BSD Ports

security/wazuh-indexer 4.11.1 DragonFly

A highly scalable, full-text search and analytics engine

System
DragonFly
Repository
DPorts
Maintainer
[email protected] (as in FreeBSD)
License
GPLv2
Categories
security
Package size
9.0 KiB, 20.1 KiB installed

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments.

Wazuh solution consists of an endpoint security agent, deployed to the monitored systems, and a management server, which collects and analyzes data gathered by the agents. Besides, Wazuh has been fully integrated with the Elastic Stack, providing a search engine and data visualization tool that allows users to navigate through their security alerts.

In the other systems

The newest version among them is 4.14.9, as upstream numbers it.

SystemPortVersionVulnerabilitiesStatusMaintainerLast update
DragonFlysecurity/wazuh-indexer4.11.1 behind since 2026-07-11none known-[email protected]-
FreeBSDsecurity/wazuh-indexer4.14.9 newestnone known-[email protected]2026-10-21
HardenedBSDsecurity/wazuh-indexer4.14.8 behind since 2026-10-21no data-[email protected]-
GhostBSDsecurity/wazuh-indexer4.14.7 behind since 2026-09-28no data-[email protected]-

Install

Binary package:

pkg install wazuh-indexer

From DPorts:

cd /usr/dports/security/wazuh-indexer && make install clean

Dependency graph

Ports that need it on the left, what it needs to run on the right; at most 8 of each. "Dependencies" below lists them all.

Dependencies

Run dependencies 1

No port depends on this one.

Configuration

No options to configure.

Service scripts
none

Message after installing

Wazuh indexer components were installed

1) Wazuh indexer is based on opensearch project. This guide help you for adapt
   wazuh configuration for it works on FreeBSD using apps are part of ports
   tree.

2) Copy /usr/local/etc/wazuh-indexer/wazuh-indexer.yml to /usr/local/etc/opensearch/opensearch.yml

3) Edit /usr/local/etc/opensearch/opensearch.yml and changes options accord to your
   setup. For example host, ssl, nodes options, etc. On this guide we will use
   like host 10.0.0.10

4) If you want use a simple way to generate wazuh infrastructure certificates
   you can use a simplified version of certificates generator script located at:

   https://people.freebsd.org/~acm/ports/wazuh/wazuh-gen-certs.tar.gz

5) Wazuh needs opensearch-security features. Rename or copy samples files
   into /usr/local/etc/opensearch/opensearch-security

   # cd /usr/local/etc/opensearch/opensearch-security
   # sh -c 'for i in $(ls *.sample ) ; do cp -p ${i} $(echo ${i} | sed "s|.sample||g") ; done'

6) You can define a custom admin password modifying internal_users.yml file into 
   /usr/local/etc/opensearch/opensearch-security/

   admin:
     hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"

   Hash password can be generated using opensearch-security hash script tool

   # cd /usr/local/lib/opensearch/plugins/opensearch-security/tools/
   # sh -c "OPENSEARCH_JAVA_HOME=/usr/local/openjdk11 ./hash.sh -p adminpass"
   $2y$12$XaEXmp4kGQpd6t8kNH03quyvpHDQZh.nywLLp9.b0NF2DxGl8FpJK

7) Add OpenSearch to /etc/rc.conf

   # sysrc opensearch_enable="YES"

8) Start OpenSearch

  # service opensearch start

9) Finally you must initialize opensearch cluster

  # cd /usr/local/lib/opensearch/plugins/opensearch-security/tools/
  # sh -c "OPENSEARCH_JAVA_HOME=/usr/local/openjdk11 ./securityadmin.sh \
    -cd /usr/local/etc/opensearch/opensearch-security/ -cacert /usr/local/etc/opensearch/certs/root-ca.pem \
    -cert /usr/local/etc/opensearch/certs/admin.pem -key /usr/local/etc/opensearch/certs/admin-key.pem -h 10.0.0.10 -p 9200 -icl -nhnv"

10) You can look more useful information at the following link:

    https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/step-by-step.html

    Take on mind wazuh arquitecture on FreeBSD is configurated not similar like
    you can read at wazuh guide

11) Testing your server installation

   # curl -k -u admin:adminpass https://10.0.0.10:9200
   # curl -k -u admin:adminpass https://10.0.0.10:9200/_cat/nodes?v

12) Enjoy it