diff --git a/glicid/packages/wazuh.scm b/glicid/packages/wazuh.scm
new file mode 100644
index 0000000..1df5fa0
--- /dev/null
+++ b/glicid/packages/wazuh.scm
@@ -0,0 +1,115 @@
+(define-module (glicid packages wazuh)
+               #:use-module ((guix licenses) #:prefix lic:)
+               #:use-module (guix packages)
+               #:use-module (guix download)
+               #:use-module (guix utils)
+               #:use-module (guix build utils)
+               #:use-module (guix build-system cmake)
+               #:use-module (guix build-system gnu)
+               #:use-module (gnu packages)
+               #:use-module (gnu packages autotools)
+               #:use-module (gnu packages base)
+               #:use-module (gnu packages compression)
+               #:use-module (gnu packages selinux)
+               #:use-module (gnu packages wget)
+               #:use-module (gnu packages curl)
+               #:use-module (gnu packages certs) ; not sure if needed
+               #:use-module (gnu packages perl)
+               #:use-module (gnu packages gawk)
+               #:use-module (gnu packages cmake)
+               #:use-module (gnu packages javascript)
+               #:use-module (gnu packages sqlite)
+               #:use-module (gnu packages serialization)
+               #:use-module (gnu packages admin)
+               #:use-module (gnu packages libffi)
+               #:use-module (gnu packages libusb)
+               #:use-module (gnu packages python-xyz)
+               #:use-module (gnu packages check)
+               #:use-module (gnu packages pcre)
+               #:use-module (gnu packages popt)
+               #:use-module (gnu packages package-management)
+               #:use-module (gnu packages llvm)
+               #:use-module (gnu packages tls)
+               #:use-module (gnu packages commencement)
+               #:use-module (gnu packages python)
+               #:use-module (gnu packages bash)
+               #:use-module (glicid utils)
+               )
+
+(define-public wazuh-agent
+               (package
+                 (name "wazuh-agent")
+                 (version "4.3.10")
+                 (source (origin
+                           (method url-fetch)
+                           (uri (string-append "https://github.com/wazuh/wazuh/archive/refs/tags/v" version ".tar.gz" ))
+                           (sha256 (base32 "0zy6w004n7px2zhy6dws1mz6mj13gcff5jy1c7jnzvf6rasbaah7"))))
+                 (build-system cmake-build-system)
+                 (arguments
+                   `(
+                     #:phases (modify-phases %standard-phases
+                                             (delete 'configure)
+                                             (add-after 'unpack 'extract-deps
+                                                        (lambda* (#:key inputs native-inputs #:allow-other-keys)
+                                                                 (begin
+                                                                   (for-each (lambda (deps)
+                                                                               (format #t (string-append "decompressing source code for " deps "~%"))
+                                                                               (mkdir-p (string-append "src/external/" deps))
+                                                                               (let ((tar (assoc-ref inputs "tar")) (deps-src (assoc-ref inputs deps )))
+                                                                                 (invoke (string-append tar "/bin/tar") "xvf" deps-src "--strip-components=1" "-C" (string-append "src/external/" deps))))
+                                                                             (list "zlib" "sqlite" "openssl" "curl" "libyaml" "audit" "libffi" "libplist" "python-cython" "msgpack" "bzip2" "pcre2" "rpm" "popt") )
+                                                                   (for-each (lambda (deps)
+                                                                               (format #t (string-append "decompressing source code for " deps "~%"))
+                                                                               (let ((deps-src (assoc-ref inputs deps )))
+                                                                                 (invoke "cp" "-rv" deps-src (string-append "src/external/" deps))))
+                                                                             (list "cjson" "googletest")
+                                                                             )
+                                                                   (invoke "mv" "src/external/audit" "src/external/audit-userspace")
+                                                                   (invoke "mv" "src/external/cjson" "src/external/cJSON")
+                                                                   (chmod "src/external/cJSON" #o750)
+                                                                   (for-each (lambda (file)
+                                                                               (chmod file #o750))
+                                                                             (find-files "src/external/cJSON"))
+                                                                   (for-each (lambda (file)
+                                                                               (chmod file #o750))
+                                                                             (find-files "src/external/cJSON" #:directories? #t))
+                                                                   (chmod "src/external/googletest" #o750)
+                                                                   (for-each (lambda (file)
+                                                                               (chmod file #o750))
+                                                                             (find-files "src/external/googletest"))
+                                                                   (for-each (lambda (file)
+                                                                               (chmod file #o750))
+                                                                             (find-files "src/external/googletest" #:directories? #t))
+                                                                   #t)))
+                                             (replace 'build
+                                                      (lambda _
+                                                        (setenv "CC" ,(cc-for-target))
+                                                        (invoke "make" "-C" "src" "TARGET=agent" "build"))))))
+                 (inputs `( ("cjson" ,(package-source cjson))
+                           ("zlib" ,(package-source zlib))
+                           ("sqlite" ,(package-source sqlite))
+                           ("openssl" ,(package-source openssl))
+                           ("curl" ,(package-source curl))
+                           ("libyaml" ,(package-source libyaml))
+                           ("audit" ,(package-source audit))
+                           ("libffi" ,(package-source libffi))
+                           ("libplist" ,(package-source libplist))
+                           ("python-cython" ,(package-source python-cython))
+                           ("msgpack" ,(package-source msgpack))
+                           ("bzip2" ,(package-source bzip2))
+                           ("googletest" ,(package-source googletest))
+                           ("pcre2" ,(package-source pcre2))
+                           ("rpm" ,(package-source rpm))
+                           ("popt" ,(package-source popt))
+                           ("zlib" ,(package-source zlib))
+                           ("perl", perl)
+                           ("python", python)
+                           ))
+                 ;(inputs (list autoconf bzip2 coreutils libtool openssl policycoreutils wget python bash grep curl nss-certs le-certs unzip zip gzip tar findutils sed perl gawk cmake cmake-shared clang-toolchain gcc-toolchain cjson))
+                 ; make
+                 (synopsis "")
+                 (description "")
+                 (home-page "https://github.com/wazuh/wazuh/")
+                 (license lic:gpl2)))
+
+wazuh-agent