{"id":4820,"date":"2025-06-05T12:48:08","date_gmt":"2025-06-05T09:48:08","guid":{"rendered":"https:\/\/webembed.gr\/?p=4820"},"modified":"2026-01-07T12:51:31","modified_gmt":"2026-01-07T09:51:31","slug":"wazuh-on-docker-part-2-setting-up-wazuh-step-by-step","status":"publish","type":"post","link":"https:\/\/webembed.gr\/el\/wazuh-on-docker-part-2-setting-up-wazuh-step-by-step\/","title":{"rendered":"Wazuh on Docker \u2013 Part 2: Setting Up Wazuh Step by Step"},"content":{"rendered":"<p data-start=\"222\" data-end=\"430\">In <strong data-start=\"225\" data-end=\"235\">Part 1<\/strong>, we covered the basics of Docker and Wazuh and explained how they work together.<br data-start=\"316\" data-end=\"319\" \/>In this part, we\u2019ll move from theory to practice and <strong data-start=\"372\" data-end=\"429\">deploy a fully working Wazuh environment using Docker<\/strong>.<\/p>\n<p data-start=\"432\" data-end=\"456\">This setup is ideal for:<\/p>\n<ul data-start=\"457\" data-end=\"533\">\n<li data-start=\"457\" data-end=\"479\">\n<p data-start=\"459\" data-end=\"479\">Testing and learning<\/p>\n<\/li>\n<li data-start=\"480\" data-end=\"491\">\n<p data-start=\"482\" data-end=\"491\">Home labs<\/p>\n<\/li>\n<li data-start=\"492\" data-end=\"533\">\n<p data-start=\"494\" data-end=\"533\">Small to medium monitoring environments<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"540\" data-end=\"570\"><strong data-start=\"547\" data-end=\"570\">Prerequisites Recap<\/strong><\/p>\n<p data-start=\"572\" data-end=\"608\">Before we begin, make sure you have:<\/p>\n<ul data-start=\"610\" data-end=\"747\">\n<li data-start=\"610\" data-end=\"630\">\n<p data-start=\"612\" data-end=\"630\">Docker installed<\/p>\n<\/li>\n<li data-start=\"631\" data-end=\"659\">\n<p data-start=\"633\" data-end=\"659\">Docker Compose installed<\/p>\n<\/li>\n<li data-start=\"660\" data-end=\"695\">\n<p data-start=\"662\" data-end=\"695\">At least <strong data-start=\"671\" data-end=\"683\">4 GB RAM<\/strong> available<\/p>\n<\/li>\n<li data-start=\"696\" data-end=\"747\">\n<p data-start=\"698\" data-end=\"747\">Terminal access (Linux \/ macOS \/ WSL recommended)<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"749\" data-end=\"776\">You can verify Docker with:<\/p>\n<p data-start=\"749\" data-end=\"776\">docker &#8211;version<br \/>\ndocker-compose &#8211;version<\/p>\n<p data-start=\"837\" data-end=\"895\"><strong data-start=\"843\" data-end=\"895\">Step 1: Get the Official Wazuh Docker Repository<\/strong><\/p>\n<p data-start=\"897\" data-end=\"983\">Wazuh provides an official Docker repository that includes preconfigured environments.<\/p>\n<p data-start=\"897\" data-end=\"983\"><div class=\"gdlr-core-code-item gdlr-core-item-pdb  gdlr-core-code-item-light\"  ><div class=\"gdlr-core-code-item-content gdlr-core-content-font gdlr-core-skin-e-background gdlr-core-skin-e-content gdlr-core-skin-border\"><p>git clone https:\/\/github.com\/wazuh\/wazuh-docker.git<br \/>\ncd wazuh-docker\/single-node<\/p>\n<\/div><\/div><\/p>\n<p data-start=\"1078\" data-end=\"1153\">The <strong data-start=\"1082\" data-end=\"1097\">single-node<\/strong> deployment is perfect for getting started and includes:<\/p>\n<ul data-start=\"1154\" data-end=\"1222\">\n<li data-start=\"1154\" data-end=\"1171\">\n<p data-start=\"1156\" data-end=\"1171\">Wazuh Manager<\/p>\n<\/li>\n<li data-start=\"1172\" data-end=\"1189\">\n<p data-start=\"1174\" data-end=\"1189\">Elasticsearch<\/p>\n<\/li>\n<li data-start=\"1190\" data-end=\"1202\">\n<p data-start=\"1192\" data-end=\"1202\">Filebeat<\/p>\n<\/li>\n<li data-start=\"1203\" data-end=\"1222\">\n<p