Installation alternatives

You can install Wazuh using other deployment options. These are complementary to the installation methods you can find in the Installation guide and the Quickstart.

Installing the Wazuh central components

All the alternatives include instructions on how to install the Wazuh central components. After these are installed, you then need to deploy agents to your endpoints.

Ready-to-use machines

  • Virtual Machine (OVA): Wazuh provides a pre-built virtual machine image (OVA) that you can directly import using VirtualBox or other OVA compatible virtualization systems.

  • Amazon Machine Images (AMI): This is a pre-built Amazon Machine Image (AMI) you can directly launch on an AWS cloud instance.


  • Deployment on Docker: Docker is a set of platform-as-a-service (PaaS) products that deliver software in packages called containers. Using Docker, you can install and configure the Wazuh deployment as a single-host architecture.

  • Deployment on Kubernetes: Kubernetes is an open-source system for automating deployment, scaling, and managing containerized applications. This deployment type uses Wazuh images from Docker and allows you to build the Wazuh environment.


  • Offline installation: Installing the solution offline involves downloading the Wazuh components to later install them on a system with no internet connection.

From sources

  • Installing the Wazuh server from sources: Installing Wazuh from sources means installing the Wazuh manager without using a package manager. You compile the source code and copy the binaries to your computer instead.

Commercial options

  • Installation with Elastic Stack basic license: As an alternative to the Wazuh indexer, you can install Wazuh using the Elastic Stack basic license option. It contains everything included in the open source version under the Apache License, Version 2.0, plus additional capabilities such as Elastic Stack Security features, Kibana alerting, and others. According to your chosen configuration, Wazuh and Elastic Stack are installed on the same host, as an all-in-one deployment, on a separate host as a single-node or multi-node cluster.

  • Installation with Splunk: You install Wazuh along with Splunk Enterprise, including the Splunk forwarder and the Wazuh Splunk app. This can be done as a single instance or as a multi-instance cluster.

Installing the Wazuh agent

The Wazuh agent is a single and lightweight monitoring software. It is a multi-platform component that can be deployed to laptops, desktops, servers, cloud instances, containers, or virtual machines. It provides visibility into the endpoint security by collecting critical system and application records, inventory data, and detecting potential anomalies.

If the Wazuh central components are already installed in your environment, select your operating system below and follow the installation steps to deploy the agent on the endpoints.

From sources

  • Installing the Wazuh agent from sources: Installing Wazuh from sources means installing the Wazuh agent without using a package manager. You compile the source code and copy the binaries to your computer instead.

Orchestration tools

These alternatives guide you to install the Wazuh central components along with the single universal agent.

  • Deployment with Ansible: Ansible is an open source platform designed for automating tasks. Its deployment tool is used to deploy the Wazuh infrastructure on AWS. The Wazuh environment consists of the Wazuh central components and a Wazuh agent.

  • Deployment with Puppet: Puppet is an open-source software tool that gives you an automatic way to inspect, deliver, operate, and future-proof all of your software, no matter where it is executed. It is very simple to use and allows you to install and configure Wazuh easily.