Overview

Wazuh brings several security workflows into one platform: it analyzes logs for threats and policy violations, tracks file changes, identifies vulnerable software, and can respond to threats. That makes it a credible fit for organizations seeking a common monitoring and response layer rather than a single-purpose tool. Compliance mappings for PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR can help structure controls, but they do not certify compliance.

Key features

Detection and response

Rules analyze operating-system and application logs for errors, misconfigurations, malicious activity, and policy violations. Built-in active responses can take countermeasures such as blocking network access from a threat source, connecting detection with action. Routing, enrichment, and suppression rules support alert handling; the absence of alert deduplication is a meaningful weakness for teams that need repeated notifications consolidated.

Integrity and vulnerability monitoring

File Integrity Monitoring tracks changes to file content, permissions, ownership, and attributes, giving security teams visibility into changes to monitored files. Vulnerability detection compares endpoint software inventory with updated CVE databases to identify known vulnerable software. The agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX, and averages 35 MB of RAM, a modest stated footprint for endpoint monitoring.

Cloud and integrations

Wazuh can monitor services, virtual machines, and activity across AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub. Its integrations guide also covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake. This breadth makes it more adaptable to mixed environments, though the platform's value depends on whether those integrations match a team's existing stack.

Pricing

The self-hosted open-source plan is free. It avoids a subscription, but the organization must run and maintain its own environment. Wazuh Cloud is the managed alternative: its environments are updated to the latest version without customer-led maintenance or upgrades, and Wazuh says the service is compliant with PCI DSS and SOC 2 and independently audited to meet those standards. A 14-day trial is available.

Plan	Price	Capacity and retention
Small	571.00 USD per month	Up to 100 active agents; 1 month indexed data retention; 3 months archive retention; Standard support
Medium	923.00 USD per month	Up to 250 active agents; 3 months indexed data retention; 1 year archive retention; Standard support
Large	1467.00 USD per month	Up to 500 active agents; 3 months indexed data retention; 1 year archive retention; Standard support
Custom	Custom pricing	Customized service

Small is the entry point for organizations with no more than 100 active agents that can work with one month of indexed history. Medium and Large raise agent capacity and provide three months of indexed data and one year of archive retention, so they better suit teams with greater scale or longer retention needs. All three published paid tiers include Standard support; Wazuh also offers support services and professional hours for Cloud environments. The open-source plan is the cost-conscious choice only if self-management is acceptable; custom pricing is the route for tailored service.

Platforms

Wazuh supports API, Linux, macOS, self-hosted, web, and Windows environments. Its agent also supports Solaris, AIX, and HP-UX, extending endpoint coverage beyond the platform labels.

Who it's for

Wazuh serves individuals and organizations from small businesses to large enterprises. It is a stronger fit for security teams that want broad monitoring and response capabilities and have either the resources to maintain a self-hosted deployment or the budget for Cloud. Teams that need alert deduplication, or that cannot work within the published paid-tier agent and retention limits, should weigh other options.

Pros and cons

Broad security coverage: combines log-based detection, file integrity monitoring, vulnerability identification, and active response.
Wide environment reach: supports major cloud services and endpoints including Solaris, AIX, and HP-UX.
Managed upkeep: Cloud environments receive current Wazuh versions without customer-led upgrades.
No alert deduplication: repeated alerts cannot be consolidated through that capability.
Paid tiers have defined ceilings: agent caps and retention periods may constrain larger or longer-running monitoring needs.
Compliance mappings are not certification: teams must not treat supported standards mappings as proof of compliance.

Alternatives

For alert-management needs rather than Wazuh's broader security monitoring, AlertOps has a free plan capped at five users with basic alert routing, three escalation policies, and more than 200 integrations; its Standard plan is 8.00 USD per month. Grafana Cloud Application Observability is a free-to-start option for application observability, with a free allowance of 2,232 host hours and a Pro rate of $0.025 per host hour plus a $19 monthly platform fee. PagerDuty is another incident-management alternative, with a free plan for five users, one on-call schedule, and one escalation policy.

For observability with usage-based ingest pricing, Elastic Observability is worth comparing; its Serverless Complete logs and traces ingest starts at $0.09. xMatters offers a free plan for up to five users and a Starter plan at 15.00 USD per month per user for up to 25 users. TrueWatch Log Management has a free plan aimed at individual developers and small teams, with usage quotas.

UTMStack is an alternative with a trial and a plan supporting an average of 300 devices and 750 GB of hot storage. Zabbix is another alternative to consider.

Readers comparing specific disciplines can also browse Alert Management Software, Intrusion Detection and Prevention Software, SIEM Software, and File Integrity Monitoring Software.

Verdict

Choose Wazuh if you want one platform for security-data analysis, endpoint vulnerability checks, file monitoring, and active response, and can accept either self-hosting work or Cloud subscription costs. Its main advantage is the breadth of those capabilities; its main reasons to look elsewhere are the lack of alert deduplication and the capacity and retention limits on paid plans.

	Riemann	Wazuh
Free plan		Yes
Free trial		Yes
Paid from		$571/mo
Platforms	Linux, Web	api, Linux, macOS, self-hosted, Web, Windows
Alert deduplication	Yes	No
Routing rules	Yes	Yes
Alert enrichment	Yes	Yes
Free plan		Yes
Paid from		571 /mo
Suppression rules		Yes

Riemann vs Wazuh

Riemann

Wazuh