Wazuh SIEM Deployment Guide 2026
Wazuh is one of the most powerful open-source SIEM and XDR platforms available today. It provides log collection, threat detection, vulnerability monitoring, file integrity monitoring, compliance reporting, and endpoint security management.
This guide explains how to deploy Wazuh in a production environment for enterprise security monitoring.
Architecture Overview
A standard Wazuh deployment consists of:
- Wazuh Manager
- Wazuh Dashboard
- OpenSearch Cluster
- Wazuh Agents
- Syslog Devices
- Cloud Integrations
Recommended Hardware
| Component |
CPU |
RAM |
Storage |
| Small Deployment |
4 Cores |
8 GB |
100 GB SSD |
| Medium Deployment |
8 Cores |
16 GB |
250 GB SSD |
| Large Deployment |
16+ Cores |
32+ GB |
500 GB SSD |
Installation (Ubuntu 24.04)
curl -sO https://packages.wazuh.com/4.12/wazuh-install.sh
chmod +x wazuh-install.sh
sudo ./wazuh-install.sh -a
This command installs:
- Wazuh Manager
- OpenSearch
- Dashboard
Access Dashboard
https://SERVER-IP
Login using credentials generated during installation.
Agent Deployment
Install Wazuh agents on:
- Windows Servers
- Linux Servers
- Workstations
- Cloud Instances
sudo WAZUH_MANAGER='10.10.10.10' bash wazuh-agent-install.sh
Integrating Sophos Firewall
Sophos Firewall can forward logs to Wazuh using Syslog.
- Enable Syslog on Sophos
- Select Firewall, IPS, ATP, VPN Logs
- Forward to Wazuh Manager IP
- Use UDP 514 or TCP 514
Important Wazuh Modules
- File Integrity Monitoring (FIM)
- Vulnerability Detection
- Rootkit Detection
- Configuration Assessment
- Threat Intelligence Integration
- MITRE ATT&CK Mapping
Compliance Monitoring
Wazuh supports:
- PCI DSS
- HIPAA
- NIST
- SOC2
- ISO 27001
Best Practices
- Use TLS certificates for all components.
- Enable daily backups.
- Integrate Active Directory.
- Monitor critical assets first.
- Enable vulnerability scanning.
- Configure email alerts.
- Store logs for at least 90 days.
Conclusion
Wazuh provides enterprise-grade SIEM capabilities without expensive licensing costs. Proper deployment and integration with firewalls, servers, cloud services, and endpoints can significantly improve visibility and threat detection capabilities.
Related Articles