wazuh/wazuh-manager
wazuh
Wazuh Manager Docker镜像为开源安全监控平台的核心组件，用于集中管理来自Agent和各类日志的安全数据，提供实时分析、入侵检测、漏洞扫描、合规性检查及多渠道告警能力。集成Web管理界面，支持可视化监控、规则配置与事件响应流程编排，容器化设计确保快速部署与环境一致性，适用于构建企业级威胁检测与安全运营中心（SOC）。
33 次收藏下载次数: 0状态：社区镜像维护者：wazuh仓库类型：镜像最近更新：1 天前
让 AI 帮你使用轩辕镜像？ · 展开查看说明 · 点击收起说明
如果你使用 DeepSeek、元宝 AI、Copilot、ChatGPT 等 AI 工具，协助配置轩辕镜像、编写 docker pull 命令、修改 Docker Compose 镜像地址、配置镜像加速、排查镜像拉取失败、分析报错日志等问题，请先让 AI 阅读并遵守轩辕镜像的规则文档。
只需在 AI 对话中先发送下面这句话即可：
请先完整阅读并严格遵守以下文档中的全部规则与要求：
https://xuanyuan.cloud/agents.md
在未充分阅读并理解该文档前，不要生成任何命令、配置、修改建议、故障排查方案或技术回答。后续所有输出都必须严格以该文档中的规范为最高优先级执行。查看 agents.md 用法指南与完整示范。国内用户首推 元宝 AI、DeepSeek 的深度思考模式，不推荐豆包 AI；Cursor 等编辑器可在对话 @ 该链接，或加入 User Rules。 若 AI 无法访问外链，可 打开说明文档 复制全文粘贴。文档会随站点更新，复制内容可能过期，建议定期检查。
Wazuh containers for Docker
In this repository you will find the containers to run:
- Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS
- Wazuh dashboard: provides a web user interface to browse through alerts data and allows you to visualize agents configuration and status.
- Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). Be aware to increase the
vm.max_map_countsetting, as it's detailed in the Wazuh documentation.
The folder build-docker-images contains a README explaining how to build the Wazuh images and the necessary assets.
The folder indexer-certs-creator contains a README explaining how to create the certificates creator tool and the necessary assets.
The folder single-node contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard.
The folder multi-node contains a README explaining how to run a Wazuh environment with two Wazuh managers, three Wazuh indexer, and one Wazuh dashboard.
Documentation
- Wazuh full documentation
- Wazuh documentation for Docker
- https://hub.docker.com/u/wazuh
Setup SSL certificate
Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed).
Documentation on how to provide these two can be found at Wazuh Docker Documentation.
Environment Variables
Default values are included when available.
Wazuh
API_USERNAME="wazuh-wui" # Wazuh API username API_PASSWORD="MyS3cr37P450r.*-" # Wazuh API password - Must comply with requirements # (8+ length, uppercase, lowercase, specials chars) INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL INDEXER_USERNAME=admin # Wazuh indexer Username INDEXER_PASSWORD=SecretPassword # Wazuh indexer Password FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) SSL_CERTIFICATE_AUTHORITIES="" # Path of Filebeat SSL CA SSL_CERTIFICATE="" # Path of Filebeat SSL Certificate SSL_KEY="" # Path of Filebeat SSL Key
Dashboard
PATTERN="wazuh-alerts-*" # Default index pattern to use CHECKS_PATTERN=true # Defines which checks must to be consider by the healthcheck CHECKS_TEMPLATE=true # step once the Wazuh app starts. Values must to be true or false CHECKS_API=true CHECKS_SETUP=true EXTENSIONS_PCI=true # Enable PCI Extension EXTENSIONS_GDPR=true # Enable GDPR Extension EXTENSIONS_HIPAA=true # Enable HIPAA Extension EXTENSIONS_NIST=true # Enable NIST Extension EXTENSIONS_TSC=true # Enable TSC Extension EXTENSIONS_AUDIT=true # Enable Audit Extension EXTENSIONS_OSCAP=false # Enable OpenSCAP Extension EXTENSIONS_CISCAT=false # Enable CISCAT Extension EXTENSIONS_AWS=false # Enable AWS Extension EXTENSIONS_GCP=false # Enable GCP Extension EXTENSIONS_VIRUSTOTAL=false # Enable Virustotal Extension EXTENSIONS_OSQUERY=false # Enable OSQuery Extension EXTENSIONS_DOCKER=false # Enable Docker Extension APP_TIMEOUT=20000 # Defines maximum timeout to be used on the Wazuh app requests API_SELECTOR=true Defines if the user is allowed to change the selected API directly from the Wazuh app top menu IP_SELECTOR=true # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu IP_IGNORE="[]" # List of index patterns to be ignored DASHBOARD_USERNAME=kibanaserver # Custom user saved in the dashboard keystore DASHBOARD_PASSWORD=kibanaserver # Custom password saved in the dashboard keystore WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-monitoring indices WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas WAZUH_MONITORING_REPLICAS=0 ##
