Installation

Installation

Wazuh Alert Manager is an OpenSearch Dashboards plugin that installs into the Wazuh Dashboard. It is a single zip per supported dashboard version, and a one-line installer handles detection, integrity verification, backup, and rollback.

Supported versions

The plugin artifact must match the exact OpenSearch Dashboards version, or the dashboard refuses to load it:

Wazuh release	OpenSearch Dashboards	Artifact
4.12.x	2.19.1	wazuhAlertManager-2.19.1.zip
4.13.x	2.19.2	wazuhAlertManager-2.19.2.zip
4.14.x	2.19.5	wazuhAlertManager-2.19.5.zip

The installer reads the dashboard's own package.json (version) to select the artifact and refuses any version not in this table — it never guesses.

One-line installer

# Latest compatible release
curl -fsSL https://github.com/xrisbarney/Wazuh-alert-manager/releases/latest/download/install.sh | sudo bash

# Pinned release (recommended)
curl -fsSL https://github.com/xrisbarney/Wazuh-alert-manager/releases/latest/download/install.sh | sudo bash -s -- --version 2.0.1

# Local / offline artifact
sudo ./install.sh --artifact ./wazuhAlertManager-2.19.5.zip \
  --checksum ./wazuhAlertManager-2.19.5.zip.sha256

For stronger supply-chain safety, download and verify the installer before running it:

curl -fsSLO https://github.com/xrisbarney/Wazuh-alert-manager/releases/download/v2.0.1/install.sh
curl -fsSLO https://github.com/xrisbarney/Wazuh-alert-manager/releases/download/v2.0.1/install.sh.sha256
sha256sum -c install.sh.sha256
sudo bash install.sh --version 2.0.1

The default release host is GitHub Releases (override with --base-url or the WAM_RELEASE_BASE_URL environment variable for a private mirror). Versioned artifacts are published under <base-url>/download/v<version>/wazuhAlertManager-<osd>.zip plus .sha256 (required) and .minisig (optional, verified when minisign and WAM_MINISIGN_PUBLIC_KEY are present). <base-url>/latest/download/ resolves the newest release for the "latest" mode.

What the installer does

1. Detects the installed OpenSearch Dashboards version.
2. Selects the matching artifact; fails closed on unsupported versions.
3. Downloads the ZIP (or uses the local --artifact).
4. Verifies the SHA-256 checksum and, when available, the minisign signature.
5. Backs up the currently installed plugin to /var/lib/wazuh-alert-manager/backups.
6. Stops wazuh-dashboard.
7. Removes the previous plugin code and installs the new artifact via the dashboard plugin installer (as the wazuh-dashboard user).
8. Restarts the dashboard and waits for readiness.
9. Verifies the plugin backend route and the browser login route.
10. Rolls back automatically if installation or startup fails.
11. Prints a concise success report.

No Wazuh credentials are required. On first startup the plugin provisions or migrates its own indices using the dashboard service identity.

What the installer never does

• Modifies wazuh-alerts-* (read-only evidence source).
• Deletes plugin data during an upgrade (data lives in OpenSearch, not on disk).
• Purges legacy wazuh-alert-status (retained read-only migration input).
• Installs custom Wazuh security roles.
• Disables certificate verification for downloaded releases.

Modes

Command	Effect
install.sh --version 2.0.1	Fresh install, v2 upgrade, or same-version reinstall
install.sh --dry-run	Resolve versions/artifacts and print the plan without changing anything
install.sh --no-restart	Install but leave the dashboard stopped
install.sh --rollback	Restore the most recent backup
install.sh --uninstall-plugin	Remove the plugin, retain all data
install.sh --remove-data	After a second confirmation, print exact manual indexer cleanup instructions. It never accepts indexer credentials or deletes data itself, and never targets wazuh-alerts-*.

Release-side tooling

Generate checksums and signatures after building:

scripts/make-release-artifacts.sh build          # *.zip.sha256 (+ .minisig)
scripts/make-release-artifacts.sh --installer    # install.sh.sha256 (+ .minisig)

Set WAM_MINISIGN_SECRET_KEY to also produce minisign signatures; consumers set WAM_MINISIGN_PUBLIC_KEY to verify them.