How to see Wazuh manager agent on dashboard?

[Mahad Mansoor]

I can see my host as agent on wazuh manager in manage agents under id 000 so it is clear that wazuh manager monitors itself and I do not need to deploy an agent. But how do i see it on dashboard?

[Olamilekan Abdullateef Ajani]

Hello Mahad,

When you install the Wazuh manager, it also runs an internal agent on the same host, but it behaves a bit differently from a standard endpoint agent. This is by design and can’t be changed at the moment.

As a result, the manager can generate alerts just like any other agent, but it won’t appear in the Agents list in the dashboard, since that internal agent is intentionally hidden.

You can always see the raw data and alerts for the manager by manually filtering for its ID. Navigate to the dashboard > Discover and filter for the id 000, please refer to the attached image.

For vulnerability data, the Wazuh manager does not scan itself for vulnerabilities to save resources. If you want to see the manager in the Vulnerability Detection dashboard, you must enable it in /var/ossec/etc/internal_options.conf.
Find the line vulnerability-detection.disable_scan_manager=1 and change it to 0

Then restart the Wazuh manager to apply the changes: systemctl restart wazuh-manager

Please let me know if you have further questions on this.