Wazuh SIEM and XDR Platform - Ready-to-Run Security

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Wazuh - Unified SIEM and XDR on AWS

This image delivers the complete Wazuh security platform as a single, ready-to-run appliance: the Wazuh indexer, the Wazuh server, and the Wazuh dashboard, installed with the project's official all-in-one deployment, fully patched, and managed by systemd. Point your agents at it and you have log analysis, file integrity monitoring, intrusion detection, vulnerability detection, configuration assessment, and MITRE ATT&CK mapping in one console.

## Why This Image Instead of a Manual Install

A manual Wazuh deployment means installing three interdependent components, generating and distributing a TLS certificate chain, wiring the dashboard to the indexer and the server API, and hardening every default credential. This image removes all of it:

• Every credential is unique to your instance. Wazuh's documented default logins and the installer's build-time passwords are both eliminated from the image. On first boot the appliance rotates every indexer account and both server API accounts to freshly generated random passwords, then writes them to a root-only file. No shared or default credential ever ships.
• Every TLS certificate is unique to your instance. The entire certificate chain - root certificate authority, indexer, filebeat, and dashboard certificates - is regenerated on first boot using the project's own certificate tool, so no private key is ever shared between deployments.
• Dedicated data volumes. Security event indices and the server's queue, alerts and archives live on their own independently resizable disks rather than competing with the operating system for space.
• Server API bound to loopback. The management API is reachable only from the instance itself by default, never exposed to the internet unless you deliberately publish it.
• Health endpoint for load balancers. An unauthenticated liveness endpoint is served for Elastic Load Balancing and Auto Scaling health checks without handing out credentials.
• Fully patched at build. The operating system is brought to a complete security baseline at build time.

## What You Can Do With It

• Endpoint detection and response - deploy Wazuh agents to Linux, Windows, and macOS hosts and collect their telemetry centrally.
• Log data analysis - collect, parse, and correlate logs from operating systems, applications, and cloud services against thousands of detection rules.
• File integrity monitoring - detect changes to critical files and registry keys, with who-data attribution.
• Vulnerability detection - correlate installed software inventories against vulnerability feeds.
• Security configuration assessment - continuously score endpoints against hardening policies.
• Regulatory compliance reporting - built-in dashboards map findings to common compliance frameworks.
• MITRE ATT&CK mapping - see which techniques your alerts correspond to.

## Example Deployment

A platform team consolidating security telemetry from a fleet of EC2 instances launches this image, opens the agent enrollment ports to their VPC, and enrolls agents from each host. Within minutes the dashboard shows live security events, agent inventory, file integrity changes, and vulnerability findings across the fleet, with no separate log pipeline to build or maintain.

## Quick Start

1. Launch the image with a security group allowing inbound TCP 443 from your administrators and TCP 1514 and 1515 from the hosts you will enroll.

2. Wait a few minutes for first boot to generate this instance's certificates and credentials.

3. Connect over SSH and read the per-instance dashboard password from the root-only credentials file.

4. Open the dashboard in your browser over HTTPS and sign in.

5. Use the dashboard's agent deployment wizard to enroll your first endpoint.

## 24/7 Support Included

cloudimg provides around-the-clock technical support covering deployment, upgrades, agent enrollment, rule and decoder tuning, storage sizing, and integration questions.

---

Wazuh is a trademark of Wazuh Inc. Wazuh is distributed under the GNU General Public License version 2. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.