data-start=\"1205\" data-end=\"1222\">Wazuh Dashboard<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"1229\" data-end=\"1286\"><strong data-start=\"1235\" data-end=\"1286\">Step 2: Review the Docker Compose Configuration<\/strong><\/p>\n<p data-start=\"1288\" data-end=\"1323\">Open the <code data-start=\"1297\" data-end=\"1317\">docker-compose.yml<\/code> file:<\/p>\n<p data-start=\"1288\" data-end=\"1323\"><div class=\"gdlr-core-code-item gdlr-core-item-pdb  gdlr-core-code-item-light\"  ><div class=\"gdlr-core-code-item-content gdlr-core-content-font gdlr-core-skin-e-background gdlr-core-skin-e-content gdlr-core-skin-border\"><p>nano docker-compose.yml<\/p>\n<\/div><\/div><\/p>\n<p data-start=\"1362\" data-end=\"1452\">At this stage, you usually <strong data-start=\"1389\" data-end=\"1422\">don\u2019t need to change anything<\/strong>, but it\u2019s good to understand:<\/p>\n<ul data-start=\"1453\" data-end=\"1544\">\n<li data-start=\"1453\" data-end=\"1480\">\n<p data-start=\"1455\" data-end=\"1480\">Which containers will run<\/p>\n<\/li>\n<li data-start=\"1481\" data-end=\"1506\">\n<p data-start=\"1483\" data-end=\"1506\">Which ports are exposed<\/p>\n<\/li>\n<li data-start=\"1507\" data-end=\"1544\">\n<p data-start=\"1509\" data-end=\"1544\">How services communicate internally<\/p>\n<\/li>\n<\/ul>\n<blockquote data-start=\"1546\" data-end=\"1638\">\n<p data-start=\"1548\" data-end=\"1638\">Tip: For production environments, memory limits and security hardening should be adjusted.<\/p>\n<\/blockquote>\n<p data-start=\"1645\" data-end=\"1684\"><strong data-start=\"1651\" data-end=\"1684\">Step 3: Start the Wazuh Stack<\/strong><\/p>\n<p data-start=\"1686\" data-end=\"1727\">Launch all services using Docker Compose:<\/p>\n<p data-start=\"1686\" data-end=\"1727\"><div class=\"gdlr-core-code-item gdlr-core-item-pdb  gdlr-core-code-item-light\"  ><div class=\"gdlr-core-code-item-content gdlr-core-content-font gdlr-core-skin-e-background gdlr-core-skin-e-content gdlr-core-skin-border\"><p>docker-compose up -d<\/p>\n<\/div><\/div><\/p>\n<p data-start=\"1763\" data-end=\"1773\">This will:<\/p>\n<ul data-start=\"1774\" data-end=\"1855\">\n<li data-start=\"1774\" data-end=\"1800\">\n<p data-start=\"1776\" data-end=\"1800\">Pull the required images<\/p>\n<\/li>\n<li data-start=\"1801\" data-end=\"1824\">\n<p data-start=\"1803\" data-end=\"1824\">Create the containers<\/p>\n<\/li>\n<li data-start=\"1825\" data-end=\"1855\">\n<p data-start=\"1827\" data-end=\"1855\">Start the entire Wazuh stack<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"1857\" data-end=\"1900\">The first startup may take a few minutes.<\/p>\n<p data-start=\"1902\" data-end=\"1925\">Check container status:<\/p>\n<p data-start=\"1902\" data-end=\"1925\"><div class=\"gdlr-core-code-item gdlr-core-item-pdb  gdlr-core-code-item-light\"  ><div class=\"gdlr-core-code-item-content gdlr-core-content-font gdlr-core-skin-e-background gdlr-core-skin-e-content gdlr-core-skin-border\"><p>docker ps<\/p>\n<\/div><\/div><\/p>\n<p data-start=\"1902\" data-end=\"1925\">You should see all Wazuh-related containers running.