diff --git a/.gitignore b/.gitignore
index 75db421843374a62cd204cb430694a79c296781c..9874ca41083b20e78b7ce149b9d68f36cae72ca3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ wazuh-ansible/
 *.swp
 *.retry
 ansible/opendistro/
+*.log
\ No newline at end of file
diff --git a/Makefile b/Makefile
index b1d23320ab5c8f612acc3f5861f043c3a5ac0dbf..365b18fe066c2c11b33f1af72be94ca094fd3885 100644
--- a/Makefile
+++ b/Makefile
@@ -12,17 +12,11 @@ clone-wazuh:
 	-git clone https://github.com/wazuh/wazuh-ansible.git > /dev/null 2>&1
 	cd wazuh-ansible && git checkout tags/v4.1.5
 
-reprovision:
-	@ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS)  $(ANSIBLE_DIR)/provision-reset.yml
-
 provision-managers:
 	@ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-managers.yml
 
 provision-agents:
 	@ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-agents.yml
 
-provision-evidence-collector:
-	@ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-evidence-collector.yml
-
 provision:
 	@ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision.yml
\ No newline at end of file
diff --git a/README.md b/README.md
index a588564179e0e01e4675e2094d3006f2f867bb92..a92aa791da6153a5b3a4c6d87023eb2b1b69d6c0 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,12 @@
-# Security Monitoring
+# Security Monitoring Demo
 
-This project is meant for quickly setting up Wazuh instance using Ansible scripts
-on top infrastructure provisioned using Vagrant.
+This project is meant for quickly setting up a demo of evidence collection with Wazuh.
 
-In addition to Wazuh, ClamAV is also installed to agent machines (for testing purposes).
+Project is deployed using Ansible scripts on top of infrastructure provisioned with Vagrant.
+
+It creates 4 VMs: a Wazuh server (manager), two machines acting as Wazuh agents, the Evidence Collector, and Clouditor.
+
+In addition to Wazuh, ClamAV is also installed on agent machines (for testing purposes).
 
 ## Requirements
 
@@ -26,6 +29,11 @@ $ git checkout tags/v4.1.5
 
 Then select your `ENVIRONMENT` in `Makefile`. Set it to `full-setup` or `no-collector`.
 
+If the case of `full-setup`, installation of additional Ansible roles is required:
+```
+$ ansible-galaxy install --roles-path ansible/ gantsign.golang
+```
+
 1. Provision Wazuh server and Wazuh agents:
 
 ```
@@ -46,13 +54,29 @@ $ PORT=8088 npx http-echo-server
 
 ## Using Evidence Collector
 
-To see Evidence Collector's output, `ssh` to it's machine and open Docker logs:
+To see Evidence Collector's output, `ssh` to its machine and open Docker logs:
 
