Deploying Wazuh All‑In‑One on Ubuntu or CentOS

Wazuh is an open‑source SIEM that doubles as a host intrusion detection system (HIDS). The article walks through an All‑In‑One (AIO) deployment, bundling the Wazuh Manager, Elastic Stack (Elasticsearch, Kibana), and Filebeat on a single server. It recommends a fresh Ubuntu 20.04/22.04 LTS or CentOS 7/8 Stream installation, with at least 4 CPU cores, 8 GB RAM (16 GB recommended), and 50 GB SSD storage. The guide lists required inbound ports: TCP 55000 for agent registration, TCP 443 for the Kibana UI, and optionally TCP/UDP 514 for syslog forwarding. Before installing, it advises updating the OS, installing curl, wget, and vim, and configuring the firewall to allow the necessary ports. The article then explains why Wazuh’s HIDS, file integrity monitoring (FIM), security configuration assessment (SCA), vulnerability detection, and log data analysis make it a cost‑effective alternative to commercial EDRs for SMBs.

The AIO installer simplifies initial setup by avoiding a multi‑node Elasticsearch cluster, allowing users to see data quickly and migrate to a distributed architecture later. The article stresses that disabling the firewall or SELinux is acceptable only for testing; production environments must configure rules properly.

Overall, the post serves as a step‑by‑step tutorial for security teams looking to deploy a lightweight, open‑source SIEM on a single server.