Security analytics & SIEM · Wazuh, Inc.

Wazuh

Free, open-source security platform combining SIEM and XDR capabilities for log analysis, threat detection and compliance.

Visit Wazuh Alternatives

Wazuh is a free, open-source security monitoring platform that combines host-based intrusion detection, log analysis, file integrity monitoring, vulnerability detection and compliance reporting (PCI-DSS, HIPAA, GDPR) in one agent-plus-manager architecture, built on an Elasticsearch/OpenSearch-compatible backend. It started as a fork of OSSEC and has grown into a full SIEM/XDR alternative to commercial platforms, appealing to security teams and MSSPs that want full control over their detection stack without per-GB licensing. It is entirely self-hosted (with a managed cloud offering from the vendor as an optional paid service), and the core software carries no license fee — revenue comes from support contracts and the managed cloud tier rather than software licensing.

At a glance

Vendor Wazuh, Inc.
Pricing model Open source + paid options
Free tier Yes
Deployment Cloud, Self-hosted
Open source Yes (GPL-2.0)
Best for Security teams and MSSPs wanting a fully open-source SIEM/XDR without per-GB licensing costs.

Pricing

The core platform is free and open source; the vendor sells an optional managed cloud tier and paid support contracts.

Pricing has not been verified yet — see the vendor's site.

Features

  • Host-based intrusion detection and log analysis
  • File integrity monitoring
  • Vulnerability detection against installed software
  • Compliance reporting (PCI-DSS, HIPAA, GDPR, NIST)
  • Agent-based architecture across Linux, Windows, macOS
  • SIEM and XDR use cases on the same open-source stack

Integrations

Profile last reviewed September 21, 2026

Head to head

Alternatives

OpenSearch Open-source fork of Elasticsearch/Kibana for log analytics and search, now governed under the Linux Foundation. Rapid7 InsightIDR Cloud SIEM/XDR from Rapid7 combining log search, UEBA and endpoint detection, priced per monitored asset rather than per GB. IBM QRadar Long-established enterprise SIEM offering log correlation, UEBA and SOAR, now offered as SaaS or on-premises appliances.

Wazuh in the index now

Terms to know

Anomaly detection Identifying data points or patterns that deviate significantly from expected or normal behavior. Data governance The policies, roles and processes that determine how data is defined, owned, accessed and kept compliant. General Data Protection Regulation (GDPR) The European Union's comprehensive data protection law governing how personal data of people in the EU is collected and used. Health Insurance Portability and Accountability Act (HIPAA) The U.S. law that sets privacy and security rules for protected health information handled by healthcare providers and insurers. SIEM (security information and event management) A platform that centralizes and correlates log and event data across an IT environment to detect and investigate security threats.

Related guides

How to choose a SIEM Choose a SIEM by deployment model, whether detection is rule-based, behavioral, or code, and how the storage architecture handles cost as retention grows. Security analytics, explained How security teams turn logs and network noise into detected threats — SIEM, threat intelligence, and the metrics that measure a SOC's speed.