Architecture

Wazuh agent - Wazuh manager

The Wazuh agent collects security data from monitored endpoints and forwards it to the Wazuh manager, where the normalization engine transforms and enriches the data. A Wazuh 5.0 agent uses an HTTPS channel for communication with the Wazuh manager. The channel carries enrollment, event reporting, state synchronization, control messages, and file downloads. The Wazuh manager serves this channel on port 1517/TCP. The listener requires a TLS certificate and private key.

A Wazuh 5.0 agent enrolls through the same HTTPS channel using the POST /enroll endpoint. The endpoint acts as a bridge to the enrollment service, authenticates the request, and relays it to that service. After enrollment, the Wazuh agent authenticates subsequent requests using a bearer token.

For Wazuh 4.x agents, the Wazuh manager provides the agent communication service on port 1514/TCP by default, or on 1514/UDP when you enable it. The service receives AES-encrypted messages, including keepalive messages and event data. Wazuh 4.x agents enroll through the enrollment service on port 1515/TCP over TLS. The installer enables these legacy services in the <remote><legacy> section of the Wazuh manager configuration. You can disable them after all Wazuh agents run Wazuh 5.x.

Wazuh manager - Wazuh indexer

The Wazuh manager forwards processed events and vulnerability data to the Wazuh indexer for indexing, storage, and search. It uses TLS certificates to secure communications between the Wazuh manager and the Wazuh indexer. The Wazuh indexer connector handles this communication. It is a shared library that replaces Filebeat in Wazuh 5.0. The Wazuh indexer listens on port 9200/TCP by default.

The Wazuh indexer indexes and stores the received documents, enabling the querying, correlation, and near real-time analytics that the Wazuh dashboard presents.

Wazuh manager - Wazuh manager

In a multi-node deployment, Wazuh manager nodes form a cluster and communicate with each other over port 1516/TCP by default. A Wazuh manager cluster consists of one master node and one or more worker nodes. All nodes use the shared key configured in the <cluster><key> setting of the Wazuh manager configuration file to encrypt cluster communication. A worker node with a different key can't connect to the master node.

The master node coordinates cluster operations. It handles Wazuh agent enrollment and deletion requests and manages the shared configuration groups. The master node synchronizes the following data with the worker nodes:

• Wazuh agent registration keys

• Enrollment password and enrollment tokens

• Shared configuration and agent group assignments

When an enrollment request arrives at a worker node, the worker forwards it to the master node. The master validates the request, assigns the agent ID, and generates the agent key. The worker returns the enrollment response to the Wazuh agent, while the cluster synchronizes the agent registration data with the worker nodes.

Wazuh dashboard - Wazuh manager

The Wazuh dashboard queries the Wazuh manager API to retrieve information and perform management operations. It displays configuration and status information about the Wazuh manager and enrolled Wazuh agents. It also performs operations such as agent enrollment, group assignment, and remote upgrades. The Wazuh manager API listens on port 55000/TCP by default and exposes a REST interface over HTTPS. Only the master node runs the Wazuh manager API.

The Wazuh manager API uses JSON Web Tokens (JWTs) for authentication. The Wazuh dashboard sends the API username and password to the POST /security/user/authenticate endpoint, which returns a signed JWT. The dashboard includes the token in the Authorization header of subsequent API requests. Tokens expire after 900 seconds by default.

Role-Based Access Control (RBAC) authorizes each authenticated request based on the user's assigned permissions. RBAC supports permissions for specific resources and actions and operates in allowlist mode by default. In this mode, the API denies actions that the user's roles don't explicitly permit. In a Wazuh manager cluster, the Distributed API (DAPI) layer coordinates API requests across cluster nodes.

Wazuh dashboard - Wazuh indexer

The Wazuh dashboard queries the Wazuh indexer to retrieve indexed security data for its visualizations, tables, and findings. It sends search, aggregation, and management requests to the Wazuh indexer REST API over HTTPS on port 9200/TCP by default. The Wazuh indexer processes each request and returns the matching documents, which the Wazuh dashboard renders. This communication is encrypted with TLS and authenticated with Wazuh indexer credentials.