security/wazuh-*: Update to 4.11.1 - security/wazuh-manager: Remove bsolete patch - security/wazuh-manager: Update http-request to 75384783d339a817b8d8f13f778051a878d642a6 ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-11-1.html Sponsored by: Entersekt916c623068
Port details
security/wazuh-manager 4.14.9
Security tool to monitor and check logs and intrusions (manager)
Port info
- Maintainer
- acm@FreeBSD.org
- Packages
- latest: 4.14.9
- Upstream
- up to date
- Last update
- to 4.14.9 · 47b0693c6d
- Quarterly
- not in the 2026Q4 packages
- WWW
- https://wazuh.com/
- Links
- cgit · VuXML · Report wrong data
Install
- Package
# pkg install wazuh-managerinstalls 4.14.9 fromlatest- Port
# cd /usr/ports/security/wazuh-manager && make install clean# make -C /usr/ports/security/wazuh-manager config # change options first
- Size
- 95 MiB download · 654 MiB installed
- Depends on
- databases/arrow 24.0.0_5, databases/gdbm 1.26, devel/libepoll-shim 0.0.20240608, devel/libffi 3.8.0, devel/readline 8.3.6, ftp/curl 8.23.0, lang/perl5.42 5.42.3, lang/python311 3.11.17, math/openblas 0.3.34_1,2, shells/bash 5.3.20, www/libnghttp2 1.70.0
- License
- GPLv2
- Creates
- user
wazuh, groupwazuh - Options
- 0 of 2 on in the package
Show the 2 options that are off
INOTIFY ZEROMQ - pkg-message
Shown after installing
Wazuh Manager was installed 1) Copy /etc/locatime to /var/ossec/etc directory # cp /etc/localtime /var/ossec/etc 2) You must edit /var/ossec/etc/ossec.conf.sample for your setup and rename/copy it to ossec.conf. Take a look wazuh manager configuration at the following url: https://documentation.wazuh.com/current/user-manual/manager/index.html 3) Move /var/ossec/etc/client.keys.sample to /var/ossec/etc/client.keys. This file is used to store all agents credentials connected to wazuh-manager # mv /var/ossec/etc/client.keys.sample /var/ossec/etc/client.keys 4) You can find additional useful files installed at # /var/ossec/packages_files/manager_installation_scripts 5) Do not forget generate auth certificate # openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 \ -subj "/C=US/ST=California/CN=Wazuh/" \ -keyout /var/ossec/etc/sslmanager.key -out /var/ossec/etc/sslmanager.cert # chmod 640 /var/ossec/etc/sslmanager.key # chmod 640 /var/ossec/etc/sslmanager.cert 6) FreeBSD rules, decoders and SCA files are installed by default. For more information about updates take a look at: https://github.com/alonsobsd/wazuh-freebsd Decoders and rules are used to extract some /var/log/userlog and /var/log/messages entries from FreeBSD agents. It is necessary add a localfile entry to /var/ossec/etc/ossec.conf <localfile> <log_format>syslog</log_format> <location>/var/log/userlog</location> </localfile> 7) Vulnerability detector and Indexer connector are disabled by default. If you want to use them, don't forget to configure and enable them from /var/ossec/etc/ossec.conf file. Also, you will need download vd database file to Wazuh tmp directory. # cd /var/ossec/tmp && fetch http://packages.wazuh.com/deps/vulnerability_model_database/vd_1.0.0_vd_4.13.0.tar.xz # chmod 640 /var/ossec/tmp/vd_1.0.0_vd_4.13.0.tar.xz # chown wazuh:wazuh /var/ossec/tmp/vd_1.0.0_vd_4.13.0.tar.xz Take on mind, a valid certificate is necessary to connect Indexer connector (Wazuh manager) to Wazuh indexer (OpenSearch). 8) Save Wazuh indexer username and password into the Wazuh keystore. # export WAZUH_HOME=/var/ossec # echo '<INDEXER_USERNAME>' | /var/ossec/bin/wazuh-keystore -f indexer -k username # echo '<INDEXER_PASSWORD>' | /var/ossec/bin/wazuh-keystore -f indexer -k password By default, INDEXER_USERNAME and INDEXER_PASSWORD are admin and admin. 9) Use a certificate generated previously. For example, you can use logstash certificates. Otherwise, you can use a simplified certificates generator script for this task. Download it from the following url: https://people.freebsd.org/~acm/ports/wazuh/wazuh-gen-certs.tar.gz 10) The sysctl 'kern.hostuuid' is used as a serial number. If you are in a jail, you should have at least started the 'hostid' rc script to uniquely identify this device. 11) Add Wazuh manager to /etc/rc.conf # sysrc wazuh_manager_enable="YES" or # service wazuh-manager enable 12) Don't forget mount procfs before of start wazuh-manager, please do the following: # mount -t procfs proc /proc To make it permanent, you need the following lines in /etc/fstab: proc /proc procfs rw 0 0 13) Start Wazuh manager # service wazuh-manager start 14) Enjoy it ;)
