Running Wazuh offline

The Wazuh indexer loads the ruleset, the IOC data, and the vulnerability content from snapshots in its package. The Wazuh manager loads its GeoIP databases from its own package. So threat detection and vulnerability detection work without an Internet connection. The detection content isn't updated automatically while the deployment has no Internet access. To update it, see Updating the content offline.

The Wazuh manager discards incoming events until it logs Event processing is now active. In tests, this took up to about 4 minutes on the first start, and a few seconds after a restart. Vulnerability detection starts when the Wazuh manager logs CVE feed fully loaded. The first load takes from a few minutes to about 2 hours, depending on the host. Run the following command on a Wazuh manager node to check both:
```
# grep -E 'Event processing is now active|CVE feed fully loaded' /var/wazuh-manager/logs/wazuh-manager.log
```
After each start, and then every 6 minutes, the Wazuh manager tries to download a GeoIP manifest. Each failed try logs a Cannot download manifest warning.
The Wazuh engine, which runs with the Wazuh indexer, also tries to download the GeoIP manifest from api.pre.cloud.wazuh.com when it starts and every 6 minutes. Each failed try logs a Cannot download manifest warning in /var/log/wazuh-indexer/wazuh-engine.log. It keeps using the GeoIP databases of the Wazuh indexer package.
The Wazuh indexer tries to update its content from Wazuh CTI when it starts and on its update schedule. It logs WARN and ERROR lines in /var/log/wazuh-indexer/wazuh-cluster.log, such as Could not reach catalog URL. These messages are expected. Each Wazuh dashboard login also adds Couldn't obtain catalog plans from CTI and Unexpected error during version check to that file, and the Wazuh dashboard logs Cannot get available updates from indexer. These are expected too. Don't turn the updates off with the plugins.content_manager.catalog settings, or the Wazuh indexer loads no content.
Optionally, set plugins.content_manager.telemetry.enabled: false in /etc/wazuh-indexer/opensearch.yml. It stops only the daily update-check ping and its log lines.
If the deployment gets Internet access later, allow outbound HTTPS on port 443/TCP from the Wazuh indexer and Wazuh manager nodes to api.pre.cloud.wazuh.com. The Wazuh indexer downloads ruleset, IOC, and vulnerability content updates from it, and the Wazuh manager and the Wazuh indexer nodes download GeoIP database updates from it.

Updating the content offline

The Wazuh indexer doesn't update its content automatically when the deployment has no Internet access. To update it, load newer snapshots from Wazuh CTI:

On a Wazuh indexer node, display the snapshot manifest. Each snapshot, such as vulnerabilities.zip, has a resource value, which is the Wazuh CTI address you use in the next step:

# cat /usr/share/wazuh-indexer/plugins/wazuh-indexer-content-manager/snapshots/manifest.json

The resource line of each snapshot holds its address.

The command output looks similar to this:

{
  "vulnerabilities.zip": {
    "name": "public-vulnerabilities-5",
    "context": "t1-vulnerabilities-5",
    "type": "cti:catalog:consumer:vulnerabilities",
    "resource": "https://api.pre.cloud.wazuh.com/api/v1/catalog/contexts/t1-vulnerabilities-5/consumers/public-vulnerabilities-5",
    "is_public": true,
    "remote_offset": 1134726
  },
  "iocs.zip": {
    "name": "public-iocs-5",
    "context": "t1-iocs-5",
    "type": "cti:catalog:consumer:iocs",
    "resource": "https://api.pre.cloud.wazuh.com/api/v1/catalog/contexts/t1-iocs-5/consumers/public-iocs-5",
    "is_public": true,
    "remote_offset": 1368060
  },
  "ruleset.zip": {
    "name": "t1-public-ruleset-5-rc2",
    "context": "rc2-t1-ruleset-5",
    "type": "cti:catalog:consumer:ruleset",
    "resource": "https://api.pre.cloud.wazuh.com/api/v1/catalog/contexts/rc2-t1-ruleset-5/consumers/public-ruleset-5",
    "is_public": true,
    "remote_offset": 1056
  }
}

On a system with Internet access, download the latest snapshot of each content type you want to update. Replace <RESOURCE> with its resource value, and <FILE> with its name in the manifest, which is vulnerabilities.zip, ruleset.zip, or iocs.zip:
```
# curl -s -o <FILE> "$(curl -s "<RESOURCE>" | python3 -c 'import json,sys; print(json.load(sys.stdin)["data"]["last_snapshot_link"])')"
```

Copy the files to every Wazuh indexer node, and place them in the snapshots directory:

# install -m 0640 -o wazuh-indexer -g wazuh-indexer <FILE> /usr/share/wazuh-indexer/plugins/wazuh-indexer-content-manager/snapshots/

On one Wazuh indexer node, request the update and enter the admin password. Replace <WAZUH_INDEXER_ADDRESS> with the network.host value in /etc/wazuh-indexer/opensearch.yml on that node, or with 127.0.0.1 if that value is 0.0.0.0:
```
# curl --cacert /etc/wazuh-indexer/export/ca.pem -u admin -X POST "https://<WAZUH_INDEXER_ADDRESS>:9200/_plugins/_content_manager/update?offline=true"
```
The response shows "status":202 when the Wazuh indexer accepts the request. A 409 response means another content update is still running, for example, right after the Wazuh indexer starts. Wait a few minutes and send the request again.
Check that each content type shows ready. Loading the vulnerability content takes a few minutes. Use the same address as in the previous step:
```
# curl --cacert /etc/wazuh-indexer/export/ca.pem -u admin "https://<WAZUH_INDEXER_ADDRESS>:9200/.wazuh-cti-consumers/_search?filter_path=hits.hits._source.type,hits.hits._source.status,hits.hits._source.local_offset&pretty"
```
The Wazuh manager loads the new vulnerability content from the Wazuh indexer at its next feed update, within the feed-update-interval of its vulnerability-detection block (60 minutes by default). Run the following command on a Wazuh manager node to check it:
```
# grep 'Feed update process completed (changed=true)' /var/wazuh-manager/logs/wazuh-manager.log | tail -1
```
The update is done when the output shows a line newer than your update request. The download takes some minutes.

Next steps

Once the Wazuh environment is ready, Wazuh agents can be installed on every endpoint to be monitored. To install the Wazuh agents and start monitoring the endpoints, see Install Wazuh agents on hosts without Internet access.

To uninstall all the Wazuh central components, see the Uninstalling the Wazuh central components section.