Wazuh

Deploy Wazuh, an open source security monitoring platform for detecting threats, intrusion attempts, system anomalies, misconfigurations, and unauthorized activity. It also provides a framework for incident response and compliance monitoring.

1. Deploy Wazuh

 Estimated deployment time: 10–15 minutes

Base distribution and plan

• Supported distribution: Ubuntu 24.04 LTS
• Recommended plans: Use at least a 4GB Compute Instance. For production, use an 8-core plan with 32GB RAM or higher.

Configuration options

StackScript ID: 913276

Notes:

• After the app deployment completes, the password for your limited sudo user is generated and stored in the .credentials file in the home directory, along with all of your Wazuh credentials. Log in to your instance as root through the Lish console or SSH, then run cat /home/$USERNAME/.credentials to view its contents.
• You can automatically configure a custom domain (optional) during deployment. To do that:
  1. First, configure your domain to use Linode’s name servers via your registrar. See Configure your domain's authoritative name servers for details.
  2. Once you complete that, specify the Linode API token, subdomain, and domain for the app in Cloud Manager or via API/CLI/Terraform.

Use API, CLI, or Terraform

curl --location 'https://api.linode.com/v4/linode/instances' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer abc123def456hij789klm' \
  --data-raw '{
    "region": "us-east",
    "type": "g6-standard-4",
    "image": "linode/ubuntu24.04",
    "label": "my-wazuh-one-click-app",
    "root_pass": "@C0mpl3x#P@ssw0rd",
    "stackscript_id": 913276,
    "stackscript_data": {
      "soa_email_address": "jsmith@example.com",
      "user_name": "jsmith"
    }
  }'

linode-cli linodes create \
  --region us-east \
  --type g6-standard-4 \
  --label my-wazuh-one-click-app \
  --image linode/ubuntu24.04 \
  --root_pass @C0mpl3x#P@ssw0rd \
  --stackscript_id 913276 \
  --stackscript_data '{"soa_email_address":"jsmith@example.com", "user_name":"jsmith"}'

resource "linode_instance" "my-linode" {
  region         = "us-east"
  type           = "g6-standard-4"
  label          = "my-wazuh-one-click-app"
  image          = "linode/ubuntu24.04"
  root_pass      = "@C0mpl3x#P@ssw0rd"
  stackscript_id = 913276
  stackscript_data = {
    "soa_email_address" = "jsmith@example.com"
    "user_name"         = "jsmith"
  }
}

2. Access the Wazuh app

1. Open a web browser and navigate to the domain you entered when creating the https://[domain] instance, replacing [domain] with your custom domain. If you didn't enter a domain, use your Linode instance's default rDNS domain such as 192-0-2-1.ip.linodeusercontent.com.

   See the Manage IP addresses on a Linode guide for information on viewing the rDNS value.

   To securely access your website, prefix the URL with https.

2. On the Wazuh login page, enter admin as the username and the corresponding password from the .credentials file.

Set up a Wazuh agent

Now that you’ve accessed your Wazuh instance, you need to configure a Wazuh agent on the server you’d like to monitor with Wazuh.

1. Before adding the agent, allow the monitored server to reach ports 1514 and 1515 on your Wazuh instance by running these commands:

   Bash

   sudo ufw allow from $AGENTSERVERIP to any port 1514 proto tcp
   sudo ufw allow from $AGENTSERVERIP to any port 1515 proto tcp

   Replace $AGENTSERVERIP with the IP address of the server where you plan to install the Wazuh agent.

2. Once the firewall rules are added, follow the steps in the Wazuh UI to deploy the Wazuh agent. The agent installation asks you for the following details:

   • The system package you're installing the agent on: RPM, DEB, Windows, macOS. For example, DEB amd64.
   • The server address: Your newly installed Wazuh instance's domain or IP address. For example, my-domain.com.
   • An agent name: The ID for the instance you're installing the agent on. For example, database1.
   Bash

   wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.7.5-1_amd64.deb && sudo WAZUH_MANAGER='my-domain.com' WAZUH_AGENT_NAME='database1' dpkg -i ./wazuh-agent_4.7.5-1_amd64.deb

3. Once you enter that information, Wazuh displays the installation commands.

   Bash

   sudo systemctl daemon-reload
   sudo systemctl enable wazuh-agent
   sudo systemctl start wazuh-agent

Additional resources

For more information about the installed packages, see their official documentation.

• Wazuh Documentation