Wazuh: What the Open-Source SIEM Does Well and What It Takes to Run
Wazuh is the most widely deployed open-source SIEM: log analysis, intrusion and malware detection, file integrity monitoring, vulnerability detection, and compliance reporting, free under an open-source license. It is the credible zero-license-cost answer to a five-figure SIEM bill for teams with real engineering time. The honest trade: deployment, tuning, storage, upgrades, and above all the 24/7 watching are yours to supply, and that staffing cost dwarfs any license fee the software saved.
Wazuh is the most widely deployed open-source SIEM: a free, actively developed platform that combines log analysis, intrusion and malware detection, file integrity monitoring, vulnerability detection, and compliance reporting behind a single agent and console. For teams with more engineering time than budget, it is the credible answer to a five- or six-figure SIEM bill. The honest trade is that the license is where the free ends: Wazuh gives you the platform, and everything a commercial vendor's services would cover, deployment, tuning, storage, and someone watching the alerts, is yours to supply.
This guide covers what Wazuh actually does, where it fits, what running it well takes, and how to decide between Wazuh and the commercial alternatives.
What Wazuh is and how it works
Wazuh grew out of the OSSEC host-intrusion-detection project and has evolved into a full detection platform. The architecture is straightforward:
- Agents on your endpoints and servers collect logs, monitor file integrity, inventory software, and watch for suspicious behavior on Windows, Linux, and macOS
- The Wazuh server ingests agent data plus agentless sources (network devices, cloud services, firewalls), runs it through a rule engine, and raises alerts
- The indexer and dashboard (built on OpenSearch) store events and give analysts search, visualization, and case views
Cloud integrations pull telemetry from AWS, Azure, Microsoft 365, and Google Workspace, which matters because that is where much of the modern attack surface lives.
What it does well
- Detection breadth for the price of nothing: a maintained ruleset spanning log analysis, rootkit and malware detection, and behavioral checks, with MITRE ATT&CK mapping in the dashboard
- File integrity monitoring built in: genuinely capable FIM (baselines, real-time change detection, who-did-it attribution), which covers a control that compliance frameworks require by name; our FIM guide covers that mapping
- Compliance reporting out of the box: rule tagging and reports aligned to PCI DSS, HIPAA, GDPR, and NIST 800-53, useful evidence for auditors without extra tooling
- Vulnerability detection: agents inventory installed software and correlate it against CVE feeds, a lightweight complement to dedicated scanning (not a replacement for it; see our vulnerability assessment tools guide)
- Active response: automated actions like blocking an IP or disabling an account when specific rules fire, within careful limits you define
- No vendor lock-in: open code, open data, standard formats. If you outgrow it, your telemetry and detection logic are portable
What it takes to run
The costs arrive in operations rather than licensing, and they are worth pricing honestly before committing:
- Deployment and sizing. A production Wazuh cluster with proper indexer sizing, retention, and TLS between components is a real infrastructure project, not an afternoon install.
- Tuning. Default rules produce noise in any real environment. Expect weeks of suppression, threshold, and custom-rule work before the alert stream is trustworthy, and ongoing maintenance as your environment changes.
- Storage. Log retention is your disk bill. Investigation-grade retention (months, not weeks) is what makes the difference when an intrusion is discovered late.
- Upgrades. The project moves quickly, which is good news that arrives as regular upgrade work.
- Watching. The platform detects; it does not investigate. Around-the-clock coverage takes four to five analysts regardless of what the software cost, which is the line item that dwarfs every license fee it saved.
Wazuh is free. 3am is not.
If the honest answer to who watches the queue is nobody, SubRosa's Managed SOC delivers 24/7 detection and response across Microsoft 365, Entra ID, Defender, and your endpoints, analysts included.
Explore the Managed SOCWazuh vs commercial SIEM platforms
| Wazuh | Commercial platforms | |
|---|---|---|
| License cost | Free (paid cloud option available) | Ingestion, node, or user-based; grows with data |
| Deployment | Yours to build and size | SaaS options remove the infrastructure work |
| Detection content | Solid maintained baseline plus community rules | Larger vendor content teams, faster coverage of new techniques |
| Integrations | Good core coverage; some connectors community-maintained | Broad maintained connector catalogs |
| Support | Community, docs, optional paid support | Vendor SLAs |
| Best fit | Engineering-led teams; budget-constrained environments; labs | Teams buying time instead of spending it |
For the commercial landscape itself, see our guides to the most used SIEM tools and SIEM vendors.
Who should (and should not) choose Wazuh
Wazuh is a strong choice when you have Linux-comfortable engineers with genuine time allocated, a budget constraint that rules out commercial platforms, a compliance requirement (FIM, log retention, PCI reporting) you want covered without new spend, or a lab and skill-building environment.
Look elsewhere when nobody owns the tuning and watching, when the team is already stretched, or when the goal was never to operate infrastructure at all. An unwatched Wazuh is the free version of the same shelfware problem commercial SIEM buyers know well: the alerts fire perfectly into a queue nobody reads.
Wazuh is free. Running it 24/7 is not.
The platform-versus-outcome decision is the same one every SIEM buyer faces, just with the license column zeroed out. If the engineering time is real, Wazuh is the best value in the category. If what you actually need is intrusions caught and handled around the clock, the staffing math points the other way: SubRosa's Managed SOC delivers 24/7 detection and response across Microsoft 365, Entra ID, Defender, and your endpoints with analysts included, and our SIEM as a service guide maps that half of the market honestly.
Frequently asked questions
Is Wazuh really free?
The software is free and open source, including the full detection, FIM, and compliance feature set, with a paid cloud-hosted option and paid support available. The costs that remain are operational: infrastructure to run the server and indexer, storage for retention, engineering time for deployment and tuning, and analysts to investigate what it finds.
Is Wazuh good enough to replace a commercial SIEM?
For many small and mid-sized environments, yes, functionally: detection content, agent coverage, cloud integrations, and compliance reporting hold up well. The gap is rarely features; it is the services around them: maintained connectors, vendor SLAs, faster detection content for new techniques, and the absence of anyone to call. Teams with strong engineering culture close that gap themselves; stretched teams should not assume they will.
What is the difference between Wazuh and OSSEC?
Wazuh began as a fork of OSSEC, the classic open-source host intrusion detection system, and has since grown far beyond it: a full SIEM with an OpenSearch-based indexer and dashboard, cloud service integrations, vulnerability detection, and an active release cadence. OSSEC remains a lightweight HIDS; Wazuh is the maintained, full-platform successor most new deployments should choose.
How hard is Wazuh to deploy and maintain?
A single-node lab install is an afternoon. A production cluster, properly sized indexer, TLS between components, agent rollout, retention planning, and integration with your cloud tenants, is a real infrastructure project, and the ongoing work is tuning: suppressing noise, writing custom rules, and keeping up with a fast release cadence. Plan for it as an operated system, not an installed product.
Who monitors Wazuh once it is running?
That is the decisive question. Wazuh detects and alerts; it does not investigate. If your team can genuinely watch and work the queue, including nights and weekends, Wazuh is excellent value. If not, the pragmatic path is managed detection and response, where the provider brings both platform and analysts, because an unwatched SIEM, free or not, is a log archive.