Ports

All ports in one place. Directions and topologies are explained in Network and firewall.

Published on the server

Port	Setting	Server	Open to	Purpose
443/tcp	HTTPS_PORT	single, app	Analysts, endpoints	Console, sign-in, Pallas, SIEM, enrolment, Theseus agent
80/tcp	HTTP_PORT	single, app	Analysts; internet with Let's Encrypt	Redirect, ACME validation
1514/tcp	AGENT_PORT	single, core	Endpoints	Wazuh agents
514/udp		single, core	The network devices you list	Syslog from firewalls and network devices; published only while syslog is set up
8088/tcp	UPSTREAM_HTTP_PORT	single, app	Cloud gateway only	Plain HTTP from a cloud gateway; bound to loopback with GATEWAY=builtin
9200/tcp		core	App server only	Wazuh indexer (on CORE_BIND)
55000/tcp		core	App server only	Wazuh manager API (on CORE_BIND)
5601/tcp		core	App server only	Wazuh dashboard (on CORE_BIND)
9001/tcp		core	App server only	Scanner API (on CORE_BIND)

Port 1515 (Wazuh registration) is never published but must be free on single and core servers.

Outbound

Port	From	To
443 (or as in the command)	Every server	Theseus control plane and registry
443	Servers	Let's Encrypt, vulnerability feeds, cti.wazuh.com, vendor APIs, LLM endpoint
443	Endpoints	Console address; packages.wazuh.com during install
1514	Endpoints	Agent address