[{"data":1,"prerenderedAt":202},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-wazuh-on-a-vps-full-soc-in-under-an-hour-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-self-host-wazuh-on-a-vps-full-soc-in-under-an-hour-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":139,"ctaBody":140,"ctaButton":141,"ctaUrl":142,"relatedPosts":143},437,"self-host-wazuh-on-a-vps-full-soc-in-under-an-hour",{"fr":12,"en":10,"ar":13,"es":14},"self-host-wazuh-vps","استضافة-wazuh-على-vps-siem-مراقبة-أمنية-شاملة","self-host-wazuh-en-vps-soc-completo-en-menos-de-una-hora","Self-host Wazuh on a VPS: full SOC in under an hour","Deploy Wazuh 4.14 as a single node via Docker Compose on your VPS. Log management, incident detection and NIS2 art. 21 compliance under your control.",9,0,false,"2026-10-13T00:00:00+00:00","2026-10-13T14:10:28+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-wazuh-vps-poster.svg","The NIS2 directive requires essential and important entities to implement logging, monitoring and incident response tools (article 21). At the same time, recent CVEs on Jira, Confluence and GitLab are a reminder that an unobserved perimeter is a silently compromised one. Wazuh is an active open source SIEM that covers exactly these three requirements — and its official Docker Compose distribution allows you to deploy it on a single VPS node in under an hour, with no prior security infrastructure expertise.",[35,39,68,71,82,113,116,119,122,125,128,131],{"type":36,"title":37,"body":38},"h2","Why Wazuh for NIS2 art. 21 compliance","Article 21 of NIS2 mandates four capabilities: event logging, incident detection, response, and notification. Wazuh covers the first three natively — log collection, detection rules, active response — and its dashboard produces the audit reports needed for the fourth. Unlike a SaaS SIEM, data stays on your infrastructure: no transfer to third-party servers, which also simplifies GDPR compliance for entities processing personal data. Version 4.14.8 (released September 25, 2026) is the current stable release; it bundles the Wazuh manager, indexer (OpenSearch-based search engine) and dashboard in a single Docker Compose stack.",{"type":40,"title":41,"headers":42,"rows":47},"comparison","Wazuh vs self-hosted SIEM alternatives",[43,44,45,46],"Tool","License","Deployment stack","NIS2 art. 21 coverage",[48,53,58,63],[49,50,51,52],"Wazuh 4.14","GPLv2 (manager) \u002F Apache 2 (indexer)","Official Docker Compose","Logging + detection + active response",[54,55,56,57],"Elastic SIEM","SSPL (Elastic Stack)","Docker or packages","Logging + detection (response via external SOAR)",[59,60,61,62],"Graylog Open","SSPL","Docker Compose","Logging (limited detection without plugins)",[64,65,66,67],"Security Onion","GPLv2","Bare-metal ISO or VM","Full coverage but requires a dedicated server",{"type":36,"title":69,"body":70},"Hardware and software prerequisites","The official requirements for a single-node deployment covering up to 25 agents are: 4 vCPU, 8 GB RAM and 50 GB storage (for 90 days of indexed data). A mid-range VPS is sufficient for a team monitoring up to 25 endpoints or servers; beyond 50 agents, move to 8 vCPU and consider an additional volume. On the software side, you need Docker Engine (version 24 minimum), Docker Compose v2, and Git. The Linux kernel must allow at least 262,144 virtual memory areas for the indexer — without this the service refuses to start.",{"type":72,"title":73,"items":74},"ul","What Wazuh monitors as soon as agents are enabled",[75,76,77,78,79,80,81],"**File integrity monitoring (FIM)** — detects any modification, creation or deletion on critical paths (`\u002Fetc`, `\u002Fbin`, `\u002Fusr\u002Fbin` by default)","**System logs** — collects and indexes authentication logs, syslog, journald and configured application logs","**Configuration assessment (SCA)** — compares actual system state to CIS benchmarks for Ubuntu, Debian, RHEL and Windows","**Rootkit detection** — analyzes hidden processes and kernel anomalies via `rootcheck`","**Vulnerability detection** — correlates installed packages on agents with CVEs from the National Vulnerability Database","**Active response** — automatically blocks an IP after N failed authentication attempts, without a third-party SOAR agent","**Cloud logs** — ingests AWS