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 4.14.9 | 4.14.8 | – |
| FreeBSD 15 | 4.14.9 | ✗ | – |
| FreeBSD 14 | ✗ | 4.14.8 | ✗ |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | ✗ | ✗ | – |
| FreeBSD 14 | ✗ | 4.14.8 | ✗ |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 4.14.9.Fixed (24)
Show 24 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-61800 | 9.1 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding … |
| CVE-2026-49441 | 9.1 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_f… |
| CVE-2026-48162 | 9.1 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in … |
| CVE-2026-48024 | 9.1 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framewor… |
| CVE-2026-44901 | 8.4 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() i… |
| CVE-2026-41424 | 8.2 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/ap… |
| CVE-2026-54083 | 8.1 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contai… |
| CVE-2026-44252 | 7.7 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API… |
| CVE-2026-71540 | 7.5 | 2026-09-24 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framewo… |
| CVE-2026-45798 | 7.5 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/sh… |
| CVE-2026-46343 | 7.5 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() i… |
| CVE-2026-74039 | 7.1 | 2026-08-18 | Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resource… |
| CVE-2026-61783 | 7.0 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticate… |
| CVE-2026-74038 | 7.0 | 2026-08-18 | Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a do… |
| CVE-2026-74044 | 7.0 | 2026-08-18 | Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal… |
| CVE-2026-74046 | 6.9 | 2026-08-18 | Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exh… |
| CVE-2026-61811 | 6.5 | 2026-09-24 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() func… |
| CVE-2026-61802 | 6.5 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege… |
| CVE-2026-54084 | 5.3 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or m… |
| CVE-2026-49392 | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile()… |
| CVE-2026-44256 | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the… |
| CVE-2026-44255 | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AuthenticationManager.check_user()… |
| CVE-2026-44254 | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remot… |
| CVE-2026-44253 | 4.9 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in fram… |
Problem reports (1) · open in Bugzilla, most recently changed first
| PR | Summary | Status | Changed |
|---|---|---|---|
| 297420 | security/wazuh-manager: chase the upgrade of databases/arrow | New | 2026-08-24 |
Commits (94)
python: bump all USE_PYTHON=distutils consumers after RUN_DEPENDS removal Any missed ports, feel free to bump. Any ports that need setuptools at runtime can have the devel/py-setuptools manually added back to RUN_DEPENDS, but understand that this practice is deprecated; see CHANGES for details.06a08e69f3
security/wazuh-*: Update to 4.11.0 - Update py-pyarrow whl to 19.0.1 ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-11-0.html Sponsored by: Entersekt1e06b54ca9
databases/arrow: update 18.0.0 → 19.0.15b9b14c4fc
security/wazuh-manager: Fix issues - Fix issue when protocol is equal to udp46 or tcp46 on FreeBSD getPorts() function - Fix issue when process elapsed-times value is equal to hyphen on FreeBSD getProcessesInfo() function - Install librocksdb.so.8 library instead of librocksdb.so.8.3.2 one. It avoids missing library issues - Bump PORTREVISION Sponsored by: Entersekt412b1442f0
security/wazuh-*: Update to 4.10.1 - Update bundle python to 3.11.11 - Update opensearch dependency to 2.16.x - Update opensearch-dashboards dependency to 2.16.x ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-10-1.html397e095752
security/wazuh-manager: Fix build on aarch64 Reported by: pkg-fallout2f32069d97
