This is the documentation for Wazuh 3.0. Check out the docs for the latest version of Wazuh!
Wazuh Docs
    Wazuh Docs
    • Product
    • Blog
    • Cloud
    • Services
    • Community
    • Contact us
      • Getting started
        • Components
        • Architecture
        • Use cases
      • Installation guide
        • Installing Wazuh server
          • Install Wazuh server with RPM packages
          • Install Wazuh server with DEB packages
          • Install Wazuh server from sources
        • Installing Elastic Stack
          • Install Elastic Stack with RPM packages
            • Connect the Wazuh App with the API
          • Install Elastic Stack with Debian packages
            • Connect the Wazuh App with the API
        • Installing Wazuh agent
          • Install Wazuh agent with RPM packages
          • Install Wazuh agent with DEB packages
          • Install Wazuh agent on Windows
          • Install Wazuh agent on Mac OS X
          • Install Wazuh agent on Solaris
          • Install Wazuh agent on HP-UX
          • Install Wazuh agent from sources
        • Optional configurations
          • Setting up SSL for Filebeat and Logstash
          • Setting up SSL and authentication for Kibana
          • Securing the Wazuh API
          • Elasticsearch tuning
        • Upgrading Wazuh
          • Upgrading from a legacy version
            • Upgrading Wazuh server
            • Upgrading Elastic Stack server
            • Upgrading Wazuh agents
          • Upgrade from the same minor version
          • Upgrade from the same major version
          • Upgrade from different major version
        • Virtual Machine
        • Packages List
        • Unattended Installation
      • User manual
        • Overview
        • Wazuh server administration
          • Remote service
          • Defining an alert level threshold
          • Integration with external APIs
          • Configuring syslog output
          • Generating automatic reports
          • Configuring email alerts
            • SMTP server with authentication
          • Deploying a Wazuh cluster
        • Registering agents
          • The registration process
          • Using the registration service
        • Agent management
          • Agent life cycle
          • Using the command line
            • Register Agent
            • Listing Agents
            • Remove Agents
          • Using the RESTful API
            • Register Agents
            • Listing Agents
            • Remove Agents
          • Using Wazup App
          • Checking connection with Manager
          • Grouping agents
          • Remote upgrading
            • Upgrading agent
            • Adding custom repository
            • Creating custom WPK packages
            • Installing custom WPK package
            • WPK List
        • Capabilities
          • Log data collection
            • How it works
            • Configuration
            • FAQ
          • File integrity monitoring
            • How it works
            • Configuration
            • FAQ
          • Anomaly and malware detection
            • How it works
            • Configuration
            • FAQ
          • Monitoring security policies
            • Rootcheck
              • How it works
              • Configuration
              • FAQ
            • OpenSCAP
              • How it works
              • Configuration
              • FAQ
          • Monitoring system calls
            • How it works
            • Configuration
          • Command monitoring
            • How it works
            • Configuration
            • FAQ
          • Active response
            • How it works
            • Configuration
            • FAQ
          • Agentless monitoring
            • How it works
            • Configuration
            • FAQ
          • Anti-flooding mechanism
          • Agent labels
          • VirusTotal integration
            • What is VirusTotal
            • ToS: Public API vs Private API
            • Integration
        • Ruleset
          • Getting started
          • Update ruleset
          • JSON decoder
          • Custom rules and decoders
          • Dynamic fields
          • Ruleset XML syntax
            • Decoders Syntax
            • Rules Syntax
            • Regular Expression Syntax
          • Testing decoders and rules
          • Using CDB lists
          • Contribute to the ruleset
        • RESTful API
          • Getting started
          • Configuration
          • Reference
          • Examples
        • Reference
          • Local configuration
            • active-response
            • agentless
            • alerts
            • auth
            • client
            • client_buffer
            • cluster
            • command
            • database_output
            • email_alerts
            • global
            • integration
            • labels
            • localfile
            • logging
            • remote
            • reports
            • rootcheck
            • ruleset
            • syscheck
            • syslog_output
            • wodle name=”open-scap”
            • Verifying configuration
          • Centralized configuration
          • Internal configuration
          • Daemons
            • ossec-agentd
            • ossec-agentlessd
            • ossec-analysisd
            • ossec-authd
            • ossec-csyslogd
            • ossec-dbd
            • ossec-execd
            • ossec-logcollector
            • ossec-maild
            • ossec-monitord
            • ossec-remoted
            • ossec-reportd
            • ossec-syscheckd
            • wazuh-clusterd
            • wazuh-clusterd-internal
            • wazuh-modulesd
          • Tools
            • agent-auth
            • agent_control
            • manage_agents
            • ossec-control
            • ossec-logtest
            • ossec-makelists
            • rootcheck_control
            • syscheck_control
            • syscheck_update
            • clear_stats
            • ossec-regex
            • update_ruleset
            • util.sh
            • verify-agent-conf
            • agent_groups
            • agent_upgrade
            • cluster_control
      • Development
        • Client keys file
        • Standard OSSEC message format
      • Docker
        • Docker installation
        • Wazuh container
        • FAQ
      • Deploying with Puppet
        • Set up Puppet
          • Installing Puppet master
          • Installing Puppet agent
          • Setting up Puppet certificates
        • Wazuh Puppet module
          • Scan paths configuration
          • Wazuh agent class
          • Wazuh server class
      • Deploying with Ansible
        • Considerations
        • Install Ansible
        • Remote Hosts
        • Roles
          • Wazuh Manager
          • Filebeat
          • Elasticsearch
          • Kibana
          • Logstash
          • Wazuh Agent
        • Variables references
      • Using Wazuh for PCI DSS
        • Log analysis
        • Policy monitoring
        • Rootkit detection
        • File integrity monitoring
        • Active response
        • Elastic Stack
      • Using Wazuh for AWS
        • Integration with AWS
        • Use Cases
          • IAM use cases
          • EC2 use cases
          • VPC Use cases
      • Migrating from OSSEC
        • Migrating OSSEC manager installed from packages
        • Migrating OSSEC agent installed from packages
      • Release Notes
        • 2.1 Release Notes
        • 3.0.0 Release Notes
      Open source community Professional services
      Edit on GitHub
      • Documentation
      • User manual

