Wazuh Offline Installation Guide (Air-Gapped Networks)

Many regulated environments run Wazuh on networks with no internet access. The official offline installation assistant lets you pre-download every package and dependency on a connected machine, then transfer the bundle and install on the air-gapped target.

1. On a connected host: download artifacts

curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
curl -sO https://packages.wazuh.com/4.9/config.yml

Run the assistant in download-only mode:

bash wazuh-install.sh -dw rpm   # or -dw deb for Debian-family

This produces `wazuh-offline.tar.gz` containing every package and dependency.

2. Transfer to the air-gapped host

Move the assistant, config.yml and the tarball to the target host (USB, internal mirror, scp through a jump host).

3. On the offline host: install

tar -xf wazuh-offline.tar.gz
bash wazuh-install.sh -a -o

The `-o` flag tells the assistant to use the local package bundle instead of trying to reach packages.wazuh.com.

4. Verify

systemctl status wazuh-indexer wazuh-manager wazuh-dashboard filebeat

When all four services report active, retrieve the admin password from wazuh-install-files.tar and log in over HTTPS. For updates, repeat the download step on the connected host with the new version, then rerun the assistant on the target.