Wazuh
SecurityAn open-source security platform for threat detection, log analysis, file integrity monitoring and compliance (SIEM and XDR), with a central server, indexer, dashboard and endpoint agents.
Open-source alternative to:
What the free edition leaves out
Scroll sideways to view all columns →The official pages do not say enough about the free edition to give a verdict. “Not confirmed” means the official pages we read did not say, so we do not guess.
| Feature | Free edition | Details | Source |
|---|---|---|---|
| SSO / SAML | Not confirmed | The user manual documents single sign-on with providers such as Okta, Microsoft Entra ID, Keycloak and Google Workspace, but the page names no edition, so this stays unconfirmed. | Source ↗ |
| Role-based access control | Not confirmed | The user manual documents role-based access control, but the page names no edition, so this stays unconfirmed. | Source ↗ |
| Audit logs | Not confirmed | Audit logging of Wazuh's own administration is not described on the pages read. | Source ↗ |
| Multi-user / teams | Not confirmed | The user manual documents creating internal users and mapping them to roles, but the page names no edition, so this stays unconfirmed. | Source ↗ |
| Backups and restore | Not confirmed | The user manual has a backup guide for creating and restoring a Wazuh installation backup, but the page names no edition, so this stays unconfirmed. | Source ↗ |
| API access | Not confirmed | The user manual documents the Wazuh server API, but the page names no edition, so this stays unconfirmed. | Source ↗ |
| Support SLA | Paid | Professional support has Standard and Premium plans with different support hours, health checks and response SLAs. Wazuh Cloud and community channels are separate. | Source ↗ |
Best for
Security teams that want self-hosted log analysis, intrusion detection, file integrity monitoring and compliance checks across servers and endpoints.
Why choose it over Splunk
The platform is GPL-2.0 and Wazuh's own support page describes it as free. The user manual documents single sign-on, role-based access control and a server API, and the quickstart calls Wazuh free and open source. Wazuh also offers a managed cloud service if you do not want to run the stack yourself.
Where it falls short
Even the quickstart deploys three components (server, indexer, dashboard) and recommends 8 GiB RAM for the smallest listed size, so it is not a light install. Larger environments need a distributed deployment. Professional support with response SLAs is a paid service.
Open-source alternative to
- Splunk — Wazuh collects security events for detection and monitoring, which overlaps with Splunk.
C++
C
Python
Bash
Go
Docker
jsonwebtoken
Google Cloud
SQLAlchemy
NumPy
Pytest
GitHub Actions
Make
npm
