---
title: "Cloud server with Wazuh"
sidebar_label: "Wazuh"
sidebar_position: 16
toc_max_heading_level: 3
description: "How to create a cloud server for managing security events"
---

import EditIcon from '@selectel/docux/icons/edit'
import CheckIcon from '@selectel/docux/icons/check'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'
import CopyIcon from '@selectel/docux/icons/copy'
import CreateServer from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/applications/create-server-for-apps.mdx'

# Cloud server with Wazuh

Wazuh is a SIEM system for information protection and security event management. It prevents and identifies vulnerabilities using a security agent, detects threats, and responds to incidents.

You can [create a cloud server with the pre-installed Wazuh application](#create-cloud-server-with-wazuh). In Russia, the application runs on a cloud server with the [SelectOS 1 64-bit](https://selectos.selectel.ru/news/mega/) operating system configured. In other [countries](/infrastructure/locations.mdx#country) — Ubuntu 22.04.

Before creating a cloud server with an application, review the [software license agreements](https://423.selcdn.ru/kb/license-agreements-for-application-images-LANG.pdf) included in the image.

## Minimum resource requirements \{#minimum-requirements}

<CustomTable>
  <table>
    <thead>
      <th />

      <th>Up to 100 agents</th><th>From 100 agents</th>
    </thead>

    <tbody>
      <tr>
        <th>vCPU count</th><td>4</td><td>8</td>
      </tr>

      <tr>
        <th>RAM</th><td>8 GB</td><td>16 GB</td>
      </tr>

      <tr>
        <th>Boot volume</th><td>20 GB</td><td>40 GB</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Create a cloud server with Wazuh \{#create-cloud-server-with-wazuh}

For Wazuh to work, the cloud server must be accessible from the internet. To do this, when creating the server, you must create a private subnet and attach a public floating IP address.

To configure Wazuh, you must specify user data when creating the server — custom operating system configuration parameters. You can set one of two sets of parameters:

* with TLS certificate issuance;
* without TLS certificate issuance.

After the server with Wazuh is created, a free [TLS certificate from Let’s Encrypt®](/certificates-manager/certificates/lets-encrypt.mdx) will be automatically issued for the domain you specify. To issue the certificate, you need to add an A record for the domain and specify the server's public floating IP address as the record value. You can add the domain to [Selectel DNS Hosting (actual](/dns-hosting/)).

1. Optional: [create a public floating IP address](#create-floating-ip).

2. Optional: [add an A record for the domain](#add-a-record).

3. [Create a cloud server with Wazuh](#create-wazuh-server).

### 1. Optional: create a public floating IP address \{#create-floating-ip}

Create a public floating IP address so that the cloud server with Wazuh is accessible from the internet.

Use the [Create a public floating IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx#create-public-floating-ip) section of the [Public floating IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx) guide.

### 2. Optional: add an A record for the domain \{#add-a-record}

[Add a resource record](/dns-hosting/records/add-record.mdx) to access Wazuh by domain.

Specify:

* [resource record type](/dns-hosting/records/add-record.mdx#record-types) in the group — A;
* record value — the public floating IP address you [created in step 1](#create-floating-ip).

### 3. Create a cloud server with Wazuh \{#create-wazuh-server}

<CreateServer AppNameInPanel="Cloud Wazuh" MinConfig="4 vCPU, RAM starting from 8 GB and a boot disk size starting from 16 GB for 100 agents and less" OptionalVolumes="Optional: add an additional" VolumeSize="Specify the size of the network disk in GB or TB" />

<div style={{paddingLeft:'2em'}}>
  You can add additional [parameters](#settings):

  <Tabs queryString="add-user-data">
    <TabItem value="tls" default>
      <TabItemLabel>
        Creating a server with TLS certificate issuance
      </TabItemLabel>

      ```yaml
      #cloud-config

      write_files:
      - path: "/opt/gomplate/values/user-values.yaml"
        permissions: "0644"
        content: |
          admin_password: "<administrator_password>"
          wazuhDomain: <example.com>
          leEmail: <root@example.com>
          useLE: true
      ```

      Specify:

      * `<administrator_password>` — Wazuh administrator password. The password must contain:
        * more than eight characters;
        * at least one uppercase letter;
        * at least one lowercase letter;
        * at least one digit;
      * `<example.com>` — the domain for accessing Wazuh that you [added in step 2](#add-a-record);
      * `<root@example.com>` — Wazuh administrator email for account creation and Let’s Encrypt® notifications;
      * `useLE: true` — parameter for automatic TLS certificate issuance from Let’s Encrypt®.
    </TabItem>

    <TabItem value="no-tls">
      <TabItemLabel>
        Creating a server without TLS certificate issuance
      </TabItemLabel>

      ```yaml
      #cloud-config

      write_files:
      - path: "/opt/gomplate/values/user-values.yaml"
        permissions: "0644"
        content: |
          admin_password: "<administrator_password>"
      ```

      Specify:

      * `<administrator_password>` — Wazuh administrator password. The password must contain:
        * more than eight characters;
        * at least one uppercase letter;
        * at least one lowercase letter;
        * at least one digit.
    </TabItem>
  </Tabs>
</div>

## Parameters \{#settings}

To configure the Wazuh cloud server, you can specify parameters from the table in the **User data** field.

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Name</th><th>Type</th><th>Default value</th><th>Description</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <td>admin\_username</td><td>string</td><td>admin</td><td>Wazuh administrator name</td>
      </tr>

      <tr>
        <td>admin\_password</td><td>string</td><td>✗</td><td>Required parameter.<br />Wazuh administrator password. Must be more than eight characters, contain at least one uppercase and one lowercase letter, and at least one digit</td>
      </tr>

      <tr>
        <td>api\_username</td><td>string</td><td>wazuh-wui</td><td>Username for API access and internal component communication</td>
      </tr>

      <tr>
        <td>api\_password</td><td>string</td><td>✗</td><td>Password for API access and internal component communication. Must be 8 to 64 characters long and contain at least one uppercase letter, one lowercase letter, a digit, and a special character (!, ?, `@`, `#`, `$`, `%`, `^`, `&`, `*`). If left empty, a generated password will be used.</td>
      </tr>

      <tr>
        <td>dashboard\_username</td><td>string</td><td>kibanaserver</td><td>Username for communication between the dashboard and the data storage server</td>
      </tr>

      <tr>
        <td>dashboard\_password</td><td>string</td><td>✗</td><td>Password for communication between the dashboard and the data storage server. Must be more than eight characters, contain at least one uppercase and one lowercase letter, and at least one digit. If left empty, a generated password will be used.</td>
      </tr>

      <tr>
        <td>agent\_password</td><td>string</td><td>✗</td><td>Authentication password for agents on the management server. Must be more than eight characters, contain at least one uppercase and one lowercase letter, and at least one digit</td>
      </tr>

      <tr>
        <td>useLE</td><td>bool</td><td>false</td><td>Parameter for automatic TLS certificate issuance from Let’s Encrypt®: `true` — certificate will be issued; `false` — certificate will not be issued</td>
      </tr>

      <tr>
        <td>wazuhDomain</td><td>string</td><td>✗</td><td>Domain to access Wazuh for which a TLS certificate from Let’s Encrypt® will be automatically issued</td>
      </tr>

      <tr>
        <td>leEmail</td><td>string</td><td>✗</td><td>Wazuh administrator email for account creation and Let’s Encrypt® notifications</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />