Skip to main content

Install the connector

The Mobius connector is a single, lightweight, outbound-only edge agent. It installs on your Wazuh indexer node, dials out to the Mobius gateway over :443 (mTLS), and holds that session open so Mobius can pull alerts on demand. Credentials for the indexer and the Wazuh API never leave the box.

Requirements​

  • The Wazuh indexer node (the connector targets localhost by default). On a distributed deployment, the dashboard node instead — see below.
  • x86_64 or arm64 Linux with systemd, curl, and root to install.
  • Outbound HTTPS/WSS egress to dl.mobius.wazuh.com (download) and connect.mobius.wazuh.com (the connector session). No inbound rules.

Install​

Copy the command from the environment card in the console (it embeds the environment's single-use enrollment token):

curl -fsSL https://dl.mobius.wazuh.com/install.sh | sudo bash -s -- \
  --token=<ENROLLMENT_TOKEN> [--connect wss://connect.mobius.wazuh.com]

The installer:

  1. downloads the static mobius-connector binary for your architecture,
  2. writes /etc/mobius/connector.yaml with localhost targets (indexer and Wazuh API are auto-discovered on the host),
  3. enrolls once with the token — the connector's mTLS identity is issued and stored locally,
  4. installs and starts the mobius-connector systemd service, which from then on runs tokenless.

Optional flags and environment overrides (rare): --indexer-user / --indexer-password (or MOBIUS_INDEXER_USER / MOBIUS_INDEXER_PASSWORD), --indexer-url, --manager-url, --manager-user, --manager-password.

Distributed deployments (separate nodes)​

If your indexer, manager, and dashboard run on separate hosts, install the connector on the dashboard node: it can reach both the indexer and the manager, and it reads their addresses (and the manager login) from the local dashboard config. It asks once for the indexer login (your Wazuh dashboard admin user), which it cannot read locally — supply it at the prompt, or non-interactively with MOBIUS_INDEXER_USER / MOBIUS_INDEXER_PASSWORD. It is stored only on your node.

If you do not know that login, see Wazuh's guide on creating a Wazuh admin user. An all-in-one node needs none of this.

Unattended install & updating credentials​

For automation, run the installer fully silent by passing everything as environment variables — no prompt:

curl -fsSL https://dl.mobius.wazuh.com/install.sh | \
  sudo MOBIUS_INDEXER_USER=admin MOBIUS_INDEXER_PASSWORD=… bash -s -- \
  --token=<ENROLLMENT_TOKEN>

Anything the installer cannot read locally can be forced the same way: MOBIUS_INDEXER_URL, MOBIUS_MANAGER_URL, MOBIUS_MANAGER_USER, MOBIUS_MANAGER_PASSWORD (or the matching --indexer-url / --manager-* flags). Everything supplied is written to the connector config on your node.

Re-running updates it: paste the one-liner again and enter (or pass) a new password to replace the stored credential. An all-in-one or co-located node stays fully automatic and needs none of this.

Verify​

systemctl status mobius-connector
journalctl -u mobius-connector -f

A healthy connector holds one outbound session and reports per-target health with its heartbeat — the environment card in the console turns healthy within a couple of minutes, with the indexer and Wazuh API shown as reachable separately, each with its auto-detected cluster name and version.

Fix an auth failed (invalid credentials) error​

An amber auth failed badge on the Indexer or Wazuh API card means the target is reachable but rejected the connector's stored login (HTTP 401/403). The usual cause is a password rotation on the Wazuh side. The fix happens on your node, not in the console:

  • Auto-discovered credentials (all-in-one nodes): the connector re-reads the local Wazuh config at startup, so a restart picks up the rotated password:

    sudo systemctl restart mobius-connector

  • Stored credentials (distributed installs, or values you supplied yourself): edit indexer.username / indexer.password or wazuh_api.username / wazuh_api.password in /etc/mobius/connector.yaml, then restart with the same command. Explicit values always win over auto-discovery.

  • Or re-run the install one-liner and enter (or pass) the new password — it replaces the stored credential and restarts the service for you.

Either way the credential stays on your host. The card recovers on its own once the connector reports healthy again.

Rotate or revoke​

On the environment page in the console, Rotate key issues a fresh token to deploy a replacement connector (the old one is revoked), and Revoke drops the connector's access immediately. Use rotate when you reinstall or move the node.

Uninstall​

sudo bash /opt/mobius-connector/uninstall.sh

Removing the connector severs the session; nothing else on the node was changed.