Cómo instalar Wazuh en Docker - Security Monitoring SIEM autohospedado

Wazuh | SIEM | XDR | Security Monitoring | Open Source | Multi-platform | Elasticsearch | Docker | Threat Detection | Compliance | Enterprise

Wazuh en Docker: SIEM + XDR autohospedado con agents multi-plataforma, file integrity monitoring, intrusion detection, malware analysis, vulnerability scanning, compliance reporting (HIPAA/PCI-DSS/GDPR), Kibana dashboards, API REST, webhook integrations, centralized threat detection, production-ready, open source 🛡️🔍

Wazuh es una solución de seguridad completamente autohospedada y open source que proporciona SIEM (Security Information and Event Management) + XDR (Extended Detection and Response) integrado. Agentes multi-plataforma (Linux, Windows, macOS), log analysis centralizado, file integrity monitoring (FIM), intrusion detection (IDS), anomaly detection, malware detection, rootkit detection, vulnerability scanning, compliance monitoring (HIPAA, PCI-DSS, GDPR, NIST), threat intelligence integration, Kibana dashboards intuitivos, API REST completa, webhook integrations, active response automation, custom detection rules, incident response workflows, escalable a miles de endpoints, 100% privado sin vendor lock-in.

Vídeo tutorial en YouTube

Mira el vídeo completo sobre cómo instalar y usar Wazuh en Docker en el canal GENBYTE:

Clickea la miniatura para ir a YouTube →

¿Qué es Wazuh en Docker?

Wazuh es una solución de seguridad completamente autohospedada y open source que proporciona SIEM (Security Information and Event Management) + XDR (Extended Detection and Response) integrado, con agentes multi-plataforma (Linux, Windows, macOS) que recopilan logs centralizadamente, file integrity monitoring (FIM - detecta cambios en archivos críticos), intrusion detection (IDS), anomaly detection, malware detection, rootkit detection, vulnerability scanning automático, compliance monitoring (HIPAA, PCI-DSS, GDPR, NIST), threat intelligence integration, Kibana dashboards intuitivos, API REST completa, webhook integrations para automatización, active response automation, custom detection rules, incident response workflows, escalable a miles de endpoints, completamente privado sin vendor lock-in, enterprise-grade security. La solución SIEM que pedías autohospedada y sin costos de licensing.

Propuesta clave: Open-source SIEM + XDR (Elastic Stack). Multi-platform agents (Linux/Windows/macOS). Centralized log analysis. File Integrity Monitoring. Intrusion Detection. Malware detection. Vulnerability scanning. Compliance automation (HIPAA/PCI-DSS/GDPR/NIST). Kibana dashboards. REST API. Webhooks. Active response. Custom rules. Thousands of endpoints. Private. No vendor lock-in. Enterprise-grade.

Para sysadmins + security teams: Enterprise SIEM autohospedado. Threat detection. Compliance. Incident response. Sin vendor lock-in.

Características principales

Log analysis centralizado

Recopila logs de múltiples fuentes. Rule-based correlation. Real-time alerting.

File Integrity Monitoring

Detecta cambios en archivos críticos. Monitorea permisos. Alertas automáticas.

Intrusion Detection (IDS)

Detección de intrusiones. Network anomaly detection. Threat signatures.

Malware detection

Detección comportamiento malware. Rootkit detection. PUP identification.

Vulnerability scanning

CVE scanning automático. Package inventory. Remediation tracking.

Compliance reporting

HIPAA, PCI-DSS, GDPR, NIST 800-53, TSC, CIS compliance reporting.

Kibana dashboards

Visualización intuitiva. Custom dashboards. Real-time metrics.

REST API

API completa. OpenAPI docs. Custom integrations. Programmatic access.

Webhook integrations

Slack, Teams, email alerting. Custom webhooks. Event-driven automation.

Active response

Automated incident response. Script execution. Firewall rules automation.

Threat intelligence

VirusTotal integration. Threat feeds. IOC ingestion y alerting.

Multi-platform agents

Linux, Windows, macOS, Amazon Linux, CentOS, Debian, Ubuntu, etc.

