Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Wazuh Agent Docker Image with Auto-Registration on Wazuh Server

The Wazuh Agent, encapsulated within a Docker image, comes equipped with an automatic registration feature for seamless integration with the Wazuh server. This versatile implementation is designed to function not only as a standalone Docker container but also as a Kubernetes DaemonSet.

Key Features:

1. Containerization: The Wazuh Agent is encapsulated within a Docker image, promoting portability and ease of deployment across various environments.

2. Auto-Registration: The agent is configured to automatically register with the Wazuh server, streamlining the onboarding process and eliminating manual intervention.

3. Standalone Deployment: The Docker container can be deployed as a standalone entity, offering flexibility for environments that do not utilize orchestration tools.

4. Kubernetes Compatibility: Integrated as a Kubernetes DaemonSet, the Wazuh Agent seamlessly scales across nodes within a Kubernetes cluster, ensuring comprehensive security coverage.

Note: Always refer to the official documentation for detailed configuration options and additional customization possibilities.

This implementation offers a seamless and adaptable solution for incorporating Wazuh security monitoring into both standalone and orchestrated environments.

register_agent.py - Auto register docker based agent

cleanup_agents.py - Cleanup disconnected or never connected agents older than N days

deregister_agent.py - De-registration of agent

The Simplest way of running the container

docker run --rm opennix/wazuh-agent:latest

Generate certificates

docker compose -f tests/single-node/generate-indexer-certs.yml run --rm generator

Run

docker compose up -d

Will run Wazuh cluster in single node mode and 3 agents

make
help                           Help for usage
build-minideb                  Build Wazuh Agent minideb based
build-amazon-linux             Build Wazuh Agent amazon linux based
build-ubuntu                   Build Wazuh Agent ubuntu linux based
docker-run                     Run Wazuh Agent docker image  minideb based
docker-push-minideb            Push Wazuh Agent docker image  minideb based
docker-push-amazon-linux       Push Wazuh Agent docker image amazon linux based
docker-push-ubuntu             Push Wazuh Agent docker image ubuntu linux based
run-local                      Run docker compose stack with all agents on board

docker run -d --name wazuh -v /:/rootfs:ro --net host --hostname ${HOSTNAME} \
-e JOIN_MANAGER_MASTER_HOST=172.17.0.1 -e JOIN_MANAGER_WORKER_HOST=172.17.0.1 \
-e JOIN_PASSWORD=test123 -e JOIN_MANAGER_USER=user \
-v /etc/os-release:/etc/os-release -v /var/run/docker.sock:/var/run/docker.sock \
 opennix/wazuh-agent

Setup environments in wazuh-daemon-sets.yaml like above.

Example:

env:
    - name: JOIN_MANAGER_MASTER_HOST
      value: "wazuh.wazuh.svc.cluster.local"
    - name: JOIN_MANAGER_WORKER_HOST
      value: "wazuh-workers.wazuh.svc.cluster.local"
    - name: JOIN_MANAGER_PROTOCOL
      value: "https"
    - name: NODE_NAME
      valueFrom:
        fieldRef:
          fieldPath: spec.nodeName
    - name: JOIN_MANAGER_USER
      valueFrom:
       secretKeyRef:
         name: wazuh-api-cred
         key: username
    - name: JOIN_MANAGER_PASSWORD
      valueFrom:
        secretKeyRef:
          name: wazuh-api-cred
          key: password
    - name: JOIN_MANAGER_API_PORT
      value: "55000"
    - name: JOIN_MANAGER_PORT
      value: "1514"

And apply template kubectl -f wazuh-daemon-sets.yaml DaemonSet will deploy to wazuh namespace.

Building default image agent based on Minideb with default Agent version 4.3.10-1

docker build . -t wazuh-agent:latest

Building agent image based on Amazon Linux with default Agent version 4.3.10-1

docker build -f images/Dockerfile.amazonlinux . -t wazuh-agent:latest

Building agent image based on Ubuntu 24.04 with default Agent version 4.3.10-1

docker build -f images/Dockerfile.ubuntu . -t wazuh-agent:latest

Build agent image with custom agent version

 docker build -f path-to-docker-file . -t  wazuh-agent:<tag> --build-arg AGENT_VERSION=<wazuh-agent-version>

For example build minideb with Wazuh agent version 4.4.5-1

 docker build . -t  wazuh-agent:latest --build-arg AGENT_VERSION=4.4.5-1