Wazuh manager

The Wazuh manager is one of the central components of the Wazuh platform. It transforms event data received from Wazuh agents, external APIs, and network devices into standardized schema documents using the Wazuh Common Schema (WCS). It then enriches this data with threat intelligence and contextual information, such as GeoIP data and indicators of compromise (IOCs), and then forwards it to the Wazuh indexer and other configured destinations for security monitoring and analysis.

The Wazuh manager uses multiple threat intelligence sources and enriches events with contextual data to enhance detection accuracy and security visibility. This includes mapping events to the MITRE ATT&CK framework, detecting vulnerabilities with the Wazuh CTI service, and aligning security findings with regulatory standards such as PCI DSS, GDPR, HIPAA, CIS benchmarks, and NIST 800-53.

For installation and configuration steps, refer to the Wazuh manager installation guide.