Wazuh SIEM Complete Guide 2026: Free Open-Source Security Monitoring

Key Fact: Wazuh monitors over 20 million endpoints globally, processes billions of security events daily, and has 30,000+ GitHub stars. It's the most deployed open-source SIEM in the world — and it's completely free, with no "enterprise edition" paywall.

Data Flow:
Endpoints (Agents) → Wazuh Server (Analysis) → Wazuh Indexer (Storage) → Dashboard (Visualization)

Agents collect logs, system events, and file changes → Server applies decoders, rules, and correlation → Indexer stores enriched events → Dashboard shows alerts, compliance status, and analytics.

# All-in-One installation (server + indexer + dashboard)

# Download and run the Wazuh installation assistant
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
curl -sO https://packages.wazuh.com/4.9/config.yml

# Edit config.yml — set your server IP
vim config.yml
# nodes:
#   indexer:
#     - name: wazuh-indexer
#       ip: "YOUR_SERVER_IP"
#   server:
#     - name: wazuh-server
#       ip: "YOUR_SERVER_IP"
#   dashboard:
#     - name: wazuh-dashboard
#       ip: "YOUR_SERVER_IP"

# Run the installer
sudo bash wazuh-install.sh --generate-config-files
sudo bash wazuh-install.sh --wazuh-indexer wazuh-indexer
sudo bash wazuh-install.sh --start-cluster
sudo bash wazuh-install.sh --wazuh-server wazuh-server
sudo bash wazuh-install.sh --wazuh-dashboard wazuh-dashboard

# Access the dashboard
# URL: https://YOUR_SERVER_IP
# Default user: admin
# Password: shown at end of installation

# Clone Wazuh Docker repository
git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0
cd wazuh-docker/single-node

# Generate SSL certificates
docker compose -f generate-indexer-certs.yml run --rm generator

# Start Wazuh stack
docker compose up -d

# Check status
docker compose ps

# Dashboard available at: https://localhost:443
# API available at: https://localhost:55000
# Default credentials: admin / SecretPassword

# View logs
docker compose logs -f wazuh.manager

Lab Tip: Docker deployment is perfect for home labs, training, and SIEM/SOC practice. You can deploy a full Wazuh stack on a single VPS or even a Raspberry Pi (with sufficient RAM). For production, use the native installation or a multi-node cluster.

# RHEL/CentOS/AlmaLinux
rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
cat > /etc/yum.repos.d/wazuh.repo << 'EOF'
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=Wazuh repository
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

WAZUH_MANAGER="10.0.0.100" yum install wazuh-agent -y
systemctl daemon-reload
systemctl enable --now wazuh-agent

# Debian/Ubuntu
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring \
  --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \
  | tee /etc/apt/sources.list.d/wazuh.list

WAZUH_MANAGER="10.0.0.100" apt-get install wazuh-agent -y
systemctl daemon-reload
systemctl enable --now wazuh-agent

# Verify agent connection
sudo /var/ossec/bin/wazuh-control status
sudo cat /var/ossec/logs/ossec.log | tail -20

# PowerShell (Administrator)
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi `
  -OutFile $env:tmp\wazuh-agent.msi

# Install with manager IP
msiexec.exe /i $env:tmp\wazuh-agent.msi /q `
  WAZUH_MANAGER="10.0.0.100" `
  WAZUH_AGENT_NAME="win-server-01" `
  WAZUH_AGENT_GROUP="windows-servers"

# Start the service
NET START Wazuh

# Ansible playbook for mass agent deployment
---
- name: Deploy Wazuh Agent to all Linux servers
  hosts: all_linux_servers
  become: yes
  vars:
    wazuh_manager_ip: "10.0.0.100"
    wazuh_agent_group: "linux-servers"
  
  tasks:
    - name: Import Wazuh GPG key
      rpm_key:
        key: https://packages.wazuh.com/key/GPG-KEY-WAZUH
        state: present
      when: ansible_os_family == "RedHat"

    - name: Add Wazuh repository
      yum_repository:
        name: wazuh
        description: Wazuh repository
        baseurl: https://packages.wazuh.com/4.x/yum/
        gpgcheck: yes
        gpgkey: https://packages.wazuh.com/key/GPG-KEY-WAZUH
      when: ansible_os_family == "RedHat"

    - name: Install Wazuh agent
      package:
        name: wazuh-agent
        state: present
      environment:
        WAZUH_MANAGER: "{{ wazuh_manager_ip }}"
        WAZUH_AGENT_GROUP: "{{ wazuh_agent_group }}"

    - name: Enable and start Wazuh agent
      systemd:
        name: wazuh-agent
        enabled: yes
        state: started

# /var/ossec/etc/ossec.conf — FIM configuration

<syscheck>
  <frequency>300</frequency>  <!-- Check every 5 minutes -->
  <alert_new_files>yes</alert_new_files>
  
  <!-- Critical system files -->
  <directories realtime="yes" check_all="yes">/etc/passwd,/etc/shadow,/etc/group</directories>
  <directories realtime="yes" check_all="yes">/etc/ssh/sshd_config</directories>
  <directories realtime="yes" check_all="yes">/etc/sudoers,/etc/sudoers.d</directories>
  
  <!-- Web application files -->
  <directories realtime="yes" report_changes="yes">/var/www/html</directories>
  
  <!-- Crontabs -->
  <directories realtime="yes" check_all="yes">/etc/crontab,/etc/cron.d</directories>
  
