Wazuh
Security
Wazuh is an open source security platform (SIEM and XDR) that collects agent events, raises alerts and tracks vulnerabilities.
The Wazuh integration powers the Wazuh widget, shows high and critical alerts in the Notifications widget and provides agent and alert counts to the Stats widget.
Wazuh stores data in two places, and each uses its own users:
- The server API (default port
55000) answers agent status and manager version. - The indexer (OpenSearch, default port
9200) holds alerts (wazuh-alerts-*), agent snapshots (wazuh-monitoring-*) and vulnerabilities (wazuh-states-vulnerabilities-*).
Alerts and severity counts need the indexer. Without server API credentials, agent counts come from the latest wazuh-monitoring-* snapshot, which the Wazuh dashboard writes every 15 minutes.
Adding the integration
Create the connection under Management → Integrations. See Managing integrations.
Pick the credential option that matches what you can reach:
| Option | URL field | Wazuh widget tabs |
|---|---|---|
| Username & Password | Server API, e.g. https://wazuh:55000 | Agents, manager version |
| Username & Password & Indexer … | Server API, indexer URL as a secret | All |
| Indexer username & Indexer password | Indexer, e.g. https://wazuh:9200 | All (agents from snapshots) |
Secrets
| Name | Description |
|---|---|
Username | Account username for authentication. |
Password | Account password for authentication. |
Steps to retrieve the credentials:
- Use a Wazuh API user, for example one with the built-in readonly role
Notes
- Wazuh ships with self-signed certificates, and the server API and the indexer each present their own. Test connection checks both endpoints and shows the certificate of whichever one fails, so the server API and the indexer certificate can both be handled from the same dialog: trust a self-signed certificate directly, or, when the certificate is signed by the Wazuh root CA, upload that CA (
/etc/wazuh-indexer/certs/root-ca.pem) from the dialog. Run Test connection again afterwards to check the other endpoint. You can also upload the root CA up front under Management → Tools → Certificates. - If the certificate is not issued for the host in the URL, Test connection offers to trust that hostname. Otherwise use a hostname or IP address listed in the certificate, or reissue the certificate with the name you use.
- An expired or not yet valid certificate cannot be trusted. Renew it and check that the clocks on the Homarr and Wazuh hosts are correct.
- A default all-in-one install binds the indexer to
127.0.0.1. Setnetwork.hostin/etc/wazuh-indexer/opensearch.ymlif Homarr runs on another host.