> For the complete documentation index, see [llms.txt](https://kchuene.gitbook.io/data-communication-project/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kchuene.gitbook.io/data-communication-project/setup/publish-your-docs/services/wazuh.md).

# Wazuh

Installation of Wazuh for SIEM and XDR.

## Download Repository

**Clone Wazuh Docker repository**

{% code overflow="wrap" lineNumbers="true" %}

```
git clone https://github.com/wazuh/wazuh-docker.git -b v4.14.4
```

{% endcode %}

**Single-node directory**

{% code overflow="wrap" lineNumbers="true" %}

```
cd wazuh-docker/single-node/
```

{% endcode %}

## Certificate Generation

For securing communication between nodes.

**Wazuh self-signed certificates generator compose (Optional edit)**

`generate-indexer-certs.yml`:

<pre class="language-yaml" data-overflow="wrap" data-line-numbers><code class="lang-yaml"># Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services:
  generator:
    image: wazuh/wazuh-certs-generator:0.0.4
    hostname: wazuh-certs-generator
    volumes:
      - ./config/wazuh_indexer_ssl_certs/:/certificates/
      - ./config/certs.yml:/config/certs.yml
<strong>    environment:
</strong><strong>      - HTTP_PROXY=&#x3C;YOUR_PROXY_ADDRESS_OR_DNS> # Optional: If your system uses a proxy
</strong></code></pre>

**Restrict Wazuh Dashboard and Indexer access**

Restrict access of the **Wazuh Dashboard** and **Indexer** to `localhost` since the **Agents** only need to communicate with the **Wazuh Manager**

Edit `wazuh-docker/single-node/docker-compose.yml` to specify

<pre class="language-yaml" data-overflow="wrap" data-line-numbers><code class="lang-yaml">  wazuh.indexer:
    #--SNIP--
    ports:
<strong>      - "127.0.0.1:9200:9200" # localhost
</strong><strong>      
</strong><strong>   wazuh.dashboard:
</strong>    #--SNIP--
    ports:
      - "127.0.0.1:443:5601"     
</code></pre>

**Compose and run certificate generator**

{% code overflow="wrap" lineNumbers="true" %}

```
sudo docker compose -f generate-indexer-certs.yml run --rm generator
```

{% endcode %}

{% hint style="info" %}
Generated certificates are stored in the `wazuh-docker/single-node/config/wazuh_indexer_ssl_certs` directory.
{% endhint %}

## Deploy and Access

**Set `max_map_count` to `262144`**&#x20;

{% code overflow="wrap" lineNumbers="true" %}

```
sysctl vm.max_map_count # 65530
sudo sysctl -w vm.max_map_count=262144
```

{% endcode %}

{% hint style="info" %}
Found that this was not necessary when **Ubuntu Desktop 24.04** is installed on a physical machine.
{% endhint %}

**Compose Pull Images and then Create + Run Containers**

{% code overflow="wrap" lineNumbers="true" %}

```
sudo docker compose pull
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```
sudo docker compose up -d
```

{% endcode %}

**Accessing the Wazuh Dashboard**

{% code overflow="wrap" lineNumbers="true" %}

```
https://localhost
```

{% endcode %}

Login with the username `admin` and password `SecretPassword` that was given after installation.

{% hint style="info" %}
I recommend checking out the link to **Wazuh indexer tuning** to optimize some aspects like swapping and replicas.
{% endhint %}

## Optional: Tune Wazuh Indexer

**Memory locking**

Edit `single-node/config/wazuh_indexer/wazuh.indexer.yml` to prevent swapping (add the line)

{% code overflow="wrap" lineNumbers="true" %}

```
bootstrap.memory_lock: true
```

{% endcode %}

Create `single-node/config/wazuh_indexer/wazuh-indexer.conf` and add

{% code overflow="wrap" lineNumbers="true" %}

```
[Service]
LimitMEMLOCK=infinity
```

{% endcode %}

Edit `single-node/docker-compose.yml` to prevent memory over allocation given the above

{% code overflow="wrap" lineNumbers="true" %}

```yaml
wazuh.indexer:
   environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms2g -Xmx2g" # Recommended 4g for 8g system, i.e half
```

{% endcode %}

And bind mount the above `wazuh-index.conf` file

{% code overflow="wrap" lineNumbers="true" %}

```yaml
wazuh.indexer:
   volumes:
      - ./config/wazuh_indexer/wazuh-indexer.conf:/etc/systemd/system/wazuh-indexer.service.d/
```

{% endcode %}

&#x20;**Limit Shards and Replicas**

Download **Wazuh Indexer template**

{% code overflow="wrap" lineNumbers="true" %}

```
curl https://raw.githubusercontent.com/wazuh/wazuh/v4.14.5/extensions/elasticsearch/7.x/wazuh-template.json -o w-indexer-template.json
```

{% endcode %}

Edit `w-indexer-template.json` to limit **Shards** by setting `index.number_of_shards` to `1` and **Replicas** to by setting `index.number_of_replicas` to `0` , insure to avoid overwriting the existing template by setting `order` to `1` (any other than 0 on base installation).

<pre class="language-json" data-overflow="wrap" data-line-numbers><code class="lang-json">{
<strong>  "order": 1,
</strong>  "index_patterns": [
    "wazuh-alerts-4.x-*",
    "wazuh-archives-4.x-*"
  ],
  "settings": {
    "index.refresh_interval": "5s",
<strong>    "index.number_of_shards": "1",
</strong><strong>    "index.number_of_replicas": "0",
</strong>    "index.auto_expand_replicas": "0-1",
    "index.mapping.total_fields.limit": 10000,
    ...
</code></pre>

**Update the settings**

{% code overflow="wrap" lineNumbers="true" %}

```
curl -X PUT "https://<INDEXER_IP_ADDRESS>:9200/_template/wazuh-custom" -H 'Content-Type: application/json' -d @w-indexer-template.json -k -u <INDEXER_USERNAME>:<INDEXER_PASSWORD>
```

{% endcode %}

The `INDEXER_USERNAME` and `INDEXER_PASSWORD` will be the same as for the **Wazuh Dashboard**, if default not changed then `admin:SecretPassword` .

{% hint style="info" %}
Of course in a production environment you should reset the password.
{% endhint %}

{% embed url="<https://documentation.wazuh.com/current/deployment-options/docker/wazuh-container.html>" %}

{% embed url="<https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-tuning.html>" %}

{% embed url="<https://documentation.wazuh.com/current/user-manual/wazuh-indexer/re-indexing.html>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://kchuene.gitbook.io/data-communication-project/setup/publish-your-docs/services/wazuh.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.