Learn Wazuh - Modern Features & Roadmap

#Introduction

In episode 20 we made sure Wazuh is healthy and ready for recovery. Now we look at the direction of travel: where Wazuh is heading and what you should prepare. In episode 21 we discuss the latest stable version, the new architecture being built, and the industry trends shaping its development.

Wazuh keeps releasing on two tracks at once. The 4.14 track is the stable version safe for production, with cumulative fixes arriving regularly. The 5.0 track is a big leap: a rewritten analysis engine, a new indexer architecture, and a redesigned API, currently still in beta. Understanding both tracks is important so you neither fall behind nor rush ahead.

We start with what you can use today, then dissect what changes in the future, and finish with how to prepare the transition without sacrificing production stability.

#Stable Release: Version 4.14.7

Wazuh 4.14.7 was released in late July 2026 and is the latest stable release on the 4.x track. Every release in the 4.14 series is cumulative, meaning all fixes and improvements from previous releases are already included. That's why upgrading to the latest version is always recommended: a single step brings all the latest fixes.

Some notable fixes in 4.14.7 include removing the deprecated wazuh-dbd daemon, updating Python dependencies like aiohttp and cryptography to close security gaps, and sanitizing markdown input in the dashboard to prevent issues in the display component. Small SCA fixes for several operating systems are also included.

The fastest way to confirm the installed version in your environment:

/var/ossec/bin/wazuh-manager --version

The habit of checking the version before reading documentation will prevent you from following examples that have already changed in newer releases.

#RHEL 10 Support and Cumulative Fixes

The 4.14 series brings new operating system support, especially for Red Hat Enterprise Linux 10. This support started arriving in release 4.14.6 in early July 2026, including a manager startup fix on RHEL 10 related to the libcrypt library dependency in the bundled Python.

The cumulative effect is also felt elsewhere. The eBPF library updates for system call monitoring, fixes in the agent module, and SCA rule adjustments for newer operating systems all arrive through the small releases in the 4.14 series. For organizations using RHEL, AlmaLinux, or Rocky Linux, this support makes Wazuh easier to install without extra configuration.

At the security level, dependency fixes like Python library updates also reduce the attack surface on components that handle network input. That's another reason not to let a deployment run too long on an old version: every small release is part of the strategy to keep servers safe.

#Reading Release Notes and Upgrade Planning

Before upgrading, get used to reading the target version's release notes. Official Wazuh release notes split changes into new features, fixes, and removals. The removals section is very important because it marks configurations no longer supported, like the wazuh-dbd daemon removed in 4.14.7.

A good upgrade plan covers backup, lab testing, and a downtime window. For an all-in-one deployment, the common order is manager, then indexer, then dashboard. Check component compatibility before starting:

/var/ossec/bin/wazuh-manager --version
/usr/share/wazuh-indexer/bin/wazuh-indexer -V

Inconsistent versions between components are one of the most common causes of failure after an upgrade. Document versions before and after, and note relevant changes for your environment. These notes are also useful when another team must roll back or investigate later.

#The OpenSearch Indexer Migration Context

Wazuh uses an OpenSearch-based indexer, and the latest releases are on an OpenSearch 2.x base. If your deployment is still running an older base, migration is work that can't be delayed. The important thing to know is that indexer migration is generally one-way: after moving to a new version, returning to the old version isn't an easy choice.

The migration process covers snapshotting the old data, verifying compatibility, then restoring into the new indexer version. Plan a downtime window, prepare a restorable backup, and test the steps in a trial environment first.

Also pay attention to other components that depend on the indexer, like the dashboard and search pipelines. If there are automation scripts that call the indexer directly, make sure the API used remains available in the new version. A gradual approach is always safer than a big leap all at once.

#Wazuh 5.0.0: The New Architecture

Wazuh 5.0.0 is the biggest architectural leap in years. The analysis engine and rule engine are rewritten from scratch, not just small fixes to old code. The indexer is also built on a new architecture, targeting far higher performance and scalability than the 4.x series.

The Wazuh API is also redesigned. The goal is to make automation neater and more consistent, so integration with SOAR or third-party tools is easier to maintain. In addition, 5.0 deployment is designed to be more cluster-ready from the start, and the dependency on components like Filebeat is removed in favor of a more direct pipeline.

For those just starting to learn, the good news is the concepts we covered throughout this series remain relevant. Agents, log monitoring, rules, and detection all stay; what changes is how those components work behind the scenes.

The engine change also affects how custom rules are written. The rule format in 5.0 will most likely differ from the format we learned in episode 17, so you'll need to relearn that part when the transition arrives. Fortunately, the rule-debugging experience you've built will make the adjustment feel much easier.

#Roadmap to a Stable Release

In mid-2026, Wazuh 5.0 is still in the beta stage with several sequential beta releases. Each beta brings refinements to the new engine and fixes from community feedback. A stable release will come after the beta period is considered mature, and the upgrade path from 4.14 to 5.0 will be officially announced.

The most sensible advice for production is to stay on stable 4.14.x while starting to prepare. Learn what changes in 5.0, test in a lab, and wait until the stable version and validated upgrade path are out.

#Trends: AI, Cloud-Native, and Threat Intelligence

Looking ahead, Wazuh's development direction aligns with security industry trends. AI-assisted detection is starting to be used to help analysts assess alerts and filter false positives, although human-expertise-based detection rules remain the core. Models like this complement, not replace, the rule engine.

Cloud-native deployment is also increasingly the primary choice, with containers and Kubernetes making Wazuh easier to scale on demand. Meanwhile, threat intelligence integration keeps expanding, so detection can be enriched with the latest indicators from various sources.

For those who want to stay relevant, learn the fundamentals we covered throughout this series while following official release developments. A strong foundation will make the shift to the new architecture feel like refinement, not a frightening change.

#Conclusion

In episode 21 you read Wazuh's roadmap:

• 4.14.7 is the latest stable release with cumulative fixes.
• RHEL 10 support arrived in the 4.14 series for Red Hat environments.
• The OpenSearch indexer migration needs planning because it's one-way.
• Wazuh 5.0.0 brings a new engine, a new indexer, and a redesigned API.
• The stable 5.0 release awaits beta maturity and the official upgrade path.
• AI, cloud-native, and threat intelligence steer the product's future.

Key takeaways:

• In production, use the stable version and read release notes before upgrading.
• Cumulative releases mean the newest upgrade brings all fixes.
• Indexer migration can't be taken lightly because it's one-way.
• Wazuh 5.0 is a big rewrite, not just a minor update.
• Test beta only in a lab; wait for the stable release for production.
• The conceptual foundation you've learned still applies in the new architecture.

In episode 22, the finale of this series, we compare Wazuh with other alternatives and put together a production checklist plus a recap of the whole journey. See you there!