Single Node Installation

A single-node installation of Wazuh refers to a setup where all essential components—Wazuh server, Wazuh indexer, and Wazuh dashboard—are deployed on either a single machine or distributed across multiple machines. In this configuration, all the components are part of the same environment, and while they can technically be installed on separate instances for better resource allocation and isolation, they are still considered part of the "single-node" deployment.

The components involved in this setup are:

1. Wazuh Server: The core component responsible for collecting, processing, and analyzing security data from the agents deployed on monitored endpoints.

2. Wazuh Indexer: This component handles the storage and indexing of event data, providing search and query capabilities for logs generated by Wazuh agents.

3. Wazuh Dashboard: A web interface that provides users with visualization, search, and analysis capabilities for the collected security events and data. It also allows for centralized management of Wazuh agents.

In a single instance setup, all these components run on one machine, making the installation process simpler and more cost-effective for small-scale environments or testing scenarios. In a distributed setup, these components can be deployed on different machines to better utilize resources, improve performance, and enhance scalability, especially in larger environments.

While the components can be separated, the term "single-node installation" typically refers to the complete setup running in a unified environment, regardless of whether it's on a single or multiple instances.