DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-04
- 📦 Latest release: v4.14.9 (2026-10-15)
- 🐞 Open issues: 3169
- 🌟 Stars: 17.6k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: wazuh.com
- Source: github.com/wazuh/wazuh
- License: GPL-2.0-only
- Deployment: Native System (Binary/Linux) | Docker Container | Kubernetes (K8s)
- Jurisdiction: United States 🇺🇸 (Wazuh, Inc.)
- Compliance (SaaS): Wazuh Cloud security and compliance page
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - Three central components, the indexer, the server with its log shipper and the dashboard, plus an agent on each endpoint; larger deployments split them across servers and cluster them
- Maintenance: High (4/5) - Index retention policies the operator sets, and coordinated upgrades of every component on every node, some changing how events are decoded
- User Management: High (4/5) - Internal users, RBAC and SAML single sign-on in the free build, TLS in the shipped indexer, and audit logs for API requests and, once switched on, the indexer; no SCIM
What the scores mean: Reading the Scores
1. The Executive Summary
What is it? Wazuh is a security platform for threat detection and response (XDR) and security event management (SIEM) across endpoints and cloud workloads: an agent on each machine sends events to a central server, which analyses logs, detects intrusions and malware, monitors file integrity, assesses configurations and finds vulnerabilities. Its default ruleset maps alerts to compliance frameworks such as PCI DSS, HIPAA and GDPR. It serves security teams that run their own monitoring. It was forked from OSSEC in 2015.
The Strategic Verdict:
- 🔴 For teams without a security engineer to run it: Caution. Three components plus an agent on every endpoint, split across servers in larger deployments, with upgrades coordinated on every node (Complexity, Maintenance).
- 🟢 For security teams replacing a SIEM priced by data volume: Strong Buy. The whole platform, single sign-on and audit logs included, carries no license fee, so no license cost grows with the data indexed (Cost of Ownership, User Management).
2. Cost of Ownership
| Cost Component | Wazuh (Self-Hosted) |
|---|---|
| Pricing Model | No license fee |
| Operations | Distributed cluster, grows with event volume; plus your team's time to run it (Maintenance, in the Profile) |
| Support | From the vendor: Wazuh Cloud, a managed service, and paid support for self-hosted installs (enterprise support); elsewhere, a paid service provider |
| Exit | Index snapshots (OpenSearch snapshot API) |
What each row covers: Total Cost of Ownership
3. Risk Assessment
- Jurisdiction: Wazuh, Inc., the project's vendor, is registered in the United States, under US law. The vendor runs Wazuh Cloud, a hosted service where your data can live; its hosts include a party domiciled in or controlled from the US. Data in Wazuh Cloud is within reach of the US CLOUD Act wherever it is stored, since its operator is based in the US. A self-hosted install sends usage data to the vendor unless the operator switches it off. US law can compel the recipient to hand over that usage data.
- The Compliance Shift: The indexer's audit log stays off until the operator turns it on in each node's configuration. Self-hosting moves the security and compliance duties of running the software to the operator (the operator's compliance checklist). Any audit of Wazuh Cloud (such as SOC 2 or ISO 27001) covers the vendor's own systems, never your install.
- License Risk: Wazuh is under GPL-2.0-only, an OSI-approved strong copyleft license (what it allows and requires). Contributors keep the rights to their code and no agreement transfers them, so moving future versions to terms without copyleft would need every holder's consent.
4. Market Landscape
🏢 Proprietary Incumbents
- Splunk: Splunk is a platform that searches and analyzes machine data.
Data held by: Splunk LLC, United States 🇺🇸 (controlled by Cisco Systems, Inc.), subject to the US CLOUD Act for the data it holds, wherever it is stored. A self-managed install keeps the data with the customer.
Why teams leave: Its installs report usage to Splunk by default, and its price grows with data indexed or compute used.
Exit: Search export (CSV, JSON, raw events); on Splunk Cloud, aged data to own storage, proprietary format, partial export (configuration)
With Wazuh: The software carries no license fee, so no license cost grows with the data indexed (Cost of Ownership). - CrowdStrike Falcon: CrowdStrike Falcon is a cloud security platform for endpoints, workloads and identities.
Data held by: CrowdStrike, Inc., United States 🇺🇸 (controlled by CrowdStrike Holdings, Inc.), subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: By default it uses the data its sensor collects to develop its own products.
Exit: Raw event data in bulk through Falcon Data Replicator (JSON), bulk export only in a higher tier
With Wazuh: Agents send the endpoint data they collect to a server you run (What is it?).
🤝 Open-Source Alternatives
—