Requisitos del sistema

• Docker & Docker Compose v2+
• 2 GB - 8 GB RAM mínimo (recomendado 4GB+ para producción)
• 20 GB - 200GB+ espacio disco (según volumen logs)
• Puertos TCP: 443 (UI/API), 1514-1515 (agents), 514 (syslog)
• Elasticsearch storage: SQLite o Elasticsearch remoto
• CPU: 2 cores mínimo (4+ recomendado para producción)
• Red: acceso outbound para threat intelligence feeds
• Opcional: Reverse proxy nginx/Caddy para HTTPS

⚠️ Resource-intensive: Wazuh consume más recursos que alternatives ligeras. Mínimo 2-4 GB RAM. Monitorea consumo.

💡 Scalability: Para grandes deployments (1000+ agents), considera multi-node Elasticsearch + Wazuh cluster.

Instalación con Docker Compose

Paso 1: docker-compose.yml (completo con Elasticsearch)

version: '3.8' services: wazuh: image: wazuh/wazuh:latest container_name: wazuh restart: unless-stopped ports: - "443:443" - "1514:1514" - "1515:1515" - "514:514/udp" environment: - INDEXER_URL=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin - INDEXER_PASSWORD=SecurePass123! - FILEBEAT_SSL_VERIFICATION_MODE=full volumes: - wazuh_api_cert:/etc/certs/wazuh - wazuh_etc:/var/ossec/etc - wazuh_var:/var/ossec/var depends_on: - wazuh.indexer - wazuh.dashboard wazuh.indexer: image: wazuh/wazuh-indexer:latest container_name: wazuh.indexer restart: unless-stopped environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g volumes: - wazuh_indexer_data:/usr/share/wazuh-indexer/data wazuh.dashboard: image: wazuh/wazuh-dashboard:latest container_name: wazuh.dashboard restart: unless-stopped ports: - "5601:5601" environment: - INDEXER_URL=https://wazuh.indexer:9200 depends_on: - wazuh.indexer volumes: wazuh_api_cert: wazuh_etc: wazuh_var: wazuh_indexer_data:

Paso 2: Iniciar Wazuh

docker compose up -d # Espera ~60 segundos para que inicie (Elasticsearch indexing) docker compose logs -f wazuh

Paso 3: Acceder a Wazuh

# UI Web: https://localhost:443 # Kibana Dashboard: https://localhost:5601 # API REST: https://localhost:443/api/v1 # Default credentials: admin/SecureSecurePass123! (cambiar!)

Acceder a Wazuh

🛡️ Wazuh Web UI: https://localhost:443
📊 Kibana Dashboard: https://localhost:5601
📡 API REST: https://localhost:443/api/v1

Primeros pasos

1. Abre https://localhost:443 en navegador
2. Login con admin/SecureSecurePass123! (cambiar credencial!)
3. Dashboard principal carga con overview de seguridad
4. Agrega agents en "Add agent" para monitorear endpoints
5. Agents instalados en Linux/Windows comienzan a reportar logs
6. Kibana dashboard muestra análisis de logs en tiempo real
7. Configure rules, alerts, webhooks según necesidad

⚠️ Cambiar contraseña por defecto: Primero login, cambia admin password. HTTPS con certificado autofirmado.

💡 Agent deployment: Windows: MSI installer. Linux: RPM/DEB packages. macOS: DMG installer. Deploy vía Ansible/Puppet para escala.

Casos de uso

• Centralized security monitoring: Monitorea 100+ endpoints centralizadamente. Threat detection automático.
• Compliance monitoring: HIPAA, PCI-DSS, GDPR, NIST compliance reporting automático.
• Incident response: Detección rápida de incidentes. Automated active response. Forensics.
• Threat intelligence: VirusTotal integration. Threat feeds. IOC matching. Malware alerts.
• File integrity monitoring: Detecta cambios no autorizados en archivos críticos. Regulatory requirement.
• Network security monitoring: Firewall logs analysis. IDS/IPS integration. Network anomaly detection.
• Enterprise self-hosted: Full data control. No vendor lock-in. Customizable. Open source.

