https://cybertoolchain.io/tools/wazuh New releases and features in Wazuh, tracked by The Cyber Toolchain. en Thu, 15 Oct 2026 17:40:40 GMT https://github.com/wazuh/wazuh/releases/tag/v4.14.9 https://github.com/wazuh/wazuh/releases/tag/v4.14.9 Thu, 15 Oct 2026 17:40:40 GMT Wazuh v4.14.9 raises active response command capacity to 1024, expands FIM eBPF whodata to older kernels, and adds a configurable API auth-context payload size limit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `auth_context_max_payload_size` option to configure the API `run_as` authentication-context payload size limit (raised from 8 KB to 64 KB by default), improving support for AD/LDAP/SSO logins with large group-membership contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Raises from 64 to 1024 the number of active response commands that `wazuh-execd` can load from `etc/shared/ar.conf`. • Allows FIM eBPF whodata on capable kernels older than 5.8, such as RHEL 8.10. • Restricts the API access log from writing the `run_as` authorization context verbatim unless debug logging is enabled; `hash_auth_context` still identifies it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.14.8 https://github.com/wazuh/wazuh/releases/tag/v4.14.8 Fri, 25 Sep 2026 18:19:40 GMT Wazuh v4.14.8 adds audit identity fields to FIM eBPF whodata alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `audit_uid`, `audit_name`, `audit_gid`, and `audit_group_name` fields to FIM whodata alerts generated by the eBPF provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.10.4 https://github.com/wazuh/wazuh/releases/tag/v4.10.4 Thu, 30 Jul 2026 16:32:16 GMT Wazuh v4.10.4 adds detection of suppressive Audit rules that could blind FIM whodata on Linux. • Adds detection of the `-a never,task` Audit rule in FIM whodata for Linux, alerting when this rule would suppress file integrity monitoring events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.14.3 https://github.com/wazuh/wazuh/releases/tag/v4.14.3 Wed, 11 Feb 2026 15:04:36 GMT Wazuh v4.14.3 adds hostname and architecture metadata to Windows keep-alive messages. • Adds hostname and architecture metadata fields to the Windows agent's keep-alive message protocol • Implements configurable bounds checking for Logcollector `max-size` configuration serialization Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.14.2 https://github.com/wazuh/wazuh/releases/tag/v4.14.2 Thu, 15 Jan 2026 11:19:35 GMT Wazuh v4.14.2 adds `-a never,task` Audit rule detection in FIM whodata for Linux and a Windows Server 2025 SCA Policy. • Added SCA Policy for Microsoft Windows Server 2025 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.14.1 https://github.com/wazuh/wazuh/releases/tag/v4.14.1 Wed, 12 Nov 2025 18:11:43 GMT Wazuh v4.14.1 adds IAM role support for AWS VPC flow logs and static/temporary credentials for the Amazon Security Lake subscriber. • `<aws:iam_role>` configuration option in the AWS wodle to assume IAM roles for VPC flow log collection. • `aws_credentials` support in the Amazon Security Lake subscriber enables static (`aws_access_key_id`, `aws_secret_access_key`) and temporary (`aws_session_token`) credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.14.0 https://github.com/wazuh/wazuh/releases/tag/v4.14.0 Thu, 23 Oct 2025 17:45:30 GMT Wazuh v4.14.0 adds syscollector inventory fields, hot config reload for Linux agents, Amazon Inspector v2 support, and new REST API endpoints. • Added system users and groups to the inventory data (Manager/Agent) • Added browser extensions and services to the inventory data (Manager/Agent) • Added IPv6 support to Maltiverse integration • Added capability to do a hot configuration reload in Linux agents • Added support for Amazon Inspector v2 • Added syscollector users and groups endpoints to the RESTful API • Added syscollector services and browser_extension endpoints to the RESTful API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.13.0 https://github.com/wazuh/wazuh/releases/tag/v4.13.0 Fri, 19 Sep 2025 07:02:27 GMT Wazuh v4.13.0 adds hot ruleset reload, global FIM/inventory queries, and