Overview

Wazuh brings XDR and SIEM together to analyze security data across endpoints, clouds, and networks. It is a practical fit for teams seeking a shared platform for threat detection, incident response, and compliance support rather than a tool focused on just one of those jobs. Its compliance mappings can help organize work against recognized standards, but they do not certify compliance.

Key features

Detection and response

Rules examine operating-system and application logs for errors, misconfigurations, malicious activity, and policy violations. Active responses can take countermeasures such as blocking network access from a threat source, giving teams a way to act on detections within the platform. Routing, enrichment, and suppression rules support alert handling, but the lack of alert deduplication is a drawback where repeated alerts need consolidating.

Endpoint and cloud coverage

File Integrity Monitoring tracks changes to file contents, permissions, ownership, and other attributes, which helps teams monitor sensitive files for unexpected changes. Vulnerability detection compares endpoint software inventory with updated CVE databases to identify known vulnerable software. Agents support Linux, Windows, macOS, Solaris, AIX, and HP-UX and require an average of 35 MB of RAM, a modest stated memory requirement for endpoint monitoring.

Cloud integrations cover AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity. The integrations guide also covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake, making Wazuh relevant to organizations with existing tools in those ecosystems.

Compliance and managed service

Default rulesets support PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR mappings. These can assist compliance work, but a mapping is not certification. Wazuh Cloud says its service is PCI DSS- and SOC 2-compliant and independently audited to meet those standards. Cloud environments are updated to the latest Wazuh version without customers handling manual maintenance or upgrades; support services and professional hours are also offered for Cloud environments, alongside free community support.

Pricing

The self-hosted open-source plan costs 0.00 USD per free. It avoids a subscription charge, but puts operation of the environment on the customer. Paid Wazuh Cloud plans start at $571/month and include standard support; their agent caps and retention periods make capacity and data history the key trade-offs.

Plan	Price	Included limits
Open source	0.00 USD per free	Free and open source; self-hosted
Small	Starting at $571/month	Up to 100 active agents; 1 month indexed data retention; 3 months archive data retention; standard support
Medium	Starting at $923/month	Up to 250 active agents; 3 months indexed data retention; 1 year archive data retention; standard support
Large	Starting at $1467/month	Up to 500 active agents; 3 months indexed data retention; 1 year archive data retention; standard support
Custom	Custom pricing	Customized settings and service

Small is the entry point for Cloud customers with no more than 100 active agents who can work with a month of indexed history. Medium raises capacity to 250 and extends indexed retention to three months and archive retention to a year. Large keeps those retention periods but doubles the agent allowance to 500, so its higher starting price primarily buys more capacity. A 14-day trial is offered. Wazuh's paid plans are best judged against both the agent cap and the indexed-versus-archive retention distinction, not just the monthly price.

Platforms

Wazuh is available across API, Linux, macOS, self-hosted, web, and Windows. Its agent also supports Solaris, AIX, and HP-UX, extending endpoint coverage beyond the main platform list.

Who it's for

Wazuh can suit individuals, small businesses, and large enterprises, but the right deployment depends on appetite for operations. The open-source edition is the stronger fit for people able to self-host and maintain a security stack. Cloud is better for organizations that prefer Wazuh-managed updates and want support services, provided the paid agent limits and retention tiers fit their needs. It is less compelling for a team that requires alert deduplication or wants a free managed service.

Pros and cons

Broad monitoring in one platform: combines XDR and SIEM with log-based detection, vulnerability identification, file-integrity monitoring, and response actions.
Wide endpoint and cloud reach: agents cover several operating systems, while integrations span major cloud services and several security data platforms.
Useful compliance mappings, with a clear boundary: default rulesets cover several named standards, but do not themselves certify compliance.
Free self-hosted option: open-source access avoids a plan fee, though the customer must run the environment.
Paid plans cap agents and retention: Small is limited to 100 active agents and one month indexed retention; larger tiers cost more to raise capacity and, for Medium, indexed retention.
No alert deduplication: teams needing duplicate alerts consolidated will need to account for that gap.

Alternatives

Vigil is worth considering for a free, self-hosted option with unlimited events, Sigma detection rules, and threat hunting. Elastic Security is another freemium security analytics option if its platform and plan fit your requirements. nano SIEM may suit readers seeking an AGPL-3.0 open-source engine that can be self-hosted without an account or bill. Sumo Logic offers a free plan with 20 daily credits for logs, metrics, and traces, seven-day log retention, and up to three users.

CrowdStrike Falcon Surface is a paid alternative with a free trial. ManageEngine Log360 is a paid option with a free trial. Rapid7 Surface Command is a paid alternative with a free trial. UTMStack is a freemium-category alternative with a free trial.

Readers comparing category choices can browse SIEM Software, Alert Management Software, Intrusion Detection and Prevention Software, and File Integrity Monitoring Software.

Verdict

Choose Wazuh if you want broad security monitoring, vulnerability detection, file-integrity coverage, and response capabilities, and can either operate the open-source self-hosted edition or justify a Cloud tier. Its strongest reason to choose is breadth with a free self-hosted route; its clearest reasons to look elsewhere are the paid tiers' agent and retention limits and the absence of alert deduplication.

	SEC (Simple Event Correlator)	Wazuh
Free plan	Yes	Yes
Free trial	No	Yes
Paid from	Free	$571/mo
Platforms	Linux, self-hosted, Windows	api, Linux, macOS, self-hosted, Web, Windows
Free plan	Yes	Yes
Alert deduplication	Yes	No
Routing rules	Yes	Yes
Suppression rules	Yes	Yes
Paid from		571 /mo
Alert enrichment		Yes

SEC (Simple Event Correlator) vs Wazuh

SEC (Simple Event Correlator)

Wazuh