Wazuh manager

The Wazuh manager is one of the central components of the Wazuh platform. It transforms event data received from Wazuh agents and external APIs into standardized schema documents using the Wazuh Common Schema (WCS). It then enriches this data with threat intelligence and contextual information, such as GeoIP data and indicators of compromise (IOCs). The Wazuh manager forwards the enriched data to the Wazuh indexer and other configured destinations for security monitoring and analysis.

The Wazuh manager enriches events with contextual data to enhance detection accuracy and security visibility. It also detects vulnerabilities with the Wazuh Cyber Threat Intelligence (CTI) service. The Wazuh indexer then evaluates the processed events against detection rules that map findings to the MITRE ATT&CK framework. These rules also map findings to regulatory standards such as PCI DSS, GDPR, HIPAA, CIS benchmarks, and NIST 800-53.

For installation and configuration steps, refer to the Wazuh manager installation guide.