Learn Wazuh - Pre-Requisites Skill & Setup Environment

#Introduction

Welcome to the Learn Wazuh series! Over the next six episodes we'll break down Wazuh — the open source SIEM and XDR platform favored by many security teams — starting from its history, architecture, installation, and agent deployment, through to monitoring and log analysis.

Episode 0 is pure foundation. It has a single goal: making sure your skills and environment are ready before you start practicing. We won't touch any Wazuh technical material here; we'll just make sure everything is installed and working. The real installation begins in episode 3.

We'll cover three big things: the essential skills you must master, the hardware and software requirements for the lab, and then a step-by-step setup of a ready-to-use lab environment.

#Skills You Must Master

Wazuh is a server-client platform that runs on Linux, so being comfortable with the terminal is a must. Don't worry if you're not fluent yet — throughout this series you'll get plenty of practice.

#Linux CLI and Server Administration

The official Wazuh server runs on distributions such as Ubuntu, Debian, RHEL, and CentOS. Master at least these:

• File navigation and manipulation with cd, ls, cp, mv, and rm.
• Service management with systemctl — this is what you'll use to check the status of all Wazuh components.
• Package installation through apt or dnf and yum.
• Reading logs with journalctl and tail.

#VM and Container Concepts

The safest way to build a Wazuh lab is on virtual machines, not on your main machine. Get familiar with one hypervisor — VirtualBox, KVM, or VMware — including how to create VMs, allocate resources, and take snapshots. Container concepts like Docker are also useful because some Wazuh components offer container options, although this series focuses on native installation.

#Basic Networking

Traffic between agents and the manager flows over the network, so the following fundamentals are essential:

• Ports and protocols: HTTP and HTTPS, UDP and TCP, plus the concept of TLS encryption.
• Firewalls: how to open ports in ufw or firewalld.
• IP addresses, hostnames, and basic DNS.
• SSH for remote access to lab servers.

#Logging and Observability

Wazuh ultimately consumes logs, so first get to know common log formats:

• Syslog and its message structure.
• JSON as a structured data format.
• Basic ELK and OpenSearch concepts: indices, documents, and queries.

#Hardware and Software Requirements

Good news: you don't need an expensive server. One machine that can run several VMs at once is enough.

#Wazuh Server (All-in-One)

An all-in-one installation runs the manager, indexer, and dashboard on a single machine. Minimum requirements:

• CPU: at least 2 cores; the more, the better.
• RAM: 4-8 GB — this runs the three components at once.
• Storage: 50-100 GB for indices and logs.
• OS: Ubuntu Server 22.04 or 24.04 is the smoothest choice for this series.

#Target Agent VM

Prepare at least one additional VM for the agent:

• 1-2 GB RAM and 1-2 CPU cores is plenty.
• Any OS works: Linux, Windows, or macOS. This series uses Linux as its example, but the concepts are the same everywhere.

#Access to the Wazuh Repository

All Wazuh 4.x packages come from the official repo at packages.wazuh.com/4.x. Make sure your server VM can reach the internet, because the installations in episodes 3 and 4 depend entirely on this repo.

#Setting Up the Lab Environment

Before creating VMs, first verify your physical machine's capabilities. Open a terminal on the host and run:

free -h
nproc

Important note: the all-in-one Wazuh needs at least 4 GB of genuinely available RAM. If the free -h output shows far less than that, increase your host's memory or use a cloud lab so you don't fail halfway through the installation.

#Creating the Wazuh Server VM

Now create the first VM, named wazuh-server:

1. Open your hypervisor and create a new VM.
2. Allocate 4-8 GB of RAM and at least 2 CPU cores.
3. Install Ubuntu Server 22.04 or 24.04.
4. Create an administrative user named wazuhadmin.
5. Set the hostname to wazuh-server.

Once the installation is complete, update the system and check connectivity to the official repo:

sudo apt update
sudo apt upgrade -y
curl -I https://packages.wazuh.com/4.x

Point your browser to https://packages.wazuh.com/4.x if curl isn't installed — what matters is that the official repo is reachable from the server VM. An HTTP 200 result means you're ready to move on to episode 3.

#Creating the Target Agent VM

Repeat the same steps for a second VM named wazuh-agent:

1. Allocate 1-2 GB of RAM and 1 CPU core.
2. Install the OS of your choice — this series uses Ubuntu Server as its example.
3. Make sure the two VMs can reach each other's IPs; a single NAT or bridged network is enough.

Note the server's IP: you'll use it again and again for agent enrollment in episode 4. The ip a or hostname -I commands show each VM's IP address.

#Verification Checklist

Before closing out episode 0, make sure everything is green:

• free -h shows enough RAM for the all-in-one server.
• The wazuh-server VM has Ubuntu 22.04 or 24.04 installed.
• The wazuh-agent VM is ready to have an OS installed.
• The packages.wazuh.com/4.x repo is reachable from the server VM.
• SSH is active on both VMs for remote access.

If all of that is done, your lab is officially ready.

#Conclusion

Episode 0 is complete. Key takeaways:

• Master the Linux CLI, service administration, and basic networking.
• Understand VM and container concepts, plus common log formats like syslog and JSON.
• Prepare an all-in-one Wazuh server with 4-8 GB of RAM and at least 2 cores.
• Prepare at least one target VM for the agent.
• Verify access to the official packages.wazuh.com/4.x repo.

Next, in episode 1 we answer the most fundamental question before installing anything: why Wazuh exists, its history from OSSEC, and what security problems it solves. See you there!