Overview

Wazuh brings XDR and SIEM together to analyze security data for threat detection, incident response, and compliance support. That combination can reduce the need to assemble separate tools for core monitoring tasks, while integrations with Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake give teams options for fitting it into an existing security stack. The open-source edition is self-hosted, so its zero price comes with responsibility for operating the environment.

Key features

Detection and response

Rules inspect operating-system and application logs for errors, misconfigurations, malicious activity, and policy violations. Built-in active responses can take countermeasures such as blocking a threat source's network access, which gives teams a path from detection to action. Routing, enrichment, and suppression rules help manage alerts, but the absence of alert deduplication is a notable weakness for teams dealing with repeated notifications.

Endpoint and cloud monitoring

File Integrity Monitoring tracks changes to file content, permissions, ownership, and attributes. Vulnerability detection compares endpoint software inventory with updated CVE databases to identify known vulnerable software. Wazuh can also monitor services, virtual machines, and activity across AWS, Microsoft Azure, Google Cloud, Microsoft 365, and GitHub. Its agent supports Linux, Windows, macOS, Solaris, AIX, and HP-UX and averages 35 MB of RAM, a modest stated requirement for broad endpoint coverage.

Compliance support

Default rulesets map to PCI DSS, HIPAA, NIST 800-53, TSC, and GDPR, which can help teams structure monitoring around compliance work. Those mappings do not certify compliance. Wazuh Cloud says its service is PCI DSS and SOC 2 compliant and independently audited to meet those standards; that distinction matters for buyers weighing the managed service against the self-hosted edition.

Pricing

Wazuh uses a freemium model, with a free and open-source self-hosted plan and paid Wazuh Cloud tiers starting at $571.00 USD per month. The free edition is the clearest fit for individuals or teams able to run their own stack; it avoids a subscription but does not include the cloud service's managed updates.

Plan	Price	Includes
Wazuh open source	0.00 USD per free	Free and open source; self-hosted.
Small	571.00 USD per month	Up to 100 active agents, 1 month indexed data retention, 3 months archive data retention, and standard support.
Medium	923.00 USD per month	Up to 250 active agents, 3 months indexed data retention, 1 year archive data retention, and standard support.
Large	1467.00 USD per month	Up to 500 active agents, 3 months indexed data retention, 1 year archive data retention, and standard support.
Custom	Custom pricing	Customized service and settings.

Small is for deployments within 100 agents that can work with a month of indexed data; teams needing more capacity or longer indexed retention should consider Medium or Large. Medium and Large both retain indexed data for three months, while Large doubles the agent ceiling for a higher monthly price. Wazuh Cloud environments are updated to the latest version without customer-managed upgrades, and Wazuh offers support services and professional hours for Cloud environments. A 14-day trial is available. The free community support option complements self-hosting, but paid tiers include standard support.

Platforms

Wazuh is available through API, Linux, macOS, self-hosted, web, and Windows platforms. The agent's support for Solaris, AIX, and HP-UX extends endpoint collection beyond the platforms shown for the product itself.

Who it's for

Wazuh is aimed at individuals and organizations from small businesses to large enterprises. It is strongest for teams seeking a wide set of security monitoring capabilities and willing either to operate open-source software themselves or pay for managed hosting. Buyers whose principal need is alert deduplication should look elsewhere, since Wazuh does not provide it.

Pros and cons

Pros: Log detection, file integrity monitoring, vulnerability checks, and active responses bring several security workflows together.
Pros: Cloud integrations and compatibility with Elastic Stack, OpenSearch, Splunk, and Amazon Security Lake support varied environments.
Pros: The self-hosted edition is free and open source, while Wazuh Cloud handles version updates.
Cons: The free edition is self-hosted, making operation the customer's responsibility.
Cons: Paid tiers cap active agents and data retention, so larger deployments or longer indexed histories require a higher tier.
Cons: No alert deduplication means repeated alerts may need handling elsewhere.

Alternatives

For teams focused on incident alerting rather than security monitoring, AlertOps offers a free plan capped at five users with basic alert routing, three escalation policies, and more than 200 integrations. PagerDuty is another incident-management option, with a free annual plan for five users, one on-call schedule, and one escalation policy. xMatters has a free tier for up to five users with a limited feature set, making it an option for small teams evaluating incident response workflows.

Alerta is a free alternative. Elastic Observability is a paid alternative with a free plan and usage-based pricing. Keep offers a Growth plan at 199.00 USD per month with 200 deduplicated alerts per month, unlimited ingested alerts, 100 workflows, 20 integrations, 10 users, and two weeks of data retention; it may suit teams that prioritize alert deduplication. Zabbix is a freemium alternative. FirstWave opEvents is a freemium option whose commercial module requires NMIS 9 and a licence.

For category comparisons, browse Alert Management Software, SIEM Software, Intrusion Detection and Prevention Software, and File Integrity Monitoring Software.

Verdict

Choose Wazuh if your team wants broad detection, endpoint integrity and vulnerability monitoring, and response capabilities, and can either maintain a self-hosted deployment or budget for managed Cloud. Its main advantage is the range of security work in one platform; its main reason to look elsewhere is the operational burden of self-hosting or the cost and capacity limits of Cloud tiers, compounded by the lack of alert deduplication.

	Vigil	Wazuh
Free plan	Yes	Yes
Free trial	No	Yes
Paid from	Free	$571/mo
Open source	No	No
Platforms	api, Linux, macOS, self-hosted, Web, Windows	api, Linux, macOS, self-hosted, Web, Windows
Free plan	Yes	Yes
Custom detection rules	Yes	—
Real-time alerting	Yes	—
Deployment	self-hosted	—
Query language	HQL	—
Paid from	—	571 /mo

Vigil vs Wazuh

Vigil

Wazuh