Get started with AlertWatch

Community edition is free. Professional and Enterprise licenses are delivered manually after payment.

System Requirements

AlertWatch server (the binary)

  • OS: Linux (x86-64), macOS 12+, or Windows Server 2019+ / Windows 10+
  • RAM: 512 MB minimum (AlertWatch itself is lightweight)
  • CPU: 1 core minimum — any modern x86-64 processor
  • Disk: 100 MB for the binary + space for acknowledgement and config files
  • Network: read-only access to your OpenSearch instance (port 9200) and Wazuh API (port 55000)

Browser / analyst workstation

  • RAM: 4 GB minimum, 8 GB recommended
  • Browser: Chrome 90+, Edge 90+, Firefox 90+, or Safari 15+ — latest version recommended
  • Display: 1280 × 800 minimum; 1920 × 1080 recommended for full dashboard layout
  • Mobile: iOS 15+ / Android 10+ supported for triage view

Wazuh + OpenSearch (existing infrastructure)

AlertWatch connects to your existing Wazuh and OpenSearch deployment read-only. Refer to Wazuh's documentation for their infrastructure requirements. As a general guide: OpenSearch requires a minimum of 8 GB RAM on its host for a small deployment.

Community Edition — Free

Full AlertWatch UI for individuals and home labs. Requires an existing Wazuh + OpenSearch deployment.

Requirements

  • Supported backends: Wazuh 4.x / 5.x, Elastic Security (ECS), Suricata, Zeek
  • Single binary — no runtime required (Linux, macOS, Windows)
  • Network access from AlertWatch host to OpenSearch / Elasticsearch (port 9200)
Request download link

Binary download coming soon. Request early access via the contact form.

Running AlertWatch as a Service

For production use, AlertWatch should run as a system service so it starts automatically on boot and restarts on failure.

Linux (systemd)

  1. Place the binary and alertwatch.yaml in /opt/alertwatch/
  2. Create a dedicated system user:
    sudo useradd -r -s /sbin/nologin alertwatch
  3. Set ownership:
    sudo chown -R alertwatch:alertwatch /opt/alertwatch
    sudo chmod 600 /opt/alertwatch/alertwatch.yaml
  4. Copy the included alertwatch.service to systemd:
    sudo cp alertwatch.service /etc/systemd/system/
  5. Enable and start:
    sudo systemctl daemon-reload && sudo systemctl enable --now alertwatch
  6. Check status:
    sudo systemctl status alertwatch
    sudo journalctl -u alertwatch -f

Windows Server / Windows 10+

  1. Download NSSM and place nssm.exe in the same folder as alertwatch.exe
  2. Place alertwatch.exe and alertwatch.yaml in a permanent folder (e.g. C:\AlertWatch\)
  3. Right-click install-windows.bat → Run as Administrator
  4. AlertWatch is now registered as a Windows service and starts automatically on boot
  5. Manage from Services (services.msc) or via command line:
    sc query AlertWatch  ·  sc stop AlertWatch  ·  sc start AlertWatch

Logs are written to alertwatch.log in the installation folder with automatic daily rotation.

Professional & Enterprise

Contact us to purchase. We send a standard invoice — after payment you receive:

  • Time-limited licensed binary
  • Pre-configured alertwatch.yaml template
  • Setup and configuration guide
  • Priority support contact
Contact sales →