Skip to content
SPECIFICTION
Get listed

Wazuh

wazuh.com

From $571/mo Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit wazuh.com
Spec score 8.6 #2 of 29 in Threat Hunting Software

What it is

Wazuh unifies XDR and SIEM to analyze security data across endpoints, clouds, and networks for threat detection, incident response, and compliance work. Its rules identify errors, misconfigurations, malicious activity, and policy violations in operating system and application logs. File Integrity Monitoring tracks changes to content, permissions, ownership, and other file attributes. Vulnerability detection compares endpoint software inventories with updated CVE databases. Built-in active responses can take countermeasures, including blocking network access from a threat source. Wazuh can monitor AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity. Its integrations guide also covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake. Default rulesets provide mappings for PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR, but those mappings do not themselves certify compliance. Wazuh runs on API, Linux, macOS, self-hosted, web, and Windows platforms. Its self-hosted open-source plan is free; paid plans start at $571 a month, and a 14-day trial is listed. Agents support Linux, Windows, macOS, Solaris, AIX, and HP-UX and require an average of 35 MB of RAM.

Spec sheet

What it does
Wazuh is a free open-source platform for threat prevention, detection and response across on-premises, virtualized, containerized and cloud workloads.Read 15 Oct 2026 · github.com
Intended users
Wazuh says its platform is used by organizations ranging from small businesses to large enterprises, as well as individuals.Read 30 Sep 2026 · documentation.wazuh.com
Support
Wazuh offers free community support as well as support services and professional hours for Cloud environments.Read 30 Sep 2026 · wazuh.com
License
Wazuh components are distributed under GNU GPL version 2 and Apache License 2.0, with the main repository code under GPLv2.Read 15 Oct 2026 · documentation.wazuh.com
Headquarters
Campbell, California, United StatesRead 28 Sep 2026 · wazuh.com
Founded
2015Read 28 Sep 2026 · wazuh.com
Agent platforms
Official agent packages cover Windows XP or later, Intel and Apple-silicon macOS, Solaris, AIX and HP-UX, in addition to Linux/Unix agents.Read 15 Oct 2026 · documentation.wazuh.com
Agent requirements
The Wazuh agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX and requires an average of 35 MB of RAM.Read 30 Sep 2026 · documentation.wazuh.com
API authentication
API calls use HTTP Basic authentication to obtain a JWT bearer token, with a default token lifetime of 900 seconds.Read 15 Oct 2026 · documentation.wazuh.com
API examples
Official examples show cURL, Python and PowerShell clients, and the documentation points to OpenAPI specifications.Read 15 Oct 2026 · documentation.wazuh.com
Architecture
The platform combines a multi-platform endpoint agent with Wazuh server, indexer and dashboard components.Read 15 Oct 2026 · wazuh.com
Central requirements
Central components require a 64-bit Intel, AMD or ARM Linux processor; documented operating systems include Amazon Linux, CentOS Stream, RHEL and Ubuntu releases.Read 15 Oct 2026 · documentation.wazuh.com
Cloud integrations
Wazuh can monitor AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity.Read 30 Sep 2026 · wazuh.com
Cloud security
Wazuh Cloud says it is compliant with PCI DSS and SOC 2 and independently audited to meet those standards.Read 30 Sep 2026 · wazuh.com
Cloud service
Wazuh Cloud environments are updated to the latest Wazuh version without manual maintenance or upgrades by the customer.Read 30 Sep 2026 · wazuh.com
Company facts
LinkedIn lists Wazuh as privately held, founded in 2015, headquartered in Campbell, California, with 201–500 employees.Read 15 Oct 2026 · linkedin.com
Company scale
Wazuh says its team has more than 200 professionals, with over 30 million downloads per year and more than 15 million protected endpoints.Read 15 Oct 2026 · wazuh.com
Compliance support
Default rulesets support PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR mappings, but Wazuh states these mappings do not by themselves certify compliance.Read 30 Sep 2026 · documentation.wazuh.com
Configuration assessment
Agents periodically scan operating-system and application settings for policy, standard and hardening-guide gaps.Read 15 Oct 2026 · wazuh.com
Documentation depth
The documentation includes quickstarts, installation, API reference, deployment guides, capability manuals, compliance use cases, integrations and release notes.Read 15 Oct 2026 · documentation.wazuh.com
Enrollment networking
Agent enrollment requires outbound manager connectivity, with configurable ports 1514/TCP for communications, 1515/TCP for configuration enrollment and 55000/TCP for API enrollment.Read 15 Oct 2026 · documentation.wazuh.com
External integrations
