Architecture

The Wazuh architecture is composed of a multi-platform Wazuh agent and three central components: the Wazuh manager, the Wazuh indexer, and the Wazuh dashboard.

• The Wazuh agent is deployed on endpoints to collect and forward security data to the Wazuh manager, where it is transformed and enriched.

• The Wazuh manager transforms data received from Wazuh agents into standardized schema documents. It decodes and enriches the data with threat intelligence, then forwards the processed output to the Wazuh indexer and other configured destinations.

• The Wazuh indexer is a highly scalable, full-text search and analytics engine. It serves as the central data store for the Wazuh platform, indexing and storing security alerts, events, vulnerability data, and system inventory generated by Wazuh agents. The Wazuh indexer includes a set of purpose-built plugins that provide access control, reporting, and content management capabilities including rules, decoders, integrations, key-value databases (KVDBs), and Indicators of Compromise (IoCs). It provides near real-time search and analytics capabilities, enabling security teams to investigate threats, monitor compliance, and gain visibility into their infrastructure.

• The Wazuh dashboard queries the indexed data from the Wazuh indexer. It provides the user interface for configuring the Wazuh manager and visualizing analyzed security data. It also supports the management of the Wazuh agent configuration, health status, notifications, and alerting integrations.

Wazuh also supports agentless monitoring for systems and devices where installing the Wazuh agent is not possible. Network devices such as firewalls, switches, routers, and access points can actively forward log data via SSH or via an API.

The Wazuh central components can be deployed in different ways, depending on scalability and availability needs:

• All-in-one deployment: All Wazuh components (manager, indexer, and dashboard) are installed on a single server. This deployment is best suited for labs and small environments with a limited number of monitored endpoints.

• Single-node deployment: The Wazuh manager, Wazuh indexer, and Wazuh dashboard are each deployed on separate servers. Recommended for medium environments that require higher performance than an all-in-one setup.

• Multi-node deployment: Typically, one instance of the Wazuh dashboard and multiple instances of the Wazuh manager (Wazuh manager cluster) and indexer (Wazuh indexer cluster) are deployed on their individual servers, respectively. The number of instances varies depending on your needs. This deployment is recommended for large environments with high event throughput, or when fault tolerance and high availability are required.

Visit the installation guide to learn how to deploy the Wazuh central components and the Wazuh agent.

The diagram below represents a Wazuh deployment architecture. It shows how the Wazuh manager and the Wazuh indexer nodes can be configured as clusters, providing load balancing and high availability.