Category: Security
Managed Wazuh: SIEM and threat detection across your infrastructure
An open source SIEM that collects events from your servers, detects what does not add up and alerts you without burying you in alerts, set up in your account and described as code.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- Open source, GPLv2 (the indexer and dashboard derive from OpenSearch, Apache 2.0)
In short
Wazuh is an open source security platform that collects logs and events from servers and computers, detects threats and checks configurations. We set it up in your account, deploy the agents, tune rules and decoders to cut the noise, send the alerts wherever you look at them and keep it up to date. We run the platform and review the important alerts.
What do we take care of?
A freshly installed SIEM protects nothing: the agents have to reach every machine, it has to learn what is normal on your systems and the important alerts have to reach someone. After that it needs maintaining, because an outdated Wazuh or one with a full disk stops seeing just when it is needed most.
Platform
Indexer, server and dashboard sized for your event volume, on one or several nodes.
Agents
Automated deployment, groups by machine type and a check on those that stop reporting.
Detections
Custom rules and decoders for your applications, and documented exceptions.
Alerts
Only what matters to email, Slack or your ticketing tool; the rest, searchable.
Retention
Index policies, rotation and archiving so that the disk does not decide for you.
Upgrades
Server, indexer, dashboard and agents on compatible versions.
What architecture do we recommend?
Wazuh has three core pieces: the server, which receives events from the agents and applies decoders and rules; the indexer, which stores events and alerts; and the dashboard, where they are searched. With a few dozen agents, all three fit on one node. With more volume, or if the SIEM cannot afford to go blind, we split the indexer into a three-node cluster and put several server nodes behind a load balancer.
| Situation | What we set up | Why |
|---|---|---|
| A few dozen servers | One node with all three pieces and off-site backups | Simple to run and enough to get started |
| Hundreds of agents or long retention | Indexer in a three-node cluster and server on two nodes | The indexer is what grows most in disk and memory |
| Several networks or sites | Agents sending over TLS to a single entry point | Without opening the dashboard to the internet |
The dashboard is never exposed to the internet: access goes through the VPN or single sign-on, and each person has their own user.
What problems do we come across most often?
- Noise: hundreds of alerts a day that nobody reads, and the important one goes unnoticed among them.
- Disconnected agents: machines that stopped reporting weeks ago without anyone noticing.
- Indexer disk full: without retention policies, the indexer stops accepting events.
- Mixed versions: agents newer than the server or an indexer that was never upgraded.
- Dashboard open to the internet: with the default admin user.
- Nowhere for the alerts to go: everything stays in the dashboard and nobody opens it.
How do we cut the noise without losing detections?
During the first weeks we review which rules fire most and why. Anything that is normal behaviour for your systems, such as a scheduled task or an authorised scan, becomes a specific exception documented in the repository, not a whole rule switched off. For your applications we write custom decoders, so that their logs are understood and can generate useful alerts. Every rule change is kept in Git and can be reviewed and reverted.
What about NIS2, the ENS and ISO 27001?
Wazuh covers one part well: centralised event logging, detection, file integrity, inventory and vulnerabilities, and evidence an auditor can review. But it does not make you compliant with anything on its own; policies, risk management and response processes are still your organisation’s work. If you want to know where you stand, we review it in the reliability and security audit.
How do we handle backups and upgrades?
The server configuration, custom rules and agent groups live in the repository. The indices are backed up with snapshots to object storage, and we do test restores to check that the events can be searched. To upgrade we follow the order in the official guide: indexer, server, dashboard and, last of all, the agents, which must never be ahead of the server. We rehearse it first in a test environment and check that the custom rules still load.
What is day-to-day support like?
Automated monitoring is continuous; human response is next business day during business hours, as part of SRE as a service. We run the platform and tune the detections; if you need analysts reviewing events all night, we will tell you before we start. Every month you receive a report with active agents, relevant alerts, rule changes and the state of retention. If you also want application metrics and logs, we connect it to observability.
- Wazuh agentsOn every server and computer
- Wazuh serverDecoders and rules
- Wazuh indexerIndexed events and alerts
- Wazuh dashboardSearch and reports
- NotificationsEmail, Slack or tickets
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- AWS
- Google Cloud
- Azure
- DigitalOcean
- OVH
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | Cloud or dedicated servers with indexer, server and dashboard on a private network, and index backups in Object Storage. | A good balance between disk and cost for keeping months of events. |
| AWS | EC2 with Wazuh on one or several instances, EBS volumes and snapshots to S3; integration with CloudTrail, GuardDuty and other AWS logs. | There is no Wazuh managed by AWS: we set it up and maintain it in your account. |
| Google Cloud | Compute Engine with Wazuh reading the Google Cloud audit logs. | No managed Wazuh service on Google Cloud. |
| Azure | Virtual machines with Wazuh and the integration with Azure activity logs and Microsoft Entra ID. | If you already pay for Microsoft Sentinel, we first compare what each one gives you. |
| DigitalOcean | Droplets with Wazuh and volumes for the indices. | Enough for a few dozen agents on a single node. |
| OVH | Public Cloud instances or dedicated servers with Wazuh. | |
| Own server | Wazuh on your servers or virtual machines, with agents across the whole network. | The SIEM should not live on the same machine it monitors: if it goes down or is compromised, you lose the evidence. |
What is included
- Wazuh indexer, server and dashboard in your account, on one node or in a cluster depending on the event volume.
- Agents deployed with Ansible or your management tool on Linux, Windows and macOS machines.
- Agent groups with the log, file integrity and audit configuration for each type of machine.
- Rules and decoders tuned to your systems to reduce the noise without losing detections.
- High-level alerts to email, Slack or your ticketing system, with the context needed to decide.
- Event retention agreed in writing and index policies so that the disk does not fill up.
- Backups of the configuration and the indices, with a tested restore.
- Upgrades of server, indexer, dashboard and agents in the order Wazuh requires.
Frequently asked questions
Does Wazuh make us compliant with NIS2, the ENS or ISO 27001?
Not on its own. Wazuh helps with the requirements for event logging, detection, file integrity and vulnerability management, and produces evidence for an audit. Compliance also requires policies, risk management, training and response processes that no tool solves by itself.
Are you a SOC?
We run the platform, tune the detections and review the important alerts, which is not the same as a SOC with analysts working through the night. Automated monitoring is continuous and critical alerts fire at any hour; human response is next business day, during business hours. If you need analysts watching at night, we will tell you and look for a SOC.
How many alerts are we going to get?
At first, a lot: Wazuh installed as it comes alerts on almost everything. In the first weeks we tune rules and thresholds against your real systems, until the alerts that reach your email or Slack are few and deserve attention. The rest is recorded so it can be looked up.
Wazuh Cloud or Wazuh in our own account?
Wazuh Cloud is the vendor's own service and takes maintenance off your hands. We set it up in your account when you want the logs to stay within your infrastructure, to control retention or to tune the cost of storage.
How long are events kept?
Whatever we agree based on your obligations and your disk budget: for example, a few months searchable in the indexer and longer archived in object storage. It is written down and enforced with index policies.
Tell us about your case
In a free 20-minute call we look at where you are and where to start. No commitment.
Official documentation consulted
The technical details on this page are based on:
Reviewed on