security/wazuh-manager: Fix pkg-plist - Remove *.bak, *.orig, and tmp files installed from some whl files - Fix issues with pkg-plist file - Improve Makefile file - Bump PORTREVISION Reported by: pkg-fallout5ab61d7591
security/wazuh-manager: Fix fetch on some FreeBSD versions4dc218e957
security/wazuh-manager: Fix fetch on 13.x-amd640b35a09810
security/wazuh-*: Update to 4.9.2 - wazuh-manager: Remove support for freebsd13-aarch64 - wazuh-manager: Cache files were generated from python3.11 instead of python3.10 - wazuh-manager: Remove obsolete patch files - wazuh-dashboards : Use opensearch-dashboards230 instead of opensearch-dashboards210 ChangeLog at: https://github.com/wazuh/wazuh/releases https://github.com/wazuh/wazuh-dashboard-plugins/releases PR: 282160 Reported by: Ian Dickens <ian at south-border.com>96a8778888
security/wazuh-*: Update to 4.7.5 - Fix build/installation on aarch64 - Fix runtime issues on 14.x and 15.x because of openssl3 support [1] PR: 279363 Reported by: girgen [1]e9a4fa124d
security/wazuh-manager: Fix fetch on 13.x-aarch64a567e09b7a
security/wazuh-*: Update to 4.7.4 - Fix wazuh-agent segment fault (agent and manager) [1] - Improve configuration files (agent and manager) - Update py-pyarrow into cache file to 15.0.2 (manager) - Update cache files used by wazuh-manager. - Other minor modifications ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-7-4.html Obtained from: https://github.com/wazuh/wazuh/issues/23154 [1]d75dd772ea
security/wazuh-*: Update to 4.7.3 ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-7-3.htmldca13c8c6c
security/wazuh-*: Update to 4.7.2 - Install FreeBSD rules, decoders and SCA files by default - Strip python binary and so files - Add devel/libffi and databases/arrow to LIB_DEPENDS - Update pkg-message files - Othe minor modifications ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html06af245d1f
security/wazuh-manager: Revert partially latest commit - Latest commit break wazuh-manager on extract Reported by: pkg-fallout Differential Revision: <https://reviews.freebsd.org/D42068>a310d1ba5b
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree - Remove all references to defunct ARCH arm - Remove all references to defunct ARCH sparc64 - Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64 ARCH - Remove sysutils/afbinit requires defunct sparc64 ARCH - Remove all references to bktr driver - Remove all references to defunct FreeBSD_12 - Remove all references to OSVERSION/OSREL corresponding to 12 - Remove conditionals in Mk/Uses/cabal.mk - Remove sparc reference from Mk/Uses/qt-dist.mk - Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64 - Remove BROKEN_FreeBSD_12* from: - Remove OpenSSL patches from: - Remove conditional flags for OSVERSION >= 1300000 to fixed flags. Also move conditional flags for non sparc64/arm ARCH to fixed flags. Reviewed by: brooks, jbeich, rene, salvadore Differential Revision: https://reviews.freebsd.org/D42068bbab7f59e9
security/wazuh-manager: Fix pkg-plist - Bump PORTREVISION. wazuh cache for 13-amd64 was repacked Reported by: pkg-fallout0dd03d4bd8
securty/wazuh-*: Update to 4.7.1 - Remove support for 12.x (EoL) - Change some config files to sample files - Fix syscollector issue when network port is equal to * ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html970d2df7ee
security/wazuh: Update to 4.7.0 - Fix ssl=openssl build [1] - Fix permissions of backup/db directory. Now backup are generated without problems - Add support for get ports info - Add support for get processes info - Add a better way for get memory info - Add new decoders and rules files (https://github.com/alonsobsd/wazuh-freebsd) - Update FreeBSD sca files (https://github.com/alonsobsd/wazuh-freebsd) - Minor changes to SysInfo::getPackages function - Another minor modifications PR: 275008 Reported by: franco _at_ opnsense.org [1]abaf8dc39c
security/wazuh-*: Update to 4.6.0 - security/wazuh-manager: Deactivate CIS files. The are renamed to yml.deprecated - security/wazuh-agent: Don't install all CIS files - Turn security.keys a sample file. It helps to avoid remove client.keys on update - Update pkg-message.in files - Another minor modificationsd7b99124a0
