What Wazuh is
Wazuh is a free, open-source security platform that provides unified SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) capabilities. It monitors endpoints for threats, analyses logs from across the infrastructure, detects file integrity changes, checks system configurations against compliance benchmarks (CIS, PCI-DSS, HIPAA) and correlates security events in a central dashboard.
Screenshot evidence
Wazuh consists of three components: the Wazuh Manager (receives and processes agent data), the Wazuh Indexer (stores and indexes security events, based on OpenSearch), and the Wazuh Dashboard (visualisation and alerting). Agents run on monitored hosts and report back to the manager.
Why I run it
While Zabbix tells me whether services are up and performing well, Wazuh tells me whether anything suspicious is happening. It monitors file integrity, watches for privilege escalation, analyses authentication logs, detects rootkits and flags configuration drift. Together with Zabbix, it gives me both availability monitoring and security visibility across the entire lab.
What I have done with it
- Deployed Wazuh Manager, Indexer and Dashboard on a dedicated KVM virtual machine
- Installed Wazuh agents across Linux hosts and containers
- Configured file integrity monitoring for critical system paths
- Tuned JVM heap settings for the Indexer to run reliably on lab hardware
- Set up alerting rules for authentication failures and privilege escalation
- Used the dashboard for log investigation and security event correlation
Why this matters
Security monitoring is not optional infrastructure — it is essential. Running a proper SIEM alongside availability monitoring shows that I think about security as a first-class concern, not an afterthought. Having deployed both Wazuh (security) and Zabbix (availability) means I understand the difference between "is it up?" and "is it compromised?" — and why you need both.