The Wazuh installation assistant is genuinely good. It gets a working Manager, Indexer and Dashboard onto a fresh Linux host in a few minutes.
The hard part is everything around it: sizing the thing, knowing which ports have to be open, and recognising the failures that look like a broken install but are not.
I wrote a step by step guide for the people who inherit a Wazuh deployment and have an afternoon to make it work.
What the guide covers
- Complete installation walkthrough using the assistant
- System requirements, and where the defaults are too small
- Troubleshooting for the failures that come up most
The failures worth knowing about
Resources. An all in one deployment on a small VM will install cleanly and then fall over under log volume. Wazuh is a search engine wearing a SIEM costume. Give the indexer memory.
Ports. The dashboard on 443, agent communication on 1514 and 1515, the API on 55000. A firewall that allows the first and blocks the rest produces an install that looks healthy and never receives an event.
Time. Certificates and log correlation both care about clock skew. Configure NTP before you start, not after you spend an evening on TLS errors.
Certificates. The assistant generates self signed certificates for internal communication. These are not the same certificates you put in front of the dashboard for users. Mixing them up is a common first day.
Read it
The full walkthrough: Wazuh installation guide using the installation assistant
If you are standing up Wazuh for the first time, install it on a lab host first. Break it. Then do it again on the real one.