This repository provides an automated, verified setup script for installing the Wazuh Agent along with essential security tools. The installer verifies script integrity using SHA256 checksums before execution.
- Verified Downloads: SHA256 checksum verification protects against tampering
- Automated Installation: One-command setup of Wazuh agent and all dependencies
- Cross-Platform Support: Compatible with Linux, macOS, and Windows
- Security Tools Integration: Pre-configured with Yara and Suricata/Snort for enhanced threat detection
- USB DLP Protection: Active Response scripts for USB device control
| Platform | Versions |
|---|---|
| Linux | Ubuntu, Debian, RHEL, CentOS, Alpine, openSUSE |
| macOS | Intel (x86_64) and Apple Silicon (arm64) |
| Windows | Windows 10/11, Windows Server 2016+ |
# Set your Wazuh Manager address
export WAZUH_MANAGER="wazuh.your-company.com"
# Run the verified installer
curl -fsSL https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/install.sh | bashWith options:
# Install with Suricata in IPS mode
curl -fsSL https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/install.sh | bash -s -- -s ips
# Install with Snort instead of Suricata
curl -fsSL https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/install.sh | bash -s -- -n
# Install with Trivy vulnerability scanner
curl -fsSL https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/install.sh | bash -s -- -s ids -t# Set your Wazuh Manager address
$env:WAZUH_MANAGER = "wazuh.your-company.com"
# Run the verified installer
irm https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/install.ps1 | iexOr download and run with options:
$env:WAZUH_MANAGER = "wazuh.your-company.com"
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/install.ps1" -OutFile install.ps1
.\install.ps1 -InstallSuricataThe installer automatically:
- Downloads
checksums.sha256from the repository - Downloads the setup script
- Verifies the SHA256 checksum matches
- Only executes if verification passes
┌─────────────────────────────────────────────────────────┐
│ VERIFICATION FLOW │
├─────────────────────────────────────────────────────────┤
│ │
│ You run: curl .../install.sh | bash │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────┐ │
│ │ 1. Download checksums.sha256 │ │
│ │ 2. Download setup-agent.sh │ │
│ │ 3. Calculate SHA256 of downloaded script │ │
│ │ 4. Compare with expected checksum │ │
│ │ │ │
│ │ ✓ Match → Execute script │ │
│ │ ✗ Mismatch → Abort + Alert │ │
│ └──────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────┘
| Option | Description |
|---|---|
-s ids |
Install Suricata in IDS mode (detection only) |
-s ips |
Install Suricata in IPS mode (detection + prevention) |
-n |
Install Snort instead of Suricata |
-t |
Also install Trivy vulnerability scanner |
-h |
Show help message |
| Parameter | Description |
|---|---|
-InstallSuricata |
Install Suricata as NIDS (default) |
-InstallSnort |
Install Snort as NIDS |
-SkipVerify |
Skip checksum verification (not recommended) |
-Help |
Show help message |
| Variable | Required | Default | Description |
|---|---|---|---|
WAZUH_MANAGER |
Yes | wazuh.example.com |
Wazuh Manager hostname or IP |
WAZUH_AGENT_VERSION |
No | 4.13.1-1 |
Wazuh Agent version |
WAZUH_AGENT_NAME |
No | $(hostname) |
Agent registration name |
See docs/ENVIRONMENT_VARIABLES.md for the complete reference.
- Wazuh Agent - Endpoint monitoring and data collection
- Wazuh Cert OAuth2 - Certificate-based authentication
- Wazuh Agent Status - Agent health monitoring
- Yara - Malware signature scanning
- USB DLP Scripts - Active Response for USB device control
- Suricata (default) - IDS/IPS with multi-threading
- Snort - Classic lightweight IDS
- Trivy - Container vulnerability scanning
For step-by-step instructions with screenshots:
| Script | Platform | Description |
|---|---|---|
install.sh |
Linux/macOS | Bootstrap installer - downloads, verifies, executes |
install.ps1 |
Windows | Bootstrap installer - downloads, verifies, executes |
scripts/setup-agent.sh |
Linux/macOS | Full agent setup with all components |
scripts/setup-agent.ps1 |
Windows | Full agent setup with all components |
scripts/install.sh |
Linux/macOS | Core Wazuh agent installation only |
scripts/install.ps1 |
Windows | Core Wazuh agent installation only |
scripts/deps.sh |
Linux/macOS | Dependency installation |
scripts/deps.ps1 |
Windows | Dependency installation |
scripts/uninstall-agent.sh |
Linux/macOS | Complete uninstallation |
scripts/uninstall-agent.ps1 |
Windows | Complete uninstallation |
The installer deploys Active Response scripts that:
- Block USB mass storage devices (prevents data exfiltration)
- Detect BadUSB/Rubber Ducky attacks (HID device monitoring)
- Collect forensic evidence for security analysis
MITRE ATT&CK Coverage:
- T1052.001: Exfiltration Over Physical Medium
- T1200: Hardware Additions
All downloaded components are verified using SHA256 checksums:
- Protects against man-in-the-middle attacks
- Detects compromised or tampered files
- Ensures you run exactly what was released
"WAZUH_MANAGER is not set"
export WAZUH_MANAGER="your-manager-address.com"Checksum verification failed
- This could indicate tampering - do NOT proceed
- Report to your security team
- Try downloading from a different network
Permission denied
# Linux/macOS: Run with sudo
sudo bash install.sh
# Windows: Run PowerShell as Administrator| Platform | Log Path |
|---|---|
| Linux | /var/ossec/logs/ossec.log |
| macOS | /Library/Ossec/logs/ossec.log |
| Windows | C:\Program Files (x86)\ossec-agent\ossec.log |
curl -fsSL https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/scripts/uninstall-agent.sh | sudo bashirm https://raw.githubusercontent.com/ADORSYS-GIS/wazuh-agent/main/scripts/uninstall-agent.ps1 | iexSee CONTRIBUTING.md for guidelines.
This project is licensed under the MIT License.