Wazuh
Campbell, California, United States
What it is
Wazuh combines XDR and SIEM capabilities to analyze security data from endpoints, clouds, and networks for threat detection, incident response, and compliance work. Its rules flag errors, misconfigurations, malicious activity, and policy violations in operating system and application logs. File Integrity Monitoring tracks changes to file content, permissions, ownership, and other attributes; vulnerability detection compares endpoint software inventories with updated CVE databases. Built-in responses can take countermeasures such as blocking network access from a threat source. Wazuh can monitor AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity. Its integrations guide covers Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake. The self-hosted open-source plan is free; paid plans start at $571/month, and a 14-day trial is listed. Agent software supports several operating systems and requires an average of 35 MB of RAM. Compliance mappings support named standards but do not themselves certify compliance.
For and against
For
- Free, self-hosted open-source plan.
- Monitors several major cloud services.
- Active responses can block threat-source network access.
- Agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX.
Against
- Paid plans start at $571/month.
- Compliance mappings do not certify compliance.
- Agent requires an average of 35 MB of RAM.
The verdict
Wazuh brings security monitoring, vulnerability detection, file integrity tracking, and response capabilities into one platform. Review its plan requirements and remember that standards mappings alone do not establish compliance.
Who it suits
Wazuh describes its users as ranging from individuals and small businesses to large enterprises. It may suit teams seeking security monitoring across endpoints, cloud services, and networks, with self-hosted and cloud options.
Plans and prices
Small
Up to 100 active agents · 1 month indexed-data retention · 3 months archive retention · Standard support
Read 15 Oct 2026 · wazuh.com
Medium
Up to 250 active agents · 3 months indexed-data retention · 1 year archive retention · Standard support
Read 15 Oct 2026 · wazuh.com
Large
Up to 500 active agents · 3 months indexed-data retention · 1 year archive retention · Standard support
Read 15 Oct 2026 · wazuh.com
Wazuh open source
Free and open source · self-hosted
Read 30 Sep 2026 · wazuh.com
Custom
Custom agents, retention, support and settings
Read 15 Oct 2026 · wazuh.com
On the record
- Agent platforms
- Official agent packages cover Windows XP or later, Intel and Apple-silicon macOS, Solaris, AIX and HP-UX, in addition to Linux/Unix agents.documentation.wazuh.com · read 15 Oct 2026
- Agent requirements
- The Wazuh agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX and requires an average of 35 MB of RAM.documentation.wazuh.com · read 30 Sep 2026
- API authentication
- API calls use HTTP Basic authentication to obtain a JWT bearer token, with a default token lifetime of 900 seconds.documentation.wazuh.com · read 15 Oct 2026
- API examples
- Official examples show cURL, Python and PowerShell clients, and the documentation points to OpenAPI specifications.documentation.wazuh.com · read 15 Oct 2026
- Architecture
- The platform combines a multi-platform endpoint agent with Wazuh server, indexer and dashboard components.wazuh.com · read 15 Oct 2026
- Central requirements
- Central components require a 64-bit Intel, AMD or ARM Linux processor; documented operating systems include Amazon Linux, CentOS Stream, RHEL and Ubuntu releases.documentation.wazuh.com · read 15 Oct 2026
- Cloud integrations
- Wazuh can monitor AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub services, virtual machines, and activity.wazuh.com · read 30 Sep 2026
- Cloud security
- Wazuh Cloud says it is compliant with PCI DSS and SOC 2 and independently audited to meet those standards.wazuh.com · read 30 Sep 2026
- Cloud service
- Wazuh Cloud environments are updated to the latest Wazuh version without manual maintenance or upgrades by the customer.wazuh.com · read 30 Sep 2026
- Company facts
- LinkedIn lists Wazuh as privately held, founded in 2015, headquartered in Campbell, California, with 201–500 employees.linkedin.com · read 15 Oct 2026
- Company scale
- Wazuh says its team has more than 200 professionals, with over 30 million downloads per year and more than 15 million protected endpoints.wazuh.com · read 15 Oct 2026
- Compliance support
- Default rulesets support PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR mappings, but Wazuh states these mappings do not by themselves certify compliance.documentation.wazuh.com · read 30 Sep 2026
- Configuration assessment
- Agents periodically scan operating-system and application settings for policy, standard and hardening-guide gaps.wazuh.com · read 15 Oct 2026
- Documentation depth
- The documentation includes quickstarts, installation, API reference, deployment guides, capability manuals, compliance use cases, integrations and release notes.documentation.wazuh.com · read 15 Oct 2026
- Enrollment networking
- Agent enrollment requires outbound manager connectivity, with configurable ports 1514/TCP for communications, 1515/TCP for configuration enrollment and 55000/TCP for API enrollment.documentation.wazuh.com · read 15 Oct 2026
- External integrations
- The Integrator module supports Slack, PagerDuty, VirusTotal, Shuffle, Maltiverse and custom integrations through webhooks, API keys and JSON alerts.documentation.wazuh.com · read 15 Oct 2026
- File integrity
- File Integrity Monitoring tracks file content, permissions, ownership, and attribute changes.wazuh.com · read 30 Sep 2026
- File integrity monitoring
- Its FIM module tracks file and directory creation, modification and deletion using checksums and attributes, with real-time or scheduled scans.documentation.wazuh.com · read 15 Oct 2026
