Run Wazuh, a Free SIEM, With Docker

Wazuh’s indexer is built on OpenSearch, which needs a higher memory-map limit than the default. On Linux (or the Docker Desktop VM) set it before you start:

$ sudo sysctl -w vm.max_map_count=262144

Confirm Docker and Docker Compose are available:

$ docker compose version

Make sure Docker Desktop is allotted at least 8 GB RAM (Settings → Resources on Win/macOS). On Windows/WSL2, set vm.max_map_count inside the WSL distro or via .wslconfig.

Why the sysctl. Without it the indexer container crashes on boot with a “max virtual memory areas too low” error — the single most common reason a Wazuh Docker deploy fails on the first try.

Wazuh ships a ready-made single-node Compose setup. Clone it at a pinned version so you get a known-good stack, and move into the single-node folder.

$ git clone https://github.com/wazuh/wazuh-docker.git -b v4.14.7 && cd wazuh-docker/single-node/

Everything below runs from inside wazuh-docker/single-node/.

Why pin a version. -b v4.14.7 checks out a specific release instead of a moving branch, so the commands here match what you get. Bump the tag later once you know the stack.

The indexer, manager and dashboard talk to each other over TLS, so Wazuh gives you a one-shot container that generates the self-signed certs they need.

$ docker compose -f generate-indexer-certs.yml run --rm generator

It runs once, writes the certificates into the config folder, and exits. You only do this on first setup.

Why a separate step. The main stack refuses to start without valid certs. Running the generator up front is what turns a pile of containers into a cluster that trusts itself.

Now bring everything up in the background. First launch pulls several gigabytes of images and initialises the indexer, so give it a few minutes.

$ docker compose up -d

Watch the containers come up and stay healthy:

$ docker compose ps

You want the wazuh.indexer, wazuh.manager and wazuh.dashboard containers all running. If the indexer restarts in a loop, revisit the vm.max_map_count setting from Step 1.

What you just ran. One command launched a three-service SIEM cluster. That is exactly why Docker Compose matters — multi-container apps come up together, wired and networked, from a single file.

Once the dashboard container is healthy, open it in your browser. It’s HTTPS with a self-signed cert, so accept the browser warning.

https://localhost:443

Log in with the default credentials — username admin, password SecretPassword. Change this immediately for anything beyond a throwaway lab.

The self-signed warning is normal. A local lab has no public certificate authority, so the browser can’t vouch for the cert. On localhost that’s fine — it’s the same reason your Splunk lab warned you too.

Wazuh comes alive as soon as you feed it a host. The fastest win: look at the built-in modules, then enrol an agent to generate real events.

In the dashboard, open Security events to see detections, MITRE ATT&CK to see them mapped to techniques, and Vulnerability Detection and File Integrity Monitoring for the blue-team staples. To generate real data, add a Wazuh agent (Agents → Deploy new agent) on your own laptop or a VM. Watch the manager digest events with:

$ docker compose logs -f wazuh.manager

Why this is the payoff. Splunk teaches you search; Wazuh hands you detections, ATT&CK mapping and compliance dashboards out of the box. Between the two you’ve seen both sides of a modern SOC stack — and paid nothing.

Your data lives in Docker volumes, so you can stop and restart without losing it.

$ docker compose stop

Bring it back later from the same folder:

$ docker compose up -d

When you want it gone entirely, remove the containers (add -v to also wipe the stored data):

$ docker compose down

Only this stack. Run these from the single-node folder and Compose touches only Wazuh’s own containers and volumes — nothing else on your machine. That’s the throwaway-lab promise: spin it up, learn, tear it down clean.