A real Wazuh agent for Android — the same enrollment handshake and encrypted transport a laptop uses, plus device‑posture and security collectors built for a phone.
Most "mobile SIEM agents" just tail a log file and ship lines over HTTP. This one enrolls the way an actual Wazuh endpoint does: a TLS handshake to authd on port 1515, then Wazuh's own encrypted transport to remoted on port 1514 — AES‑256‑CBC, validated byte‑for‑byte against a live manager. Your phone shows up in the same Agents list as every other endpoint, because as far as the manager's concerned, it is one.
A syslog‑forwarding fallback exists for managers or networks where the full wire protocol isn't reachable.
Every category below is off by default and toggled independently in Settings. Nothing is collected until you turn it on.
OS version, patch level, encryption and lock‑screen state, root indicators.
Package list with delta tracking — flags new installs, especially from outside the Play Store.
Connectivity and power‑state changes, for anomaly context rather than continuous tracking.
Runs YARA rules locally against installed packages; matches are reported as agent events.
Opt‑in only — off unless explicitly enabled, separate from every other toggle.
An in‑app view of exactly what the agent is sending, in real time — nothing is a black box.
Because this agent enrolls as a real Wazuh endpoint, everything it collects lands in the same manager and indexer as the rest of your network — which means an AI assistant with access to that manager can work with your phone's data exactly the way it works with any other endpoint's.
"Has this phone installed anything odd this week?" instead of learning Wazuh's query syntax first.
Tie a phone event to what your firewall or laptop saw at the same moment — one picture, not three consoles.
Turn a public detection rule into one that actually matches your data, then prove it fires before trusting it.
Read through what's accumulated and separate genuine findings from noise — with the reasoning shown, not just a verdict.
| Build | Size | Use | |
|---|---|---|---|
| Release | 5.3 MB | Install on a device | download → |
| Debug | 7.7 MB | Verbose logging, troubleshooting | not published here |
SHA‑256 of the published release APK, for anyone who wants to verify the file before installing it:
| 4bd1d92d3460fa042a771e421f54b067b9446427f2036cc3e1bb48bd64537f9c |
Settings → Apps → the browser you download with → Install unknown apps → allow. Android blocks sideloaded APKs by default until this is set, per app.
Open the download link above on the phone itself, or transfer the file over from another device.
Open the downloaded file, tap Install. No collectors are enabled at this point — installing the app grants it nothing on its own.
Open the app → Settings → enter your Wazuh manager's address and enrollment port 1515. If the manager runs its default self‑signed certificate — common for a lab deployment — toggle Trust all certificates first, or enrollment fails at the TLS handshake before it ever prompts for anything else.
Back in Settings, enable whichever categories apply. Check Live Log to confirm data is actually flowing.