<\/p>\n<div class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" class=\"wpa-warning wpa-image-missing-alt alignleft wp-image-4821\" src=\"https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_1.png\" alt=\"Wazuh_1\" width=\"800\" height=\"450\" data-warning=\"Missing alt text\" srcset=\"https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_1.png 1280w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_1-300x169.png 300w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_1-1024x576.png 1024w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_1-768x432.png 768w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/div>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<h3 data-start=\"2008\" data-end=\"2052\"><\/h3>\n<p data-start=\"2008\" data-end=\"2052\"><strong data-start=\"2014\" data-end=\"2052\">Step 4: Access the Wazuh Dashboard<\/strong><\/p>\n<p data-start=\"2054\" data-end=\"2111\">Once everything is up, open your browser and navigate to:<\/p>\n<p data-start=\"2054\" data-end=\"2111\"><div class=\"gdlr-core-code-item gdlr-core-item-pdb  gdlr-core-code-item-light\"  ><div class=\"gdlr-core-code-item-content gdlr-core-content-font gdlr-core-skin-e-background gdlr-core-skin-e-content gdlr-core-skin-border\"><p>https:\/\/localhost or https:\/\/your-server-ip<\/p>\n<\/div><\/div><\/p>\n<p data-start=\"2176\" data-end=\"2200\">Default Credentials:<\/p>\n<ul data-start=\"2201\" data-end=\"2248\">\n<li data-start=\"2201\" data-end=\"2224\">\n<p data-start=\"2203\" data-end=\"2224\"><strong data-start=\"2203\" data-end=\"2216\">Username:<\/strong> <code data-start=\"2217\" data-end=\"2224\">admin<\/code><\/p>\n<\/li>\n<li data-start=\"2225\" data-end=\"2248\">\n<p data-start=\"2227\" data-end=\"2248\"><strong data-start=\"2227\" data-end=\"2240\">Password:<\/strong> <code data-start=\"2241\" data-end=\"2248\">admin<\/code><\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2250\" data-end=\"2336\"><strong data-start=\"2253\" data-end=\"2267\">Important: <\/strong><strong>Change the default credentials immediately after your first login.<\/strong><\/p>\n<p data-start=\"2250\" data-end=\"2336\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-4825\" src=\"https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_2.png\" alt=\"Wazuh_2\" width=\"800\" height=\"450\" srcset=\"https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_2.png 1280w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_2-300x169.png 300w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_2-1024x576.png 1024w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/Wazuh_2-768x432.png 768w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<p data-start=\"2250\" data-end=\"2336\"><strong data-start=\"2349\" data-end=\"2372\">What You Should See<\/strong><\/p>\n<p data-start=\"2374\" data-end=\"2414\">Inside the Wazuh Dashboard, you\u2019ll find:<\/p>\n<ul data-start=\"2415\" data-end=\"2530\">\n<li data-start=\"2415\" data-end=\"2432\">\n<p data-start=\"2417\" data-end=\"2432\">Security alerts<\/p>\n<\/li>\n<li data-start=\"2433\" data-end=\"2458\">\n<p data-start=\"2435\" data-end=\"2458\">System and agent status<\/p>\n<\/li>\n<li data-start=\"2459\" data-end=\"2494\">\n<p data-start=\"2461\" data-end=\"2494\">Compliance and vulnerability data<\/p>\n<\/li>\n<li data-start=\"2495\" data-end=\"2530\">\n<p data-start=\"2497\" data-end=\"2530\">File integrity monitoring results<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2532\" data-end=\"2598\">At this point, <strong data-start=\"2547\" data-end=\"2577\">Wazuh is fully operational <\/strong>&#8211; even without agents.