Learn Wazuh - History, Background & Why You Need It

#Introduction

In episode 0, you set up the lab: a Wazuh server VM with Ubuntu, a target VM for the agent, and access to the official repo. Now it's time to understand why Wazuh exists and where it sits in the modern security landscape.

This episode covers Wazuh's history from its birth as OSSEC HIDS, its evolution up to Wazuh 5.0, and the real-world problems it solves. Without this background, you'll struggle to place Wazuh among the abundance of other security tools.

We'll trace a fairly interesting journey: from a small open source tool, to an Elastic Stack plugin, then to a standalone platform with its own indexer and engine.

#The Beginning: OSSEC HIDS

Wazuh's story begins in 2004, when Daniel Cid released OSSEC HIDS — a host-based intrusion detection system focused on one thing: detecting suspicious activity inside servers.

OSSEC introduced concepts that were quite advanced for its time:

• Real-time log analysis to detect attacks from logs.
• File integrity monitoring, usually shortened to FIM, to detect changes to important files.
• Rootkit detection and active response.
• Alerting based on rules that could be customized.

For over a decade, OSSEC was the world's leading open source endpoint security choice. But its foundation was built in a different era, and industry needs kept evolving beyond what OSSEC was designed for.

#The Birth of Wazuh

In 2015-2016, a need emerged for a broader platform. Wazuh was born as an extended fork of OSSEC — taking OSSEC's detection engine and adding new capabilities such as vulnerability detection, regulatory compliance, and cloud integration.

The most fundamental difference at the time: OSSEC was a pure HIDS, while Wazuh was designed as a more comprehensive platform — combining detection, visibility, and compliance in a single package.

#Becoming Part of the Elastic Stack

The big leap came in 2018-2019 when Wazuh joined the Elastic Stack as an official plugin. With this integration, data from Wazuh agents flowed into Elasticsearch and was displayed in Kibana.

This was a paradigm shift: previously alerts were shown through a simple interface, but now you could search, aggregate, and visualize security data in the same dashboard as application logs. Wazuh gained Elasticsearch's large-scale search power, and the Elastic Stack gained quality security data from Wazuh.

#Standing Alone Since Wazuh 4.0

The relationship with the Elastic Stack didn't last forever. Since 2020, with the release of Wazuh 4.0, Wazuh became standalone with three main components:

• Wazuh Indexer — an OpenSearch fork for data storage and search.
• Wazuh Dashboard — the web interface replacing Kibana.
• Wazuh Manager — the central server for analysis and rules.

This separation gave Wazuh full control over the entire stack, with no dependency on Elastic's roadmap. Since then, versioning and releases have been fully independent.

#A Quick Timeline at a Glance

To make it easy to remember, here's a summary of Wazuh's version journey:

• 2004 — Daniel Cid releases OSSEC HIDS, the forerunner of the detection engine.
• 2015-2016 — Wazuh is born as an extended fork of OSSEC.
• 2018-2019 — Wazuh becomes an official Elastic Stack plugin.
• 2020 — Wazuh 4.0 goes standalone with its own indexer and dashboard.
• 2025-2026 — Wazuh 5.0 arrives in beta with the new Wazuh Engine.

A clear pattern emerges: every major leap happens when industry needs outgrow the old design. From a simple HIDS, Wazuh grew into an independent XDR and SIEM platform.

#Toward Wazuh 5.0

At the time of writing, Wazuh 5.0 is still in beta for the 2025-2026 period. This major release brings a new architecture with the Wazuh Engine — an analysis engine that replaces parts of the old detection pipeline.

The main changes to look forward to:

• A new modular engine that processes events faster.
• A redesigned rules pipeline with a more flexible schema.
• Improved multi-tenant support and scalability.

For this series we stick with the stable Wazuh 4.x. The concepts you learn — agent, manager, indexer, dashboard — still apply in 5.0; only the implementation differs.

#Getting to Know the Version in the Lab

To avoid confusion in episode 3, first learn how to check package versions. After installation later, you can run the following command on the server:

apt-cache policy wazuh-manager wazuh-indexer wazuh-dashboard

The output above shows the available and installed versions for the three components. Make sure all three share the same major version — for example, all 4.9.x — because the manager, indexer, and dashboard depend on each other. Consistent versions will save you from inter-component connection failures. apt-cache policy is also useful in episode 4 when checking agent package availability.

#The Problems Wazuh Solves

Why do organizations need Wazuh? Let's look at the concrete problems it solves.

#Lack of Endpoint Security Visibility

Most modern attacks happen at the endpoint level: servers, workstations, and containers. Without an agent monitoring every endpoint, security teams are blind to suspicious activity. Wazuh answers this with agents that collect logs, monitor file integrity, and detect weaknesses.

#Expensive Commercial SIEMs

Large SIEMs like Splunk or IBM QRadar require licensing costs that many organizations can't afford, especially startups and SMBs. Wazuh offers similar functionality open source: log collection, correlation, alerting, and dashboards. The cost shifts from licensing to operational server costs.

#Proactive Intruder Detection

Wazuh performs real-time log analysis with thousands of built-in rules that detect attack patterns: brute force, privilege escalation, exploit usage, and more. Combined with active response, threats can be blocked automatically.

#FIM and Vulnerability Scanning

Two of Wazuh's flagship modules:

• FIM detects changes to important files in real time — a common indicator of compromise.
• Vulnerability detector compares installed software against the CVE database, making missing patches clearly visible.

#Compliance and Regulatory

Wazuh provides compliance modules for frameworks such as GDPR, NIST, HIPAA, and PCI DSS. It collects compliance evidence and produces periodic auditable reports — features typically found only in expensive enterprise products.

#Conclusion

In this episode you've understood Wazuh's journey: from OSSEC HIDS in 2004, becoming an extended fork in 2015-2016, joining the Elastic Stack, then going standalone since 4.0 and preparing for 5.0.

Key takeaways:

• Wazuh evolved from OSSEC HIDS (2004) into a comprehensive security platform.
• The Elastic Stack integration (2018-2019) brought large-scale search capabilities.
• Since Wazuh 4.0 (2020), it stands alone with its own indexer and dashboard.
• Wazuh 5.0 is in beta with the new Wazuh Engine.
• It solves visibility, SIEM cost, intruder detection, FIM, and compliance problems.

Next, in episode 2 we get to the most important part: Wazuh's core concepts and main architecture — the differences between SIEM, EDR, and XDR, its components, and the data flow from agent to dashboard. See you there!