Wazuh

Top 10 per category. † marks Wazuh-specific strengths.

A. Identity: Login success/failure; account lockout; password change; role/permission change; service account activation; OAuth token anomaly; MFA registration; privileged session; SSH/SUDO audit; † Wazuh: SSH authorized_keys modification, SUDO command execution, and PAM authentication events natively decoded and rule-mapped

B. File/Storage: File create/modify/delete; API key rotation; cloud bucket policy; DB query on restricted tables; PAM session; first-time object access; mass download; container image pull; Git permission; † Wazuh FIM: real-time file integrity monitoring with baseline comparison, detecting modification, creation, deletion, and permission changes on specified directories, with the original hash and the modified hash preserved for forensic reconstruction

C. Network Flow: Src/Dst IP/port/protocol; DNS query; TLS handshake; HTTP transaction; NetFlow via integration; DNS tunneling; non-standard ports; multi-connection; cross-region; † Wazuh: Suricata integration for network intrusion detection, DNS query logging, and TCP/UDP connection tracking, all natively decoded

D. Endpoint/Email: Executable hash; macro document; C2 beacon; fileless execution; sandbox rejection; new scheduled task; SUID creation; registry persistence; email gateway; † Wazuh: Sysmon integration (Windows), Auditd integration (Linux), process execution monitoring, file access monitoring, and registry monitoring, all natively decoded and rule-mapped

E. Exploit: Buffer overflow; SQLi/XSS (CRS 4.25 via Coraza); exploit kit; RCE via CVE; lateral movement; cloud metadata access;

F. Behavioral: Impossible travel; egress spike; off-hours access; privilege escalation; service account interactive; new API consumer; IAM role first-time; auth method change; data breadth; † Wazuh: rule-based anomaly detection (threshold breaches, pattern matches) without ML. The behavioral detection is rule-driven, not model-driven. Simpler, more transparent, less automated.

Ingestion Pipeline & Scale

Wazuh Agents (push-based), syslog, cloud log collectors. Source-side filtering via agent configuration. No pre-ingest deduplication. Rule-based aggregation. FIM baselines reduce noise.

Architecture: Wazuh Manager + OpenSearch/Elasticsearch indexer + Dashboard. Manual scaling. No auto-scaling. ILM via OpenSearch policies.

>10K EPS: Handled by the OpenSearch cluster. Scaling is manual: add data nodes, increase heap, tune shards. At enterprise scale, the cluster is the bottleneck and the operational cost is the engineering time.

Failure Modes: The OpenSearch/Elasticsearch cluster is the single point of failure. A disk failure, a heap overflow, or a shard corruption takes down the search. The recovery is the organization's responsibility. There is no vendor SLA. There is no support hotline. There is the open-source community and the organization's own engineers.

Schema, Search, Detection

Decoders (regex, JSON, XML), rules (XML-based, fully auditable). Not CIM, not UDM, not OCSF by default. Custom field mapping via decoders and OpenSearch pipelines.

OpenSearch Query DSL / Lucene. Timeline, entity views, FIM monitoring, vulnerability reports, compliance trackers. Kibana/OpenSearch Dashboards. REST API. CSV/JSON export.

Detection is from the Wazuh rule engine, the FIM, the vulnerability detector, and upstream sources (CRS 4.25 via Coraza, EDR, identity). The rule engine is text-based and fully auditable. Every rule is a human-readable XML file. There is no black-box correlation. The SOC analyst can read the rule, understand the logic, and modify it. This is a genuine transparency advantage over commercial SIEMs where the correlation logic is opaque.

SOAR: webhook triggers, REST API, ITSM connectors. Not a playbook engine. A third-party SOAR is required for complex orchestration.

Architecture & Cost

Self-managed. Wazuh Manager nodes, OpenSearch/Elasticsearch indexer cluster, Node.js dashboard. SAML/OIDC. RBAC. TLS 1.2+. No EOL. Active community development.

Cost: $0 licensing. MIT license. Free.

Infrastructure cost reflects VM sizing, OpenSearch storage, cluster optimization. No per-GB, per-seat, or per-query fees. Paid support (~$3–$9/user/month) is optional. The open-source community is the primary support channel.

Search: unlimited within cluster capacity. No per-query fees. Storage: ILM Hot → Warm → Cold → Frozen. Manual configuration.

Cloud, Ecosystem, Customers

Self-managed across any cloud. No SaaS dependency. SAML/OIDC. SOC 2 Type II (via partner), ISO 27001 (community), GDPR/CCPA, HIPAA-ready, PCI-DSS.

Compliance packs (CIS, PCI, HIPAA, NIST, GDPR, ISO). Cloud integrations (AWS, Azure, GCP). Vulnerability detection. OpenSearch plugins. Webhook/ITSM connectors. Professional services via Wazuh partners.

Customer base: Open-source. No public enterprise customer list. Community-driven. Government, education, healthcare, and enterprise deployments exist but are not published. The user's own deployment (Ubuntu + Stalwart + Wazuh + Falco + ClamAV + Chkrootkit + CrowdSec + Coraza/CRS + Fail2ban + Lynis) is representative of the community deployment model.

Strengths: $0 licensing. Full infrastructure control. No vendor lock-in. Native FIM, CIS benchmarks, vulnerability detection. Transparent rule engine (text-based, auditable). Flexible deployment (on-prem, private cloud, air-gapped). Active community.

Weaknesses: Manual scaling and cluster management. No native SOAR. No ML-driven UEBA. Support requires paid contract or internal expertise. Steep learning curve (OpenSearch DSL, rule/decoder architecture, cluster administration). No vendor SLA. The operational cost is the engineer's time.

Wazuh is the strongest choice for organizations with engineering capacity that want a free, self-managed, transparent security platform. The FIM, CIS benchmarks, vulnerability detection, and rule engine are functional and free. The transparency (text-based rules, open-source code, no black-box correlation) is a genuine advantage for a SOC that wants to understand and audit every detection rule.

Wazuh is not the right choice for a 50,000-endpoint enterprise that needs a 24/7 vendor SLA, a native SOAR engine, ML-driven UEBA, and a 3,000+ connector ecosystem. For that buyer, the commercial platforms in this review are the rational choice.

The user's free-stack deployment (Wazuh + Falco + ClamAV + Chkrootkit + CrowdSec + Coraza/CRS + Fail2ban + Lynis + Stalwart) is a complete, production-grade security stack at zero licensing cost. The CISO should understand that this stack is functionally equivalent to a $20–$25/endpoint/month commercial EDR + SIEM for a 50-endpoint organization. The difference is the operational model: the free stack is the engineer's responsibility. The commercial stack is the vendor's.

Ideal buyer: Organization with engineering capacity (SRE/DevOps), 50–5,000 endpoints, data sovereignty or air-gapped requirement, budget constraint, or philosophical preference for open-source. SOC team of 1–10 with Linux/DevOps skills.

Key RFP (for Wazuh Enterprise support):

1. Support SLA: response time, escalation path, named engineer.
2. CIS benchmark update cadence and the process for custom control mapping.
3. FIM baseline management at scale (10,000+ files across 500+ endpoints).
4. OpenSearch cluster sizing and ILM optimization for the organization's ingestion volume.
5. 3-year roadmap: features, community governance, commercial support tiers.
6. 3–5 referenceable deployments at comparable scale.

Red flags: A Wazuh Enterprise support contract that does not include the OpenSearch cluster management. A deployment plan that does not include a disaster recovery procedure for the indexer cluster. A compliance mapping that is generic rather than industry-specific.