<\/p>\n<p data-start=\"2605\" data-end=\"2628\"><strong data-start=\"2611\" data-end=\"2628\">Security Note<\/strong><\/p>\n<p data-start=\"2630\" data-end=\"2664\">This Docker setup is intended for:<\/p>\n<ul data-start=\"2665\" data-end=\"2707\">\n<li data-start=\"2665\" data-end=\"2675\">\n<p data-start=\"2667\" data-end=\"2675\">Learning<\/p>\n<\/li>\n<li data-start=\"2676\" data-end=\"2685\">\n<p data-start=\"2678\" data-end=\"2685\">Testing<\/p>\n<\/li>\n<li data-start=\"2686\" data-end=\"2707\">\n<p data-start=\"2688\" data-end=\"2707\">Internal monitoring<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2709\" data-end=\"2740\">For production use, you should:<\/p>\n<ul data-start=\"2741\" data-end=\"2850\">\n<li data-start=\"2741\" data-end=\"2763\">\n<p data-start=\"2743\" data-end=\"2763\">Enable TLS hardening<\/p>\n<\/li>\n<li data-start=\"2764\" data-end=\"2790\">\n<p data-start=\"2766\" data-end=\"2790\">Change default passwords<\/p>\n<\/li>\n<li data-start=\"2791\" data-end=\"2815\">\n<p data-start=\"2793\" data-end=\"2815\">Restrict exposed ports<\/p>\n<\/li>\n<li data-start=\"2816\" data-end=\"2850\">\n<p data-start=\"2818\" data-end=\"2850\">Consider a multi-node deployment<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3043\" data-end=\"3063\"><strong data-start=\"3049\" data-end=\"3063\">Conclusion<\/strong><\/p>\n<p data-start=\"3065\" data-end=\"3281\">You now have a working <strong data-start=\"3088\" data-end=\"3132\">Wazuh SIEM environment running on Docker<\/strong>. This setup provides a fast and flexible way to explore security monitoring, log analysis, and threat detection without complex manual installation.<\/p>\n<p data-start=\"2857\" data-end=\"2896\"><strong data-start=\"2863\" data-end=\"2896\">What\u2019s Next? (Part 3 Preview)<\/strong><\/p>\n<p data-start=\"2898\" data-end=\"2925\">In <strong data-start=\"2901\" data-end=\"2911\">Part 3<\/strong>, we\u2019ll cover:<\/p>\n<ul data-start=\"2926\" data-end=\"3036\">\n<li data-start=\"2926\" data-end=\"2947\">\n<p data-start=\"2928\" data-end=\"2947\">Adding Wazuh agents<\/p>\n<\/li>\n<li data-start=\"2948\" data-end=\"2973\">\n<p data-start=\"2950\" data-end=\"2973\">Monitoring real systems<\/p>\n<\/li>\n<li data-start=\"2974\" data-end=\"3006\">\n<p data-start=\"2976\" data-end=\"3006\">Basic alerting and rule tuning<\/p>\n<\/li>\n<li data-start=\"3007\" data-end=\"3036\">\n<p data-start=\"3009\" data-end=\"3036\">Common troubleshooting tips<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3065\" data-end=\"3281\">","protected":false},"excerpt":{"rendered":"<p>In Part 1, we covered the basics of Docker and Wazuh and explained how they work together.In this part, we\u2019ll move from theory to practice and deploy a fully working Wazuh environment using Docker. This setup is ideal for: Testing and learning Home labs Small to medium monitoring environments Prerequisites Recap Before we begin, make [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4831,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,78,74,3,4],"tags":[79,149,109,152,151,150,113,117,153,108,148],"class_list":["post-4820","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-data-privacy-protection","category-digital-transformation","category-how-to-guides","category-tech-insights-trends","tag-cybersecurity","tag-devops-security","tag-docker","tag-infrastructure-security","tag-log-monitoring","tag-open-source-security","tag-security-monitoring","tag-siem","tag-soc-tools","tag-wazuh","tag-wazuh-docker"],"_links":{"self":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/comments?post=4820"}],"version-history":[{"count":5,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4820\/revisions"}],"predecessor-version":[{"id":4886,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4820\/revisions\/4886"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media\/4831"}],"wp:attachment":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media?parent=4820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/categories?post=4820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/tags?post=4820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}