new API endpoints for managers and agent summaries. • `Analysisd` now supports hot ruleset reloads without restarting the service. • Adds global queries capability for `FIM` and system inventory data across all agents. • Adds a new `/agents/summary` RESTful API endpoint to retrieve aggregated agent status. • Adds `server uuid` field to the `/manager/info` RESTful API response. • Adds hot ruleset reload management via new RESTful API endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.12.0 https://github.com/wazuh/wazuh/releases/tag/v4.12.0 Thu, 08 May 2025 13:27:46 GMT Wazuh v4.12 adds eBPF whodata to FIM, MS Graph riskDetections integration, and indexed vulnerability package conditions. • FIM now supports whodata using an eBPF-based integration • Added support for the `riskDetections` relationship in MS Graph • Added a time delay option in the MS Graph integration to prevent log loss • Added a page size option to the MS Graph integration • Deleted the restriction for the use of the AWS profile in the Amazon Security Lake integration • Added package condition field in indexed vulnerabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.11.2 https://github.com/wazuh/wazuh/releases/tag/v4.11.2 Wed, 02 Apr 2025 13:40:18 GMT Wazuh v4.11.2 adds `authentication_pool_size` configuration option to the RESTful API. • Adds `authentication_pool_size` config key in Wazuh API to set the number of authentication processes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.11.0 https://github.com/wazuh/wazuh/releases/tag/v4.11.0 Mon, 24 Feb 2025 08:37:40 GMT Wazuh v4.11.0 adds CISA vulnerability content priority, .pkg support, and API revoke action. • Adds CISA vulnerability content prioritized over NVD in the vulnerability scanner • Extends Syscollector to detect installed .pkg packages on macOS • Adds `security:revoke` permission action for the `PUT /security/user/revoke` API endpoint Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.10.0 https://github.com/wazuh/wazuh/releases/tag/v4.10.0 Fri, 10 Jan 2025 12:29:33 GMT Wazuh v4.10.0 adds RESTful API endpoint for agent uninstall, new Windows Server 2012 SCA policy, and self-recovery for indexer connector CA files • Creates new RESTful API endpoint to trigger the agent uninstall process. • Allows multiple Certificate Authority files in the indexer connector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.9.1 https://github.com/wazuh/wazuh/releases/tag/v4.9.1 Thu, 17 Oct 2024 15:48:27 GMT Wazuh Manager adds ARM package support, API enables dual-stack IPv4/IPv6 listening, and Agent supports macOS 15 • Adds `ARM packages` support for the Wazuh Manager component • Enables the RESTful API to listen on both `IPV4` and `IPV6` stacks simultaneously Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.9.0 https://github.com/wazuh/wazuh/releases/tag/v4.9.0 Thu, 05 Sep 2024 16:04:09 GMT Wazuh v4.9.0 adds Fluentd alert forwarding, Amazon Security Hub via SQS, Journald logcollector support, and HAProxy helper • Adds `alert_forwarding` to `ossec.conf` for Manager to forward alerts to Fluentd • Adds Amazon Security Hub integration via AWS SQS in the Agent • Adds `journald` input support in Logcollector (Agent) • Adds HAProxy helper script to manage load balancer configuration and automatically balance agents • Merges group file endpoints into a single endpoint (`GET /groups/{group_id}/files/{filename}`) with `raw` parameter • Removes the `cache` configuration option from the Wazuh API Breaking changes: • The `cache` configuration option is removed from the Wazuh API config, requiring removal if previously set • Group file endpoints are merged; the previous individual endpoint paths for each group file no longer exist (now handled by `GET /groups/{group_id}/files/{filename}`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.8.0 https://github.com/wazuh/wazuh/releases/tag/v4.8.0 Thu, 13 Jun 2024 14:35:58 GMT Wazuh v4.8.0 adds `GET /manager/version/check` API endpoint, MS Graph multi-tenant support, and snap package detection in Syscollector. • Added new `GET /manager/version/check` endpoint to obtain