Wazuh is an open source security platform that brings extended detection and response (XDR) and security information and event management (SIEM) together for endpoints and cloud workloads.
Security teams use it to monitor devices, detect threats and respond to incidents across public clouds, private clouds and on-premises data centres, with no licence cost and no vendor lock-in.
At A Glance
| Vendor | Wazuh |
|---|---|
| Category | Open source XDR and SIEM |
| Deployment | Self-hosted (on premises, private or public cloud, Kubernetes) or Wazuh Cloud |
| Certifications | PCI DSS and SOC 2 for Wazuh Cloud |
| Scale | More than 15 million reported protected endpoints |
| Market classification | Security Operations |
What Wazuh Does
Endpoint security, threat intelligence, security operations and cloud security have traditionally been handled by separate tools. Wazuh puts these functions into a single agent and platform architecture. The SIEM side gives analysts correlated, real-time context on security events, and the XDR side lets them act on the affected device to contain a threat. The same data supports compliance reporting for PCI DSS, NIST, TSC and HIPAA. Because the core is open source, organisations that self-host keep full control of where their security data lives, while those that prefer not to run the stack can hand operations to Wazuh as a managed service.
Products
Wazuh Platform
The open source platform is what most teams install and run themselves. It suits organisations that want to monitor laptops, servers and cloud instances, hunt for threats and meet audit requirements without paying for a commercial licence. Its main capabilities are:
- File integrity monitoring, including Windows Registry changes
- Malware detection through rootkit behaviour checks, VirusTotal and YARA, plus collection of ClamAV and Windows Defender logs
- Security Configuration Assessment with built-in and custom policies
- Active Response using default or custom scripts
- Log collection, including syslog and journald
- Vulnerability detection, command monitoring, system inventory and system call monitoring
- Container security for Docker, through a native agent integration with the Docker engine
Wazuh Cloud
Wazuh Cloud is the same platform delivered as a managed service, for teams that would rather not operate the server and indexer themselves. It includes an AI security analyst meant to cut alert fatigue and manual effort. The service is independently audited, with a SOC 2 Type 2 certificate from A-LIGN.
How It Works
Wazuh is agent based, with optional agentless monitoring. Agents collect data and send it to the server for analysis, alerts are stored in the indexer, and the dashboard presents them.
| Component | What it does |
|---|---|
| Wazuh agent | Runs on laptops, desktops, servers, cloud instances and virtual machines on Linux, Windows, macOS, Solaris, AIX and HP-UX. |
| Wazuh server | Analyses agent data with decoders and rules, checks it against threat intelligence for indicators of compromise, manages agent configuration and upgrades, and can be scaled horizontally as a cluster. |
| Wazuh indexer | A scalable full-text search and analytics engine that stores alerts. |
| Wazuh dashboard | The web interface, with prebuilt views for threat hunting, compliance, vulnerabilities, file integrity and configuration assessment. |
| Agentless monitoring | Firewalls, switches, routers and network intrusion detection systems are monitored through Syslog, SSH or an API. |
Integrations
| Area | Integrations |
|---|---|
| Cloud and SaaS | AWS, Microsoft Azure, GCP, Microsoft 365, GitHub |
| Malware and threat intelligence | VirusTotal, YARA, ClamAV, Windows Defender, third-party threat intelligence feeds |
Company Background
| Founded | 2015 |
|---|---|
| Origins | The code is based on the OSSEC project |
| Team | More than 200 people, distributed around the world |
| Adoption | More than 100 thousand reported enterprise users and over 30 million downloads a year |
| Licence | The main repository is licensed under GPLv2, with the engine under AGPLv3 or later |
| Recognition | Two 2026 wins at the Cybersecurity Stars Awards |
Note: This overview is compiled from Wazuh’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.