      User manual¶

      Welcome to the Wazuh user manual. Use it as your Wazuh reference library once you have a basic Wazuh installation in place. In the same way that the main components of Wazuh are a fork of the renowned OSSEC HIDS project, so this user manual has been derived from the OSSEC documentation. Kudos to the OSSEC team for their huge contribution to the IT security community.

      Contents

      • Overview
        • Wazuh server
        • Elastic Stack
        • Wazuh agents
      • Wazuh server administration
        • Remote service
        • Defining an alert level threshold
        • Integration with external APIs
        • Configuring syslog output
        • Generating automatic reports
        • Configuring email alerts
        • Deploying a Wazuh cluster
      • Registering agents
        • The registration process
        • Using the registration service
      • Agent management
        • Agent life cycle
        • Using the command line
        • Using the RESTful API
        • Using Wazup App
        • Checking connection with Manager
        • Grouping agents
        • Remote upgrading
      • Capabilities
        • Log data collection
        • File integrity monitoring
        • Anomaly and malware detection
        • Monitoring security policies
        • Monitoring system calls
        • Command monitoring
        • Active response
        • Agentless monitoring
        • Anti-flooding mechanism
        • Agent labels
        • VirusTotal integration
      • Ruleset
        • Getting started
        • Update ruleset
        • JSON decoder
        • Custom rules and decoders
        • Dynamic fields
        • Ruleset XML syntax
        • Testing decoders and rules
        • Using CDB lists
        • Contribute to the ruleset
      • RESTful API
        • Getting started
        • Configuration
        • Reference
        • Examples
      • Reference
        • Local configuration
        • Centralized configuration
        • Internal configuration
        • Daemons
        • Tools
      Unattended Installation Overview
      © 2020 · Wazuh Inc.