Wazuh SIEM Deployment on a

Configuration

After the basic installation of Wazuh Manager, Indexer, and Dashboard, additional configuration is required to enhance security and usability. We will focus on configuring TLS/HTTPS for the Dashboard via Certbot and Nginx, as well as basic health checks.

1. Configuring Nginx as a Reverse Proxy for Wazuh Dashboard

Although Wazuh Dashboard can run directly on port 443, using Nginx as a reverse proxy provides more flexibility, allows easy integration of Certbot for automatic issuance of Let's Encrypt SSL certificates, and centralizes traffic management.

1.1. Nginx Installation

sudo apt install nginx -y # Install Nginx
sudo systemctl enable nginx # Enable Nginx autostart
sudo systemctl start nginx # Start Nginx

1.2. Creating Nginx Configuration for Wazuh Dashboard

We will disable Wazuh Dashboard from listening directly on port 443 and configure Nginx. First, change the Dashboard port to avoid conflicts with Nginx. Open /etc/wazuh-dashboard/opensearch_dashboards.yml.

sudo nano /etc/wazuh-dashboard/opensearch_dashboards.yml

Change server.port to, for example, 5601:

server.port: 5601 # Change port for Dashboard

Save and exit. Restart the Dashboard:

sudo systemctl restart wazuh-dashboard

Now, create a new Nginx configuration file for your domain (e.g., wazuh.yourdomain.com).

sudo nano /etc/nginx/sites-available/wazuh.yourdomain.com

Insert the following configuration, replacing wazuh.yourdomain.com with your actual domain:

server {
    listen 80;
    listen [::]:80;
    server_name wazuh.yourdomain.com;
    return 301 https://$host$request_uri; # Redirect HTTP to HTTPS
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name wazuh.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/wazuh.yourdomain.com/fullchain.pem; # Will be generated by Certbot
    ssl_certificate_key /etc/letsencrypt/live/wazuh.yourdomain.com/privkey.pem; # Will be generated by Certbot
    ssl_session_cache shared:SSL:10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://localhost:5601; # Proxy to Dashboard port
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_http_version 1.1;
        proxy_set_header Connection "Keep-Alive";
        proxy_set_header Proxy-Connection "Keep-Alive";
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }
}

Save and exit. Activate the configuration and check Nginx syntax:

sudo ln -s /etc/nginx/sites-available/wazuh.yourdomain.com /etc/nginx/sites-enabled/ # Create symbolic link
sudo nginx -t # Check Nginx syntax
sudo systemctl restart nginx # Restart Nginx

2. Install Certbot and obtain a Let's Encrypt SSL certificate

Now that Nginx is configured, we will obtain a free SSL certificate from Let's Encrypt using Certbot.

2.1. Certbot Installation

sudo apt install certbot python3-certbot-nginx -y # Install Certbot and Nginx plugin

2.2. Obtaining the certificate

Ensure that your domain (wazuh.yourdomain.com) points to your VPS's IP address in your DNS records. Then execute:

sudo certbot --nginx -d wazuh.yourdomain.com # Run Certbot to obtain the certificate

Certbot will ask a few questions (email, agreement to terms, HTTP to HTTPS redirection). Choose automatic redirection. Certbot will automatically modify the Nginx configuration, adding certificate paths. Upon successful completion, you will see a message indicating that the certificate has been successfully installed. Certbot will also configure automatic certificate renewal.

3. Health Check

Now that everything is configured, let's check Wazuh's accessibility and functionality.

• Dashboard Access: Open a web browser and navigate to https://wazuh.yourdomain.com. You should see the Wazuh Dashboard login page with a valid SSL certificate. Use the login admin and password admin (default) to log in.
• Check service status:

sudo systemctl status wazuh-manager wazuh-indexer wazuh-dashboard nginx # Check status of all services

• Check Wazuh Manager API:

curl -u wazuh:wazuh -k "https://localhost:55000/api/overview/info" # Check Manager API

You should receive a JSON response with Manager information. The default password for the Manager API is wazuh.

4. Changing Default Passwords

VERY IMPORTANT: Change the default passwords for Indexer/Dashboard (admin:admin) and Wazuh API (wazuh:wazuh) immediately after installation. Instructions for changing passwords can be found in the official Wazuh documentation, as the process may vary for different versions. This is typically done via OpenSearch or Wazuh CLI utilities.

For Indexer/Dashboard: use the securityadmin.sh utility (for OpenSearch 2.x):

sudo /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh # Interactive tool for changing passwords

For Wazuh API: change the password in the /var/ossec/etc/ossec.conf file in the section or use the agent_auth utility to generate a new API key.

Backups and Maintenance

Regular backups and timely maintenance are key aspects to ensure the stability and security of your Wazuh SIEM system.