  <!-- Ignore false positives -->
  <ignore>/var/www/html/cache</ignore>
  <ignore type="sregex">\.log$</ignore>
</syscheck>

# /var/ossec/etc/rules/local_rules.xml

<group name="custom_rules">
  
  <!-- Detect multiple failed SSH logins (brute force) -->
  <rule id="100001" level="10" frequency="5" timeframe="120">
    <if_matched_sid>5710</if_matched_sid>
    <description>SSH brute force attack detected (5+ failures in 2 min)</description>
    <mitre>
      <id>T1110</id>  <!-- Brute Force -->
    </mitre>
    <group>authentication_failures,pci_dss_10.2.4,pci_dss_11.4,</group>
  </rule>

  <!-- Detect new user creation -->
  <rule id="100002" level="8">
    <if_sid>5901</if_sid>
    <match>useradd</match>
    <description>New user account created: $(account)</description>
    <mitre>
      <id>T1136</id>  <!-- Create Account -->
    </mitre>
    <group>account_changed,pci_dss_8.1.2,gdpr_II_5.1.f,</group>
  </rule>

  <!-- Detect web shell upload (PHP) -->
  <rule id="100003" level="12">
    <if_sid>550</if_sid>
    <match>/var/www</match>
    <regex>\.php$</regex>
    <description>New PHP file created in web directory — possible web shell</description>
    <mitre>
      <id>T1505.003</id>  <!-- Web Shell -->
    </mitre>
    <group>web,attack,</group>
  </rule>

  <!-- Detect sudo to root -->
  <rule id="100004" level="5">
    <if_sid>5402</if_sid>
    <match>USER=root</match>
    <description>User $(srcuser) executed command as root via sudo</description>
    <group>sudo,pci_dss_10.2.2,</group>
  </rule>

</group>

# /var/ossec/etc/ossec.conf — Active Response configuration

<!-- Auto-block IPs after brute force detection -->
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>100001</rules_id>
  <timeout>3600</timeout>  <!-- Block for 1 hour -->
</active-response>

<!-- Disable compromised user account -->
<active-response>
  <command>disable-account</command>
  <location>local</location>
  <rules_id>100010</rules_id>  <!-- Triggered by account compromise rule -->
  <timeout>no</timeout>  <!-- Permanent until admin reviews -->
</active-response>

Cost Comparison: A 100-agent Wazuh deployment costs only infrastructure (~$50-200/month on a VPS). The same coverage with Splunk Enterprise would cost $100,000+/year. Even Splunk Cloud starts at approximately $15,000/year. Wazuh makes enterprise SIEM accessible to organizations of any size.

# Authenticate with Wazuh API
TOKEN=$(curl -s -u "wazuh-wui:wazuh-wui" -k \
  -X POST "https://localhost:55000/security/user/authenticate" | \
  jq -r '.data.token')

# List all agents
curl -s -k -X GET "https://localhost:55000/agents" \
  -H "Authorization: Bearer $TOKEN" | jq '.data.affected_items[] | {id, name, status, os: .os.name}'

# Get security alerts (last 24 hours)
curl -s -k -X GET "https://localhost:55000/alerts" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"limit": 20, "sort": "-timestamp"}' | jq

# Get vulnerability inventory for an agent
curl -s -k -X GET "https://localhost:55000/vulnerability/001" \
  -H "Authorization: Bearer $TOKEN" | jq '.data.affected_items[] | {cve: .cve, name: .name, severity: .severity}'

# Restart an agent remotely
curl -s -k -X PUT "https://localhost:55000/agents/001/restart" \
  -H "Authorization: Bearer $TOKEN"

Why Wazuh on Your Resume Matters: Many organizations are migrating from expensive Splunk deployments to Wazuh. Professionals who can deploy, configure, and tune Wazuh are in high demand — especially at startups, MSPs (Managed Security Service Providers), and mid-size enterprises looking to build cost-effective security operations.

Recommended Books for SIEM & Security:

• Linux Intrusion Detection with OSSEC & Wazuh — €14.90
• SOC Analyst Fundamentals — €11.90
• SOC Analyst Advanced: Incident Response & Forensics — €15.90
• Linux Security Hardening — €14.90
• Linux Security Auditing — €14.90
• Cybersecurity Fundamentals — €24.90
• Network Security Basics — €19.90
• Network Security Fundamentals — €19.90
• Docker Security & Production Hardening — €12.90
• Kubernetes Security & Best Practices — €14.90
• Ansible Automation: From Zero to Production — €24.90
• Security+ Certification Guide — €22.90

Wazuh is the most capable free security platform available today. It delivers SIEM, XDR, HIDS, vulnerability detection, file integrity monitoring, compliance reporting, and automated response — all without a single dollar in license fees.

For SOC analysts and security engineers, Wazuh expertise is a career accelerator. As organizations increasingly move away from expensive commercial SIEMs, professionals who can deploy and tune Wazuh are building the next generation of security operations centers.

For organizations, Wazuh means enterprise-grade security monitoring without enterprise pricing. Whether you're a startup with 5 servers or a mid-size company with 500 endpoints, Wazuh scales to meet your needs — and it grows with you.

Start with a Docker lab today. Deploy a few agents. Write your first custom rule. The learning curve is manageable, the community is supportive, and the career payoff is substantial.

Master Wazuh & Intrusion Detection

Build your SIEM lab and learn enterprise security monitoring: