Overview

Wazuh unifies XDR and SIEM to analyze security data across endpoints, clouds, and networks. It brings threat detection, response, vulnerability identification, file monitoring, and compliance mappings into one platform, making it a fit for teams that want coverage across several security tasks rather than a point solution. The breadth comes with a choice: operate the open-source edition yourself or pay for Wazuh Cloud.

Key features

Detection and response

Rules examine operating-system and application logs for errors, misconfigurations, malicious activity, and policy violations. Built-in active responses can take countermeasures such as blocking network access from a threat source, which lets teams connect detection with action. Routing, enrichment, and suppression rules support alert handling, but the absence of alert deduplication is a disadvantage when teams need repeated alerts consolidated.

Endpoint and cloud security

File Integrity Monitoring tracks changes to file contents, permissions, ownership, and attributes, helping teams spot unexpected modifications. Vulnerability detection compares endpoint software inventory with updated CVE databases to identify known vulnerable software. The Wazuh agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX and averages 35 MB of RAM, a modest stated memory requirement across a broad range of endpoint systems.

Cloud monitoring covers AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity. Integrations also cover Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake, which may help teams connect Wazuh with existing security tooling. Default rulesets map to PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR, but those mappings support standards work rather than certify compliance. Wazuh Cloud says its service is compliant with PCI DSS and SOC 2 and independently audited to meet those standards.

Pricing

Wazuh offers a free, open-source self-hosted plan and paid cloud plans priced by active-agent capacity and retention. The free edition avoids a subscription price, but places operation and maintenance with the customer. Paid environments are updated to the latest Wazuh version without customer-managed upgrades, and include standard support; community support is also free.

Wazuh open source: 0.00 USD per free. Free and open source, self-hosted. It suits individuals and teams prepared to run the platform themselves.
Small: 571.00 USD per month, starting price. Includes up to 100 active agents, 1 month of indexed data retention, 3 months of archive retention, and standard support. It is the entry cloud tier for smaller deployments that can work within the agent and retention limits.
Medium: 923.00 USD per month, starting price. Includes up to 250 active agents, 3 months of indexed data retention, 1 year of archive retention, and standard support. The larger capacity and longer retention suit growing deployments that need more searchable history.
Large: 1467.00 USD per month, starting price. Includes up to 500 active agents, 3 months of indexed data retention, 1 year of archive retention, and standard support. It fits deployments needing more agent capacity than Medium, with the same stated retention periods.
Custom: custom pricing for customized settings and service. This is the option for requirements beyond the set cloud tiers.

The paid tiers raise agent limits and, from Small to Medium, extend indexed and archive retention. Teams should weigh those ceilings against their deployment size and history needs; the published tiers specify no more than 500 active agents. Support services and professional hours are offered for Cloud environments.

Platforms

Wazuh is available across API, Linux, macOS, self-hosted, web, and Windows environments. Its agent also supports Solaris, AIX, and HP-UX, extending endpoint coverage beyond the headline platform list.

Who it's for

Wazuh is suited to individuals through large enterprises that need broad security monitoring and can choose between self-managed infrastructure and a managed cloud environment. It is particularly compelling where file integrity, vulnerability detection, cloud monitoring, and response actions belong in the same workflow. Teams that need alert deduplication or cannot work within the cloud plans' agent and retention limits should consider other options.

Pros and cons

Pro: Detection, file integrity, vulnerability identification, and active response sit together, reducing the need to assemble those capabilities from separate tools.
Pro: Cloud integrations span major infrastructure and productivity services, including AWS, Azure, Google Cloud, Microsoft 365, and GitHub.
Pro: The self-hosted open-source edition has no plan charge, and the agent's average 35 MB RAM requirement is modest.
Con: The free edition is self-hosted, so it is not the managed option for teams seeking to avoid operating the platform.
Con: Paid cloud plans start at 571.00 USD per month and impose active-agent and retention limits.
Con: Alert deduplication is absent, which can leave teams without a built-in way to consolidate repeated alerts.
Con: Compliance mappings do not by themselves establish certification, so standards alignment still requires separate compliance work.

Alternatives

Vigil is worth considering for readers who want a free plan with unlimited ClickHouse events, Sigma detection rules, threat hunting with HQL, and multi-endpoint support.

Elastic Security is another freemium option with a free plan and trial, for readers comparing security analytics platforms with Wazuh.

Sumo Logic may suit readers who prefer a web-based option with a free plan capped at 20 daily credits, 7-day log retention, and up to 3 users.

nano SIEM is an alternative for readers seeking an open-source engine under AGPL-3.0 that can be self-hosted without an account or bill.

LogSentinel SIEM is another SIEM option for readers considering pay-per-volume enterprise SaaS with unlimited connected applications and extended retention.

Seceon Open Threat Management is an alternative with licensing based on device count, user count, or a combination of both.

Devo Analytics Cloud is an alternative for readers comparing paid analytics and SIEM plans with custom pricing.

Rapid7 InsightIDR is another paid option for readers comparing SIEM plans with add-on log retention.

For a wider comparison, see SIEM Software, Alert Management Software, Intrusion Detection and Prevention Software, and File Integrity Monitoring Software.

Verdict

Choose Wazuh if you want broad security monitoring and response in one platform, especially when you can self-host the free edition or fit within a cloud plan's agent and retention limits. Its strongest reason to choose it is the combination of detection, vulnerability and file monitoring, cloud coverage, and active response. Look elsewhere if alert deduplication is essential or the paid cloud entry price and capacity limits do not suit your deployment.

	Panther	Wazuh
Free plan		Yes
Free trial	Yes	Yes
Paid from		$571/mo
Platforms	api, self-hosted, Web	api, Linux, macOS, self-hosted, Web, Windows
Custom detection rules	Yes
Real-time alerting	Yes
Query language	PantherFlow and SQL
Free plan		Yes
Paid from		571 /mo
Alert deduplication		No
Routing rules		Yes
Alert enrichment		Yes
Suppression rules		Yes

Panther vs Wazuh

Panther

Wazuh