Installation guide
Wazuh is a security platform that provides unified XDR and SIEM protection for endpoints and cloud workloads. The solution is composed of the Wazuh agent and three central components: the Wazuh manager, the Wazuh indexer, and the Wazuh dashboard.
Wazuh is a free and open source platform. Its components abide by the GNU General Public License, version 2, and the GNU Affero General Public License version 3 (AGPLv3).
This guide shows how to install Wazuh on your own infrastructure. To use Wazuh without installing anything, try Wazuh Cloud, our SaaS solution: see the Wazuh Cloud service documentation or start a free trial.
Installing the Wazuh central components
You can install the Wazuh indexer, Wazuh manager, and Wazuh dashboard on a single host or distribute them in cluster configurations. Each Wazuh central component supports two deployment methods: Assisted installation and Step-by-step installation. Both methods provide instructions to install the central components on a single host or on separate hosts.
Check our Quickstart documentation to perform an all-in-one installation of the Wazuh central components. This is the fastest way to get the Wazuh central components up and running.
For more deployment flexibility and customization, install the Wazuh central components by starting with the Wazuh indexer deployment. This deployment method supports both an all-in-one installation and installing components on separate hosts. For an all-in-one host, use the hardware requirements in the Quickstart.
Before you start, choose the name and IP address of every Wazuh indexer, Wazuh manager, and Wazuh dashboard node. You create the certificates and passwords for all of them on one host, usually the first Wazuh indexer node. Then you copy one archive to every other node. The archive also holds each Wazuh manager node's agent listener and Wazuh manager API certificates, issued from the same root CA.
I want to... |
Use |
Typical time |
|---|---|---|
Try Wazuh on one Linux host |
About 5 to 10 minutes |
|
Install on one or more hosts with a script |
About 6 minutes (all-in-one), 15 minutes (3 hosts) |
|
Control every step |
About 20 minutes (all-in-one) |
|
Install without internet access |
About 20 minutes, plus the download |
|
Import a ready virtual machine |
About 15 minutes, plus a 3.8 GB download |
|
Run in containers |
About 15 minutes (Docker single-node) |
|
Automate with Ansible |
About 10 minutes (all-in-one) |
The assisted and step-by-step methods install one component at a time, and both start on the Wazuh indexer page. Use the same method for the three components.
Follow this installation workflow:
Installing the Wazuh agent
The Wazuh agent is a single, lightweight monitoring software. It is a multi-platform component that you can deploy to laptops, desktops, servers, cloud instances, containers, or virtual machines. It provides visibility into the monitored endpoint by collecting critical system and application records, inventory data, and detecting potential anomalies.
Before you install a Wazuh agent, create an enrollment token on the Wazuh manager, as described in Generate the enrollment token. Then select your endpoint operating system below and follow the installation steps.
Packages list
The Packages list section contains all the packages required for installing Wazuh.
Uninstalling Wazuh
In the Uninstalling Wazuh section, you will find instructions on how to uninstall the Wazuh central components and the Wazuh agent.
Installation alternatives
Wazuh provides other installation alternatives as well. These are complementary to the installation methods of this installation guide. You will find instructions on how to deploy Wazuh using ready-to-use machines, containers, and orchestration tools. There is also information on how to install Wazuh offline.