Installing Wazuh agents on macOS systems

The agent runs on the host you want to monitor and communicates with the Wazuh manager, sending data in near real time through an encrypted and authenticated channel.

To start the installation process, download the Wazuh agent for macOS. The package is suitable for macOS Sierra or later.
Select the installation method you want to follow: command line interface (CLI) or graphical user interface (GUI).
To deploy the Wazuh agent to your system, edit the WAZUH_MANAGER variable to contain your Wazuh manager IP address or hostname and run the following command.

# launchctl setenv WAZUH_MANAGER "10.0.0.2" && installer -pkg wazuh-agent-4.1.5-2.pkg -target /

For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for macOS section.

Note

Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the Registering Wazuh agents section.

To complete the installation process, start the Wazuh agent.

# sudo /Library/Ossec/bin/ossec-control start

The installation process is now complete and the Wazuh agent is successfully installed, registered, and configured, running on your macOS system.
To install the Wazuh agent on your system, run the downloaded file and follow the steps in the installation wizard. If you are not sure how to answer some of the prompts, use the default answers.

To complete the installation process, start the Wazuh agent.

# sudo /Library/Ossec/bin/ossec-control start

The installation process is now complete and the Wazuh agent is successfully installed on your macOS system. The next step is to register and configure the agent to communicate with the Wazuh manager. To perform this action, see the Registering Wazuh agents section.

By default, all agent files are stored in /Library/Ossec/ after the installation.

Uninstall a Wazuh agent

To uninstall the agent, follow these steps:

Stop the Wazuh agent service.

# /Library/Ossec/bin/ossec-control stop

Remove the /Library/Ossec/ folder and ossec-init.conf file.

# /bin/rm -r /Library/Ossec
# /bin/rm /etc/ossec-init.conf

Stop and unload dispatcher.

# /bin/launchctl unload /Library/LaunchDaemons/com.wazuh.agent.plist

Remove launchdaemons and StartupItems.

# /bin/rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
# /bin/rm -rf /Library/StartupItems/WAZUH

Remove User and Groups.

# /usr/bin/dscl . -delete "/Users/ossec"
# /usr/bin/dscl . -delete "/Groups/ossec"

Remove from pkgutil.

# /usr/sbin/pkgutil --forget com.wazuh.pkg.wazuh-agent

The Wazuh agent is now completely removed from your macOS system.