information about new releases of Wazuh • Introduced an `auto` option for the `ssl_protocol` setting in the API configuration that enables automatic negotiation of the TLS certificate to be used • Extended the MS Graph integration module to support multiple tenants Breaking changes: • Removed `PUT /vulnerability`, `GET /vulnerability/{agent_id}`, `GET /vulnerability/{agent_id}/last_scan` and `GET /vulnerability/{agent_id}/summary/{field}` API endpoints • Removed the `compilation_date` field from `GET /cluster/{node_id}/info` and `GET /manager/info` endpoints • Deprecated the `cache` configuration option • Removed `custom` parameter from `PUT /active-response` endpoint Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.7.5 https://github.com/wazuh/wazuh/releases/tag/v4.7.5 Fri, 31 May 2024 06:20:58 GMT Wazuh v4.7.5 adds a database endpoint to recalculate the hash of agent groups. • Adds a database endpoint to recalculate the hash of agent groups Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.7.2 https://github.com/wazuh/wazuh/releases/tag/v4.7.2 Thu, 11 Jan 2024 18:30:56 GMT Wazuh v4.7.2 adds timeouts to Cloud/integrations and a Debian 12 SCA policy • Adds configurable `timeout` setting to external and Cloud integration configurations to prevent indefinite waits Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.7.0 https://github.com/wazuh/wazuh/releases/tag/v4.7.0 Tue, 28 Nov 2023 16:52:57 GMT Wazuh v4.7.0 adds native Maltiverse integration, Slack customization, and custom AWS SQS log buckets. • Introduced native Maltiverse integration for the Manager to enrich threat intelligence data. • Added configurable options for the Slack integration within the Wazuh Manager configuration. • Added support for Custom Logs in Buckets via AWS SQS in the Agent to route log data to Amazon Simple Queue Service. • Added geolocation data for the `aws.data.client_ip` field to provide location context for AWS CloudTrail events. • Added package inventory coverage for Alpine Linux, MacPorts, PYPI, and Node packages in Syscollector. Breaking changes: • Deprecated `PUT /vulnerability`, `GET /vulnerability/{agent_id}`, `GET /vulnerability/{agent_id}/last_scan` and `GET /vulnerability/{agent_id}/summary/{field}` API endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.6.0 https://github.com/wazuh/wazuh/releases/tag/v4.6.0 Tue, 07 Nov 2023 07:28:43 GMT Wazuh v4.6.0 adds X509 cert generation, AWS GuardDuty support, new CLI for API RBAC, logcollector filters, and FIM wildcards • Adds `wazuh-authd` capability to generate X509 certificates automatically during agent enrollment • Introduces a new CLI subcommand set to manage Wazuh API RBAC resources (users, roles, rules) • Adds `--prefix` parameter to the Azure Storage integration to filter objects by prefix • Adds support for Amazon Linux 2022 in the Vulnerability Detector feed • Adds support for Alma Linux in the Vulnerability Detector feed • Adds support for Debian 12 in the Vulnerability Detector feed • Adds new logcollector configuration settings `ignore` and `restrict` to filter logs before parsing • Adds wildcard (*) support in File Integrity Monitoring (FIM) Windows register paths • Adds wildcard support for folders in the `localfile` configuration on Windows Breaking changes: • The unused `local_ip` agent configuration option has been removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.5.3 https://github.com/wazuh/wazuh/releases/tag/v4.5.3 Tue, 10 Oct 2023 10:15:45 GMT Wazuh v4.5.3 adds SUSE Gzip feeds, nested query support in API `q` parameter, and macOS 14 agent reporting. • Adds support for the `$` symbol in RESTful API query values • Adds support for the `@` symbol in RESTful API query values • Adds support for nested queries in the `q` API parameter • Vulnerability Detector now fetches the SUSE feeds in Gzip compressed format • Updates the agent to report the name of macOS 14 (Sonoma) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.5.1 https://github.com/wazuh/wazuh/releases/tag/v4.5.1 Thu, 24 Aug 2023 10:56:51 GMT Adds `discard_regex` to AWS Inspector and CloudWatchLogs