Wazuh

A free security platform (SIEM/XDR) that collects logs, configuration, and vulnerability data from agents on your endpoints and shows it all in one dashboard.

View on GitHub(opens in a new tab)Official site(opens in a new tab)
cat wazuh/meta.ymlChecked on 2026-10-24

Safety

Impact Local onlyStays on your machine and sends nothing out
Admin rights
Required
Test lab
Required

Usage

Purpose
Defense
Difficulty
Advanced
Type
Self-hosted server
Platforms
Linux / Windows / macOS / Docker

Trust

Repository
wazuh/wazuh
License
CopyleftGPL-2.0（一部の構成要素は Apache-2.0）
GitHub
stars17,4102026-10-25
Maintenance
Actively updatedLast update 2026-10-24
CategoryVulnerability scanningForensics
Contents
  1. Introduction
  2. What Wazuh is for
  3. Try it safely on one virtual machine
  4. Where to look first
  5. Cautions
  6. Read next
  7. Sources

Wazuh collects information from agents installed on your computers and servers, so you can check for signs of attack and configuration problems in one place. It is free and open source, and you can run all of its central components on a single Linux machine.

This review is for people who want to monitor the devices at home or in a small office. After reading it, you can do the following:

  • Set up Wazuh on a test virtual machine
  • Install an agent on your own device and check its status in the dashboard
  • Explain what each of Wazuh’s four components does

What Wazuh is for

The official documentation lists these main capabilities:

  • Log data collection and analysis
  • Intrusion and malware detection
  • File integrity monitoring (FIM)
  • Security configuration assessment (SCA)
  • Vulnerability detection
  • Support for regulatory compliance such as PCI DSS and NIST 800-53

Wazuh has four components.

Component Role
Agent Runs on each endpoint you want to monitor and sends data to the server over an encrypted, authenticated channel
Server Analyzes data from the agents with decoders and rules, and manages the agents
Indexer Stores the alerts the server generates and makes them searchable
Dashboard The web interface for viewing results and changing settings

The agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX.

What it doesn’t doWazuh doesn’t see inside devices that have no agent. On its own, it also doesn’t inspect packets on the network. To watch network traffic, combine it with an intrusion detection system such as Suricata.

Try it safely on one virtual machine

Start by installing the server, indexer, and dashboard together on one test virtual machine. This matches the official quickstart.

  1. Prepare a virtual machine running 64-bit Linux. The docs recommend versions such as Ubuntu 22.04 or 24.04, RHEL 9, and Amazon Linux 2023. For up to 25 agents, plan on 4 vCPUs, 8 GiB of RAM, and 50 GB of storage.

  2. On the virtual machine, run the official installation assistant.

    curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

  3. When it finishes, it prints the dashboard URL and the password for the admin user. The passwords are also saved in wazuh-passwords.txt inside wazuh-install-files.tar.

  4. Open https://<IP address of the virtual machine> in a browser and log in. The certificate is self-signed, so you will see a warning the first time.

  5. In the dashboard, go to Agents management>Summary, select Deploy new agent, and follow the steps to install an agent on your own device.

Where to look first

Once an agent is connected, open these views in the dashboard.

View Tells you
Configuration assessment (SCA) Whether the device’s settings meet benchmarks such as CIS
Vulnerability detection Whether installed applications have known vulnerabilities
File integrity monitoring When monitored files changed
Log data analysis Events that matched rules, such as failed logins

Cautions

  • Only install agents on devices you manage or have the administrator’s permission to monitor. Agents send logs and lists of installed applications to the server.
  • Active Response can run actions automatically when conditions are met. A wrong setting can block your own traffic, so test how it behaves in a lab first.
  • Keep the dashboard’s admin password and wazuh-install-files.tar private.
  • The LICENSE file in the release version (v4.14.9) is GPL-2.0. The official documentation says the components follow GPL-2.0 and Apache-2.0. The LICENSE on the main development branch says the engine (src/engine/) is licensed under AGPL-3.0 (as of October 24, 2026).

Sources

  1. Docs: Quickstartdocumentation.wazuh.com/current/quickstart.html
  2. Docs: Componentsdocumentation.wazuh.com/current/getting-started/components/index.html
  3. Docs: Wazuh agent installationdocumentation.wazuh.com/current/installation-guide/wazuh-agent/index.html
  4. Docs: Active Responsedocumentation.wazuh.com/current/user-manual/capabilities/active-response/index.html
  5. Docs: Network IDS integrationdocumentation.wazuh.com/current/proof-of-concept-guide/integrate-network-ids-suricata.html
  6. Official repository LICENSE (v4.14.9)github.com/wazuh/wazuh/blob/v4.14.9/LICENSE

Checked on 2026-10-24

Similar tools

Suricata

Impact Reaches others
OISF/suricata

An intrusion detection and prevention engine (IDS/IPS) that matches network traffic against rules and records suspicious activity as alerts.

Purpose
Defense
Type
Self-hosted server
Difficulty
Intermediate
License
CopyleftGPL-2.0
Category
Network
Actively updatedstars6,773Last update 2026-10-23
Read the Suricata review

Vuls

Impact Reaches others
future-architect/vuls

An agentless vulnerability scanner that checks the packages installed on a server and lists the ones affected by known CVEs.

Purpose
Defense
Type
Command line
Difficulty
Intermediate
License
CopyleftGPL-3.0
Category
Vulnerability scanning
Actively updatedstars12,302Last update 2026-10-21
Read the Vuls review