Learn Wazuh - All-in-One Installation (Quickstart)

#Introduction

In episode 2 you learned the architecture: manager, indexer, dashboard, agent, and API — and how data flows from the agent to the dashboard. Now we move into the most exciting stage: the real installation.

Episode 3 focuses on the all-in-one deployment — all of Wazuh's central components on a single server. This is the fastest pattern for labs and proofs of concept. We'll use wazuh-install.sh, the official script that automates the entire single-node process.

By the end of this episode, you'll have a fully running Wazuh server with a dashboard ready to use.

#Preparation Before Installation

Make sure your server VM meets the episode 0 prerequisites:

Ubuntu Server 22.04 or 24.04.
At least 4-8 GB of RAM and 2 CPU cores.
Internet access to packages.wazuh.com/4.x.
A user with sudo privileges.

Update the system before starting:

Update the operating system

sudo apt update
sudo apt upgrade -y
sudo reboot

After the reboot, log back in and make sure the hostname is set correctly:

Check hostname and active user

hostnamectl set-hostname wazuh-server
whoami

A clean hostname makes identification easier when working with multiple servers in a lab, and it is also used during certificate generation.

#Running wazuh-install.sh

Wazuh provides the wazuh-install.sh script that handles single-node installation and configuration automatically. Download it first:

Download the installer script

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh

Info

Do not run the installer as root. Use a user with sudo privileges such as wazuhadmin. If you use the root user, the script will refuse to run for security reasons.

Before executing, look at the available options:

Show installer help

bash wazuh-install.sh --help

The command above displays options such as --generate-config-files for custom configuration and --uninstall for cleanup. For a standard all-in-one installation, run it directly with the all-in-one flag:

All-in-one single node installation

sudo bash wazuh-install.sh -a

This process takes ten to fifteen minutes: the script installs the indexer, manager, and dashboard, then sets up the internal certificates automatically. At the end of the process, the script shows the admin credentials:

Sample installer output

INFO: You can access the web interface https://IP_SERVER
    User: admin
    Password: KATA_SANDI_GENERATED
INFO: Installation finished.

Save this username and password — you'll use them to log in to the dashboard. If you miss it, you can still recover it from the wazuh-install-files.tar archive with the command sudo tar -O -xvf wazuh-install-files.tar wazuh-passwords.txt.

#Verifying Service Status

After the installation finishes, make sure the three main services are running:

Check Wazuh service status

sudo systemctl status wazuh-manager
sudo systemctl status wazuh-indexer
sudo systemctl status wazuh-dashboard

Run all three one at a time and check for active (running) status. If any of them fails, read the logs with journalctl -u wazuh-manager or the relevant service name — the most common errors are port conflicts or insufficient RAM.

Besides the service status, make sure the required ports are open:

Check listening ports

sudo ss -tulpn

Important note: ss shows the ports that are actively listening. Note ports 1514 and 1515 for agent connections, 9200 for the indexer, 443 for the dashboard, and 55000 for the manager API. If all of them appear, the installation is ready to use.

The Wazuh dashboard runs on port 443 over HTTPS. Open your browser and go to https://IP_SERVER, replacing IP_SERVER with your VM's address. Because it uses a self-signed certificate, the browser will show a security warning — that's normal for a lab. Continue and log in with the admin user and the password from the installer output.

Info

A self-signed certificate is part of the installation's default security. In production you'll replace it with a certificate from a public CA, but for this lab it's enough to click continue when the browser warns you.

After logging in, you'll see the dashboard page with the main modules in the sidebar: Security events, Integrity monitoring, and Vulnerability detection. We'll explore this page more deeply in episode 5.

#Verifying the Wazuh API

Besides the dashboard, also check the manager API that the dashboard uses to communicate:

Check the manager API endpoint

curl -k -u admin:KATA_SANDI https://IP_SERVER:55000

Replace IP_SERVER and KATA_SANDI according to your lab. The response contains version and component info about Wazuh — a sign that the API is working. The -k flag is used because of the self-signed certificate, just like what happens in the browser.

#Conclusion

Episode 3 is complete. Your Wazuh server is now fully running: manager, indexer, and dashboard are active on a single machine.

Key takeaways:

wazuh-install.sh with the all-in-one flag automates the single-node installation.
Don't run the installer as root — use a user with sudo privileges.
Verify the three main services are running after installation.
Log in to the dashboard with the admin user and the password from the installer output.
A self-signed certificate shows a browser warning that is safe to ignore for a lab.
The manager API runs on port 55000 and can be checked with curl.

Next, in episode 4 we install the Wazuh Agent on Linux and Windows endpoints, perform enrollment, and verify the agent status from the dashboard. See you there!