The Integrator module supports Slack, PagerDuty, VirusTotal, Shuffle, Maltiverse and custom integrations through webhooks, API keys and JSON alerts.Read 15 Oct 2026 · documentation.wazuh.com
File integrity
File Integrity Monitoring tracks file content, permissions, ownership, and attribute changes.Read 30 Sep 2026 · wazuh.com
File integrity monitoring
Its FIM module tracks file and directory creation, modification and deletion using checksums and attributes, with real-time or scheduled scans.Read 15 Oct 2026 · documentation.wazuh.com
Incident response
Built-in active responses can take countermeasures such as blocking network access from a threat source.Read 30 Sep 2026 · wazuh.com
Latest documented release
Release 4.13.0 dated 18 September 2025 added an IT Hygiene dashboard, global IT Hygiene queries, reliability improvements and multiple manager/API enhancements.Read 15 Oct 2026 · documentation.wazuh.com
Limit: G2 reviewers
Repeated complaints include difficult deployment and tuning, steep learning curve, heavy resource or storage use, upgrade effort, less-polished UI/reporting and limited visual correlation or SOAR integration.Read 15 Oct 2026 · g2.com
Limit: Gartner reviewers
A reported drawback is the need to install a client on every machine; one reviewer said crashed clients can be difficult to restore and viewed open-source deployment as adding potential vulnerabilities.Read 15 Oct 2026 · gartner.com
Limit: PeerSpot reviewers
PeerSpot reports recurring concerns about deployment complexity, scalability and hot-log storage, cloud/Kubernetes integration, AI and threat-intelligence gaps, agent resource use, maintenance and uneven support.Read 15 Oct 2026 · peerspot.com
Limit: self-hosted operation
A six-month independent self-hosting review describes ongoing backup, update testing, index maintenance and rule-tuning work, including occasional agent restart loops after updates.Read 15 Oct 2026 · mustafa.net
Limit: Trustpilot complaint
The sole reviewer reported repeated manager/indexer failures, false-positive vulnerability findings and an interface that resets during interactions.Read 15 Oct 2026 · trustpilot.com
Notable news
LinkedIn reported Wazuh 5.0 Release Candidate 1 with the Wazuh Common Schema, Sigma-rule support, native CTI, a dashboard AI assistant, HTTPS agent communication and broader regulatory mappings.Read 15 Oct 2026 · linkedin.com
Other integrations
The integrations guide covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake.Read 30 Sep 2026 · documentation.wazuh.com
Praise: G2 reviewers
Reviewers repeatedly praise the free open-source model, broad visibility, FIM, vulnerability detection, compliance monitoring, integrations and customizable rules and dashboards.Read 15 Oct 2026 · g2.com
Praise: Gartner reviewers
A repeated positive is the large community, frequent updates, abundant online information and the ability to use the full product in the free version.Read 15 Oct 2026 · gartner.com
Praise: PeerSpot reviewers
PeerSpot summaries repeatedly cite open-source flexibility, low licensing cost, customizable automation, strong dashboards, documentation, FIM, compliance reporting and broad integrations.Read 15 Oct 2026 · peerspot.com
Public API
The Wazuh server exposes an open-source REST API covering agents, managers, clusters, FIM, MITRE, rules, decoders, SCA, syscollector and RBAC.Read 15 Oct 2026 · documentation.wazuh.com
Rating on G2
4.5 out of 5 from 72 reviews.Read 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.4 out of 5 from 57 ratings.Read 15 Oct 2026 · gartner.com
Rating on PeerSpot
3.7 out of 5 from 51 reviews.Read 15 Oct 2026 · peerspot.com
Rating on Trustpilot
3 out of 5 from 1 review.Read 15 Oct 2026 · trustpilot.com
Security certifications
Wazuh Cloud states that it operates under PCI DSS and SOC 2 compliance programs and is independently audited for those standards.Read 15 Oct 2026 · wazuh.com
Self-hosting
The quickstart installs server, indexer and dashboard on Linux with an installation assistant, while Docker and Kubernetes deployment options are documented.Read 15 Oct 2026 · documentation.wazuh.com
SIEM
Wazuh centralizes and analyzes telemetry in real time for threat detection and compliance monitoring.Read 15 Oct 2026 · wazuh.com
SIEM integrations
Wazuh provides integration guidance for Elastic, OpenSearch, Splunk and Amazon Security Lake; its former Splunk and Elastic apps are only maintained for critical updates from version 4.6.Read 15 Oct 2026 · documentation.wazuh.com
Threat detection
Its rules detect errors, misconfigurations, malicious activity, and policy violations in operating system and application logs.Read 30 Sep 2026 · wazuh.com
Threat intelligence
Wazuh documents integrations with VirusTotal, MISP, URLHaus, AlienVault and other intelligence sources.Read 15 Oct 2026 · documentation.wazuh.com
Vulnerability detection
The vulnerability module correlates agent software inventories with Wazuh CTI vulnerability data and raises CVE findings.Read 15 Oct 2026 · documentation.wazuh.com
XDR
Wazuh XDR correlates and responds to threats across multiple infrastructure layers.Read 15 Oct 2026 · wazuh.com

