Skip to content
Wazuh SIEM with Grafana product logo
  • AWSAvailable on Amazon Web Services
  • Azure· nextMicrosoft Azure is next on the roadmap
  • GCP· nextGoogle Cloud is next on the roadmap
Available

Wazuh SIEM with Grafana

The complete Wazuh 4.14.7 security platform - manager, indexer, dashboard and Filebeat - with Grafana 13.2.1 pre-wired to the indexer and a ready-made alerts dashboard. Checked line by line against the AWS Marketplace AMI policies: every credential is rotated to your instance at first boot, and the indexer never faces the internet.

Version
v4.14.7
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image. Nothing else is installed.

  • Wazuh manager 4.14.7
  • Wazuh indexer 4.14.7
  • Wazuh dashboard 4.14.7
  • Filebeat 7.10.2
  • Grafana OSS 13.2.1
  • OpenSearch datasource plugin 2.34.3
  • nginx 1.24.0

Licensing — Open source (GPL-2.0), no licence key required

Deploy anywhere

Wazuh SIEM with Grafana on AWS.

Microsoft Azure and Google Cloud are next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS

    Amazon Web Services

    AMI · v4.14.7

    Available

    AWS AMI ID

    ami-0c8674408d0647d59
    Released
    September 12, 2026
    Root volume
    gp3 · 50 GiB

    Instance types

    • t3a.xlarge
    • t3a.large
    • m6a.xlarge
    • m6a.2xlarge

    Regions

    • us-east-1
    AWS launch steps

Getting started

From launch to signed in, step by step.

  1. Launch in us-east-1 with TCP 22, 80, 1514, 1515, 3000 and 55000 open; wait for the health checks. Use t3a.large as a floor, t3a.xlarge for headroom.

  2. Open http://<instance-public-ip>/ and sign in with username admin and your EC2 Instance ID with a capital I as the password: an instance shown as i-0123456789abcdef0 has the password I-0123456789abcdef0. Wazuh's policy needs an uppercase letter; nothing else changes.

  3. Grafana is at http://<instance-public-ip>:3000 and the Wazuh API at https://<instance-public-ip>:55000, same credential. The Wazuh Security Overview dashboard fills in as the manager starts auditing the host.

  4. Enrol agents on port 1515; they report on 1514.

  5. SSH as ubuntu with your key pair. Change the login everywhere at once with sudo bash /home/ubuntu/iscripts/change_login.sh; wazuh_status.sh prints this instance's exact working credential.

  6. Do not open 9200 (indexer) or 443 (the dashboard's internal HTTPS); both are loopback-only by design.

Security posture

What this image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: every component comes from its own official repository or release, nothing is copied from any third-party image, and the finished image was scanned for third-party vendor strings before capture.

  • No usable credential ships in the image; passwords are set on your instance at first boot from EC2 instance metadata (IMDSv2) and the scripts that set them delete themselves afterwards.

  • SSH is key-only, root login over SSH is refused, and build-time SSH keys, shell history and logs were removed before imaging.

  • Checked line by line against the AWS Marketplace AMI product policies: no hardcoded secrets, per-instance passwords, no SSH password authentication, no root password login, no baked-in authorized keys, full sudo for the ubuntu user.

  • The image carries only the Wazuh installer's random passwords, with Grafana's randomised during cleanup, and first boot rotates all of them to this instance's credential.

  • The Wazuh indexer (9200) and the dashboard's own HTTPS listener (443) are loopback-only and must not be opened; nginx on 80 is the documented entry point.

  • Build-time alert, archive and state indices were deleted so no build-host inventory ships. pass_wazuh.sh enforces Wazuh's own policy (10+ chars, upper, lower, digit and one of . * + ? -) and keeps Grafana's datasource credential in step.

  • The image is HTTP-only by design so it works at a bare IP with no certificate warnings: terminate TLS at a load balancer or add a certificate before exposing it publicly, and restrict port 22 and any admin ports to trusted IP ranges in your security group.