashboard coexist on one server) are outlined below:

| Monitored Agents | Recommended CPU | Minimum RAM | Storage Space (90-Day Retention) | |---|---|---|---| | 1 – 25 Agents | 4 vCPU | 8 GiB | 50 GB | | 25 – 50 Agents | 8 vCPU | 8 GiB | 100 GB | | 50 – 100 Agents | 8 vCPU | 8 GiB | 200 GB |

Note: For environments scaling beyond 100 endpoints or generating heavy log volume (>1,000 EPS), a distributed multi-node cluster architecture is strongly recommended to separate the Indexer nodes from the Server nodes.

---

Step-by-Step Quickstart Installation Guide

Deploying an all-in-one Wazuh central stack on a clean Ubuntu 22.04 LTS or 24.04 LTS server can be completed using the official automated installation assistant.

Step 1: Download and Execute the Installation Assistant

Run the following command as root or with `sudo` privileges to initiate the installation of the central components (Indexer, Server, Dashboard):

```bash curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a ```

The script configures system security parameters, generates unique TLS certificates, installs OpenSearch dependencies, and deploys the Wazuh manager stack.

Step 2: Accessing the Web Dashboard

Once the installer completes, it outputs the initial `admin` credentials and dashboard access URL:

```text INFO: --- Summary --- INFO: You can access the web interface https://<YOUR_SERVER_IP> INFO: User: admin INFO: Password: <GENERATED_SECURE_PASSWORD> ```

Open a secure browser, navigate to the web portal URL, and log in with the provided administrator credentials.

Step 3: Enrolling Endpoints (Agent Deployment)

To monitor a remote Linux or Windows host, navigate to Wazuh Dashboard > Deploy new agent. Select the target OS, enter the IP address of your Wazuh Server, and execute the generated deployment command on the endpoint.

On Ubuntu/Debian endpoints, the deployment command resembles:

```bash wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.14.0-1_amd64.deb sudo WAZUH_MANAGER='192.168.1.100' dpkg -i wazuh-agent_4.14.0-1_amd64.deb sudo systemctl daemon-reload sudo systemctl enable --now wazuh-agent ```

Within moments, the agent connects to the central server, establishes an encrypted channel, and starts streaming system telemetry into the dashboard.

---

Real-World Threat Hunting Scenario: Detecting SSH Brute-Force Attacks

To demonstrate Wazuh's practical detection power, consider an attacker attempting to gain unauthorized access to a Linux server via SSH brute-force password guessing.

1. Log Ingestion: The endpoint's `/var/log/auth.log` records repeated failed login entries: `Failed password for root from 192.168.1.250 port 54321 ssh2` 2. Decoder & Rule Matching: The Wazuh manager receives the log and parses it using pre-configured SSH decoders. Rule ID `5710` matches single failed attempts, incrementing the internal event counter. 3. Alert Generation: When 8 failed attempts occur within 120 seconds, Wazuh triggers Rule ID `5712` (Level 10 high-severity alert: SSHD brute force trying to get access). 4. Automated Active Response: The Wazuh server executes the `host-deny` or `firewall-drop` script, instructing the endpoint agent to execute an `iptables` drop rule blocking `192.168.1.250` for a configurable timeout period.

---

Open-Source vs. Commercial SIEM: Making the Decision

While open-source tools like Wazuh eliminate software licensing costs, organizations must evaluate operational trade-offs.

For organizations looking for enterprise capabilities without hardware management overhead, hybrid managed solutions or dedicated cloud hosting options provide a balanced middle ground.

---