Plans and prices

Wazuh open source Free Free and open source · self-hosted Read 30 Sep 2026 · wazuh.com
Small $571 a month Starting at $571/month Up to 100 active agents · 1 month indexed-data retention · 3 months archive retention · Standard support Read 15 Oct 2026 · wazuh.com
Medium $923 a month Starting at $923/month Up to 250 active agents · 3 months indexed-data retention · 1 year archive retention · Standard support Read 15 Oct 2026 · wazuh.com
Large $1,467 a month Starting at $1467/month Up to 500 active agents · 3 months indexed-data retention · 1 year archive retention · Standard support Read 15 Oct 2026 · wazuh.com
Custom Priced on request Custom agents, retention, support and settings Read 15 Oct 2026 · wazuh.com

Every Wazuh plan and price →

Strong points and limits

Strong points

  • Rules detect misconfigurations and policy violations in logs.
  • File monitoring tracks content, permissions, and ownership changes.
  • Vulnerability detection compares software inventories with CVE databases.
  • Self-hosted open-source plan is free.
  • Agents support six listed operating system families.

Limits

  • Paid plans start at $571 a month.
  • Compliance mappings do not certify compliance.
  • Agents require an average of 35 MB of RAM.

Who it suits

Wazuh may suit individuals and organizations of different sizes seeking endpoint, cloud, and network security monitoring. It offers a self-hosted open-source option as well as paid cloud plans.

Wazuh in depth

Read the full write-up

Wazuh is an XDR and SIEM platform for monitoring security data across endpoints, cloud services, and networks. It is best suited to teams that want detection, response, vulnerability checks, and file monitoring together—and can operate a self-hosted stack or pay for managed Cloud service. Its breadth is useful, but the free option requires self-management and paid plans impose agent and retention limits.

Overview

Wazuh brings several security workflows into one platform: it analyzes logs for threats and policy violations, tracks file changes, identifies vulnerable software, and can respond to threats. That makes it a credible fit for organizations seeking a common monitoring and response layer rather than a single-purpose tool. Compliance mappings for PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR can help structure controls, but they do not certify compliance.

Key features

Detection and response

Rules analyze operating-system and application logs for errors, misconfigurations, malicious activity, and policy violations. Built-in active responses can take countermeasures such as blocking network access from a threat source, connecting detection with action. Routing, enrichment, and suppression rules support alert handling; the absence of alert deduplication is a meaningful weakness for teams that need repeated notifications consolidated.

Integrity and vulnerability monitoring

File Integrity Monitoring tracks changes to file content, permissions, ownership, and attributes, giving security teams visibility into changes to monitored files. Vulnerability detection compares endpoint software inventory with updated CVE databases to identify known vulnerable software. The agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX, and averages 35 MB of RAM, a modest stated footprint for endpoint monitoring.

