Wazuh for MSPs: managing many clients

What Wazuh gives you

Wazuh runs agents on servers and endpoints that report vulnerabilities, configuration assessments and events to a Wazuh manager, with a dashboard on top. It is open source and widely used, which makes it attractive for MSPs: no per-seat licence for the detection layer.

The multi-client problem

Out of the box, Wazuh is built around one organisation. An MSP has dozens, each with its own data that must not mix, its own people who may see only their own estate, and a team that has to work across all of them. Three needs follow:

• Keep one client’s data and users apart from another’s.
• Give your own team a combined view and a single queue.
• Keep the cost of running it per client low.

Model 1: one deployment per client

Each client gets its own Wazuh manager and dashboard. Isolation is simple and strong: a client’s data lives in its own stack, and access follows the stack.

The cost is operational. You patch, upgrade, back up and monitor every stack, and you have no single view across them. This model suits a small number of larger clients or clients with strict contractual isolation.

Model 2: a shared deployment

One manager (or cluster) serves many clients. You separate them with agent groups and role-based access, so a client user sees only their group’s agents. The running cost per client is lower and your team works in one place.

The trade-off is that isolation now depends on how carefully groups and roles are set up, and on what your version supports. Verify it by logging in as a client user and checking that nothing from another client is visible, and re-check after upgrades.

Which model to choose

• Few clients, strict isolation needs, or regulated clients: separate deployments.
• Many small clients and a lean team: a shared deployment, with disciplined group and role management.
• A mix is common: shared for most, a dedicated stack for the clients who require it.

The missing layer: one view across clients

Neither model answers the question your team asks every morning: which client, and which asset, needs work first? Wazuh reports findings per deployment. You still need to rank them across the book, add exploitation data, turn attacks into cases with deadlines, and show clients what was done.

Where Cronzy Watch fits

Cronzy Watch reads from Wazuh and adds the multi-client layer: a dashboard across all clients, ranking by real exploitation with CISA KEV and EPSS, cases with deadlines, and strict client separation enforced in the database with row-level security. See Cronzy Watch for MSPs. It can also send a host-response command back through Wazuh (isolate, block an address, stop a process) after a second person approves.