SIEM Operations

Understanding the Wazuh Components

Understand the Wazuh manager, indexer, dashboard, agents, services, StatefulSets, Deployments, persistent volumes, and secrets.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

SIEM OperationsPlatform Operations

Lab objective

Understand the deployed Wazuh components as Kubernetes resources. The goal is to connect SOC concepts to what is actually running in the cluster.

Component map

  • Manager: receives, analyzes, and manages data from agents.
  • Indexer: stores and indexes alert data for search and analysis.
  • Dashboard: provides analyst access to alerts and Wazuh data.
  • Agents: collect telemetry depending on deployment model.
  • Services: expose component communication paths.
  • PersistentVolumeClaims: preserve state.
  • Secrets: store credentials and sensitive configuration values.

Inspection commands

kubectl get all -n wazuh
kubectl get statefulset -n wazuh
kubectl get deployment -n wazuh
kubectl get svc -n wazuh
kubectl get pvc -n wazuh
kubectl get secrets -n wazuh
kubectl describe pod -n wazuh <pod-name>

StatefulSet vs Deployment

StatefulSets are used when stable identity and persistent state matter. Deployments are better for stateless workloads. Wazuh manager and indexer components commonly need state; dashboard-style web front ends are generally more stateless.

Analyst note: If the dashboard, indexer, manager, or agents are unhealthy, alert absence may mean collection failure rather than safety.

Check your understanding

Use these questions to check whether the lab and analyst concepts are clear before moving forward.

  1. Which component processes data from agents?
  2. Which component stores searchable alert data?
  3. Which component provides analyst UI?
  4. Why are Services important?
  5. Why are PVCs important?
  6. Why inspect Secrets?
  7. When is a StatefulSet useful?
  8. When is a Deployment useful?
  9. Why document component roles?
  10. Why can missing alerts be misleading?
Answer key
  1. Wazuh manager.
  2. Wazuh indexer.
  3. Wazuh dashboard.
  4. They expose communication paths between components or users.
  5. They preserve state for stateful components.
  6. They may contain credentials or sensitive settings.
  7. When stable identity and persistent state matter.
  8. For stateless workloads.
  9. It supports troubleshooting and investigation.
  10. They may indicate collection or platform failure, not safety.
← Previous: Deploying Wazuh on Kubernetes Series index Next: Accessing the Wazuh Dashboard Safely →