Cloud and integrations

Wazuh can monitor services, virtual machines, and activity across AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub. Its integrations guide also covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake. This breadth makes it more adaptable to mixed environments, though the platform's value depends on whether those integrations match a team's existing stack.

Pricing

The self-hosted open-source plan costs nothing. It avoids a subscription, but the organization must run and maintain its own environment. Wazuh Cloud is the managed alternative: its environments are updated to the latest version without customer-led maintenance or upgrades, and Wazuh says the service is compliant with PCI DSS and SOC 2 and independently audited to meet those standards. A 14-day trial is available.

PlanPriceCapacity and retentionSmall$571 a monthUp to 100 active agents; 1 month indexed data retention; 3 months archive retention; Standard supportMedium$923 a monthUp to 250 active agents; 3 months indexed data retention; 1 year archive retention; Standard supportLarge$1,467 a monthUp to 500 active agents; 3 months indexed data retention; 1 year archive retention; Standard supportCustomCustom pricingCustomized serviceSmall is the entry point for organizations with no more than 100 active agents that can work with one month of indexed history. Medium and Large raise agent capacity and provide three months of indexed data and one year of archive retention, so they better suit teams with greater scale or longer retention needs. All three published paid tiers include Standard support; Wazuh also offers support services and professional hours for Cloud environments. The open-source plan is the cost-conscious choice only if self-management is acceptable; custom pricing is the route for tailored service.

Platforms

Wazuh supports API, Linux, macOS, self-hosted, web, and Windows environments. Its agent also supports Solaris, AIX, and HP-UX, extending endpoint coverage beyond the platform labels.

Who it's for

Wazuh serves individuals and organizations from small businesses to large enterprises. It is a stronger fit for security teams that want broad monitoring and response capabilities and have either the resources to maintain a self-hosted deployment or the budget for Cloud. Teams that need alert deduplication, or that cannot work within the published paid-tier agent and retention limits, should weigh other options.

Pros and cons

Broad security coverage: combines log-based detection, file integrity monitoring, vulnerability identification, and active response.

Wide environment reach: supports major cloud services and endpoints including Solaris, AIX, and HP-UX.

Managed upkeep: Cloud environments receive current Wazuh versions without customer-led upgrades.

No alert deduplication: repeated alerts cannot be consolidated through that capability.

Paid tiers have defined ceilings: agent caps and retention periods may constrain larger or longer-running monitoring needs.

Compliance mappings are not certification: teams must not treat supported standards mappings as proof of compliance.

Alternatives

For alert-management needs rather than Wazuh's broader security monitoring, AlertOps has a free plan capped at five users with basic alert routing, three escalation policies, and more than 200 integrations; its Standard plan is $8 a month. Grafana Cloud Application Observability is a free-to-start option for application observability, with a free allowance of 2,232 host hours and a Pro rate of $0.025 per host hour plus a $19 monthly platform fee. PagerDuty is another incident-management alternative, with a free plan for five users, one on-call schedule, and one escalation policy.

For observability with usage-based ingest pricing, Elastic Observability is worth comparing; its Serverless Complete logs and traces ingest starts at $0.09. xMatters offers a free plan for up to five users and a Starter plan at $15 a month per user for up to 25 users. TrueWatch Log Management has a free plan aimed at individual developers and small teams, with usage quotas.

UTMStack is an alternative with a trial and a plan supporting an average of 300 devices and 750 GB of hot storage. Zabbix is another alternative to consider.

Readers comparing specific disciplines can also browse Alert Management Software, Intrusion Detection and Prevention Software, SIEM Software, and File Integrity Monitoring Software.

Verdict

Choose Wazuh if you want one platform for security-data analysis, endpoint vulnerability checks, file monitoring, and active response, and can accept either self-hosting work or Cloud subscription costs. Its main advantage is the breadth of those capabilities; its main reasons to look elsewhere are the lack of alert deduplication and the capacity and retention limits on paid plans.

Verdict

Wazuh combines security-data analysis with file monitoring, vulnerability detection, and active response capabilities. Its free self-hosted option differs from paid Cloud plans, and compliance mappings should not be treated as certification.

Where Specifiction places it

Alternatives to WazuhAll alternatives →