Uptime monitoring for Wazuh SIEM platform

Wazuh is the security platform watching your infrastructure — collecting logs from every agent, running threat detection rules, alerting on suspicious activity, and feeding your security operations workflow. The bitter irony of any SIEM is that when the platform itself goes down, you go blind. Attackers know this. A Wazuh outage is not just a service disruption; it is an unmonitored window.

This tutorial covers production-grade uptime monitoring for Wazuh using Vigilmon. We will walk through:

• Monitoring the Wazuh API health endpoint
• Monitoring the Wazuh Dashboard (Kibana/OpenSearch Dashboards)
• SSL certificate monitoring
• Webhook alerts for DOWN/UP events
• Multi-node cluster monitoring

Prerequisites

• Wazuh 4.x running (all-in-one or distributed deployment)
• A free account at vigilmon.online

Part 1: Identify the Wazuh health endpoints

Wazuh exposes health checks across several components. Monitor each one independently so you know exactly which layer is failing.

Wazuh Manager API

The Wazuh Manager exposes a REST API on port 55000. The / endpoint returns API metadata when the manager is healthy:

curl -sk https://localhost:55000/ \
  -H "Authorization: Bearer $(curl -sk -X POST https://localhost:55000/security/user/authenticate \
    -H 'Content-Type: application/json' \
    -d '{"password":"<password>"}' \
    -u wazuh:wazuh | jq -r .data.token)"

For external monitoring without authentication, use the unauthenticated ping endpoint available in Wazuh 4.4+:

curl -sk https://wazuh-manager.example.com:55000/ping

Expected response:

{
  "title": "Wazuh API REST",
  "api_version": "4.9.0",
  "revision": 40924,
  "license_name": "GPL 2.0",
  "license_url": "https://github.com/wazuh/wazuh/blob/master/LICENSE",
  "hostname": "wazuh-manager",
  "timestamp": "2026-06-30T08:00:00Z"
}

For older Wazuh versions that require authentication, create a dedicated read-only monitoring user:

# Create a monitoring user via the Wazuh API
curl -sk -X POST https://localhost:55000/security/users \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "monitoring",
    "password": "M0nit0ring!2026",
    "allow_run_as": false
  }'

Wazuh Indexer (OpenSearch)

curl -sk -u admin:admin https://localhost:9200/_cluster/health | jq .status

Expected: "green" or "yellow" (yellow means replica shards are unassigned, which is normal on single-node deployments).

Wazuh Dashboard

curl -sk https://localhost:443/app/wazuh | head -1

A 200 response with HTML confirms the dashboard is serving the frontend.

Part 2: Expose endpoints for external monitoring

The Wazuh API and Dashboard typically run behind the same host. Use nginx to front them:

# /etc/nginx/sites-available/wazuh-monitor
server {
    listen 443 ssl;
    server_name wazuh.example.com;

    ssl_certificate /etc/letsencrypt/live/wazuh.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/wazuh.example.com/privkey.pem;

    # Expose Wazuh API ping for external health checks
    location /api/ping {
        proxy_pass https://localhost:55000/ping;
        proxy_ssl_verify off;
        proxy_set_header Host $host;
    }

    # Expose Indexer cluster health
    location /indexer/health {
        proxy_pass https://localhost:9200/_cluster/health;
        proxy_ssl_verify off;
        proxy_http_version 1.1;
    }

    # Dashboard (auth required)
    location / {
        proxy_pass https://localhost:443;
        proxy_ssl_verify off;
        proxy_set_header Host $host;
    }
}

Part 3: Set up HTTP monitoring in Vigilmon

Monitor the Wazuh Manager API

1. Log in to vigilmon.online and click Add Monitor.
2. Choose HTTP(S) monitor.
3. Enter: https://wazuh.example.com/api/ping
4. Set interval to 1 minute.
5. Add a keyword check: must contain Wazuh API REST.
6. Add your alert channel.
7. Click Save.

Monitor the Wazuh Indexer

1. Click Add Monitor → HTTP(S) monitor.
2. Enter: https://wazuh.example.com/indexer/health
3. Set interval to 2 minutes.
4. Add a keyword check: must contain "status":"green" or "status":"yellow".
5. Click Save.

Monitor the Wazuh Dashboard

1. Click Add Monitor → HTTP(S) monitor.
2. Enter: https://wazuh.example.com/
3. Set interval to 2 minutes.
4. Add a keyword check: must contain Wazuh.
5. Click Save.

| Monitor | URL | Check | |---------|-----|-------| | Wazuh Manager API | /api/ping | keyword: Wazuh API REST | | Wazuh Indexer | /indexer/health | keyword: "status":"green" or yellow | | Wazuh Dashboard | / | keyword: Wazuh |

Part 4: SSL certificate monitoring

Wazuh uses TLS for the Manager API (port 55000), Indexer (port 9200), and Dashboard (port 443). Each has its own certificate. Monitor all of them:

1. In Vigilmon, click Add Monitor.
2. Choose SSL monitor.
3. Add entries for:
   • wazuh.example.com (Dashboard / nginx frontend)
4. Set alert threshold to 30 days before expiry — Wazuh certificates often have long TTLs and may not renew automatically.
5. Add your alert channel.

