ELB Ports - eric-holtzclaw/wazuh GitHub Wiki

Source host Source port Destination host Destination port Source component Destination component Description Wazuh agents * Wazuh manager 1514 UDP Wazuh agent Wazuh manager Agent data communication with manager Wazuh agents * Wazuh manager 1515 TCP Wazuh agent Wazuh manager Agent registration, key exchange. One time process Wazuh manager 1514 UDP Wazuh agents * Wazuh manager Wazuh agent Manager communication with agent. Control messages Wazuh manager 1515 TCP Wazuh agents * Wazuh manager Wazuh agent Manager communication with agent. Key delivery Wazuh manager * Elastic Stack host 5000 TCP Filebeat Logstash Filebeat shipping events to Logstash Elastic Stack host * Elastic Stack host 9200 TCP Logstash Elasticsearch node Elasticsearch RESTful API. Index/ingest events. Elastic Stack host * Elastic Stack host [9300:9400] TCP Elasticsearch node Elasticsearch node Elasticsearch nodes data transfer protocol Elastic Stack host * Wazuh manager 55000 TCP Kibana Wazuh API Wazuh App interface communication with Wazuh API Elastic Stack host * Elastic Stack host 9200 TCP Kibana Elasticsearch Kibana access to Elasticsearch API. Fetching events. SOC * Elastic Stack host 443 TCP Web browser Kibana Access to Kibana and Wazuh App web interface0