Configuración avanzada

Agregar agentes Windows

# Dashboard → Add agent → Windows # Descarga MSI installer desde UI # Ejecuta en Windows: cmd.exe /c wazuh-agent-4.x.x.msi WAZUH_MANAGER="192.168.1.100" WAZUH_AGENT_GROUP="windows" # Agent automáticamente se registra y empieza a reportar

Custom detection rules

# /var/ossec/etc/rules/custom_rules.xml # Agregar reglas XML personalizadas # Ejemplo: detectar failed logins, suspicious processes, file changes # Reload manager: /var/ossec/bin/wazuh-control restart

Webhook integrations

# Management → Configuration → Integrations # Configure Slack/Teams/Custom webhook # POST to webhook URL cuando alerta es generada # Example: Slack channel #security-alerts

Threshold-based alerting

# Management → Groups → Rules # Set alert level threshold (1-15) # Higher level = more critical alerts only # Reduce false positives tuning rules

Gestión y mantenimiento

Ver estado

docker compose ps

Ver logs

docker compose logs -f wazuh # Ver logs de Elasticsearch/Indexer docker compose logs -f wazuh.indexer

Detener Wazuh

docker compose down

Actualizar versión

docker compose pull docker compose up -d # Datos persistentes en volúmenes Docker

Backup de datos

docker compose exec wazuh.indexer curl -XGET "https://localhost:9200/_snapshot" -u admin:SecurePass123! # O simplemente backup volúmenes: docker compose down tar -czf wazuh_backup.tar.gz wazuh_* 2>/dev/null || true

Monitorear consumo

docker stats wazuh wazuh.indexer wazuh.dashboard # Típicamente: # Wazuh CPU: 5-20% (según volumen logs) # Wazuh RAM: 500MB-2GB # Indexer RAM: 1-4GB (Elasticsearch memory)

Stack técnico

• Backend Manager: C/C++ (core engine), rule-based correlation
• Agents: C/C++ (lightweight, multi-platform)
• Frontend Dashboard: Vue.js / React (Kibana-based)
• Storage: Elasticsearch / Wazuh Indexer (OpenSearch fork)
• API: REST API (OpenAPI docs)
• Log pipeline: Filebeat → Wazuh Manager → Elasticsearch
• Authentication: LDAP, Active Directory, SAML, API key
• Multi-platform: Linux (RPM/DEB), Windows (MSI), macOS (DMG)
• Deployment: Docker, Docker Compose, Kubernetes, standalone binary
• Licencia: AGPL-3.0 open source (community edition)

Comparativa con alternativas

vs Splunk Enterprise ($5000-$50000/año)

Wazuh gana: Gratis, open source, self-hosted, sin vendor lock-in. Splunk gana: Managed service, 99.99% uptime SLA, soporte 24/7, más features enterprise.

vs ELK Stack (DIY)

Wazuh gana: All-in-one SIEM, threat detection nativa, compliance reporting, agents pre-built. ELK gana: Más flexible, customizable, mejor para log analysis puro (no SIEM).

vs Suricata + Graylog

Wazuh gana: SIEM integrado, compliance built-in, agents multi-platform, threat intel. Suricata+Graylog gana: Más simple, menos recursos, DIY customization.

Mejor para: Enterprise security teams, compliance requirement, centralized monitoring, threat detection. Self-hosted. Open source preference. Production-ready.

---

Referencias oficiales

• Wazuh GitHub Repository
• Docker Hub - Wazuh official images
• Official Documentation - Complete guide
• Docker Deployment Guide
• Agent Installation Guide - Multi-platform
• REST API Documentation
• Releases - Download binaries
• Official Blog - Security insights

Apoya el canal GENBYTE

Suscríbete al canal de YouTube Suscríbete a la newsletter semanal Invítame a un Ko-fi genbyte@proton.me

Sígueme en mis redes sociales

Telegram Discord YouTube GitHub Blog Twitter