Wazuh
Open-source XDR and SIEM in one free platform, from endpoint agents to compliance dashboards.
About
Wazuh is a free and open-source security platform that unifies SIEM and XDR capabilities. Lightweight agents on Linux, Windows, macOS, and other systems ship logs, file-integrity events, vulnerability findings, and configuration-assessment results to a central manager, which correlates them against detection rules and stores everything in an indexer you can query and visualize. It started as a fork of OSSEC in 2015 and is now one of the most widely deployed open-source security platforms, with over 15 million downloads per year reported and 17,281 GitHub stars at last check.
The core platform is genuinely free: the manager and agent components are GPLv2 and the indexer and dashboard are Apache 2.0, with no licence fee, per-agent charge, or ingestion metering. Wazuh Inc. sells a managed Wazuh Cloud service and professional support tiers, which is how the project is funded. Because it runs fully on-premises or air-gapped with offline vulnerability feeds, it is a realistic option for regulated environments that cannot send telemetry to a vendor cloud. It is also a CVE Numbering Authority, so it maintains its own vulnerability database and can assign CVE identifiers.
What it can do
- Unified open-source SIEM + XDR
- Log collection and real-time correlation
- File integrity monitoring (FIM)
- Vulnerability detection and software inventory
- Security configuration assessment (SCA)
- Active response and automated countermeasures
- Cloud workload protection (AWS, Azure, GCP, Docker, Kubernetes)
- Compliance dashboards: PCI DSS, GDPR, HIPAA, NIST
Setup
- Install the Wazuh manager, indexer, and dashboard on your own infrastructure (or start a Wazuh Cloud trial).
- Deploy the lightweight Wazuh agent on each endpoint or server you want to monitor.
- Point the agents at the manager; logs, FIM events, and scan results start flowing automatically.
- Tune the out-of-the-box ruleset and review compliance dashboards for PCI DSS, GDPR, HIPAA, and NIST.
Prerequisites
Server infrastructure for the manager/indexer stack, or a Wazuh Cloud subscription; admin access on endpoints for agent installation.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (TIER verified, metrics-v1). Evidence: active development with commits through Oct 2026; 17,281 GitHub stars (checked 2026-10-16); GPLv2 core plus Apache 2.0 indexer/dashboard; CVE Numbering Authority status; ~15M reported annual downloads. Strengths: genuinely free core with no metering, massive open-source community, runs air-gapped for regulated buyers. Docked for: (1) the real cost is infrastructure plus engineering time to run a distributed indexer well, which third parties say can level the savings versus managed SIEM; (2) GPLv2 on core components may concern some enterprise legal teams. License: GPLv2 (manager/agent), Apache 2.0 (indexer/dashboard).
★ 17,281 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 9.0/10
- Maintenance · recency, releases, issue load
- 9.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 1.0/10
- · 17,281 GitHub stars checked 2026-10-16; active commits through Oct 2026
- · CVE Numbering Authority; ~15M reported annual downloads
- · Runs air-gapped; no licence fee or ingestion metering
- · Real cost is infra + engineering time to run a distributed indexer
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.