CloudTrail, Azure Activity Log and GCP Audit Log events via dedicated modules",{"type":83,"title":84,"steps":85},"steps","Step-by-step deployment on a Debian\u002FUbuntu VPS",[86,89,92,95,98,101,104,107,110],{"title":87,"body":88},"Prepare the system","Update packages and install dependencies:\n```\napt update && apt upgrade -y\napt install -y docker.io docker-compose-v2 git curl\nsystemctl enable --now docker\n```\nAdd your non-root user to the docker group if needed:\n```\nusermod -aG docker $USER\n```",{"title":90,"body":91},"Configure vm.max_map_count","The Wazuh indexer (OpenSearch) requires at least 262,144 virtual memory areas. Apply the parameter immediately and make it permanent:\n```\nsysctl -w vm.max_map_count=262144\necho 'vm.max_map_count=262144' >> \u002Fetc\u002Fsysctl.conf\n```\nWithout this step, the `wazuh.indexer` container stops with the error `max virtual memory areas vm.max_map_count [65530] is too low`.",{"title":93,"body":94},"Clone the official repository","Clone the branch matching the current stable version:\n```\ngit clone https:\u002F\u002Fgithub.com\u002Fwazuh\u002Fwazuh-docker.git -b v4.14.8\ncd wazuh-docker\u002Fsingle-node\u002F\n```\nThe `single-node\u002F` directory contains the main `docker-compose.yml` and the `generate-indexer-certs.yml` needed in the next step.",{"title":96,"body":97},"Generate TLS inter-service certificates","Wazuh encrypts all internal communications (manager → indexer → dashboard). Generate certificates with the provided utility:\n```\ndocker compose -f generate-indexer-certs.yml run --rm generator\n```\nCertificates are placed in `config\u002Fwazuh_indexer_ssl_certs\u002F`. Do not regenerate them without recreating the entire stack — certificates are mutually signed.",{"title":99,"body":100},"Start the stack","Launch all three services in the background:\n```\ndocker compose up -d\n```\nFollow the startup in real time:\n```\ndocker compose logs -f\n```\nThe indexer needs about 60 seconds to be ready. Wait for the line `Node 'node-1' initialized` before continuing.",{"title":102,"body":103},"Access the dashboard and change the password","Open `https:\u002F\u002FYOUR-VPS-IP` in your browser. Accept the self-signed certificate warning for the first connection. Default credentials: user `admin`, password `SecretPassword`. Change the password immediately via **Security → Internal users → admin → Edit**. For command-line automation:\n```\ndocker exec -it single-node-wazuh.manager-1 \\\n  \u002Fvar\u002Fossec\u002Fbin\u002Fwazuh-passwords-tool.sh \\\n  -u admin -p 'NewPassword!'\n```",{"title":105,"body":106},"Open the required firewall ports","On the VPS, allow inbound traffic for agents and the dashboard:\n```\nufw allow 443\u002Ftcp   # Dashboard HTTPS\nufw allow 1514\u002Ftcp  # Agents (Wazuh protocol)\nufw allow 1515\u002Ftcp  # Agent registration\nufw allow 514\u002Fudp   # Syslog reception\nufw allow 55000\u002Ftcp # Wazuh REST API (restrict to your IPs)\nufw enable\n```\nRestrict port 55000 to your management IPs only (`ufw allow from 203.0.113.10 to any port 55000`).",{"title":108,"body":109},"Install the Wazuh agent on a server to monitor","On each machine to observe, install the agent and point it at your VPS. Example on Debian\u002FUbuntu:\n```\ncurl -s https:\u002F\u002Fpackages.wazuh.com\u002Fkey\u002FGPG-KEY-WAZUH | gpg --dearmor \\\n  -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Fwazuh.gpg\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Fwazuh.gpg] \\\n  https:\u002F\u002Fpackages.wazuh.com\u002F4.x\u002Fapt\u002F stable main\" \\\n  > \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fwazuh.list\napt update && apt install -y wazuh-agent\nWAZUH_MANAGER='YOUR-VPS-IP' \\\nWAZUH_AGENT_NAME='your-server-01' \\\n  dpkg-reconfigure wazuh-agent\nsystemctl enable --now wazuh-agent\n```\nThe agent appears in the dashboard under **Agents** within 30 seconds of registration.",{"title":111,"body":112},"Further reading — related guides","To strengthen your security posture beyond Wazuh, see our related guides: **[nis2-securite-informatique-hebergement-obligations]** for detailed legal obligations, **[crowdsec-vs-fail2ban-securite-vps]** for collaborative upstream network-level blocking, and **[zitadel-sso-self-hosted-vps]** to centralize authentication and reduce the attack surface