Atomic OSSEC vs SELKS
Atomic OSSEC
atomicorp.com
SELKS
stamus-networks.comSide by side
| Figure | Atomic OSSEC | SELKS |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | Yes | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Intrusion Detection and Prevention Software | 8.2 (#8) | 8.3 (#7) |
| Deployment | Atomic OSSEC is available on premises or as cloud-based SaaS and can run in air-gapped environments. | The archive page offers a Docker Compose package for Linux and Debian-based ISO images with or without a desktop, deployable on bare metal or a virtual machine. |
| Integrations | The product page names Splunk, ArcSight, ELK, and QRadar as out-of-the-box SIEM integrations. | The documented deployment can send logs to a Splunk indexer and optionally authenticate users through LDAP or LDAPS. |
| Intended users | Atomicorp says it serves hundreds of customers worldwide with security and compliance requirements across cloud and datacenter environments. | Stamus Networks describes SELKS as suitable for many small-to-medium organizations and says practitioners, researchers, educators, students, and hobbyists use it to explore Suricata. |
| Support | The maker describes ticket-based support from a small expert team and advertises expert support with its SaaS offering. | The maker directs users to GitHub for documentation, issues, and the wiki, and to Discord for questions and help. |
Plans
In their own words
Atomic OSSEC
Atomic OSSEC is an endpoint detection and response system that also protects cloud workloads and APIs. Its monitoring covers intrusion detection, file integrity, log management, active response, and vulnerability management. A GUI centralizes management of agents, servers, events, file integrity monitoring, rollbacks, and third-party integrations. The product lists more than 5,000 preconfigured OSSEC rules and out-of-the-box integrations for Splunk, ArcSight, ELK, and QRadar. It supports AWS, Azure, and GCP, and offers compliance reporting for frameworks including PCI DSS, HIPAA, NIST, GDPR, and CIS. Deployment can be on premises or cloud-based SaaS, including in air-gapped environments. The maker also describes support for legacy systems such as Windows, Linux, AIX, HP-UX, and Solaris, plus monitoring of operational technology without agents on sensitive equipment. A 14-day trial covers up to 10 licenses and does not require a credit card. The listed plan price is priced on request, pricing starts at $55 per agent, and bulk discounts are available; a separate pricing note says from $5/mo.
SELKS
SELKS is a free, open-source software package for network intrusion detection and prevention, network security monitoring, and threat hunting, built around Suricata. Its web interface manages Suricata rulesets, threat intelligence sources, custom rules, and IoC data files. Predefined filters and contextual views support threat hunting; thresholding and suppression can help reduce noisy alerts. SELKS 10 includes Suricata, Elasticsearch, Logstash, Kibana, Stamus Community Edition, and functionality from Arkime, Evebox, and CyberChef. It can capture packets tied to detection events and export session PCAP files for investigation or playback in SELKS or other tools. Deployment options include Docker Compose for Linux and Debian-based ISO images, with or without a desktop, on bare metal or a virtual machine. SELKS is licensed under GPL 3.0-or-later. Stamus Networks says it stopped actively enhancing the legacy product on January 1, 2025, and has no future releases planned. The maker says SELKS was not designed for enterprise deployment.