Environments
An environment is one Wazuh deployment you want the agent to work on: a production cluster, a staging setup, a lab. Environments are managed on the Environments page; registering and deleting them, changing their agent mode and minting enrollment tokens are admin actions.
Register an environment
-
Open Environments and add a new environment with a name your team will recognize ("prod-eu", "lab").
-
The console mints a single-use enrollment token and shows the full install command, ready to copy:
curl -fsSL https://dl.vesper.wazuh.com/install.sh | sudo bash -s -- \--token=<ENROLLMENT_TOKEN> --connect=wss://connect.vesper.wazuh.com -
Run that command on the environment's Wazuh node. The connector installs, enrolls once with the token, and starts dialing out to Vesper. See Install the connector for what it does on the box.
:::caution The token is shown once Copy the command when it is displayed. If you lose it, or the token expires or is consumed by a failed attempt, mint a new one from the environment's card; tokens are single-use. :::
Connector status
Each environment card shows its connector state:
| Status | Meaning |
|---|---|
| Pending | Registered, but no connector has enrolled yet. |
| Online | The connector's outbound session is up; heartbeats are arriving. |
| Offline | The connector enrolled before, but is not currently connected. |
Online environments also surface cluster metadata reported by the connector, so you can confirm you enrolled the right deployment before letting the agent loose on it.
Agent mode
The environment card carries the agent mode selector (Read only / Manual / Auto). The mode is the per-environment ceiling for what the agent may do; only admins can change it.
Removing a connector or an environment
The environment card always offers the uninstall one-liners, independent of the connector's state:
# stop and remove the connector, keep its config
curl -fsSL https://dl.vesper.wazuh.com/uninstall.sh | sudo bash
# remove everything, including config and the enrolled identity
curl -fsSL https://dl.vesper.wazuh.com/uninstall.sh | sudo bash -s -- --purge
Deleting the environment in the console revokes its enrolled connector server-side.