Wazuh SIEM: Open Source Threat Detection Deployment

The PagerDuty pager went off 300 times between 02:00 and 06:00 on a Saturday. The on-call sysadmin — a good one, two months into the job — muted the channel at 03:40 and went back to sleep. Nobody blamed him. The root cause was a default Wazuh install forwarding every level-7 alert to PagerDuty, with no suppression, no tuning, and no ISM policy. That deployment was ripped out six weeks later and the org bought a commercial SIEM they couldn't afford. The tool wasn't the problem. The deployment was.

This guide is for infrastructure and security engineers who are deploying Wazuh for real — not labbing it. By the end you'll know how to size it honestly, deploy it with TLS from day one, tune rules so you don't drown, wire up the integrations that pay for themselves, and keep it running past the 18-month mark when most open source SIEM installs quietly rot.

:::note[TL;DR]

• Wazuh is a real SIEM + HIDS + compliance stack, but only if you separate the indexer from the manager past ~50 agents — the all-in-one installer is a lab toy.
• Set ISM retention on the indexer before you ingest a single alert. Default is forever; you will fill a disk.
• Custom rules go in the 100000+ ID range, always. Never edit stock rules in place.
• Don't forward everything to PagerDuty. Level ≥ 10 only, and only after a week of tuning.
• The tuning tax is real: budget 2-4 hours a week for the first quarter, then ~1 hour a week ongoing. :::

Prerequisites

• Two or more Linux hosts (Ubuntu 22.04 LTS or RHEL/Rocky 9 are safe bets) with root or sudo
• Minimum 8 vCPU / 16 GB RAM / 200 GB SSD for a lab; see sizing section for prod
• A DNS name or IP plan for manager, indexer, dashboard, and agents
• Open ports per the table below (firewall both sides)
• Basic familiarity with systemctl, openssl, and reading XML without crying

Why Wazuh Exists (And Why You Should Care)

Most orgs can't afford Splunk at scale. Elastic's move to SSPL in 2021 burned a lot of people who'd built on the ELK stack. Wazuh is the FOSS answer that actually ships, and it bundles three things you'd otherwise buy separately: host-based intrusion detection (file integrity, rootkit, log analysis), SIEM correlation, and compliance evidence collection. The common failure mode is people install it, forget to tune it, and drown in 40k alerts a day.

The OSSIM Problem and the Agent-Based Advantage

OSSIM (AlienVault's open source SIEM) died a slow death after AT&T acquired AlienVault, and its agentless, network-scanning model was already losing to agent-based telemetry for endpoint detection. Agents see file changes, process executions, and registry modifications that a network tap never will. Wazuh's architecture reflects this: an agent on each endpoint forwards events to a manager that evaluates rules and correlates, which writes to an indexer (OpenSearch fork) that the dashboard queries.

⚠️ TRUNCATED VERSION
This is an abbreviated cross-post. Full article (all config files, architecture diagrams, images): valtersit.com

🛠️ Partner Tools for Developers

ValtersIT curates partner deals for developers and sysadmins — VPS hosting, security tools, monitoring platforms and dev productivity gear. No filler, no affiliate spam.

➜ valtersit.com/deals/