Wazuh

Wazuh is a free and open source security platform that provides unified XDR and SIEM protection for endpoints and cloud workloads: threat prevention, detection, and response.

This Cloudron package bundles the complete Wazuh stack in a single app:

• Wazuh manager — collects and analyzes events from deployed agents, runs detection rules, file integrity monitoring, vulnerability detection, and compliance checks.
• Wazuh indexer — a search and analytics engine (OpenSearch fork) that stores alerts and events.
• Wazuh dashboard — the web UI for visualizing alerts, managing agents, and compliance reporting.

First login

After installation, open the app. Log in to the dashboard with:

• Username: admin
• Password: the generated INDEXER_ADMIN_PASSWORD (see the file manager at /app/data/secrets.env)

Change the password after first login with the helper in the app's web terminal: /app/pkg/change-admin-password.sh '<new-password>' (the reserved admin user cannot be changed from the dashboard UI).

Enrolling agents

Enable the Agent events (TCP 1514) and Agent enrollment (TCP 1515) ports in the app's access control settings. Enrollment requires the generated AGENT_ENROLLMENT_PASSWORD (see /app/data/secrets.env). Example for a Linux server:

WAZUH_MANAGER="wazuh.example.com" WAZUH_MANAGER_PORT="1514" \
WAZUH_REGISTRATION_PASSWORD="<AGENT_ENROLLMENT_PASSWORD>" \
  apt install wazuh-agent

Agents enroll automatically; registered agents appear in the dashboard under Endpoints summary.

Notes

• The optional Wazuh API port (TCP 55000, HTTPS) exposes the Wazuh server API for scripting. It uses a self-signed certificate and the wazuh-wui user (password also in /app/data/secrets.env).
• All internal components communicate over an internal PKI generated at first boot and stored in /app/data/certs.
• The stack needs a generous memory limit — 4 GB is recommended (the indexer heap is sized to half the app's memory limit).