Work through the lessons in order. Each one builds on the last, ends with the errors you are most likely to meet, and links to the exact page of the official documentation for the detail this tutorial does not repeat.
Wazuh for Beginners
Thirteen lessons that take you from an empty server to agents reporting, findings you can read, and the confidence to fix the first things that break. Written and tested on Wazuh 5, with notes for anyone still running 4.x.
- 01What Is Wazuh? Architecture ExplainedA practitioner's explanation of the Wazuh agent, manager, indexer and dashboard, the ports between them, and how a log line becomes a finding.10 min read
- 02Wazuh vs Splunk, Elastic, Security Onion and OSSECAn honest comparison of Wazuh against Splunk, Elastic Security, Security Onion and OSSEC, including the cases where Wazuh is the wrong answer.9 min read
- 03Wazuh System Requirements and SizingSupported operating systems, CPU and RAM per component, and the disk arithmetic that tells you how big a Wazuh deployment really needs to be.9 min read
- 04Install Wazuh on Ubuntu Step by StepInstall the Wazuh central components on Ubuntu with the assistant, find your credentials, and finish the post-install work most guides skip.9 min read
- 05Wazuh Docker DeploymentRun the Wazuh single-node stack on Docker: certificates, compose, the kernel setting everyone misses, and what to fix before agents connect.12 min read
- 06Install the Wazuh Agent on LinuxAdd the repository, install the agent with the manager address and enrolment password, put it in a group, verify it and remove it cleanly.9 min read
- 07Install the Wazuh Agent on WindowsOne MSI, one silent command line, and a group policy or Intune pattern that survives a thousand endpoints. Plus what the beta docs get wrong.15 min read
- 08Wazuh Agent Enrolment ExplainedWhat the 5.0 handshake actually does on port 1517, the two ways to enrol, why groups must exist first, and how clock skew breaks it.12 min read
- 09Wazuh Dashboard Tour: Reading Your First FindingsHow the 5.0 dashboard is laid out, the difference between events, findings and states, and why the data you are looking for may already be deleted.12 min read
- 10Wazuh Rules, Decoders and Severity Levels ExplainedHow a raw log becomes a finding in Wazuh 5.0: YAML decoders on the manager, Sigma rules on the indexer, severity strings, spaces and integrations.12 min read
- 11Wazuh File Integrity Monitoring SetupConfigure Wazuh FIM on Linux and Windows: watch a directory, add real-time and who-data, monitor the registry, and read the results in the dashboard.12 min read
- 12Wazuh Vulnerability Detection SetupTurn on the Wazuh Vulnerability Scanner, confirm the CTI feed and Syscollector inventory, read the inventory, and work through the not-working checklist.12 min read
- 13Wazuh Agent Disconnected or Never Connected: Fix ItA decision tree for a Wazuh agent stuck disconnected, pending or never connected: state file, logs, port 1517, TLS, password, group, clock skew, duplicates.18 min read