Directory structure
├── build-docker-images │ ├── build-images.sh │ ├── build-images.yml │ ├── README.md │ ├── wazuh-dashboard │ │ ├── config │ │ │ ├── config.sh │ │ │ ├── config.yml │ │ │ ├── dl_base.sh │ │ │ ├── entrypoint.sh │ │ │ ├── install_wazuh_app.sh │ │ │ ├── opensearch_dashboards.yml │ │ │ ├── wazuh_app_config.sh │ │ │ └── wazuh.yml │ │ └── Dockerfile │ ├── wazuh-indexer │ │ ├── config │ │ │ ├── action_groups.yml │ │ │ ├── config.sh │ │ │ ├── config.yml │ │ │ ├── entrypoint.sh │ │ │ ├── internal_users.yml │ │ │ ├── opensearch.yml │ │ │ ├── roles_mapping.yml │ │ │ ├── roles.yml │ │ │ └── securityadmin.sh │ │ └── Dockerfile │ └── wazuh-manager │ ├── config │ │ ├── check_repository.sh │ │ ├── create_user.py │ │ ├── etc │ │ │ ├── cont-init.d │ │ │ │ ├── 0-wazuh-init │ │ │ │ ├── 1-config-filebeat │ │ │ │ └── 2-manager │ │ │ └── services.d │ │ │ ├── filebeat │ │ │ │ ├── finish │ │ │ │ └── run │ │ │ └── ossec-logs │ │ │ └── run │ │ ├── filebeat_module.sh │ │ ├── filebeat.yml │ │ ├── permanent_data.env │ │ └── permanent_data.sh │ └── Dockerfile ├── CHANGELOG.md ├── indexer-certs-creator │ ├── config │ │ └── entrypoint.sh │ ├── Dockerfile │ └── README.md ├── LICENSE ├── multi-node │ ├── config │ │ ├── certs.yml │ │ ├── nginx │ │ │ └── nginx.conf │ │ ├── wazuh_cluster │ │ │ ├── wazuh_manager.conf │ │ │ └── wazuh_worker.conf │ │ ├── wazuh_dashboard │ │ │ ├── opensearch_dashboards.yml │ │ │ └── wazuh.yml │ │ └── wazuh_indexer │ │ ├── internal_users.yml │ │ ├── wazuh1.indexer.yml │ │ ├── wazuh2.indexer.yml │ │ └── wazuh3.indexer.yml │ ├── docker-compose.yml │ ├── generate-indexer-certs.yml │ ├── Migration-to-Wazuh-4.4.md │ ├── README.md │ └── volume-migrator.sh ├── README.md ├── SECURITY.md ├── single-node │ ├── config │ │ ├── certs.yml │ │ ├── wazuh_cluster │ │ │ └── wazuh_manager.conf │ │ ├── wazuh_dashboard │ │ │ ├── opensearch_dashboards.yml │ │ │ └── wazuh.yml │ │ └── wazuh_indexer │ │ ├── internal_users.yml │ │ └── wazuh.indexer.yml │ ├── docker-compose.yml │ ├── generate-indexer-certs.yml │ └── README.md └── VERSION
Branches
masterbranch contains the latest code, be aware of possible bugs on this branch.stablebranch on correspond to the last Wazuh stable version.
Compatibility Matrix
| Wazuh version | ODFE | XPACK |
|---|---|---|
| v4.3.0+ | N/A | N/A |
| v4.2.7 | 1.13.2 | 7.11.2 |
| v4.2.6 | 1.13.2 | 7.11.2 |
| v4.2.5 | 1.13.2 | 7.11.2 |
| v4.2.4 | 1.13.2 | 7.11.2 |
| v4.2.3 | 1.13.2 | 7.11.2 |
| v4.2.2 | 1.13.2 | 7.11.2 |
| v4.2.1 | 1.13.2 | 7.11.2 |
| v4.2.0 | 1.13.2 | 7.10.2 |
| v4.1.5 | 1.13.2 | 7.10.2 |
| v4.1.4 | 1.12.0 | 7.10.2 |
| v4.1.3 | 1.12.0 | 7.10.2 |
| v4.1.2 | 1.12.0 | 7.10.2 |
| v4.1.1 | 1.12.0 | 7.10.2 |
| v4.1.0 | 1.12.0 | 7.10.2 |
| v4.0.4 | 1.11.0 | |
| v4.0.3 | 1.11.0 | |
| v4.0.2 | 1.11.0 | |
| v4.0.1 | 1.11.0 | |
| v4.0.0 | 1.10.1 |
Credits and Thank you
These Docker containers are based on:
- "deviantony" dockerfiles which can be found at https://github.com/deviantony/docker-elk
- "xetus-oss" dockerfiles, which can be found at https://github.com/xetus-oss/docker-ossec-server
We thank you them and everyone else who has contributed to this project.
License and copyright
Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
Web references
Wazuh website
镜像拉取方式
您可以使用以下命令拉取该镜像。请将 <标签> 替换为具体的标签版本。如需查看所有可用标签版本，请访问 标签列表页面。
轩辕镜像加速拉取命令点我查看更多 wazuh-manager 镜像标签
docker pull docker.xuanyuan.run/wazuh/wazuh-manager:<标签>
DockerHub 原生拉取命令
docker pull wazuh/wazuh-manager:<标签>
镜像拉取常见问题
功能
错误码
用户好评
来自真实用户的反馈，见证轩辕镜像的优质服务
oldzhang
运维工程师
Linux服务器
5
"Docker访问体验非常流畅，大镜像也能快速完成下载。"