Comprehensive Guide to Installing and Configuring Wazuh SIEM on CentOS Stream 9 - ITFROMZERO - Share tobe shared! Battle-tested guide to deploying Wazuh SIEM on CentOS Stream 9: from a 5-minute all-in-one setup and firewalld rules to FIM alerts and automatic SSH brute-force IP blocking.

Table of Contents

Quick Start: Spin Up Wazuh Server in 5 Minutes

Need a quick test lab or immediate protection for a few internal servers? The official all-in-one script is your fastest shortcut. It automatically pulls and deploys OpenSearch (Wazuh Indexer), Wazuh Server, and Wazuh Dashboard to your machine, saving you from manually tweaking error-prone YAML configuration files.

Minimum hardware requirements for CentOS Stream 9: 4 vCPUs and 8 GB of RAM. OpenSearch is quite memory-hungry; anything below this threshold makes services prone to crashing mid-deployment.

# 1. Update system packages and install curl
sudo dnf update -y && sudo dnf install -y curl tar

# 2. Download official all-in-one installation script
curl -sO https://packages.wazuh.com/4.8/wazuh-install.sh

# 3. Run automated installation for all components
sudo bash ./wazuh-install.sh -a

The download and deployment process takes around 4 to 6 minutes. Once complete, the terminal will print your dashboard login credentials. The default user is admin paired with a randomly generated password. Extract and save this password immediately:

# Retrieve generated random password
sudo tar -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O

Now open your browser and navigate to https://<IP_SERVER>. Bypass the self-signed SSL certificate warning, and you will land directly on the Wazuh central WebUI.

System Architecture and Standard Configuration Steps

Back when CentOS 8 reached EOL, our team had to scramble and migrate 5 production servers over to Rocky Linux in just 7 days. The hardest-earned lesson: reinstalling the OS only takes half a day, but flying blind without security logs and wondering whether your server is being scanned by port botnets during cutover is truly nerve-racking. Ever since, whenever I set up CentOS Stream 9 or any RHEL-family distro, the first service I spin up right after OpenSSH is always Wazuh.

1. The Three Pillars of the Wazuh Architecture

Wazuh Indexer: A fork of OpenSearch. Its primary mission: storing, indexing, and querying millions of log entries every second.
Wazuh Server: The analytical brain. This component ingests logs from agents, matches them against decoders and rulesets, inspects file integrity (FIM), and triggers immediate countermeasures via Active Response.
Wazuh Dashboard: The WebUI that visualizes CVE alerts, MITRE ATT&CK heatmaps, and regulatory compliance reports such as PCI-DSS or ISO 27001.

2. Configure Firewalld Ports on CentOS Stream 9

CentOS Stream 9 blocks all incoming ports by default except SSH. To allow your cluster nodes and agents to communicate properly, open these three specific ports:

# Port 1514 (TCP): Log collection from agents
# Port 1515 (TCP): Key enrollment and agent registration
# Port 443 (TCP): Web access to Wazuh Dashboard
sudo firewall-cmd --permanent --add-port=1514/tcp
sudo firewall-cmd --permanent --add-port=1515/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

3. Install Wazuh Agent on Monitored Endpoints

Switch over to your target CentOS/RHEL host. Add the repository and fetch the wazuh-agent package:

# Add Wazuh GPG key and repository
sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
cat <<EOF | sudo tee /etc/yum.repos.d/wazuh.repo
[wazuh]
name=Wazuh repository
baseurl=https://packages.wazuh.com/4.x/yum/
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
EOF

# Install agent pointing to Wazuh Server IP
sudo WAZUH_MANAGER='192.168.1.100' dnf install -y wazuh-agent

# Reload systemd and enable agent on system boot
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

Advanced: Enable FIM and Automatically Drop SSH Brute-Force IPs

Staring passively at aggregated log dashboards is not enough. The real value of a SIEM lies in its automated self-defense reflexes: catching attackers tampering with web code red-handed and booting suspicious IPs the second they attempt to guess credentials.

1. Enable File Integrity Monitoring (FIM)

Open /var/ossec/etc/ossec.conf on the endpoint and locate the <syscheck> block. Declare your critical directories right away to intercept unauthorized file modifications in real time:

<syscheck>
  <!-- Real-time scan for web source code and system binaries -->
  <directories realtime="yes" check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
  <directories realtime="yes" check_all="yes">/var/www/html</directories>
  
  <!-- Ignore temporary runtime files to prevent disk I/O saturation -->
  <ignore>/etc/mtab</ignore>
  <ignore>/etc/hosts.deny</ignore>
</syscheck>

2. Automatically Block IPs with Over 5 Failed SSH Attempts

Switch back to Wazuh Manager. We can leverage the built-in firewall-drop active response script to drop offensive packets straight at the iptables/firewalld layer:

<!-- Configured in /var/ossec/etc/ossec.conf on Wazuh Server -->
<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <rules_id>5712</rules_id> <!-- Triggers on SSH brute-force rule match -->
  <timeout>1800</timeout> <!-- Block offending IP for 30 minutes -->
</active-response>

After updating the file, restart the manager daemon to load the new rules:

sudo systemctl restart wazuh-manager

Battle-Tested Tips for Running Wazuh on CentOS 9

Never disable SELinux recklessly: Encountering connection errors often tempts sysadmins to instinctively run setenforce 0. Avoid doing this; you are actively stripping away a core kernel-level shield in Linux. Instead, execute sudo ausearch -m avc -ts recent to pinpoint the exact blocked denial. Then generate a proper policy module using audit2allow -M wazuh_custom.
Watch out for log-induced disk bloat: By default, the Indexer continuously ingests logs without throttling. Ingesting 50–100 GB of logs weekly can deplete disk space within a month. Configure Index Lifecycle Management (ILM) in Dashboard early on: compress indices after 7 days and delete logs older than 30 days.
Constrain OpenSearch RAM allocation: On a node with 8 GB of RAM, pin the Indexer heap size to exactly 50% of physical memory (i.e., 4 GB). Modify the /etc/wazuh-indexer/jvm.options file:

# Configured in /etc/wazuh-indexer/jvm.options
-Xms4g
-Xmx4g

This 4 GB ceiling leaves plenty of breathing room for the kernel and Wazuh Manager, preventing Linux OOM Killer from abruptly terminating critical processes in the middle of the night.