integrations; native Apple silicon agent support. • Added the `discard_regex` functionality to Inspector and CloudWatchLogs AWS integrations • Added new validations for the AWS integration arguments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.4.3 https://github.com/wazuh/wazuh/releases/tag/v4.4.3 Fri, 26 May 2023 05:59:55 GMT Wazuh v4.4.3 adds macOS agent support for Apple Silicon processors. • Unified SCA policy names across the ruleset Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.4.2 https://github.com/wazuh/wazuh/releases/tag/v4.4.2 Thu, 18 May 2023 14:50:20 GMT Wazuh v4.4.2 adds Amazon Security Lake integration and `localfile` deployment support • Adds an agent module to publish events as a subscriber to Amazon Security Lake • Adds support for deploying `localfile` configuration blocks to agents • Adds macOS 13.0 Ventura SCA policy to the ruleset Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.4.1 https://github.com/wazuh/wazuh/releases/tag/v4.4.1 Wed, 12 Apr 2023 09:53:51 GMT Wazuh v4.4.1 adds Debian Linux 11 SCA policy support • Adds Debian Linux 11 SCA policy to the ruleset Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.4.0 https://github.com/wazuh/wazuh/releases/tag/v4.4.0 Tue, 28 Mar 2023 20:45:28 GMT Wazuh v4.4.0 adds SUSE & Ubuntu Jammy to Vulnerability Detector, Syscollector delta alerts, Alpine agent build, and native Shuffle integration. • Adds `SUSE` support in Vulnerability Detector for vulnerability scanning • Adds `Ubuntu Jammy` support in Vulnerability Detector for vulnerability scanning • Enables delta events in Syscollector when data gets changed to produce alerts Breaking changes: • Renamed `wazuh-logtest` and `wazuh-clusterd` scripts to follow the same scheme as other scripts (spaces symbolized with _ instead of -) • Deprecate status field in SCA Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.3.7 https://github.com/wazuh/wazuh/releases/tag/v4.3.7 Wed, 24 Aug 2022 12:40:31 GMT Wazuh v4.3.7 adds `cluster` subcommand and `/cluster/ruleset/synchronization` API for ruleset synchronization management • Added `cluster` command to obtain custom ruleset files and their hash • Added endpoint GET /cluster/ruleset/synchronization to check ruleset synchronization status in a cluster Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.3.6 https://github.com/wazuh/wazuh/releases/tag/v4.3.6 Wed, 20 Jul 2022 14:45:35 GMT Wazuh v4.3.6 adds Ubuntu 22 and Red Hat 9 support in Vulnerability Detector • `Vulnerability Detector` now supports scanning for vulnerabilities on Ubuntu 22 (Jammy) agents. • `Vulnerability Detector` now supports scanning for vulnerabilities on Red Hat 9 agents. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.3.4 https://github.com/wazuh/wazuh/releases/tag/v4.3.4 Thu, 09 Jun 2022 09:01:36 GMT Wazuh v4.3.4 Manager adds indefinite alert reading for Integratord and timeouts for Office 365/GitHub/Agent Update modules. • Integratord now tries to read alerts indefinitely instead of performing only 3 attempts. • Adds a timeout configuration option for remote queries made by the Office 365, GitHub, and Agent Update modules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh https://github.com/wazuh/wazuh/releases/tag/v4.3.0 https://github.com/wazuh/wazuh/releases/tag/v4.3.0 Thu, 05 May 2022 16:06:52 GMT Wazuh v4.3.0 adds vulnerability inventory, Arch/Amazon Linux support in VD, verbose logtest, and force option for authd conflicts. • Vulnerability Detector introduces a new capability to maintain a vulnerability inventory on the manager, delivering alerts only when vulnerabilities are newly detected or stop applying (previously applied). • Added `<force>` configuration option to `authd.conf` to control how the server handles conflicts during agent enrollment requests. • Vulnerability Detector gains support for Arch Linux and Amazon Linux operating systems. Breaking changes: • The UNIX user and group have been renamed from the previous default to 'wazuh'; existing setups using the old names must update their system accounts or configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wazuh