Wazuh Exposure Reviews Should Start With API and RBAC Evidence

Wazuh, a security monitoring solution, exposes security events, manages agents, and allows configuration changes through its server API. This API is where an exposure review should start due to its role in handling authentication and authorization. Wazuh mandates authentication and enforces role-based access control (RBAC) before processing core logic.

Authentication generates a JSON Web Token (JWT) that authenticates requests; however, a valid token does not automatically allow any action. RBAC can prevent an endpoint from performing operations even if it possesses a correctly signed JWT. Sensitive node configuration values, like enrollment and cluster keys, are hidden unless the caller has explicit permission to read secrets.

As of October 29, 2026, ZoomEye identified 18,047 instances where the app was Wazuh and 17,867 instances where the title was Wazuh, both queried with the sub_type=all parameter. This slight discrepancy suggests that matches may represent different entities, such as documentation, dashboards, or unrelated references.

To perform a thorough review, record the dashboard URL, API endpoint, management network, certificate status, authentication source, RBAC mode, and token lifespan for each confirmed deployment. Test the API using various identities, including a read-only analyst who should only receive event data for allowed agents and be denied administrative actions. A node-scoped role should not disclose configuration secrets from another node, and a revoked token should be rejected promptly.

The Wazuh API serves as the authoritative interface, but the dashboard and index access paths also require review. Ensure the management interface is not exposed to the public internet; if remote administration is necessary, place it behind a robust identity-aware access layer and a precise network policy. Keep the API and dashboard on their intended pathways, enable TLS, and refrain from sharing JWT or enrollment secrets through insecure channels.

Agent enrollment credentials should be reviewed and retired agents promptly removed. Logs should trace the authenticated user, operation, affected agent or node, and the outcome of authorization checks. Alert on failed authentication attempts, role changes, secret-reading attempts, token revocation, and configuration edits.

Wazuh's default token lifespan is brief, but a stolen token remains valid until expiration or revocation. Monitoring and response strategies must operate within this timeframe. A practical inventory should compare the organization's agent list and manager records against observed external service data. Note that a title match or application fingerprint does not identify the owning business unit. Assign ownership to the manager, then seek confirmation of RBAC mode, users, tokens, and exposed routes.

Wazuh's security hinges on the identity and RBAC configuration behind the service. Maintain these layers as separate entities in the report and avoid conflating product counts with claims of monitoring coverage or compromise.