 ```
 $ make ssh-evidence-collector
 $ docker logs -ft evidence-collector
 ```
 
+## Testing with Clouditor
+
+Clouditor starts automatically when clouditor VM is provisioned.
+
+To see Clouditor's output, `ssh` to its machine and examine the log file:  
+
+```
+$ make ssh-clouditor
+$ tail /var/log/clouditor.log
+```
+
+To manually start clouditor (normally not needed), you can use the following command on the clouditor VM (in `/home/vagrant/`):
+```
+$ make run
+```
+
 ## Potential issues
  
 ### ClamAV (re)start failed/timed out
@@ -108,4 +132,23 @@ ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.10"
 ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.11"
 ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.12"
 ssh-keygen -f ".ssh/known_hosts" -R "192.168.33.13"
-```
\ No newline at end of file
+```
+
+### Virtual networking problem
+
+If your Vagrant / hypervisor for whatever reason doesn't make the `192.168.33.0` virtual network
+directly accessible from the host, you need to manually specify the IP address and port for SSH 
+connections to each of the VMs.
+
+After the VMs have been created, the SSH connection parameters can be seen with the `vagrant ssh-config` command:
+```
+$ cd environments/full-setup/
+$ vagrant ssh-config
+```
+
+Edit `environments/full-setup/inventory.txt` and add `ansible_host` and `ansible_port` parameters 
+to each of the VMs. Example:
+```
+[wazuh_managers]
+192.168.33.10 ansible_host=127.0.0.1 ansible_port=2222 public_ip=192.168.33.10 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/full-setup/.vagrant/machines/manager/virtualbox/private_key
+```
diff --git a/ansible/clouditor/Makefile b/ansible/clouditor/Makefile
new file mode 100644
index 0000000000000000000000000000000000000000..64ed440e2a6dccfa59d9f08a54ed9ff23eecf2ea
--- /dev/null
+++ b/ansible/clouditor/Makefile
@@ -0,0 +1,2 @@
+run:
+	cd clouditor && go run cmd/engine/engine.go --db-in-memory
\ No newline at end of file
diff --git a/ansible/provision-agents.yml b/ansible/provision-agents.yml
index b5f7fc61f052dfcb81506f8dac3e67cd226b3350..be2d4da10a60571c5107f98dae462bdc1b9292b2 100644
--- a/ansible/provision-agents.yml
+++ b/ansible/provision-agents.yml
@@ -3,7 +3,7 @@
   - hosts: wazuh_agents
     become: yes
     pre_tasks:
-    - import_tasks: "{{ ansible_dir }}/globals/vars.yml" 
+      - import_tasks: "{{ ansible_dir }}/globals/vars.yml" 
     roles:    
       - ../wazuh-ansible/roles/wazuh/ansible-wazuh-agent
       - docker
diff --git a/ansible/provision-clouditor.yml b/ansible/provision-clouditor.yml
new file mode 100644
index 0000000000000000000000000000000000000000..be610251203edc0b2816ce26c0e35fdf9fb9876a
--- /dev/null
+++ b/ansible/provision-clouditor.yml
@@ -0,0 +1,45 @@
+---
+# Clouditor
+  - hosts: clouditor
+    tasks:
+      - name: Install yum packages
+        yum:
+          name:
+            - git
+            - gcc
+            - wget
+            - make
+          state: present
+        become: yes
+      - name: Download Golang installer
+        get_url:
+          url: https://storage.googleapis.com/golang/getgo/installer_linux
+          dest: ~/installer_linux
+          mode: '0555'
+      - name: Run Golang installer
+        raw: ./installer_linux && source ~/.bashrc
+      - name: Create dir
+        file:
+          path: /home/vagrant/clouditor
+          state: directory
+      - name: Clone Clouditor repo
+        git:
+          repo: https://github.com/clouditor/clouditor.git
+          dest: /home/vagrant/clouditor
+      - name: Copy Makefile
+        copy:
+          src: ./clouditor/Makefile
+          dest: ~/Makefile
+      - name: Create Clouditor log file
+        file:
+          path: /var/log/clouditor.log
+          mode: 0666
+          state: touch
+          owner: vagrant
+        become: yes
+      - name: Run Clouditor in background
+        shell:
+          chdir: ~/clouditor
+          executable: /bin/bash
+          cmd: "(nohup ~/.go/bin/go run cmd/engine/engine.go --db-in-memory </dev/null >/var/log/clouditor.log 2>&1 & sleep 1)"
+          # see https://ansibledaily.com/execute-detached-process-with-ansible/
\ No newline at end of file
diff --git a/ansible/provision-evidence-collector.yml b/ansible/provision-evidence-collector.yml