1. What to Back Up

The following components are critically important for Wazuh SIEM:

• Indexer Data (OpenSearch): This is the largest and most important part. All collected logs and security events are stored here. Indices need to be backed up.
• Wazuh Manager Configuration: Files in /var/ossec/etc/, especially ossec.conf, agent_keys (although they can be restored by re-registering agents), decoders, rules, and shared.
• Wazuh Dashboard Configuration: The /etc/wazuh-dashboard/opensearch_dashboards.yml file and any custom visualizations/dashboards, if not stored in the Indexer.
• Certificates: All generated and used SSL/TLS certificates (e.g., in /etc/wazuh-indexer/certs/, /etc/wazuh-dashboard/certs/, /etc/letsencrypt/).

2. Simple Auto-Backup Script for Configurations

For configuration files, a simple script with rsync or tar, run by cron, can be used. For Indexer data, it's better to use OpenSearch's built-in mechanisms.

Example script for backing up configurations (/opt/wazuh-backup.sh):

#!/bin/bash

# Directory for temporary backups
BACKUP_DIR="/var/backups/wazuh_configs"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="${BACKUP_DIR}/wazuh_configs_${DATE}.tar.gz"

# Create directory if it doesn't exist
mkdir -p "$BACKUP_DIR"

# Archive critical files
tar -czf "$BACKUP_FILE" \
    /var/ossec/etc/ossec.conf \
    /var/ossec/etc/agent_keys \
    /var/ossec/etc/decoders \
    /var/ossec/etc/rules \
    /var/ossec/etc/shared \
    /etc/wazuh-indexer/opensearch.yml \
    /etc/wazuh-indexer/certs/ \
    /etc/wazuh-dashboard/opensearch_dashboards.yml \
    /etc/wazuh-dashboard/certs/ \
    /etc/nginx/sites-available/wazuh.yourdomain.com \
    /etc/letsencrypt/live/wazuh.yourdomain.com/ \
    /etc/letsencrypt/archive/wazuh.yourdomain.com/

# Delete old backups (e.g., older than 7 days)
find "$BACKUP_DIR" -type f -name "*.tar.gz" -mtime +7 -delete

echo "Backup of Wazuh configurations completed: $BACKUP_FILE"

Make the script executable:

sudo chmod +x /opt/wazuh-backup.sh

Add it to crontab for daily execution (e.g., at 3 AM):

sudo crontab -e

Add the line:

0 3 * * * /opt/wazuh-backup.sh > /dev/null 2>&1

3. Where to Store Backups

Local storage of backups on the same server is susceptible to data loss in case of server failure. Remote storage is recommended:

• Cloud Storage (S3-compatible): AWS S3, DigitalOcean Spaces, Backblaze B2. Utilities like s3cmd or rclone can be used for this.
• Separate VPS: Set up a second VPS as a backup storage and use rsync over SSH for synchronization.
• Network Storage (NFS/SMB): If you have a local network.

4. Indexer Data Backup (OpenSearch Snapshots)

OpenSearch has built-in snapshots functionality for creating incremental backups of indices. To do this, you need to register a repository (e.g., S3 or a local path) and then create snapshots.

Example of registering a local repository (for testing):

sudo mkdir /var/lib/wazuh-indexer/snapshots # Create directory for snapshots
sudo chown wazuh-indexer:wazuh-indexer /var/lib/wazuh-indexer/snapshots # Set permissions

Then via the Indexer API:

curl -XPUT "https://localhost:9200/_snapshot/my_backup_repository" -u admin:admin -k -H 'Content-Type: application/json' -d '{
  "type": "fs",
  "settings": {
    "location": "/var/lib/wazuh-indexer/snapshots"
  }
}'

And creating a snapshot:

curl -XPUT "https://localhost:9200/_snapshot/my_backup_repository/snapshot_1?wait_for_completion=true" -u admin:admin -k

In production, it is recommended to use S3-compatible repositories and automate snapshot creation via Index State Management or cron.

5. Updates: rolling vs maintenance window

Updating Wazuh and its components requires a careful approach.

• Wazuh Manager/Indexer/Dashboard: For small deployments on a single VPS, use a "maintenance window" approach. Schedule a time when system downtime will be least critical. Stop all services, update packages, and then start them. Always read the official release notes before updating, as there may be changes in configuration or procedure.

sudo systemctl stop wazuh-dashboard wazuh-manager wazuh-indexer
sudo apt update && sudo apt upgrade -y # Update all packages
sudo systemctl start wazuh-indexer wazuh-manager wazuh-dashboard

• Wazuh Agents: Agents can be updated "rolling" (gradually) to avoid mass downtime. Wazuh provides remote agent update functionality via API or Kibana.
• System: Regularly update the operating system (sudo apt update && sudo apt upgrade -y) to receive security patches.

Always make a backup before major updates!

