Production Wazuh SIEM Deployment
A distributed Wazuh 4.14.5 SIEM deployment across 13 VMs: a 3 node indexer cluster, server cluster with HAProxy load balancing, and mass agent deployment via Active Directory GPO and Ansible.
Production Wazuh SIEM Deployment
Project Description
A production deployment of the Wazuh SIEM platform in a fully distributed, high availability architecture on Ubuntu 22.04. The stack spans 13 VMs and mirrors how Wazuh is rolled out across a real enterprise fleet.
The core stack is a 3 node OpenSearch indexer cluster, green with zero unassigned shards, a server cluster with one master and two workers for horizontal event processing, a dedicated dashboard node, and an HAProxy load balancer that distributes agent enrollment and reporting traffic in TCP mode.
Endpoints are onboarded the way they are in production: Windows hosts join an Active Directory domain and receive the agent through a Group Policy startup script, while Ubuntu hosts are provisioned with Ansible. The deployment is fully documented stage by stage, from the OS baseline through the end to end validation.
Goals & Objectives
Distributed indexer cluster
Deploy a 3 node OpenSearch cluster with replication and zero unassigned shards, green and horizontally scalable.
Load balanced server cluster
Build a master and two workers behind HAProxy in TCP mode, with verified failover and event processing across workers.
Agent deployment at scale
Onboard Windows agents through Active Directory GPO and Ubuntu agents through Ansible, plus the domain controller itself as agent 005.
End to end validation
Prove the full pipeline from a triggered event on an agent to a searchable alert in OpenSearch, with ISM retention and snapshots applied.
Architecture & Workflow
flowchart TB
subgraph EP["Endpoints"]
DC["windows-ad-dc
192.168.90.121
Active Directory DC"]
W1["win-agent-01
192.168.90.122
group: windows"]
W2["win-agent-02
192.168.90.123
group: windows"]
U1["ubuntu-agent-01
192.168.90.119
group: linux"]
U2["ubuntu-agent-02
192.168.90.120
group: linux"]
end
LB["wazuh-lb-01<br/>192.168.90.112<br/>HAProxy TCP"]
subgraph SRV["Wazuh server cluster"]
M["wazuh-master-01<br/>192.168.90.115<br/>master"]
K1["wazuh-worker-01<br/>192.168.90.116<br/>worker"]
K2["wazuh-worker-02<br/>192.168.90.117<br/>worker"]
end
subgraph IDX["Wazuh indexer cluster"]
I1["wazuh-indexer-01<br/>192.168.90.111"]
I2["wazuh-indexer-02<br/>192.168.90.113"]
I3["wazuh-indexer-03<br/>192.168.90.114"]
end
SNAP["Snapshot repo<br/>/mnt/wazuh-snapshots<br/>ISM: alerts 90d, archives 30d"]
D["wazuh-dashboard-01<br/>192.168.90.118"]
A["Admin / User browser"]
DC -.->|GPO pushes agent| W1
DC -.->|GPO pushes agent| W2
W1 -->|1514 event / 1515 enroll| LB
W2 -->|1514 event / 1515 enroll| LB
U1 -->|1514 event / 1515 enroll| LB
U2 -->|1514 event / 1515 enroll| LB
LB -->|1515 enrollment| M
LB -->|1514 reporting RR| K1
LB -->|1514 reporting RR| K2
M <-->|1516 cluster sync| K1
M <-->|1516 cluster sync| K2
M -->|Filebeat 9200| I1
K1 -->|Filebeat 9200| I2
K2 -->|Filebeat 9200| I3
I1 <-->|9300:9400 transport| I2
I2 <-->|9300:9400 transport| I3
I1 <-->|9300:9400 transport| I3
I1 -.->|snapshot| SNAP
I2 -.->|snapshot| SNAP
I3 -.->|snapshot| SNAP
D -->|9200 search| I1
D -->|55000 API| M
A -->|443 HTTPS| D
Implementation
The deployment follows a strict bottom up order so each layer is validated before the next is built.
Indexer cluster. Three OpenSearch nodes with a shared root CA, per node certificates, and a 3 GB heap tuned for 2 GB RAM hosts. Cluster health is green with replication across all three, zero unassigned shards.
Server cluster. One master and two workers, joined with an identical cluster key over port 1514. Filebeat on each node ships alerts to the indexer over TLS 1.3, and health checks confirm every node talks to server and reports in.
