{
 "slug": "wazuh",
 "name": "Wazuh",
 "tagline": "SIEM, XDR and security monitoring platform, all-in-one",
 "category": "security-identity",
 "use_cases": [
  "siem",
  "xdr",
  "intrusion-detection"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Wazuh, Inc.",
  "url": "https://wazuh.com",
  "license": "GPL-2.0-only",
  "license_url": "https://github.com/wazuh/wazuh/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443,
   1514,
   1515,
   55000
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "4.14.9",
   "last_build": "2026-10-23",
   "entity_id": "prod-2ypwk2tyq7yfu",
   "ami_alias": "/aws/service/marketplace/prod-2ypwk2tyq7yfu/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-wdampsdujb2yc",
   "recommended_instance_type": "m6i.xlarge",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "4.14.8",
   "last_build": "2026-10-11",
   "offer_id": "wazuh",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:wazuh:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.wazuh?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/wazuh/",
  "json": "https://lynxroute.com/products/wazuh/product.json"
 },
 "release_notes": [
  {
   "version": "4.14.9",
   "title": "Wazuh 4.14.9",
   "notes": "* Wazuh manager, indexer and dashboard updated 4.14.8 -> 4.14.9, a bugfix and hardening release. GPL-2.0 unchanged\n* Security hardening: binaries built with PIE, full RELRO and FORTIFY_SOURCE; fixes pre-authentication connection exhaustion in cluster and authd, an OS_StrBreak overflow, API access-log injection and wodle token leaks\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "4.14.8",
   "title": "Wazuh v4.14.8",
   "notes": "* Same Wazuh 4.14.8, rebuilt with first-boot reliability and security fixes. GPL-2.0 unchanged\n* Vulnerability Detection and IT Hygiene (inventory) now populate from first boot on every instance size. Previously a slow first start could leave them empty until the first reboot\n* Agent enrollment is now password-protected: a per-instance enrollment password is generated at first boot and listed, with a copy-paste agent install command, in /root/wazuh-credentials.txt\n* Fresh dashboards start empty: no build-time alerts or host inventory ship in the image\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-08",
    "azure": "2026-10-11"
   }
  },
  {
   "version": "4.14.8",
   "title": "Wazuh 4.14.8",
   "notes": "* Wazuh updated 4.14.7 -> 4.14.8, an upstream security-hardening and bugfix release. GPL-2.0 unchanged\n* Manager API: login attempt limits now hold under concurrent requests, empty passwords are rejected on user update, and run_as tokens are invalidated on logout or role revocation\n* Manager hardening: path validation for rule, decoder and CDB list files, and the remote_commands restriction can no longer be bypassed with mixed-case XML element names\n* Fixes an analysisd deadlock that stopped alert generation when the Active Response queue filled up, and AES agent connections falling back to Blowfish after a keystore rebuild\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-08",
    "azure": "2026-10-11"
   }
  },
  {
   "version": "4.14.7",
   "title": "Wazuh v4.14.7",
   "notes": "* Updated to Wazuh 4.14.7 - upstream security-hardening and bugfix release\n* Manager: the deprecated wazuh-dbd daemon and its database_output configuration are removed\n* Cluster hardening: improved payload buffer allocation, tighter archive decompression limits, and stricter worker file-path validation\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23",
    "azure": "2026-08-21"
   }
  },
  {
   "version": "4.14.6",
   "title": "Wazuh v4.14.6",
   "notes": "* Updated to Wazuh 4.14.6 - upstream security-hardening and bugfix release\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-20",
    "azure": "2026-07-13"
   }
  },
  {
   "version": "4.14.5",
   "title": "Wazuh 4.14.5 - Initial release (June 2026)",
   "notes": "* Wazuh 4.14.5 all-in-one (manager + indexer + dashboard + Filebeat) on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Dashboard admin password + all backing-store credentials (indexer, REST API, Filebeat) rotated at first boot\n* OpenSearch indexer bound to 127.0.0.1 only; dashboard fronted by TLS nginx with a startup readiness gate\n* UFW firewall pre-configured (ports 22, 443, 1514, 1515, 55000 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-06-30"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.14.9",
   "aws": "2026-10-23"
  },
  {
   "version": "4.14.8",
   "aws": "2026-10-08",
   "azure": "2026-10-11"
  },
  {
   "version": "4.14.7",
   "aws": "2026-08-23",
   "azure": "2026-08-21"
  },
  {
   "version": "4.14.6",
   "aws": "2026-07-20",
   "azure": "2026-07-13"
  },
  {
   "version": "4.14.5",
   "aws": "2026-07-01",
   "azure": "2026-06-30"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-2ypwk2tyq7yfu/latest \\\n  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer wazuh --plan payg-gen2\naz vm create -g my-rg -n wazuh --size Standard_D4s_v3 \\\n  --image lynxroute:wazuh:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Wazuh is a free, open source security platform that unifies SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) capabilities. This image runs the complete all-in-one stack on one host: the Wazuh manager (the GPLv2 analysis engine), the Wazuh indexer (an Apache-2.0 OpenSearch fork that stores and searches events), the Wazuh dashboard (an Apache-2.0 OpenSearch-Dashboards fork), and Filebeat. It performs log data analysis, intrusion and threat detection, file integrity monitoring (FIM), vulnerability detection, configuration assessment, active response, and MITRE ATT&CK mapping, with out-of-the-box regulatory compliance reporting for PCI DSS, HIPAA, NIST 800-53, and GDPR. Lightweight agents for Linux, Windows, and macOS enroll over TCP 1515/1514 and stream security telemetry to the manager. The indexer and dashboard are OpenSearch forks under Apache-2.0 - not Elastic SSPL - so the full platform is auditable with no vendor lock-in and no per-agent SaaS fees.",
  "image_adds": "Security hardening:\n* The dashboard admin login password is generated uniquely at first boot (no admin/admin default)\n* All backing-store credentials - indexer service account, manager REST API users, and Filebeat - are rotated per-instance at first boot and written to /root/wazuh-credentials.txt (mode 0600)\n* The Wazuh indexer (OpenSearch) is bound to 127.0.0.1:9200 only - never exposed off-host\n* The dashboard listens on 127.0.0.1:5601 and is reachable only through a TLS-terminating nginx on port 443, with a loading splash + readiness gate during startup\n* UFW firewall pre-configured: only TCP 22, 443, 1514, 1515, and 55000 are open\n* fail2ban, auditd, and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}