For self-signed Wazuh internal certificates (used between Manager, Indexer, and Dashboard components), add SSL monitors on the internal ports if those are reachable from your monitoring vantage point:

# Check internal certificate expiry manually
openssl s_client -connect localhost:9200 -showcerts 2>/dev/null | \
  openssl x509 -noout -dates

Part 5: Webhook alerts

Security platform outages require immediate response. Configure Vigilmon webhooks to page your security team:

// wazuh-alerting.ts
import express from 'express';

const app = express();
app.use(express.json());

app.post('/webhook/vigilmon', (req, res) => {
  const { monitor_name, status, url, response_code, checked_at } = req.body;

  if (status === 'down') {
    console.error('[VIGILMON] Wazuh component DOWN', {
      monitor: monitor_name,
      url,
      code: response_code,
      at: checked_at,
    });

    // Page the SOC team immediately — a SIEM outage is a security event
    pageSOC({
      severity: 'critical',
      message: `${monitor_name} is DOWN as of ${checked_at}`,
      runbook: 'https://wiki.example.com/runbooks/wazuh-outage',
    });
  } else if (status === 'up') {
    console.info('[VIGILMON] Wazuh component recovered', {
      monitor: monitor_name,
      at: checked_at,
    });
  }

  res.sendStatus(204);
});

app.listen(3000);

Vigilmon payload:

{
  "monitor_id": "mon_abc123",
  "monitor_name": "Wazuh Manager API",
  "status": "down",
  "url": "https://wazuh.example.com/api/ping",
  "checked_at": "2026-06-30T08:01:00Z",
  "response_code": 503,
  "response_time_ms": 2103
}

Part 6: Multi-node cluster monitoring

In a distributed Wazuh deployment, you have multiple manager nodes (master + workers), multiple indexer nodes, and one or more dashboard nodes. Monitor each independently:

Monitor all manager nodes

# Check cluster node status via the API
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://wazuh-master.example.com:55000/cluster/nodes | jq '.data.items[] | {name, type, status}'

Add individual Vigilmon monitors for each worker node's API ping:

| Monitor name | URL | |--------------|-----| | Wazuh Master API | https://wazuh-master.example.com:55000/ping | | Wazuh Worker-1 API | https://wazuh-worker-1.example.com:55000/ping | | Wazuh Indexer Node-1 | https://wazuh-indexer-1.example.com:9200/_cluster/health | | Wazuh Dashboard | https://wazuh-dashboard.example.com/ |

Alert on indexer cluster degradation

The Wazuh Indexer cluster health transitions through three states: green → yellow → red. Configure Vigilmon to alert when health drops to red (data unavailable):

1. Add an HTTP monitor for https://wazuh-indexer.example.com:9200/_cluster/health.
2. Set keyword check: must NOT contain "status":"red".
3. Invert the check (or use a negative keyword check if supported) to alert on red state.

Part 7: Agent connectivity monitoring

Wazuh agents report back to the manager. You can monitor agent connectivity health via the API and surface it externally:

#!/bin/bash
# /usr/local/bin/wazuh-agent-health
# Returns 0 if no agents have been disconnected for more than 5 minutes

TOKEN=$(curl -sf -X POST https://localhost:55000/security/user/authenticate \
  -H 'Content-Type: application/json' \
  -d '{"password":"<password>"}' -u wazuh:wazuh | jq -r .data.token)

DISCONNECTED=$(curl -sf -H "Authorization: Bearer $TOKEN" \
  "https://localhost:55000/agents?status=disconnected&limit=1" | jq .data.total_affected_items)

if [ "$DISCONNECTED" -gt "5" ]; then
  echo "DEGRADED: $DISCONNECTED agents disconnected"
  exit 1
fi

echo "OK: $DISCONNECTED agents disconnected (within threshold)"
exit 0

Expose this as an HTTP endpoint and add it as a Vigilmon monitor with keyword check OK.

Summary

Your Wazuh deployment now has comprehensive external monitoring:

1. Manager API monitor — confirms the Wazuh Manager and its REST API are alive, polled every 60 seconds by Vigilmon.
2. Indexer monitor — confirms OpenSearch is healthy and accepting index writes from the Manager.
3. Dashboard monitor — confirms analysts can reach the UI for investigation and triage.
4. SSL monitors — alerts before any certificate expires across the Wazuh component stack.
5. Webhook/SOC alerts — DOWN events trigger immediate escalation to your security operations team.

A SIEM outage is a security event, not just a service disruption. Vigilmon gives you independent, external verification that Wazuh is up and watching — so you know when it isn't.

Monitor your Wazuh SIEM platform free at vigilmon.online

#wazuh #siem #security #devops #monitoring #opensearch