The security overview after a throwaway agent raised real alerts — one active endpoint and the 24-hour severity tally it generated.
Threat Hunting over the agent's own events: 550 real alerts, 79 auth failures, and the MITRE ATT&CK breakdown of the SSH brute-force.
The raw event stream — sshd brute-force (rule 5712, level 10), failed PAM logins and a file-integrity change (rule 550) on the endpoint.
Wazuh
wazuh.comshc install wazuh
Run this on your own machine — store install isn’t on yet.Copy
A SIEM you run yourself, watching the estate you already own
Threat detection, file-integrity monitoring, log analysis and compliance reporting across your fleet — manager, indexer and dashboard installed and wired together as one stack.
What the SHC package gives you
3tiers, one install
Three tiers, one install
The manager agents report to, the indexer that stores and searches the events
Alerts route by severity, not by volume
Wazuh grades events from 0 to 15
You
Your IdP
This app
The one manual identity step is printed
Administrative access maps a realm role through to the indexer's all-access role
The search index is snapshotted before the
A pre-backup job fixes the queue permissions and takes a proper indexer snapshot
You
Your IdP
This app
The auto-redirect warning is on the label
Making the identity provider the only login removes the dashboard's password form outright
What this installs
Wazuh release this package tracks4.14.7
Manager, indexer and dashboard3
Alert severity levels it grades on0–15
Wazuh is a free and open source SIEM/XDR platform for threat detection, integrity monitoring, incident response, and compliance.
4.14
VersionSecurity
CategoryCompose · Swarm · Podman
RuntimesFlagship
PackagingRatings & reviews
No reviews yetBe the first to say how this runs on your estate.
Write a reviewTags
security
intrusion-detection
ids
monitoring