Learn Wazuh - Core Concepts & Main Architecture

#Introduction

In episode 1, you understood Wazuh's history — from OSSEC HIDS to an independent platform since 4.0. Now we get to the technical core: how Wazuh works architecturally.

This episode dissects the fundamental concepts you must understand before installing anything. We'll cover the differences between SIEM, EDR, and XDR, where Wazuh stands among them, then the five main components and the data flow from endpoint to dashboard.

Really internalize this material, because every subsequent episode — installation, agent deployment, and log analysis — will always refer back to this architecture.

#SIEM vs EDR vs XDR

These three terms are often mixed up. Let's break them down one by one.

#SIEM: Collecting and Correlating Logs

SIEM, or Security Information and Event Management, is a category of tool that collects logs from across the infrastructure — servers, firewalls, applications — then normalizes them, correlates across sources, and produces alerts. A SIEM answers the big question: what's happening across my entire environment.

The strength of a SIEM lies in aggregation and correlation. It typically doesn't place sensors on every endpoint; it relies on logs being sent to a central point.

#EDR: Focus on the Endpoint

EDR, or Endpoint Detection and Response, works deeper at the endpoint level: an agent is installed on every machine, continuously monitoring processes, files, the registry, and system behavior. An EDR answers the question: what is this suspicious process doing on this machine?

The strength of EDR is rich forensic detail — it reaches deeper than logs alone.

#XDR: Bringing Everything Together

XDR, or Extended Detection and Response, is the evolution of EDR that expands the scope: not just endpoints, but also network, email, cloud, and identity — with cross-layer correlation.

You could say XDR is EDR widened, and SIEM is the comprehensive data collector. They complement each other rather than replace each other.

#Where Does Wazuh Stand?

Wazuh positions itself as a unified open source XDR and SIEM. It has signature EDR capabilities through agents with FIM, vulnerability detection, and endpoint security monitoring. It also has SIEM capabilities through centralized log collection and correlation. Combining both in one platform makes Wazuh attractive to organizations that don't want to buy three products at once.

#Five Main Components of Wazuh

The Wazuh 4.x architecture consists of five components working together.

#Wazuh Manager

The central server that receives data from agents, runs decoding and rules, then produces alerts. The manager also handles clustering and active response. In an all-in-one installation, it runs on your server VM.

#Wazuh Indexer

OpenSearch-based data storage. All alerts and events processed by the manager go into the indexer and can be searched quickly. This replaced Elasticsearch since Wazuh 4.0.

#Wazuh Dashboard

The web interface that reads data from the indexer. Here you view alerts, create visualizations, and manage policies. The dashboard is the face of Wazuh you see every day.

#Wazuh Agent

A lightweight program installed on every monitored endpoint. Agents collect logs, monitor file integrity, and send everything to the manager over an encrypted connection.

#RESTful API

An API on the manager and indexer components that enables management and automation. Tools like the dashboard use it, and you can write your own scripts for bulk operations.

#Data Flow

Now let's follow one event from end to end. Here's a summary of the flow:

agent -> manager -> decoder and rules -> alert -> indexer -> dashboard

Step-by-step explanation:

1. The agent captures activity on the endpoint, for example repeated failed logins.
2. Data is sent to the manager over an encrypted TLS connection. The default protocol is UDP port 1514 for data and TCP port 1515 for enrollment.
3. The manager runs a decoder to normalize the log, then matches it against rules. If it matches, it produces an alert.
4. The alert and raw data are stored in the indexer as OpenSearch documents.
5. The dashboard reads the indices and displays everything in a searchable interface.

The speed of this entire pipeline matters. In Wazuh 5.0, the decoder and rules process is replaced by the more modular Wazuh Engine, but the same overall flow remains.

#Port Map of the Architecture

Each component talks on a specific port. Knowing this map makes it easier to read logs and open firewall rules later:

• 1514 UDP and TCP — data connections from agents to the manager.
• 1515 TCP — agent enrollment to the manager.
• 9200 — the indexer, where data is stored and searched.
• 443 — the dashboard, the web interface you access.
• 55000 — the manager's RESTful API.

You'll use this port map in episode 3 when verifying the installation and in episode 4 when deploying agents. If a connection fails, the first step is always to check the relevant port.

#Verifying the Architecture in the Lab

After the installation in episode 3, you can verify that all five components are running by checking their main services:

sudo systemctl status wazuh-manager
sudo systemctl status wazuh-indexer
sudo systemctl status wazuh-dashboard

Run them one at a time so the output doesn't get mixed up. All three must show active (running) before you continue. The agent is only installed in episode 4, so you don't need to look for that component yet. If any service fails, use journalctl -u wazuh-manager to read the cause from its logs.

#Conclusion

In this episode you've understood the Wazuh architecture map: the roles of SIEM, EDR, and XDR, Wazuh's position as a unified platform, and the five components working as one unit.

Key takeaways:

• SIEM collects logs, EDR goes deep into endpoints, XDR unifies both.
• Wazuh is a unified open source XDR and SIEM.
• Manager, indexer, dashboard, agent, and API are the five main components.
• Data flows from agent to manager, then to indexer, then to dashboard.
• Wazuh 5.0 replaces the decoder and rules pipeline with the Wazuh Engine.

Next, in episode 3 we get our hands dirty: all-in-one Wazuh installation with wazuh-install.sh, service verification, and the first dashboard login. See you there!