Wazuh v5.0.0-beta1 release notes

Added cluster-by-default deployment model: all Wazuh Server installations now run as a cluster node, removing the distinction between clustered and non-clustered deployments. The cluster.disabled configuration option has been removed. (#31295)
Added stateless metadata enrichment in remoted, centralizing event metadata handling for stateless messages and removing the dependency on wazuh-db for that ingestion path. (#33269)
Added Engine enrichment support: IOC matching, GeoIP lookup, and event filters. (#33493)
Added Engine adaptation tier 2: raw archives handling, uncategorized event routing, input-level throttling, and internal metrics exposure. (#34477)
Added Wazuh Instance Registration status to reflect CTI access_token availability (Pending, Polling, Denied, Available), allowing the Dashboard to query the subscription state. (#31906)

Upgraded embedded Python interpreter from 3.10 to 3.12. (#33377) (#33570)
Adapted Vulnerability Detector input pipeline to the new Wazuh 5.0 synchronization algorithm, covering first-scan, inventory-change, and feed-update scenarios. (#30535)
Revamped Role-Based Access Control (RBAC) management and introduced an upgrade mechanism for existing RBAC configurations. (#27706)
Removed legacy configuration surfaces, database schemas, build targets, and compatibility layers in the second server cleanup phase. (#34608)

Removed Filebeat as the log-shipping component; event forwarding now uses native Wazuh server connectivity to the Wazuh Indexer via indexer-connector. (#33124)
Removed deprecated manager daemons: ossec-authd, wazuh-agentlessd, wazuh-maild, wazuh-dbd. (#30922)
Removed deprecated C CLI tools: manage_agents, agent-auth. (#30924)
Removed OpenSCAP server-side module. (#31028)
Removed inventory-related API endpoints. (#31299)
Removed legacy API security configuration endpoints. (#28425)

Fixed Vulnerability Detector version matcher logic for improved detection accuracy. (#31746)
Fixed Cloudtrail log ingestion parsing errors. (#33108)

Added local state persistence for agent modules (FIM, System Inventory, SCA), removing the dependency on rsync with the Wazuh Server and reducing network traffic and server-side processing overhead. (#29533) (#31838)

Changed the Wazuh Manager installation path to /var/wazuh-manager (replacing /var/ossec) and removed agent ID 000, fully decoupling agent and manager processes on shared hosts. (#33378)
Changed Vulnerability Detection to use the Wazuh Indexer as the sole authoritative CVE data source, removing direct CTI network access from the agent-side Vulnerability Detector. (#34849)
Adjusted agent-side Vulnerability Detector inventory emission and synchronization (OS, packages, hotfixes) to align with the updated VD behavior in Wazuh 5.0. (#33199)
Simplified rootcheck: removed the server-side database, sync path, and API surface; findings are now indexed through the standard alert pipeline. (#31478)
Updated logcollector file-tailing initial read strategy for more consistent behavior across log rotation scenarios. (#33382)
Updated Windows Event Channel log collection to emit native XML from EvtRender() without an XML declaration header. (#34462)
Increased default limits for agent event throughput and inventory message sizes. (#35330)

Removed deprecated agent binaries and legacy modules as part of the Wazuh 5.0 agent cleanup. (#30435)
Removed NSIS-based Windows agent installer; Windows agent now ships exclusively as an MSI package. (#31582)

Fixed FIM checksum calculation that was incorrectly ignoring some file fields. (#29668)
Fixed syscollector reporting duplicate and bogus packages on macOS arm64. (#30513)
Fixed agent_control not displaying agent status information. (#32915)
Fixed SCA handling of invalid operators and missing values in regex patterns. (#35071)
Fixed agent modules initializing before agent metadata was fully ready. (#35156)
Fixed FIM inventory reporting file modification time as 1970-01-01. (#35162)
Fixed agent automatic reload failing after receiving centralized configuration. (#35169)
Fixed syscollector false positive package detection on macOS. (#35248)

Wazuh v5.0.0-beta1