Wazuh

Wazuh is a security monitoring platform that combines SIEM (collecting and correlating logs) with XDR (detecting and responding on endpoints). Wazuh, Inc. develops it and releases the software as open source; the vendor states that it carries no licence cost. A small program, the Wazuh agent, runs on Windows, macOS, Linux, Solaris, AIX and HP-UX machines and sends data to a central server.

The server analyses events against decoders and rules, an indexer stores the alerts, and a web dashboard displays them. The same agent covers file integrity monitoring, vulnerability detection, configuration checks and log collection. Teams can install the central components on their own servers or buy Wazuh Cloud, where the vendor runs the environment. The vendor describes it as the most widely adopted open source security platform, a claim we cannot verify.

• File integrity monitoring. The agent watches files for changes in content, permissions, ownership and attributes, and identifies the user or application behind a change. The vendor links this to compliance needs such as PCI DSS and NIST.
• Vulnerability detection. Agents report installed software to the server, which compares the inventory with continuously updated CVE databases. Findings list known vulnerable packages so a team can patch before an attacker uses them.
• Security configuration assessment. Periodic scans compare endpoint settings with hardening guides and your own policies. Alerts carry recommendations, references and mapping to regulatory controls, and the checks can be customised.
• Log data analysis. Agents collect operating system and application logs and forward them to the server for rule-based analysis. Rules flag errors, misconfigurations, policy violations and malicious activity, and they are mapped to the MITRE ATT&CK framework.
• Active response. Wazuh can act when criteria match, for example by blocking network access from a threat source. It can also run remote commands or system queries to help with incident response tasks.
• Container and cloud monitoring. The agent integrates with the Docker engine to watch images, volumes and running containers. Cloud modules connect to AWS, Microsoft Azure, GCP, Microsoft 365 and GitHub to collect their security data.
• Cluster deployment. The server and the indexer can each run as multi-node clusters for high availability and load balancing. The quickstart is a single-host install that the vendor calls enough for up to 100 endpoints.

• A 30-person company with one sysadmin. Installs the all-in-one deployment on a single Linux host, enrols laptops and servers, and uses file integrity and vulnerability reports as a first line of visibility without a licence bill.
• A managed service provider. Runs Wazuh for several customers, using agents on client machines and the vendor's partner programme. Role-based access and multi-tenancy in the dashboard documentation support separating customers.
• A team facing a compliance audit. Uses the PCI DSS, NIST, TSC and HIPAA dashboards, file integrity monitoring and configuration assessment to collect evidence for technical controls. The vendor says Wazuh provides some of the controls, not full certification.

The documentation quickstart installs the server, indexer and dashboard on one host with a script: download wazuh-install.sh and run it with the -a option. The vendor says this is usually enough for up to 100 endpoints and 90 days of indexed alerts. Sizing starts at 4 vCPU, 8 GiB of RAM and 50 GB of storage for 1 to 25 agents.

The central components need a 64-bit Linux system, with Amazon Linux, CentOS Stream, Red Hat Enterprise Linux and Ubuntu listed. The script prints an admin password at the end. Agents then enrol from the dashboard. Other install routes are Docker, Kubernetes, virtual machine images, Ansible and Puppet. Wazuh Cloud skips all of this and offers a free 14-day trial.

Wazuh is the one entry here whose software carries no licence cost: the vendor says so and the code is GPLv2. The price is your own time, because you install and size the indexer, server and dashboard, or you buy Wazuh Cloud.

Its Small cloud tier covers up to 100 active agents and keeps indexed data for one month. The vendor pages state no country of establishment.

In our SIEM software ranking Wazuh stands at #1 of 12: Graylog follows directly after it. Because challengers fill the first three places when a category has them, the number is a place on a list and not a rating.

The vendor states no country of establishment, so Wazuh is left out of the regional count for this list.

Wazuh installs as an indexer, a server and a dashboard, with an agent on each monitored endpoint, and the same agent covers file integrity monitoring, configuration assessment and vulnerability detection.

Because the software is GPLv2, you can buy, run and leave without a contract, which is the strongest independence result in this list.

The trade is staffing: parsing, rule tuning and upgrades are yours unless you buy Wazuh Cloud or professional support.

Charging model: Self-hosted software free; Wazuh Cloud tiers published by active agents; 14-day trial.

The software is free to install, and the vendor states there is no licence cost. Wazuh Cloud is priced by active agents. The Small tier covers up to 100 agents with 1 month of indexed data and 3 months of archive, starting at $571 per month. Medium covers up to 250 agents with 3 months indexed and 1 year archive, from $923 per month. Large covers up to 500 agents on the same retention, from $1467 per month. A Custom tier has no published price. All tiers list a standard support plan, and a 14-day trial asks for no credit card. Professional support, consulting and training are sold separately, and their prices are not published.

We took this from wazuh.com, the vendor’s own site, when we reviewed Best SIEM Software in 2026; that review is dated 5 November 2026.

For Wazuh Cloud, the vendor says it operates in compliance with PCI DSS and SOC 2 and that independent audit reports and certificates can be downloaded from the Cloud page. Cloud hosting regions are not stated on the pages we read.

For the self-hosted version, data stays on your own servers, and the documentation covers certificates, API security and role-based access control. Alert data is held in the indexer, which you can query and manage with index lifecycle tools.

Integrations the vendor names (12):

• VirusTotal
• TheHive
• PagerDuty
• AWS
• Microsoft Azure
• Google Cloud Platform
• Microsoft 365
• GitHub
• Docker
• Kubernetes
• Ansible
• Puppet

We pick the closest products in the same guide by tags, price model and region.

• Sumo Logic (#6 of 12): Log analytics vendor whose Cloud SIEM sits in the Enterprise Suite. (United States)
• Datadog (#7 of 12): Suits: Organisations that want every observability product from one vendor.
• Rapid7 InsightIDR (#8 of 12): SIEM now sold as Incident Command, in three packages. (United States)
• Microsoft Sentinel (#9 of 12): Aimed at: Organisations that already run workloads in Azure and use Microsoft security tools. (United States)

Read from the vendor’s own pages on 5 November 2026.

• wazuh.com: No licence cost, open source claim, platform summary
• wazuh.com/platform/overview: Use cases, components, agent platforms
• wazuh.com/cloud: Cloud tiers, prices, trial, PCI DSS and SOC 2
• documentation.wazuh.com/current/quickstart.html: Install steps, hardware sizing, operating systems, licences

Four tests decide a position: how soon the product is useful, what the bill really becomes, how data leaves and who it suits. That puts Wazuh at #1 of 12. Method and commercial relationships are in our editorial process.