Quickstart

Requirements

Installing Wazuh

You need a host that meets the requirements above, internet access, and a user with sudo privileges. The installation takes about 5 to 10 minutes.

1. Download and run the installation assistant to deploy the Wazuh central components and generate the credentials required to access the Wazuh dashboard. In the command, -a installs all the central components on this host, -id installs missing operating system dependencies without asking, and -d pre-release downloads the release candidate packages.

   If agents or Wazuh manager API clients will reach this server through another address, such as its public IP address, a DNS name, or a load balancer, see Connecting through another address before you install.

   Run the following command. The assistant adds this server's hostname and IP addresses to the certificate that agents check.

   $ wget https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-install-5.0.0-rc2.sh && sudo bash ./wazuh-install-5.0.0-rc2.sh -a -id -d pre-release
   

   Note

   If firewalld or UFW is active, the assistant warns about it and lists the ports to open, for example, WARNING: The system has UFW enabled. Please ensure that traffic is allowed on these ports: 1515, 1517, 1514, 443. Allow incoming traffic on the following ports. This lets Wazuh agents and users reach the Wazuh central components:

   • 1517/TCP: Wazuh 5.x agent enrollment and connection.

   • 443/TCP: Wazuh dashboard web interface.

   • 1514/TCP and 1515/TCP: only needed if Wazuh 4.x agents connect to this deployment. A Wazuh 4.x agent that enrolls for the first time also needs this server's enrollment password. Read it with sudo cat /etc/wazuh-manager/authd.pass and pass it as WAZUH_REGISTRATION_PASSWORD when you install the agent, or write it to /var/ossec/etc/authd.pass on the agent and restart it.

   For example, with firewalld, run sudo firewall-cmd --permanent --add-port=443/tcp --add-port=1517/tcp && sudo firewall-cmd --reload. With UFW, run sudo ufw allow 443/tcp && sudo ufw allow 1517/tcp.

   If you use another firewall or a cloud security group, allow these ports there too. See required ports for the full list of default ports.

   When the installation finishes, the assistant prints a summary. It shows one Wazuh dashboard URL for each IP address of the host, the username, and the password. It also shows the command to read the password again and how to enroll agents:

   INFO: Wazuh dashboard web application initialized.
   INFO: --- Summary ---
   INFO: You can access the web interface https://<WAZUH_DASHBOARD_ADDRESS>:443
   INFO:     User: admin (Wazuh dashboard login and Wazuh indexer administrator)
   INFO:     Password: <ADMIN_PASSWORD>
   INFO:     To read the password again, run:
   INFO:         sudo grep '^WAZUH_INDEXER_ADMIN_PASSWORD=' /etc/wazuh-indexer/export/credentials.env | cut -d= -f2-
   INFO: The passwords of the other users are in /etc/wazuh-indexer/export/credentials.env and /etc/wazuh-manager/export/credentials.env.
   INFO: --- Next steps ---
   INFO: To enroll agents, use Deploy new agent in the Wazuh dashboard, or create an enrollment token on this server:
   INFO:     sudo /var/wazuh-manager/bin/wazuh-manager-authd --create-enrollment-token --address <WAZUH_MANAGER_ADDRESS>
   INFO: For more information, see https://documentation.wazuh.com/5.0/installation-guide/wazuh-agent/index.html
   INFO: Installation finished.
   

2. The summary shows the password only when the assistant runs in an interactive terminal. If you redirect its output, for example to a file or a cloud-init log, the summary shows only the command to read it. The assistant never writes the password to /var/log/wazuh-install.log. To show the admin password again, run:

   $ sudo grep '^WAZUH_INDEXER_ADMIN_PASSWORD=' /etc/wazuh-indexer/export/credentials.env | cut -d= -f2-
   

3. Open the Wazuh dashboard at https://<WAZUH_DASHBOARD_ADDRESS> in a browser. Replace <WAZUH_DASHBOARD_ADDRESS> with an address of this host that your browser can reach, such as one of the URLs the assistant printed. On a cloud instance, the assistant might print only the instance's private address. Use its public IP address or DNS name instead. Log in with the following credentials:

   • Username: admin

   • Password: the admin password from step 2

   The browser warns that the certificate wasn't issued by a trusted authority, because Wazuh creates its own certificate authority. Add an exception in the browser, or, for better security, import the Wazuh dashboard CA, /etc/wazuh-dashboard/export/ca.pem, into the browser's certificate manager. Only root can read it. Run sudo cat /etc/wazuh-dashboard/export/ca.pem on this host, and save the output as ca.pem on the computer that runs the browser. You can also configure a certificate from a trusted authority.

The Wazuh packages create the certificate authorities, certificates, and Wazuh user passwords during installation. Store the passwords in a safe place. Keep the /etc/wazuh-indexer/export/credentials.env and /etc/wazuh-manager/export/credentials.env files, readable by root only. In /etc/wazuh-manager/export/credentials.env, WAZUH_MANAGER_API_PASSWORD is the password of the wazuh user of the Wazuh manager API, and WAZUH_MANAGER_WUI_PASSWORD is the password of wazuh-internal-client, the user of the Wazuh dashboard. The Wazuh components take their passwords from their keystores. At every start, they check these files and refuse to start if one has the wrong owner or permissions. The command in step 2 reads the admin password from /etc/wazuh-indexer/export/credentials.env. To change a password, see Password management.

Each package keeps its certificate authority and the private key of that authority in its ca/ directory: /etc/wazuh-indexer/ca, /etc/wazuh-manager/ca, and /etc/wazuh-dashboard/ca. Back up these three directories in a safe place. You need them to renew certificates.

To remove the Wazuh central components and all their data, run the Wazuh installation assistant using the option -u or --uninstall. See Uninstalling the Wazuh central components for details.

$ sudo systemctl restart wazuh-manager

Next steps

Next, deploy Wazuh agents. Each agent enrolls with a token that you create on this server for the address agents connect to. The assistant printed the command that creates it, under Next steps in its summary. Create the token first, as described in Generate the enrollment token. Then follow the instructions for your operating system below. You can also go to Agents management > Summary > Deploy new agent in the Wazuh dashboard. Its wizard generates the token too. The Wazuh manager doesn't monitor the server it runs on. To monitor this server too, deploy a Wazuh agent on it with a token for this server's own address.

Linux

Windows

macOS