Sign inSign up

wazuh/wazuh-agent

By wazuh

•Updated 2 days ago

XDR + SIEM

Image
1

1M+

wazuh/wazuh-agent repository overview

⁠Wazuh agent containers for Docker

In this repository, you will find the containers to run the Wazuh agent.

The Wazuh agent is multi-platform and runs on the endpoints that you want to monitor. It communicates with the Wazuh manager, sending data in near real-time through an encrypted and authenticated channel.

⁠Key Features:

  • Log Data Collection: Collects and forwards operating system and application logs.
  • File Integrity Monitoring (FIM): Detects changes in health check files, content, ownership, and attributes.
  • Vulnerability Detection: Identifies software vulnerabilities in the installed applications.
  • SCA: Performs scans to detect misconfigurations and harden the endpoint.

⁠Documentation

⁠Environment Variables

The following variables allow you to configure the agent's connection and registration to the Wazuh Manager upon container startup.

⁠Configuration variables
VariableDescriptionDefault
WAZUH_MANAGERIP or FQDN of the Wazuh Manager.wazuh.manager
WAZUH_MANAGER_PORTPort for communication with the manager.1514
WAZUH_REGISTRATION_SERVERIP/FQDN of the registration service (authd).Value of WAZUH_MANAGER
WAZUH_REGISTRATION_PORTPort for agent registration.1515
WAZUH_REGISTRATION_PASSWORDPassword for agent enrollment (if enabled on manager).""
WAZUH_AGENT_NAMECustom name for the agent.Container hostname
WAZUH_AGENT_GROUPAssigns the agent to specific group(s) (comma-separated).default
⁠Example Usage:
  wazuh.agent:
    image: wazuh/wazuh-agent:4.13.0
    restart: always
    environment:
      - WAZUH_MANAGER=192.168.1.100
      - WAZUH_REGISTRATION_PASSWORD=MyRegistrationPassword
      - WAZUH_AGENT_GROUP=linux,webservers
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/log:/var/log:ro

Note: If you plan to use this agent to monitor the Docker host itself, ensure you mount the necessary host volumes (like /var/run/docker.sock or /var/log) as shown in the example above.

⁠Directory Structure

├── build-docker-images
│   ├── build-images.sh
│   ├── build-images.yml
│   ├── README.md
│   ├── wazuh-agent
│   │   ├── config
│   │   │   ├── check_repository.sh
│   │   │   └── etc
│   │   │       ├── cont-init.d
│   │   │       │   ├── 0-wazuh-init
│   │   │       │   └── 1-agent
│   │   │       └── services.d
│   │   │           └── ossec-logs
│   │   │               └── run
│   │   └── Dockerfile
│   ├── wazuh-dashboard
│   │   ├── config
│   │   │   ├── check_repository.sh
│   │   │   ├── config.sh
│   │   │   ├── config.yml
│   │   │   ├── entrypoint.sh
│   │   │   ├── wazuh_app_config.sh
│   │   │   └── wazuh.yml
│   │   └── Dockerfile
│   ├── wazuh-indexer
│   │   ├── config
│   │   │   ├── action_groups.yml
│   │   │   ├── check_repository.sh
│   │   │   ├── config.sh
│   │   │   ├── config.yml
│   │   │   ├── entrypoint.sh
│   │   │   ├── internal_users.yml
│   │   │   ├── opensearch.yml
│   │   │   ├── roles_mapping.yml
│   │   │   ├── roles.yml
│   │   │   └── securityadmin.sh
│   │   └── Dockerfile
│   └── wazuh-manager
│       ├── config
│       │   ├── check_repository.sh
│       │   ├── create_user.py
│       │   ├── etc
│       │   │   ├── cont-init.d
│       │   │   │   ├── 0-wazuh-init
│       │   │   │   ├── 1-config-filebeat
│       │   │   │   └── 2-manager
│       │   │   └── services.d
│       │   │       ├── filebeat
│       │   │       │   ├── finish
│       │   │       │   └── run
│       │   │       └── ossec-logs
│       │   │           └── run
│       │   ├── filebeat_module.sh
│       │   ├── filebeat.yml
│       │   ├── permanent_data.env
│       │   └── permanent_data.sh
│       └── Dockerfile
├── CHANGELOG.md
├── docs
│   ├── book.toml
│   ├── build.sh
│   ├── dev
│   │   ├── build-image.md
│   │   ├── introduction.md
│   │   ├── run-tests.md
│   │   └── setup.md
│   ├── README.md
│   ├── ref
│   │   ├── configuration
│   │   │   ├── configuration-files.md
│   │   │   ├── configuration.md
│   │   │   └── environment-variables.md
│   │   ├── getting-started
│   │   │   ├── deployment
│   │   │   │   ├── deployment.md
│   │   │   │   ├── multi-node.md
│   │   │   │   ├── single-node.md
│   │   │   │   └── wazuh-agent.md
│   │   │   ├── getting-started.md
│   │   │   └── requirements.md
│   │   ├── glossary.md
│   │   ├── Introduction
│   │   │   ├── description.md
│   │   │   └── introduction.md
│   │   └── upgrade.md
│   ├── server.sh
│   └── SUMMARY.md
├── indexer-certs-creator
│   ├── config
│   │   └── entrypoint.sh
│   ├── Dockerfile
│   └── README.md
├── LICENSE
├── multi-node
│   ├── config
│   │   ├── certs.yml
│   │   ├── nginx
│   │   │   └── nginx.conf
│   │   ├── wazuh_cluster
│   │   │   ├── wazuh_manager.conf
│   │   │   └── wazuh_worker.conf
│   │   ├── wazuh_dashboard
│   │   │   ├── opensearch_dashboards.yml
│   │   │   └── wazuh.yml
│   │   └── wazuh_indexer
│   │       ├── internal_users.yml
│   │       ├── wazuh1.indexer.yml
│   │       ├── wazuh2.indexer.yml
│   │       └── wazuh3.indexer.yml
│   ├── docker-compose.yml
│   ├── generate-indexer-certs.yml
│   ├── Migration-to-Wazuh-4.4.md
│   ├── README.md
│   └── volume-migrator.sh
├── README.md
├── SECURITY.md
├── single-node
│   ├── config
│   │   ├── certs.yml
│   │   ├── wazuh_cluster
│   │   │   └── wazuh_manager.conf
│   │   ├── wazuh_dashboard
│   │   │   ├── opensearch_dashboards.yml
│   │   │   └── wazuh.yml
│   │   └── wazuh_indexer
│   │       ├── internal_users.yml
│   │       └── wazuh.indexer.yml
│   ├── docker-compose.yml
│   ├── generate-indexer-certs.yml
│   └── README.md
├── tools
│   └── repository_bumper.sh
├── VERSION.json
└── wazuh-agent
    ├── config
    │   └── wazuh-agent-conf
    └── docker-compose.yml

⁠Compatibility Matrix

The Wazuh manager version must be equal to or greater than the Wazuh agent version to ensure full compatibility.

Wazuh Agent versionMinimum Wazuh Manager version
v4.13.0+v4.13.0

⁠License and copyright

Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)

Tag summary

Content type

Image

Digest

sha256:32215f51b…

Size

72 MB

Last updated

2 days ago

docker pull wazuh/wazuh-agent:4.14.8