Wazuh 4.14 Installation - Deployment Guide
This section covers the installation of all Wazuh 4.14 components: the indexer, server, dashboard, and agents. Before proceeding with installation, you need to select a deployment model and verify that the target systems meet the minimum hardware requirements.
Deployment Models
Wazuh supports two deployment models for its central components:
All-in-one (single host)
All three central components - Wazuh Indexer, Wazuh Server, and Wazuh Dashboard - are installed on a single host. This model is suitable for:
- Test and lab environments
- Small infrastructures (up to 50 agents)
- Quick evaluation of the platform (see quickstart )
Distributed deployment
Components are installed on separate hosts with clustering support. This model provides:
- Horizontal scaling of each component
- Fault tolerance when individual nodes fail
- Workload distribution across hosts
- Support for thousands of agents
The installation order for a distributed deployment is strictly defined:
- Wazuh Indexer - data storage based on OpenSearch
- Wazuh Server - management and event processing server
- Wazuh Dashboard - web management interface
- Wazuh Agent - endpoint agents
Supported Operating Systems
Central components (Indexer, Server, Dashboard)
| Operating System | Versions | Architecture |
|---|---|---|
| Amazon Linux | 2, 2023 | x86_64 |
| CentOS Stream | 10 | x86_64 |
| Red Hat Enterprise Linux | 7, 8, 9, 10 | x86_64 |
| Ubuntu | 16.04, 18.04, 20.04, 22.04, 24.04 | x86_64 |
Wazuh Agent
| Operating System | Versions | Architecture |
|---|---|---|
| Amazon Linux | 2, 2023 | x86_64 |
| CentOS / RHEL | 7, 8, 9, 10 | x86_64 |
| Ubuntu | 16.04, 18.04, 20.04, 22.04, 24.04 | x86_64 |
| Debian | 9, 10, 11, 12 | x86_64 |
| Windows | 10, 11, Server 2016-2025 | x86_64 |
| macOS | 11+ (Big Sur and later) | Intel, Apple Silicon |
| Solaris | 10, 11 | SPARC, x86_64 |
| AIX | 6.1, 7.x | PowerPC |
| HP-UX | 11.31 | Itanium |
Hardware Requirements
Minimum requirements per component
| Component | CPU (cores) | RAM (GB) | Disk (GB) | Notes |
|---|---|---|---|---|
| Wazuh Indexer | 2 (min) / 8 (rec) | 4 (min) / 16 (rec) | 50+ | Disk depends on agent count and retention period |
| Wazuh Server | 2 (min) / 8 (rec) | 2 (min) / 8 (rec) | 20+ | Increases with Vulnerability Detector enabled |
| Wazuh Dashboard | 2 (min) / 4 (rec) | 2 (min) / 8 (rec) | 20 | Minimal disk requirements |
All-in-one requirements (all components on a single host)
| Scenario | CPU (cores) | RAM (GB) | Disk (GB) |
|---|---|---|---|
| Up to 25 agents, 90-day retention | 4 | 8 | 50 |
| Up to 100 agents, 90-day retention | 8 | 8 | 200 |
Indexer storage estimation
Wazuh Indexer storage requirements depend on the type of monitored endpoints:
| Agent type | Data per 90 days (GB) |
|---|---|
| Server (Linux/Windows) | 3.7 |
| Workstation | 7.4 |
| Network device | 1.5 |
Formula: Total storage = Number of agents * Data per period * Replica factor
Network Ports
The following ports must be open for proper component communication:
| Port | Protocol | Component | Purpose |
|---|---|---|---|
| 1514 | TCP | Wazuh Server | Agent data reception |
| 1515 | TCP | Wazuh Server | Agent enrollment |
| 1516 | TCP | Wazuh Server | Server cluster communication |
| 55000 | TCP | Wazuh Server | REST API |
| 9200 | TCP | Wazuh Indexer | REST API (HTTPS) |
| 9300-9400 | TCP | Wazuh Indexer | Cluster inter-node communication |
| 443 | TCP | Wazuh Dashboard | Web interface (HTTPS) |
Installation Sections
- Quickstart - install all components with a single command for quick evaluation
- Wazuh Indexer Installation - step-by-step indexer installation for distributed deployments
- Wazuh Server Installation - step-by-step management server installation
- Wazuh Dashboard Installation - step-by-step web interface installation
- Wazuh Agent Installation - agent deployment on Linux, Windows, and macOS
- Uninstalling Wazuh - proper removal of platform components