on your Wazuh dashboard.",{"type":36,"title":114,"body":115},"Single-node stack architecture","The official Docker Compose stack deploys three interdependent services. The **Wazuh manager** is the core: it receives events from agents on port 1514, applies detection rules, triggers active responses and forwards alerts to the indexer. The **Wazuh indexer** (OpenSearch) stores and makes those alerts searchable; it communicates with the manager on port 9200 and requires the kernel resources specific to a search engine. The **Wazuh dashboard** exposes the user interface on port 443 and queries the indexer over HTTPS. All three services share self-signed TLS certificates generated during the preparation step; modifying one without regenerating the others causes mutual validation errors. Persistent data — manager configuration, alert queue, index data — is stored in named Docker volumes, decoupled from the container lifecycle: an update by image replacement does not lose historical data.",{"type":36,"title":117,"body":118},"Configuring retention and email alerts","By default, Wazuh retains data for 90 days. To adjust retention, modify the `max_age` parameter in the indexer ISM policy, accessible via **Index Management → Policies** in the dashboard. You can extend retention to 180 days to meet NIS2 log retention requirements, or reduce it to 30 days on a storage-constrained VPS. For email alerts, edit `\u002Fvar\u002Fossec\u002Fetc\u002Fossec.conf` in the manager container — add an `\u003Cemail_notification>` block with your SMTP server and desired alert levels (level 7 and above is a good starting point for critical alerts, level 5 to include medium alerts). Wazuh can also send notifications via webhooks to Slack, Teams or PagerDuty through its integration mechanism. Restart the manager after each configuration change:\n```\ndocker compose restart wazuh.manager\n```",{"type":36,"title":120,"body":121},"Generating NIS2 \u002F GDPR compliance reports","The Wazuh dashboard includes dedicated dashboards for compliance frameworks: GDPR, PCI DSS, HIPAA and NIST 800-53. These dashboards allow you to export PDF reports listing covered controls and associated events — useful for justifying your posture to an auditor or a NIS2 competent authority. For NIS2 specifically, use the GDPR view as a base (logging and detection obligations overlap significantly) and complement it with incident detection rules classified by Mitre ATT&CK category available under **Threat intelligence → Mitre ATT&CK**. NIS2 requires notification within 72 hours of detecting a significant incident: configure level-12 (critical) alerts to trigger an immediate notification — Wazuh includes ready-to-use rules for known CVE exploitation attempts, lateral movement and privilege escalation. The **Security events** overview filtered by agent provides the chronological context needed to draft the regulatory notification.",{"type":123,"body":124},"tip","Enable the strong password policy in Wazuh as soon as it is installed: under **Security → Security settings**, check 'Require complex passwords' and 'Enable audit logging'. Both options are disabled by default and must be enabled manually before going to production.",{"type":36,"title":126,"body":127},"Updating Wazuh without losing data","Indexer data is persisted in named Docker volumes. The update procedure consists of cloning the new version of the repository into a separate directory, copying the existing volumes, then restarting the stack. The official documentation recommends backing up volumes before any major update:\n```\ndocker run --rm \\\n  -v single-node_wazuh-indexer-data:\u002Fdata \\\n  -v $(pwd)\u002Fbackup:\u002Fbackup \\\n  alpine tar czf \u002Fbackup\u002Findexer-data-$(date +%Y%m%d).tar.gz \u002Fdata\n```\nFor a minor version update (e.g. 4.14.7 → 4.14.8), simply update the tag in `docker-compose.yml` and restart with `docker compose up -d --pull always`.",{"type":36,"title":129,"body":130},"Troubleshooting — common errors","Here are the five most common errors during a first Wazuh Docker deployment, with their causes and remedies.",{"type":72,"title":132,"items":133},"Frequent errors and remedies",[134,135,136,137,138],"**`max virtual memory areas vm.max_map_count [65530] is too low`** — The kernel parameter was not applied. Run `sysctl -w vm.max_map_count=262144` and verify with `sysctl vm.max_map_count` before restarting the stack.","**`Connection refused` on port 443 after `docker compose up -d`** — The indexer is not yet ready. Wait 60 to 90 seconds and check `docker compose logs wazuh.indexer` to confirm node initialization.","**`Agent disconnected` right after registration** — Port 1514\u002FTCP or 1515\u002FTCP is blocked on the VPS side. Check `ufw status` and your hosting provider's network security rules (cloud security groups).","**`certificate verify failed` in dashboard logs** — Auto-generated certificates do not match the IP or hostname being used. Regenerate certificates (`docker compose -f generate-indexer-certs.yml run --rm generator`) after verifying that `WAZUH_DASHBOARD_HOST` in `docker-compose.yml` matches your IP or domain name.","**`Wazuh API 401 Unauthorized`** — The `admin` password change was not propagated to the dashboard configuration. After modifying the password, also update `DASHBOARD_PASSWORD` in the `.env` file or in the `wazuh.dashboard` service environment variables, then restart with `docker compose restart wazuh.dashboard`.","A VPS built for Wazuh","Our professional VPS configurations are optimized for SIEM workloads: 8 vCPU, 16 GB RAM, fast NVMe storage and isolated networking. Deploy Wazuh in production with the bandwidth and resources it deserves.","View professional plans","\u002Fsolutions\u002Fprofessionnels",[144,162,185],{"id":145,"slug":146,"slugs":147,"title":150,"excerpt":151,"readTime":152,"views":18,"isPinned":19,"publishedAt":153,"updatedAt":21,"category":154,"categories":159,"featuredImage":30,"bgImage":31,"posterImage":161,"relatedSolution":30},433,"nis2-cybersecurity-hosting-obligations",{"fr":148,"en":146,"ar":146,"es":149},"nis2-securite-informatique-hebergement-obligations","nis2-seguridad-informatica-alojamiento-obligaciones","NIS2 and hosting: technical obligations in 2026","Which Article 21 NIS2 obligations apply to your VPS infrastructure? A technical guide for essential and important entities in 2026.",11,"2026-10-11T00:00:00+00:00",{"id":155,"name":156,"slug":157,"color":158,"icon":157},10,"Compliance & Regulation","conformite","bg-amber-500\u002F10 text-amber-400",[160],{"id":155,"name":156,"slug":157,"color":158,"icon":157},"\u002Fblog\u002Fcovers\u002Fnis2-securite-informatique-hebergement-obligations-poster.svg",{"id":163,"slug":164,"slugs":165,"title":169,"excerpt":170,"readTime":171,"views":172,"isPinned":19,"publishedAt":173,"updatedAt":174,"category":175,"categories":180,"featuredImage":30,"bgImage":31,"posterImage":182,"relatedSolution":183},348,"crowdsec-vs-fail2ban-which-to-choose-for-your-vps",{"fr":166,"en":164,"ar":167,"es":168},"crowdsec-vs-fail2ban-securite-vps","crowdsec-مقابل-fail2ban-ايهما-تختار-لخادمك","crowdsec-vs-fail2ban-cual-elegir-para-tu-vps","CrowdSec vs Fail2ban: Which One to Choose for Your VPS","CrowdSec or Fail2ban on your Linux VPS? Comparison by use case: community blocklist or local simplicity — the decision tree to choose the right tool.",7,3,"2026-09-11T00:00:00+00:00","2026-09-11T11:34:13+00:00",{"id":176,"name":177,"slug":178,"color":179,"icon":178},5,"Comparison","comparatif","bg-info\u002F10 text-info",[181],{"id":176,"name":177,"slug":178,"color":179,"icon":178},"\u002Fblog\u002Fcovers\u002Fcrowdsec-vs-fail2ban-securite-vps-poster.svg",{"categorySlug":184,"appSlug":30},"cybersecurity-bastion",{"id":186,"slug":187,"slugs":188,"title":192,"excerpt":193,"readTime":194,"views":18,"isPinned":19,"publishedAt":195,"updatedAt":21,"category":196,"categories":197,"featuredImage":30,"bgImage":31,"posterImage":199,"relatedSolution":200},435,"self-hosting-zitadel-vps-multi-tenant-sso",{"fr":189,"en":187,"ar":190,"es":191},"zitadel-sso-self-hosted-vps","استضافة-zitadel-على-vps-sso-متعدد-المستأجرين","zitadel-vps-sso-multi-tenant-sin-keycloak","Self-Hosting ZITADEL on a VPS: Multi-Tenant SSO Without Keycloak","Deploy ZITADEL on your VPS with Docker Compose: cloud-native IAM in Go, native multi-tenancy, OIDC, OAuth2, SAML and Passkeys — without Keycloak's complexity.",14,"2026-10-12T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[198],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fzitadel-sso-self-hosted-vps-poster.svg",{"categorySlug":184,"appSlug":201},"zitadel",1791901054718]