Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	4.14.9	$0.05/hr Recommended instance: m6i.xlarge · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	4.14.8	$0.028/vCPU/hr Recommended VM: Standard_D4s_v3	2026-10-11	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	GPL-2.0-only
Upstream	Wazuh, Inc.
Machine-readable	product.json · catalog.json

What is Wazuh

Wazuh is a free, open source security platform that unifies SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) capabilities. This image runs the complete all-in-one stack on one host: the Wazuh manager (the GPLv2 analysis engine), the Wazuh indexer (an Apache-2.0 OpenSearch fork that stores and searches events), the Wazuh dashboard (an Apache-2.0 OpenSearch-Dashboards fork), and Filebeat. It performs log data analysis, intrusion and threat detection, file integrity monitoring (FIM), vulnerability detection, configuration assessment, active response, and MITRE ATT&CK mapping, with out-of-the-box regulatory compliance reporting for PCI DSS, HIPAA, NIST 800-53, and GDPR. Lightweight agents for Linux, Windows, and macOS enroll over TCP 1515/1514 and stream security telemetry to the manager. The indexer and dashboard are OpenSearch forks under Apache-2.0 - not Elastic SSPL - so the full platform is auditable with no vendor lock-in and no per-agent SaaS fees.

What the Lynxroute image adds

Security hardening:

The dashboard admin login password is generated uniquely at first boot (no admin/admin default)
All backing-store credentials - indexer service account, manager REST API users, and Filebeat - are rotated per-instance at first boot and written to /root/wazuh-credentials.txt (mode 0600)
The Wazuh indexer (OpenSearch) is bound to 127.0.0.1:9200 only - never exposed off-host
The dashboard listens on 127.0.0.1:5601 and is reachable only through a TLS-terminating nginx on port 443, with a loading splash + readiness gate during startup
UFW firewall pre-configured: only TCP 22, 443, 1514, 1515, and 55000 are open
fail2ban, auditd, and AppArmor pre-configured
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/wazuh-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-2ypwk2tyq7yfu/latest \
  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer wazuh --plan payg-gen2
az vm create -g my-rg -n wazuh --size Standard_D4s_v3 \
  --image lynxroute:wazuh:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Wazuh 4.14.9

AWS · 2026-10-23

Wazuh manager, indexer and dashboard updated 4.14.8 -> 4.14.9, a bugfix and hardening release. GPL-2.0 unchanged
Security hardening: binaries built with PIE, full RELRO and FORTIFY_SOURCE; fixes pre-authentication connection exhaustion in cluster and authd, an OS_StrBreak overflow, API access-log injection and wodle token leaks
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build