Installing Wazuh with Elastic Stack

All-in-one deployment

Wazuh server and Elastic Stack are installed on the same host. This type of deployment is appropriate for testing and small working environments.

The following components will be installed:

• The Wazuh server, including the Wazuh manager as a single-node cluster, and Filebeat.

• Elastic Stack, including Elasticsearch as a single-node cluster, and Kibana, including the Wazuh Kibana plugin.

The communication is encrypted using certificates. Follow the installation guide to install and configure all the required components.

Distributed deployment

Each component is installed in a separate host as a single-node or multi-node cluster. This type of deployment allows high availability and scalability of the product and is convenient for large working environments.

Kibana can be installed on the same server as the Elasticsearch node, or on a separate one. This type of deployment is appropriate for production environments as it provides high availability and scalability of the services.

The following components will be installed:

• The Wazuh server, including the Wazuh manager as a single-node cluster or as a multi-node cluster, and Filebeat.

• Elastic Stack as a single-node cluster or as a multi-node cluster, and Kibana, including the Wazuh Kibana plugin, on the same host as Elasticsearch node or on a separate one.

The communication will be encrypted using certificates, and the user can follow the installation steps guide to install all required components.