Wazuh (security monitoring)

An open-source SIEM and XDR in one deployment - what you get, how to connect your machines to it, and what is yours to look after.

Wazuh watches your machines. A small program on each one, the agent, reports what happens there - sign-ins, file changes, installed packages, running processes - and the server turns those reports into alerts: an intrusion attempt, a known vulnerability, a file that should not have changed.

On ISOGrid it is deployed from Security → Security tools, like a solution: pick a size, pick a network, deploy. A few minutes later the dashboard is on its own address.

What is deployed

Three containers, the versions Wazuh releases together:

Part	What it does
Dashboard	The web interface. The only part with a web address.
Manager	Receives the agents' reports and applies the detection rules.
Indexer	Stores alerts and events, and answers the dashboard's searches.

They run on one node, on a private network of their own. The indexer, which holds every alert, is reachable from nowhere else.

Three things are set up for you that the stock installation leaves to you:

No default password. The administrator's password is generated for your deployment, and the accounts the three parts use to sign in to each other are unique to it. The demo accounts of the stock installation do not exist.
Certificates. The three parts talk to each other over TLS, with certificates from an authority created for your deployment.
Enrollment password. A machine can only register as an agent with the password shown on the Agents tab.

Size

The smallest size offered has 4 GB of memory; the indexer uses most of it. For more than a few dozen agents, or to keep several months of events, take 8 GB or more. You can change the size later from the Size tab.

Signing in

Open the deployment, then Sign in. The user is admin; the password is on the Overview tab.

Connecting a machine

The Agents tab gives the command to run on each machine, for Debian and Ubuntu, RHEL and its relatives, Windows and macOS. It contains the manager's address, its two ports and the enrollment password, so there is nothing to fill in. The machine appears on the dashboard about a minute later.

Two addresses exist:

From outside the platform - your own servers, laptops, another cloud - agents connect to the address and the two ports shown on the tab. That traffic is encrypted by Wazuh itself.
From an application on the same private network, agents reach the manager by its internal name, on ports 1514 and 1515, without leaving the network. Choose Inside your network on the tab.

The enrollment password is used once. After that the agent holds a key of its own, and removing the agent from the dashboard revokes it.

What is yours to look after

Rules and configuration. The manager's configuration, rules and decoders are yours to edit, from the dashboard or from the Files tab.
Disk. Events accumulate. Set a retention policy in the dashboard (Indexer management → Index management) that matches the size you bought.
Backups. The Backups tab covers the manager's configuration: its rules, its decoders and the keys of the enrolled agents. The indexed events are not part of those backups.

If it is unpublished

Without a public address the dashboard is reachable only from your private network, and only applications on that network can report to it. Publish it again and the agents' address and ports are the same as before.

Guide

What ISOGrid is — A cloud platform built in Algeria, for teams who want to ship without running servers.

Getting started — From an account to something running on the internet.

Your experience level — Three questions at first sign-in decide how your home page is laid out and how the assistant talks to you - and nothing else.

Deploying an application — From a repository to a running address, and what happens at each step.

How the build is detected — Which files count as a Dockerfile or a Compose file, how the port is found, and what happens when there are several candidates or none.

Compose and stack files — Deploying a Docker Compose or Swarm stack file - what is applied, what is not, and what applying it again does.

Git repositories — Connecting GitHub or GitLab, deciding who in the organization may build from your repositories, and what happens when you leave.

Addresses and domains — The address every application gets, using your own name instead, and what breaks when DNS is wrong.

Connect your own network (VPN gateway) — Reach the services on a private network from your laptop, your office or another cloud, by alias, through a WireGuard gateway you open from the Networks page.

Databases — Ordering one, what each arrangement survives, and why replication is not a backup.

Vector search and AI with pgvector — Store embeddings in your PostgreSQL database and search them by meaning - switching pgvector on, a working example, indexes, and what to check first.

Object storage — Stores and buckets, what one node and several nodes survive, keys limited per bucket, and connecting over S3.

Volumes — Disk that outlives a copy. Where it comes from, what it survives, browsing it, and backing it up.

Managed services — Kafka, RabbitMQ, Redis and Keycloak - what you get, what each arrangement survives, and how an application connects.

Private clusters without lock-in — What runs on your machines is standard Docker Swarm or Kubernetes, and it keeps running if you leave.

Supabase — A complete backend on PostgreSQL in one deployment - what you get, which database to put behind it, and where your keys are.

Your own cluster with the Nomad agent — Deploy from the ISOGrid console on a Docker Swarm or Kubernetes you run yourself, without giving ISOGrid any access to your machines or your secrets.

Wazuh (security monitoring) — An open-source SIEM and XDR in one deployment - what you get, how to connect your machines to it, and what is yours to look after.

Roles, permission groups and access — The three layers that decide what each member may do, the groups every organization starts with, and the rules that stop anyone climbing.

The AI Studio sandbox — The workspace behind every Studio project - starting, pausing and restarting it, what happens when it is left unused, and how your files come back.

The DevOps Agent and your code — How the agent deploys repositories you already have, what it asks before acting, and when the code it cloned is deleted.

REST API — The address, how a script signs in, how the organization is chosen, what errors look like, and worked examples with curl.

Prices and billing — The subscription prices, why resource prices are set per region, what is paid ahead and what by the hour, what happens when credit runs out, and how to get an invoice.

When things go wrong — The failures you are most likely to meet, what each one actually means, and what to do.

Command line

Installing the CLI — One command on Linux, macOS or Windows, a checksum on every download, and how to update or remove it.

Command reference — Every command group, what it does, and where each one is explained in full.

Automating applications — Create, configure, deploy and remove applications from a terminal or a script, with every flag explained.

Deploying from CI/CD — Deploy on every push from GitHub Actions or GitLab CI/CD, with a narrow credential and a job that fails when the deployment does.

Repositories, groups and access — Decide who can build from a repository, manage permission groups and read who holds what, from the terminal.

Tutorials

Your first deployment — A repository to a working address, with the mistakes pointed out before you make them.

An application with a database — An API and a managed PostgreSQL, joined by a secret, running as two copies, with a backup you have restored once.

Deploy on every push — From a first deployment by hand to one on every push, from GitHub Actions or GitLab CI/CD, with a credential that cannot do more, and what happens when a release fails.

Policy

Availability and support — What the platform commits to, what it does not, and how to reach a person.

Acceptable use — What you may run, what you may not, and what happens if a line is crossed.

Privacy — What personal data ISOGrid keeps, why, who else sees it, how long it is kept, and how to delete your account.