index 627cbbe5eecc3654e96a378a4ac7f4fb489c468e..fa13074a6eae484b0943811654fad3a33047d8f5 100644
--- a/ansible/provision-evidence-collector.yml
+++ b/ansible/provision-evidence-collector.yml
@@ -3,7 +3,7 @@
   - hosts: evidence_collector
     become: yes
     pre_tasks:
-    - import_tasks: "{{ ansible_dir }}/docker/credentials/vars.yml"
+      - import_tasks: "{{ ansible_dir }}/docker/credentials/vars.yml"
     roles:   
       - docker
     tasks:
diff --git a/ansible/provision-managers.yml b/ansible/provision-managers.yml
index 31edada492d9d5af1c5f592114084eb7bf56687f..1d8947259847cd8a4e430231565cc0b0c987892f 100644
--- a/ansible/provision-managers.yml
+++ b/ansible/provision-managers.yml
@@ -4,7 +4,7 @@
     become: yes    
     become_user: root
     pre_tasks:
-    - import_tasks: "{{ ansible_dir }}/globals/vars.yml"
+      - import_tasks: "{{ ansible_dir }}/globals/vars.yml"
     roles:
       - role: ../wazuh-ansible/roles/opendistro/opendistro-elasticsearch
       - role: ../wazuh-ansible/roles/wazuh/ansible-wazuh-manager
diff --git a/ansible/provision.yml b/ansible/provision.yml
index 6901c339d3bad30efd718058f10e2e26e5369f31..a06d9089e2055386bac9b22d53f64ad4a72b2e32 100644
--- a/ansible/provision.yml
+++ b/ansible/provision.yml
@@ -5,5 +5,8 @@
 - name: Start provision of the Wazuh Agents
   import_playbook: provision-agents.yml
 
-- name: Start provision of Evidence Collector
-  import_playbook: provision-evidence-collector.yml
\ No newline at end of file
+- name: Start provision of the Evidence Collector
+  import_playbook: provision-evidence-collector.yml
+
+- name: Start provision of the Clouditor
+  import_playbook: provision-clouditor.yml
\ No newline at end of file
diff --git a/environments/full-setup/Vagrantfile b/environments/full-setup/Vagrantfile
index 2b311d4158b39a74ff057a0b6c99714bd93d5e31..de5e3ef3fb53f7d29abd64218fecd344856073a9 100644
--- a/environments/full-setup/Vagrantfile
+++ b/environments/full-setup/Vagrantfile
@@ -13,14 +13,14 @@ servers=[
     :hostname => "agent1",
     :ip => "192.168.33.11",
     :box => "centos/8",
-    :ram => 1024,
+    :ram => 512,
     :cpu => 1
   },
   {
     :hostname => "agent2",
     :ip => "192.168.33.12",
     :box => "centos/8",
-    :ram => 1024,
+    :ram => 512,
     :cpu => 1
   },
   {
@@ -29,6 +29,13 @@ servers=[
     :box => "centos/8",
     :ram => 1024,
     :cpu => 2
+  },
+  {
+    :hostname => "clouditor",
+    :ip => "192.168.33.14",
+    :box => "centos/8",
+    :ram => 512,
+    :cpu => 1
   }
 ]
 
diff --git a/environments/full-setup/full-setup.mk b/environments/full-setup/full-setup.mk
index cf5009bb77e1e293c46321646e8509af8d9f0c12..4932cf8400d7ac752438fb79cea2cc05c87d90e7 100644
--- a/environments/full-setup/full-setup.mk
+++ b/environments/full-setup/full-setup.mk
@@ -18,4 +18,13 @@ ssh-agent2:
 	@$(VAGRANT_RUN) ssh agent2
 
 ssh-evidence-collector:
-	@$(VAGRANT_RUN) ssh evidence-collector
\ No newline at end of file
+	@$(VAGRANT_RUN) ssh evidence-collector
+
+ssh-clouditor:
+	@$(VAGRANT_RUN) ssh clouditor
+
+provision-evidence-collector:
+	@ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-evidence-collector.yml
+
+provision-clouditor:
+	@ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook $(ANSIBLE_ARGS) $(ANSIBLE_DIR)/provision-clouditor.yml
\ No newline at end of file
diff --git a/environments/full-setup/inventory.txt b/environments/full-setup/inventory.txt
index cea1c6b98ce6f4712d9641a31cfc2ecd3e68ddcc..58aa44970fba348721c0b9ac7ff7441443c3c447 100644
--- a/environments/full-setup/inventory.txt
+++ b/environments/full-setup/inventory.txt
@@ -15,4 +15,10 @@ ansible_ssh_common_args='-o StrictHostKeyChecking=no'
 192.168.33.13 public_ip=192.168.33.13 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/full-setup/.vagrant/machines/evidence-collector/virtualbox/private_key
 
 [evidence_collector:vars]
+ansible_ssh_common_args='-o StrictHostKeyChecking=no'
+
+[clouditor]
+192.168.33.14 public_ip=192.168.33.14 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=environments/full-setup/.vagrant/machines/clouditor/virtualbox/private_key
+
+[clouditor:vars]
 ansible_ssh_common_args='-o StrictHostKeyChecking=no'
\ No newline at end of file