Troubleshooting + FAQ

This section collects common problems and answers to frequently asked questions that may arise during the deployment and operation of Wazuh SIEM.

Unable to connect to Wazuh Dashboard via browser.

What to check:

1. Ensure that Nginx and Wazuh Dashboard are running: sudo systemctl status nginx wazuh-dashboard.
2. Check that port 443 is open in the firewall: sudo ufw status.
3. Check Nginx logs (sudo tail -f /var/log/nginx/error.log) and Wazuh Dashboard logs (sudo tail -f /var/log/wazuh-dashboard/wazuh-dashboard.log) for errors.
4. Make sure the domain name correctly points to your VPS's IP address.

How to fix: Restart the services. If the problem is with Nginx, check its configuration (sudo nginx -t). If it's with the Dashboard, ensure it's configured to the correct port (e.g., 5601) and that the Indexer is accessible.

Wazuh Indexer (OpenSearch) does not start or runs unstably.

What to check:

1. Check Indexer logs: sudo journalctl -u wazuh-indexer -f or sudo tail -f /var/log/wazuh-indexer/wazuh-indexer.log.
2. Ensure there is enough RAM. OpenSearch is very demanding on RAM.
3. Check free disk space: df -h.
4. Check the /etc/wazuh-indexer/opensearch.yml configuration for errors, especially certificate paths.

How to fix: Increase the RAM for your VPS, if possible. Free up disk space. Correct configuration errors and restart the service.

Wazuh agents are not connecting to the Manager.

What to check:

1. Ensure that Wazuh Manager is running: sudo systemctl status wazuh-manager.
2. Check that port 1514/TCP is open in your VPS firewall: sudo ufw status.
3. Check Manager logs: sudo journalctl -u wazuh-manager -f.
4. Ensure that agents are configured to the correct Manager IP address/FQDN and are using the correct key.

How to fix: Check network connectivity between the agent and the Manager (telnet YOUR_IP_ADDRESS 1514). Ensure that agent keys are correctly imported and used. Restart the agent on the client machine.

What is the minimum suitable VPS configuration?

For a test deployment or a very small environment (up to 10 agents), you can start with a VPS with 2-4 vCPU, 8 GB RAM, and 100 GB NVMe SSD. However, for stable operation and data retention for a reasonable period (several weeks), at least 4 vCPU, 12-16 GB RAM, and 200 GB NVMe SSD are recommended. Smaller configurations may lead to slower indexing and performance issues as log volume grows.

What to choose — VPS or dedicated for this task?

The choice between a VPS and a dedicated server depends on the scale of your infrastructure and the volume of data. For small to medium deployments (up to 50-100 agents) with moderate log volume, a VPS with good specifications (as described above) will be sufficient and cost-effective. If you plan to monitor hundreds of agents, process terabytes of logs, require long-term data retention, or demand maximum performance and predictability, then a dedicated server with a high-performance CPU, large amount of RAM, and a fast disk array will be preferable. Dedicated servers provide exclusive access to all physical resources, which is critical for high-load SIEM systems.

How to update Wazuh to a new version?

Updating Wazuh typically involves stopping all components (Indexer, Manager, Dashboard), updating packages via the package manager (apt upgrade), and then sequentially starting them. Always check the official Wazuh documentation for the specific version you are upgrading to, as there may be special steps or configuration changes. Before updating, always make a full system backup.

How to change the password for the admin Dashboard user?

The password for the admin user in Wazuh Dashboard (OpenSearch Dashboards) is managed by OpenSearch. To change it, you need to use the wazuh-passwords-tool.sh utility, which is located in the Indexer's security plugins directory. Run it with sudo privileges, and it will interactively prompt you to change passwords for various users, including admin. After changing the password, you may need to restart the Indexer and Dashboard.

Conclusions and Next Steps

We have successfully deployed a comprehensive Wazuh SIEM system on a single VPS, configuring all necessary components: Wazuh Manager, Indexer (OpenSearch), and Dashboard (OpenSearch Dashboards). You now have a powerful tool for security monitoring, threat detection, and centralized log management. This significantly enhances the transparency and security of your infrastructure.

To make the most effective use of your new SIEM system, consider the following steps:

1. Agent Deployment: Install Wazuh agents on all your servers, workstations, and cloud instances that you want to monitor. This will allow you to collect data from all sources.
2. Fine-tuning Rules and Decoders: Explore the Wazuh documentation to create your own threat detection rules and log decoders specific to your applications and infrastructure.
3. Integration with Other Systems: Consider integrating Wazuh with notification systems (Slack, Telegram, email), ticketing systems (Jira), or other security tools to automate incident response.
4. Performance Monitoring: Regularly monitor the performance of your VPS and Wazuh components to ensure the system can handle the data volume, and if necessary, consider scaling (increasing VPS resources or transitioning to a cluster architecture).