Run Wazuh, a Free SIEM, With Docker
0 / 7 steps
The goal
Stand up Wazuh — a genuinely free, open-source SIEM/XDR — on your own machine with Docker, log in, and get your first look at security events, MITRE ATT&CK mapping and vulnerability detection. Unlike a trial, this one you can run forever at zero cost, so it’s the natural free companion to the Splunk lab — same SOC skills, no licence clock.
Local lab, and it’s hungry. The Wazuh stack (indexer + manager + dashboard) wants about 8 GB of RAM and runs on localhost over a self-signed certificate — your browser will warn you, and that is expected on a local lab. Keep it on your own machine; never expose these ports to the internet.
New to Docker? Do the Build a Security Lab With Docker lab first — this one uses Docker Compose to run several containers at once, and that lab covers the basics it builds on.
Indexer crash-looping? The 50-second fix on YouTube.
Steps
01Prep Docker and raise a kernel limit
Wazuh’s indexer is built on OpenSearch, which needs a higher memory-map limit than the default. On Linux (or the Docker Desktop VM) set it before you start:
$ sudo sysctl -w vm.max_map_count=262144
Confirm Docker and Docker Compose are available:
$ docker compose version
Make sure Docker Desktop is allotted at least 8 GB RAM (Settings → Resources on Win/macOS). On Windows/WSL2, set vm.max_map_count inside the WSL distro or via .wslconfig.
Why the sysctl. Without it the indexer container crashes on boot with a “max virtual memory areas too low” error — the single most common reason a Wazuh Docker deploy fails on the first try.
02Clone the official Wazuh Docker repo
Wazuh ships a ready-made single-node Compose setup. Clone it at a pinned version so you get a known-good stack, and move into the single-node folder.
$ git clone https://github.com/wazuh/wazuh-docker.git -b v4.14.7 && cd wazuh-docker/single-node/
Everything below runs from inside wazuh-docker/single-node/.
Why pin a version. -b v4.14.7 checks out a specific release instead of a moving branch, so the commands here match what you get. Bump the tag later once you know the stack.
03Generate the certificates
The indexer, manager and dashboard talk to each other over TLS, so Wazuh gives you a one-shot container that generates the self-signed certs they need.
$ docker compose -f generate-indexer-certs.yml run --rm generator
It runs once, writes the certificates into the config folder, and exits. You only do this on first setup.
Why a separate step. The main stack refuses to start without valid certs. Running the generator up front is what turns a pile of containers into a cluster that trusts itself.
04Start the stack
Now bring everything up in the background. First launch pulls several gigabytes of images and initialises the indexer, so give it a few minutes.
$ docker compose up -d
Watch the containers come up and stay healthy:
$ docker compose ps
You want the wazuh.indexer, wazuh.manager and wazuh.dashboard containers all running. If the indexer restarts in a loop, revisit the vm.max_map_count setting from Step 1.
What you just ran. One command launched a three-service SIEM cluster. That is exactly why Docker Compose matters — multi-container apps come up together, wired and networked, from a single file.
05Log in to the dashboard
Once the dashboard container is healthy, open it in your browser. It’s HTTPS with a self-signed cert, so accept the browser warning.
https://localhost:443
Log in with the default credentials — username admin, password SecretPassword. Change this immediately for anything beyond a throwaway lab.
The self-signed warning is normal. A local lab has no public certificate authority, so the browser can’t vouch for the cert. On localhost that’s fine — it’s the same reason your Splunk lab warned you too.
06Find your way around
Wazuh comes alive as soon as you feed it a host. The fastest win: look at the built-in modules, then enrol an agent to generate real events.
In the dashboard, open Security events to see detections, MITRE ATT&CK to see them mapped to techniques, and Vulnerability Detection and File Integrity Monitoring for the blue-team staples. To generate real data, add a Wazuh agent (Agents → Deploy new agent) on your own laptop or a VM. Watch the manager digest events with:
$ docker compose logs -f wazuh.manager
Why this is the payoff. Splunk teaches you search; Wazuh hands you detections, ATT&CK mapping and compliance dashboards out of the box. Between the two you’ve seen both sides of a modern SOC stack — and paid nothing.
07Stop, start, and clean up
Your data lives in Docker volumes, so you can stop and restart without losing it.
$ docker compose stop
Bring it back later from the same folder:
$ docker compose up -d
When you want it gone entirely, remove the containers (add -v to also wipe the stored data):
$ docker compose down
Only this stack. Run these from the single-node folder and Compose touches only Wazuh’s own containers and volumes — nothing else on your machine. That’s the throwaway-lab promise: spin it up, learn, tear it down clean.
You have a full open-source SIEM running for free, with detections and ATT&CK mapping ready to explore. Enrol a couple of agents next and watch real events flow in.
If it didn’t work
- The indexer keeps restarting. Nine times out of ten it’s the kernel limit from step 01 — and it resets on reboot. Make it permanent: echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf. On Docker Desktop for Windows, run the step 01 command inside the Docker VM instead: wsl -d docker-desktop sysctl -w vm.max_map_count=262144.
- The dashboard says it isn’t ready yet, or you get a 502. The three services start at different speeds. Give it two or three minutes, then check docker compose ps — all three should be up.
- “port is already allocated” on 443. Something else on your machine already serves HTTPS. Stop it, or change the host side of the 443 mapping in docker-compose.yml and browse to that port instead.
- Containers exit with memory errors. Wazuh wants around 8 GB of RAM for itself. On Docker Desktop, raise the memory limit under Settings → Resources.
Your turn — no walkthrough
Make Wazuh notice you. Enroll one agent — your Kali VM from Lab 00 is ideal — using the Deploy new agent wizard in the dashboard. Then, on that machine, fail a sudo password three times on purpose and find the alert those failures produced. The wizard and the Wazuh docs are allowed; this page is not.
Keep the evidence. Note the rule ID and description that fired, the MITRE ATT&CK technique Wazuh mapped it to, and the time it took from your last failed attempt to the alert appearing. Detection latency is a number real SOCs track.
What you learned
- Wazuh in one Compose stack — indexer + manager + dashboard, a real SIEM/XDR at zero cost.
- docker compose up / ps / logs / down — running and debugging a multi-container app.
- The vm.max_map_count gotcha — the fix for the classic indexer boot crash.
- Detections, ATT&CK mapping, FIM, vuln detection — the blue-team features Wazuh gives you out of the box.
- A free Splunk alternative — the same SOC skills without a licence clock.
Put it on your resume. Deployed the Wazuh SIEM/XDR in Docker and reviewed security events, MITRE ATT&CK mappings and vulnerability findings. Change it to match what you actually did.
Tried it? Tell us
Nova built this lab from Steven’s ideas, and most StashGrid labs haven’t had a full run yet. If a step broke, behaved differently for you, or you know a better way, tell us. Ideas for the next lab are welcome too — no promises on timing.
NextMore labs — feed real logs into your new SIEM→
Go deeper
- Lab 08 — enroll a Wazuh agent and catch real alerts — the next step once this stack is running
- Prerequisite: Build a Security Lab With Docker — the Compose basics this lab uses.
- Compare against the paid standard: Set Up Splunk Free With Docker.
- See detections mapped to attacker technique with the Cyber Kill Chain.
- Official docs: Wazuh on Docker and wazuh/wazuh-docker.
Part of the StashGrid SIEM / blue-team lab track, alongside the Splunk lab. Wazuh bumped a version or moved a menu? Tell me and I will fix it.