Vigil vs Wazuh
Vigil
vigil-siem.comWazuh
wazuh.comSide by side
| Figure | Vigil | Wazuh |
|---|---|---|
| Price from | Free | $571/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 5 |
| Spec score · SIEM Software | 8.2 (#10) | 8.6 (#4) |
| License | The repository and pricing page identify the software as Apache License 2.0. | Wazuh components are distributed under GNU GPL version 2 and Apache License 2.0, with the main repository code under GPLv2. |
| Public API | The repository documents a local API at port 6987 and interactive API documentation at /docs. | The Wazuh server exposes an open-source REST API covering agents, managers, clusters, FIM, MITRE, rules, decoders, SCA, syscollector and RBAC. |
| SIEM integrations | Vigil Connect supports Wazuh and Elastic now, while Splunk and Microsoft Sentinel integrations are listed as coming soon. | Wazuh provides integration guidance for Elastic, OpenSearch, Splunk and Amazon Security Lake; its former Splunk and Elastic apps are only maintained for critical updates from version 4.6. |
| Support | Enterprise includes a dedicated Slack channel, custom integrations, custom SLAs, and a SOC 2 report. | Wazuh offers free community support as well as support services and professional hours for Cloud environments. |
Plans
Wazuh
- Wazuh open sourceFree
- Small$571 a month
- Medium$923 a month
- Large$1,467 a month
- CustomPriced on request
In their own words
Vigil
Vigil is a self-hosted SIEM that collects endpoint events, evaluates Sigma detections in real time, and returns structured JSON for AI agents. It runs on Linux, macOS, and Windows, or as a self-hosted service, without requiring a cloud account. Its single binary collects Windows Event Logs or Linux journald and sends batches every five seconds; short-lived enrollment tokens support secure agent onboarding. Vigil includes 41 Sigma rules covering 10 MITRE ATT&CK tactics. Its HQL query language searches event history with aggregations, timelines, endpoint filters, time ranges, and field values. The CLI pauses destructive actions until a person approves them. Vigil Connect extracts selected fields and the untouched raw alert from alerts; it supports Wazuh and Elastic, with Splunk and Microsoft Sentinel listed as coming soon. The Claude Code integration uses npx @vigil/skill and needs no MCP server or running process. The Apache 2.0 open-source plan is free and includes unlimited events. Enterprise support includes a dedicated Slack channel, custom integrations and SLAs, and a SOC 2 report.
Wazuh
Wazuh unifies XDR and SIEM to analyze security data across endpoints, clouds, and networks for threat detection, incident response, and compliance work. Its rules identify errors, misconfigurations, malicious activity, and policy violations in operating system and application logs. File Integrity Monitoring tracks changes to content, permissions, ownership, and other file attributes. Vulnerability detection compares endpoint software inventories with updated CVE databases. Built-in active responses can take countermeasures, including blocking network access from a threat source. Wazuh can monitor AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity. Its integrations guide also covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake. Default rulesets provide mappings for PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR, but those mappings do not themselves certify compliance. Wazuh runs on API, Linux, macOS, self-hosted, web, and Windows platforms. Its self-hosted open-source plan is free; paid plans start at $571 a month, and a 14-day trial is listed. Agents support Linux, Windows, macOS, Solaris, AIX, and HP-UX and require an average of 35 MB of RAM.