security/wazuh-*: Update to 4.5.4 ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-5-4.htmla8e4946f00
security/wazuh-*: Update to 4.5.3 - security/wazuh-agent: Enable INOTIFY option by default. It enables Kevent based real time monitoring. See some examples like use it at: https://wazuh.com/blog/detecting-common-linux-persistence-techniques-with-wazuh/ - security/wazuh-manager: Add entries to pkg-message.in about FreeBSD SCA files and FreeBSD decoders and rules files. I'll maintain update versions of these files at https://github.com/alonsobsd/wazuh-freebsd - security/wazuh-dashboard: Update project url to new one - Othe minor modifications45aab66eae
security/wazuh-*: update to 4.5.2 - wazuh-indexer and wazuh-dashboards now use 2.10.0 version of opensearch and opensearch-dashboard ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-5-2.htmla1b512e016
security/wazuh-*: Update to 4.5.0 - wazuh-indexer and wazuh-dashboards now use 2.9.0 version of opensearch and opensearch-dashboard - Revert beats dependency to beats7 (filebeat) at security/wazuh-server. beats8 has some issues with filebeat (Take a look at PR/272701)3bfa0c383e
security/wazuh-*: Update to 4.4.4 - Add python path files from lang/python39/files - wazuh-indexer and wazuh-dashboards now use 2.8.0 version of opensearch and opensearch-dashboard - Update beats dependency to beats8 (filebeat) at security/wazuh-server08d0f06faa
security/wazuh-*: Update to 4.4.3 - Mark IGNORE on FreeBSD 12-aarch64 - Use makepatch to generate patch files - Fix typo at wazuh-agent and wazuh-manager pkg-message files [1] - Fix some linking issues when devel/libsysinfo is installed (using ports). wazuh-manager compile/install a library with the same name like libsysinfo and it is used by syscollector feature. - wazuh-dashboard use opensearch-dashboards 2.7.0 - Some other modifications ChangeLog at: https://github.com/wazuh/wazuh/releases PR: 271376 Reported by: lambert _ at _ sanesecurityguy.com [1]55048ca1c7
security/wazuh-manager: Fix pkg-plist file Reported by: pkg-falloutb55640631d
security/wazuh-*: update to 4.4.1 ChangeLog at: https://github.com/wazuh/wazuh/releases/tag/v4.4.13f387b5f46
security/wazuh-manager: Fix issue on aarch64 - Bump PORTREVISION Reported by: pkg-fallouta3244e67b7
security/wazuh-*: Update to 4.4.0 - security/wazuh-manager: Add support for aarch64 ChangeLog at: https://github.com/wazuh/wazuh/releases/tag/v4.4.072044b5eaa
security/wazuh-*: Update to 4.3.10 ChangeLog at: https://github.com/wazuh/wazuh/releases/tag/v4.3.10bdb2089d27
security/wazuh-*: update to 4.3.9 ChangeLog at: https://github.com/wazuh/wazuh/releases/tag/v4.3.9eed33d5e03
security/wazuh-manager: Fix fetch on FreeBSD 13.x and 14.x Reported by: pkg-fallout9e70fb1423
security/wazuh-manager: update to 4.3.8 ChangeLog at: https://documentation.wazuh.com/current/release-notes/release-4-3-8.html0db71d89bc
*/*: Update path set in BUILD_DEPENDS for CMake Commit b23ea4e2d2f51b53d8915fe9fd7b4efbdd575e38 changed its location to devel/cmake-core Approved by: portmgr (blanket)e942e560c4
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
cleanup: remove trailing whitepacesb86221feea
security/wazuh-*: update to 4.3.7 - Add better way to install python wheels. It could fix issues when fbsd is updated to security patch or minor release ChangeLog at: https://github.com/wazuh/wazuh/releases/tag/v4.3.778cd7fdce0
security/wazuh-manager: Fix build - Fix build on 14-CURRENT - It works only on amd64. It could works on i386 but I prefer don't expend time on it because i386 passed to tier 2 on 13.x. aarch64 could be a good platform for it. I'll try looking on it later - Bump PORTREVISION Reported by: pkg-fallout46dd52bdbf
security/wazuh-manager: Make pkg-fallout happier - Change OSVERSION for 13.x support - Bump PORTREVISIONf198cfc25e
security/wazuh-manager: New port: Security tool to monitor and check logs and intrusions (server) Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored systems, and a management server, which collects and analyzes data gathered by the agents. Besides, Wazuh has been fully integrated with the Elastic Stack, providing a search engine and data visualization tool that allows users to navigate through their security alerts. WWW: https://wazuh.com/d7fcd1c31b