/PLAYBOOK · 2026-08-19

Wazuh SIEM Deployment: Open-Source Intrusion Detection and Log Analysis Platform Configuration Guide

End-to-end Wazuh SIEM deployment: single-host install, Agent onboarding, FIM, and active response. Log collection, intrusion-detection alerts, and verification—open-source enterprise security monitoring.

Scope

Wazuh SIEM fits SMB security teams that need centralized server logs and real-time intrusion detection. Typical cases: Linux servers scattered across sites, security logs uncorrelated, MLPS log-retention/audit requirements, and HIDS without a commercial SIEM. Wazuh covers log management, FIM, vulnerability detection, and active response in one platform.

Prerequisites

Ubuntu 22.04/24.04 or CentOS 7+ server, ≥4GB RAM, ≥20GB free disk, for Wazuh server (Manager + Indexer + Dashboard)
Monitored hosts: Linux (RHEL/Debian) or Windows Server 2012+, for Agent
Open TCP 1514 (Agent comms), TCP 55000 (API), TCP 443 (Dashboard) between server and agents
Server needs outbound internet for Wazuh packages and index templates

Mechanism

Wazuh is C/S: Agent collects system events, audit logs, and file-hash changes on the host, reports over an encrypted channel to Manager. Manager parses, alerts, and stores, then forwards to Indexer (OpenSearch) for full-text indexing. Dashboard (OpenSearch Dashboards) provides query and alert views. Agent includes FIM (syscheck): periodic file hashes vs baseline to detect tampering. Active response runs predefined commands on alert (block IP, kill process) for automated containment.

Procedure

Step 1: Install Wazuh server

Official one-shot script deploys Manager, Indexer, and Dashboard:

# Run as root; ~10-20 minutes
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
bash wazuh-install.sh -a

# After install, retrieve initial Dashboard credentials
tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Script prints Dashboard URL (https://SERVER_IP). Default user admin; password in wazuh-passwords.txt from the previous extract. First login: browser warns on untrusted cert—continue (replace with a real cert in production).

Step 2: Install and register Agent on monitored hosts

In Wazuh Dashboard click Add agent, pick OS, copy the generated install command. Ubuntu example:

curl -s https://packages.wazuh.com/4.x/wazuh-install.sh | bash -s -- agent SERVER_IP
# Register and start (replace IP with Wazuh Manager address)
/var/ossec/bin/agent-auth -m SERVER_IP -p 1515
systemctl enable --now wazuh-agent

Back on Dashboard Agents page, new Agent shows Active in ~1 minute. If stuck Disconnected, check server firewall allows TCP 1514.

Step 3: Enable FIM

Default already watches /etc, /usr/bin, and other critical dirs. To add custom dirs, edit Agent config:

# /var/ossec/etc/ossec.conf, add inside <syscheck>
<directories check_all="yes">/var/www/html</directories>

# Restart Agent to apply
systemctl restart wazuh-agent

After change, Dashboard Security events → Integrity monitoring shows create/delete/modify events, including before/after hashes and acting user.

Step 4: Configure active response (optional)

Auto-block attacker IP on SSH brute force. Configure on Manager ossec.conf:

# /var/ossec/etc/ossec.conf, add inside <ossec_config>
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5710,5715</rules_id>
  <timeout>600</timeout>
</active-response>

# Restart Manager to apply
systemctl restart wazuh-manager

rules_id 5710/5715 map to SSH repeated-auth-failure rules; auto-unblock after 600 seconds.

Verification

# Manager service status; all should be active (running)
systemctl status wazuh-manager wazuh-indexer wazuh-dashboard --no-pager

# Verify Agent-Manager comms (run on Agent)
/var/ossec/bin/agent_control -l    # on server, list Agents; status should be Active

# Verify log collection: failed login on monitored host
ssh root@localhost 2>/dev/null || echo "fail"
# Then search rule.id:5710 in Dashboard Discover; alert should appear

FAQ

FAQ 1: Agent stuck Disconnected?

Check in order: server TCP 1514 allowed; on Agent run tail -f /var/ossec/logs/ossec.log for connect errors; confirm Manager ossec-authd listens on 1515 (ss -lntp | grep 1515). If registration failed, run agent-auth -m SERVER_IP manually.

FAQ 2: Is Wazuh free? How does it scale with volume?

Core (HIDS, FIM, log analysis, active response) is fully open-source free. Enterprise hosted and some advanced support require paid subscription. A single 4GB Manager stably handles 50-100 Agents. Split Indexer from Manager at scale, and configure ILM to archive old logs.

Summary

Full Wazuh SIEM deploy and core module config: one-shot server install, bulk Agent onboarding, FIM, and active-response linkage. Wazuh delivers commercial SIEM core at zero license cost—fit for budget-constrained teams that still need log audit and IDS. After go-live: watch Dashboard alerts, configure email, and bake Agent into new-server bootstrap for a continuous monitoring loop.