This article walks you through the process of running Wazuh in Docker on your local systemn (or server) in about 5 minutes. It’s a simple process and a great tool.
The official documentation is “https://wazuh.com/install/” but their instructions didn’t work. Hence this article.
You can run the docker containers on Windows if you have WSL installed and running. If you go with that option, Ubuntu is a good choice for the WSL OS. If you instend to run Wazuh on a normal Linux system, consider Ubuntu there too. In this example, we’re using Ubuntu 26.04 from a fresh Desktop installation. Best practice is to do this in a test environment first. In this example, we’re using Wazuh version v4.9.2 because it appeared to work without error, whereas the latest version had issues. I suggest some trial and error with the versions.
Install the basics:
apt install docker-compose docker.io vim git
Install Wazuh as Docker containers:
git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.2 cd wazuh-docker/single-node sysctl -w vm.max_map_count=262144 docker compose -f generate-indexer-certs.yml run --rm generator docker compose up -d
Browse to your new Wazuh server:
https://ip-address.local Username=admin Password=SecretPassword
Add a new host (client) to your Wazuh environment by navigating to: Server Management => Endpoint Summary => Deploy New Agent.
The result from the above is a command that you can copy/paste into a terminal on the client system to isntall the Wazuh agent. Once done, return to the Wazuh web portal and navigate to: Server Management => Endpoint Summary. You may need to wait and refresh that page before the new system appears.
The agent (client) system be joined like this:
wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.2-1_amd64.deb && sudo WAZUH_MANAGER='ip-address.local' WAZUH_AGENT_NAME='my-agent-name' dpkg -i ./wazuh-agent_4.9.2-1_amd64.deb
Security hasn’t been factored in so far. In the current state, any agent (remote system) can be joined without authetnication. To require the agent to present a secret (password) to the server, issue the following commands on the server-side.
docker exec -it single-node-wazuh.manager-1 bash -c "echo 'myPassWord' > /var/ossec/etc/authd.pass" docker exec -it single-node-wazuh.manager-1 /var/ossec/bin/wazuh-control restart
The agent (client) system could then be joined like this:
wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.2-1_amd64.deb && sudo WAZUH_MANAGER='ip-address.local' WAZUH_AGENT_NAME='my-agent-name' WAZUH_REGISTRATION_PASSWORD='myPassWord' dpkg -i ./wazuh-agent_4.9.2-1_amd64.deb
Important: Each time I ran through this example, I noticed the client file “/var/ossec/etc/ossec.conf” had an error in it. The IP address of the Wazuh server contained an error. If you have problems with the agent contacting the server, try this. Edit that file and look for the following:
<address>MANAGER_IP</address>
And change it to be list this:
<address>ip-address.local</address>
Where “ip-address.local” is the IP address of the Wazuh server.
Then restart the agent service:
systemctl restart wazuh-agent