Wazuh 4.14 Quickstart - Install in Under 10 Minutes

The quickstart procedure installs all Wazuh 4.14 central components (indexer, server, dashboard) on a single host using the assisted installer. This is the fastest path to a working installation for evaluation or testing purposes.

Prerequisites

Hardware requirements

Detailed requirements for various scenarios are described in the installation overview .

Supported operating systems

• Amazon Linux 2, Amazon Linux 2023
• CentOS Stream 10
• Red Hat Enterprise Linux 7, 8, 9, 10
• Ubuntu 16.04, 18.04, 20.04, 22.04, 24.04

A 64-bit operating system is required.

Preconditions

• Root access or sudo privileges
• Internet connectivity for package downloads
• Open ports: 443 (Dashboard), 1514-1515 (agents), 9200 (Indexer), 55000 (API)
• Up-to-date system packages (apt update or yum update)

Installation

Download and run the installer

Download the installation script and execute it with the -a flag (all-in-one):

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

The script automatically performs the following steps:

1. Validates system requirements
2. Generates SSL certificates
3. Installs and configures Wazuh Indexer
4. Installs and configures Wazuh Server (manager + Filebeat)
5. Installs and configures Wazuh Dashboard
6. Initializes the security cluster

The process takes between 5 and 15 minutes depending on internet bandwidth and server performance.

Installation output

Upon completion, the installer displays the access credentials:

INFO: --- Summary ---
INFO: You can access the web interface https://<WAZUH_DASHBOARD_IP>
   User: admin
   Password: <ADMIN_PASSWORD>

Save these credentials as they are required to log in to the web interface.

Accessing the Dashboard

Open a web browser and navigate to:

https://<SERVER_IP_ADDRESS>

Use the credentials from the installer output:

• Username: admin
• Password: password from the installer output

The browser will display a certificate warning because the installer generates self-signed certificates. This is expected behavior.

Retrieving passwords

If the passwords were lost, extract them from the installation archive:

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Enrolling Your First Agent

After installing the central components, deploy agents to the endpoints you want to monitor.

Linux (DEB)

WAZUH_MANAGER="<SERVER_IP_ADDRESS>" apt-get install wazuh-agent
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

The Wazuh repository must be added before installation. The complete procedure is documented in the agent installation section.

Linux (RPM)

WAZUH_MANAGER="<SERVER_IP_ADDRESS>" yum install wazuh-agent
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

Windows

wazuh-agent-4.14.4-1.msi /q WAZUH_MANAGER="<SERVER_IP_ADDRESS>"
NET START WazuhSvc

Download the MSI package from: https://packages.wazuh.com/4.x/windows/wazuh-agent-4.14.4-1.msi

macOS

echo "WAZUH_MANAGER='<SERVER_IP_ADDRESS>'" > /tmp/wazuh_envs && sudo installer -pkg wazuh-agent-4.14.4-1.arm64.pkg -target /
sudo launchctl bootstrap system /Library/LaunchDaemons/com.wazuh.agent.plist

For Intel Macs, use the wazuh-agent-4.14.4-1.intel64.pkg package.

Verifying the Installation

Check component status

systemctl status wazuh-manager
systemctl status wazuh-indexer
systemctl status wazuh-dashboard

Verify indexer availability

curl -k -u admin:<ADMIN_PASSWORD> https://localhost:9200

The expected response contains the cluster name and OpenSearch version.

Verify agent connectivity

curl -k -u admin:<ADMIN_PASSWORD> https://localhost:9200/_cat/nodes?v

Alternatively, query through the Wazuh REST API:

TOKEN=$(curl -sk -u wazuh-wui:<WUI_PASSWORD> \
  -X POST "https://localhost:55000/security/user/authenticate?raw=true")

curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/agents?status=active" | python3 -m json.tool

Post-installation Steps

Disable automatic updates

To maintain stability, disable automatic Wazuh package updates:

Ubuntu/Debian:

sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
apt-get update

CentOS/RHEL:

sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

Change default passwords

The passwords generated by the installer should be changed for production environments. The procedure is described in the dashboard installation section.

Uninstallation

To completely remove an installation performed with the assisted installer:

sudo bash ./wazuh-install.sh -u

The procedure for removing individual components is documented in uninstalling Wazuh .

Next Steps

• Agent installation - deploy agents to monitored endpoints
• Wazuh architecture - understand the platform components
• Wazuh components - detailed description of each component