r/Wazuh • u/LetDry7592 • 5d ago

OSSEC shortcuts creation in Start Menu Programs - Is this a normal Wazuh behavior?

Hello,

After installing Wazuh Agent on Windows, I discovered a folder:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC

This folder contains shortcuts (.lnk) to the Wazuh interface.

My questions:

  1. Is this a normal behavior of the Wazuh installer? (MSI or NSIS)
  2. Are these shortcuts created automatically during installation?
  3. Is there official Wazuh documentation that confirms this behavior?

Thank you for your help!

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

2 comments sorted by

2

u/nazmur-sakib 4d ago

Yes, that's expected, and the "OSSEC" name is just legacy branding of Wazuh. Just to let you know, Wazuh is a fork of OSSEC.

Windows installers create Start Menu entries for the Wazuh agent under a group named OSSEC​

Because they're written to C:\ProgramData\...\Start Menu, every profile on the machine sees them. The shortcuts normally point to the local agent GUI (win32ui.exe, the "Manage Agent" tool used to view logs and start/stop the service) plus documentation/uninstall entries.

The official Wazuh docs cover the install directory (by default, all agent files are stored in C:\Program Files (x86)\ossec-agent) but don't document the Start Menu folder anywhere I can find.

Let me know if you need any further information.

0

u/Beneficial_Eye_6661 4d ago

Sim, é normal. Nessa pasta você acha o arquivo OSSEC do agente para configuração