Wazuh combines XDR and SIEM to analyze security data from endpoints, clouds, and networks for threat detection, incident response, and compliance support. Its rules identify errors, misconfigurations, malicious activity, and policy violations in operating system and application logs. File Integrity Monitoring tracks changes to file contents, permissions, ownership, and other attributes. Vulnerability detection compares endpoint software inventories with updated CVE databases, while active responses can take countermeasures such as blocking network access from a threat source. Wazuh can monitor services, virtual machines, and activity across AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub. Its integrations guide also covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake. The self-hosted open-source plan is free; paid plans start at 571.00 USD per month, and a 14-day trial is listed. Agents support Linux, Windows, macOS, Solaris, AIX, and HP-UX and require an average of 35 MB of RAM. Compliance mappings do not themselves certify compliance.
Who it is for
Wazuh suits organizations and individuals looking to analyze security data across endpoints, cloud services, and networks. It offers a free self-hosted option and paid Cloud plans with support and retention allowances.
What is good
- Rules flag suspicious activity and policy violations in logs.
- File monitoring tracks changes to content and permissions.
- Vulnerability detection checks software against updated CVE databases.
- Monitors several major cloud services and GitHub.
- Self-hosted open-source plan is free.
What to know first
- Small plan starts at 571.00 USD per month.
- Compliance mappings do not certify compliance.
- Agents require an average of 35 MB of RAM.
Verdict
Wazuh combines security monitoring with response capabilities and integrations for a range of environments. Its compliance mappings can support standards work, but they are not certification; paid plans begin at 571.00 USD per month.
Wazuh plans and pricing
All plansCompared on intrusion detection and prevention software
- Free plan
- Yes
- Paid from
- $571/mo
- Alert deduplication
- No
- Routing rules
- Yes
- Alert enrichment
- Yes
- Suppression rules
- Yes