Load balancer. HAProxy in TCP mode distributes agent enrollment on 1515 and event reporting on 1514, with health checks and verified failover.
Agent deployment. Windows endpoints join the lab.local domain and receive the agent through a GPO startup script, landing across both workers rather than one. Ubuntu endpoints are provisioned with an Ansible playbook from the master. The domain controller is enrolled as agent 005.
Operations. ISM policies enforce 90 day alert and 30 day archive retention, and a snapshot repository is configured and tested. End to end ingestion is confirmed by triggering failed SSH logins and finding the rule 5710 alerts in OpenSearch within seconds.
Tech Stack Used
SIEM platform across a server cluster, indexer cluster, and dashboard, deployed one consistent pinned version on every node.
Indexer tier holding alert and archive indices, green with replication and zero unassigned shards.
Load balances agent enrollment on 1515 and event reporting on 1514, with health checks and verified failover.
Ubuntu agents provisioned with an Ansible playbook, Windows agents pushed through an Active Directory Group Policy startup script.
Key Features & Deliverables
3 node indexer cluster
Green status, zero unassigned shards, 100 percent active shards, with a shared root CA and per node certificates.
Load balanced server cluster
Master and two workers over port 1514 with an identical cluster key, load balanced through HAProxy with verified failover.
Mass agent deployment
Five agents active across Ubuntu and Windows, onboarded through Ansible and Active Directory GPO, including the domain controller.
Operations and retention
ISM policies for 90 day alert and 30 day archive retention, a tested snapshot repository, and end to end ingestion confirmed.
Key Metrics
Results & Outcome
A fully operational distributed SIEM with every layer verified working.
The indexer cluster is green across 3 nodes with zero unassigned shards, 100 percent active shards, and wazuh-indexer-02 as cluster manager. The server cluster runs a master and two workers, load balanced through HAProxy with verified failover. Filebeat on all three server nodes talks to all three indexers over TLS 1.3.
Five agents are active, not four: two Ubuntu via Ansible, two Windows via GPO, and the domain controller itself enrolled as agent 005. End to end ingestion is confirmed, ISM retention and snapshots are configured and tested, and the Wazuh API and dashboard pull cluster and per node stats cleanly.
The result is a reusable reference architecture that demonstrates high availability, horizontal scaling, and enterprise agent deployment patterns on modest hardware, and it is documented stage by stage so it can be reproduced.
Screenshots & Demo
Endpoint Agent Onboarding and Health Validation
Wazuh endpoint dashboard showing five active agents across Ubuntu and Windows Server 2022 systems. This validates successful agent enrollment, OS visibility, group segmentation, and cluster node assignment across the SIEM deployment.
Wazuh Alert Index and Event Search
Wazuh Discover view showing 3,532 indexed security events in the wazuh-alerts-* index within the last 24 hours. This validates successful log ingestion, event parsing, cluster metadata enrichment, and searchable alert visibility across the SIEM deployment.
Wazuh Cluster Node
Command output confirming a three node Wazuh manager cluster with one master node and two worker nodes running version 4.14.5. This validates cluster membership, node role assignment, and internal manager communication across the SIEM deployment.
Filebeat Test Output
Filebeat test output confirms successful connectivity between the Wazuh manager and the indexer backend. This validates that alert data can be forwarded from the manager node to the OpenSearch/Wazuh indexer pipeline.
Health Check
Health check output confirming that the Wazuh backend services are reachable and responding correctly. This validates service availability, backend readiness, and the operational state of the SIEM deployment components.
Home Page Overview
Wazuh home overview showing the operational status of the SIEM environment, including endpoint visibility, security monitoring access, and centralized dashboard readiness. This validates that the Wazuh dashboard is properly connected to the backend and ready for monitoring activities.
ISM and Snapshot
Configured ISM policy and snapshot mechanism for the Wazuh indexer to manage alert index retention, rollover, and backup readiness. This validates that the SIEM deployment includes index lifecycle control and recovery preparation for long term operations.
IT Hygiene and Endpoint Posture
IT Hygiene view showing endpoint security posture and system visibility across monitored assets. This validates that the SIEM deployment can support asset inventory, configuration review, vulnerability awareness, and operational hygiene monitoring.
Cluster Nodes
Validated a three node Wazuh manager cluster consisting of one master node and two worker nodes. This confirms proper cluster role assignment, manager node registration, version consistency, and distributed SIEM processing readiness.
Interested in This Project?
Discuss your security needs or explore collaboration opportunities.