Install Wazuh Agent on macOS (Intel and Apple Silicon)

Wazuh provides signed pkg installers for both Intel and Apple Silicon Macs. Like Linux and Windows, the macOS installer accepts deployment variables that enroll the agent automatically.

1. Download the package

# Apple Silicon
curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.arm64.pkg

# Intel
curl -so wazuh-agent.pkg https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.intel64.pkg

2. Install with deployment variables

echo "WAZUH_MANAGER='<MANAGER_IP>' && WAZUH_AGENT_GROUP='default'" > /tmp/wazuh_envs
sudo installer -pkg ./wazuh-agent.pkg -target /

3. Start the agent

sudo /Library/Ossec/bin/wazuh-control start

4. Verify

sudo /Library/Ossec/bin/wazuh-control status

Every wazuh-* daemon should report `is running`. On the manager dashboard, the Mac appears under Agents shortly after.

Uninstall

sudo /bin/rm -r /Library/Ossec*
sudo /bin/launchctl unload /Library/LaunchDaemons/com.wazuh.agent.plist
sudo /bin/rm -f /Library/LaunchDaemons/com.wazuh.agent.plist
sudo /bin/rm -rf /Library/StartupItems/WAZUH
sudo /usr/bin/dscl . -delete "/Users/wazuh"
sudo /usr/bin/dscl . -delete "/Groups/wazuh"
sudo /usr/sbin/pkgutil --forget com.wazuh.pkg.wazuh-agent