Connect your Wazuh

Mobius reads alerts from your Wazuh indexer through the connector — a single outbound-only agent installed on the Wazuh node. Connecting an environment takes a few minutes.

1. Create an environment

In the console, an environment represents one Wazuh deployment (a production cluster, a lab, a customer site). Create one from the environments page; it starts in a waiting for connector state.

2. Deploy the connector

The environment card shows the exact install command with a single-use enrollment token already embedded:

curl -fsSL https://dl.mobius.wazuh.com/install.sh | sudo bash -s -- \
  --token=<ENROLLMENT_TOKEN>

Run it on the Wazuh indexer node. The installer downloads the static binary, enrolls with the token (the connector's mTLS identity is issued and stored locally), auto-discovers the local indexer and Wazuh API, and starts the mobius-connector systemd service — which from then on runs tokenless.

Details, flags, and troubleshooting: Install the connector.

3. Watch the first alerts arrive

Within a couple of minutes the environment turns healthy and the ingest cycle starts pulling recent alerts. Each one lands in the console already triaged: verdict, risk score, MITRE tags, and the analyst rationale.

note

Mobius pulls on demand through the connector's outbound session. If the connector goes down, nothing in your network is exposed — Mobius simply stops seeing new alerts, and the environment health card tells you so.