Wazuh Commands Cheatsheet
The Wazuh commands our SOC engineers reach for every day. Copy, paste, ship. Search the full list or jump to a section below.
Service management
Start, stop and check the status of the Wazuh manager, indexer, dashboard and agent.
sudo systemctl status wazuh-managerShow the Wazuh manager service status
sudo systemctl restart wazuh-managerRestart the Wazuh manager (after rule / ossec.conf changes)
sudo systemctl status wazuh-indexerShow the Wazuh indexer (OpenSearch) service status
sudo systemctl restart wazuh-indexerRestart the indexer node
sudo systemctl status wazuh-dashboardShow the Wazuh dashboard service status
sudo systemctl status wazuh-agentCheck agent status on an endpoint
sudo systemctl enable --now wazuh-agentEnable + start agent at boot
Agent management (manager side)
Register, list and remove agents from the Wazuh manager using manage_agents and agent_control.
sudo /var/ossec/bin/manage_agentsInteractive menu to add / remove / list agents
sudo /var/ossec/bin/agent_control -lList all registered agents and their last keep-alive
sudo /var/ossec/bin/agent_control -i 001Detailed info about agent with ID 001
sudo /var/ossec/bin/agent_control -R 001Force a re-scan / restart of agent 001 remotely
sudo /var/ossec/bin/agent_control -sShow summary of agent counts by status
Agent (endpoint) commands
Run these on the endpoint where the Wazuh agent is installed.
sudo /var/ossec/bin/agent-auth -m <MANAGER_IP>Auto-enroll the agent against a manager
sudo /var/ossec/bin/wazuh-control statusPer-component status on the agent
sudo /var/ossec/bin/wazuh-control restartRestart the agent daemons
sudo tail -f /var/ossec/logs/ossec.logLive-tail the agent log
Rules, decoders and logtest
Validate ossec.conf, test new rules and decoders without restarting the manager.
sudo /var/ossec/bin/wazuh-control configtestValidate ossec.conf syntax before restart
sudo /var/ossec/bin/wazuh-logtestInteractive prompt, paste a log to see rule + decoder matches
sudo /var/ossec/bin/wazuh-logtest -tVerbose mode, show full decoder / rule trace
ls /var/ossec/ruleset/rules/Browse built-in rule files
ls /var/ossec/etc/rules/Your custom local_rules.xml lives here
Logs & alerts
Where to look when something is wrong.
sudo tail -f /var/ossec/logs/ossec.logMain manager log (errors, warnings, startup)
sudo tail -f /var/ossec/logs/alerts/alerts.jsonLive JSON stream of every triggered alert
sudo tail -f /var/ossec/logs/api.logWazuh API request log
sudo tail -f /var/ossec/logs/cluster.logCluster sync log (multi-node deployments)
Wazuh API
The REST API on port 55000 powers the dashboard and automation.
curl -k -u wazuh:<password> -X POST "https://localhost:55000/security/user/authenticate"Get a JWT token (replace credentials)
curl -k -H "Authorization: Bearer <TOKEN>" "https://localhost:55000/agents?pretty=true"List agents via API
curl -k -H "Authorization: Bearer <TOKEN>" "https://localhost:55000/manager/info?pretty=true"Manager version + cluster info
Wazuh indexer (OpenSearch)
Check cluster health, indices and shard allocation.
curl -k -u admin:<password> "https://localhost:9200/_cluster/health?pretty"Cluster health, green / yellow / red
curl -k -u admin:<password> "https://localhost:9200/_cat/indices?v"List all indices with size + doc count
curl -k -u admin:<password> "https://localhost:9200/_cat/nodes?v"Show every node in the indexer cluster
Required network ports
Open these on firewalls / security groups.
1514/udp, agent to manager (events)Default agent --> manager event channel
1515/tcp, agent enrollmentagent-auth registration to manager
55000/tcp, Wazuh APIREST API used by dashboard + integrations
9200/tcp, Wazuh indexerOpenSearch HTTP API
443/tcp, Wazuh dashboardWeb UI (HTTPS)