Wazuh is a defensive security platform that merges two jobs usually handled by separate products: the log collection and correlation of a SIEM and the endpoint monitoring of an XDR. It is built by Wazuh Inc., a company that traces its beginnings to 2015, and its codebase grew out of OSSEC, the host intrusion detection system started by Daniel Cid, as the official repository acknowledges. Most of the code is released under the GPL v2, with a few newer components under the AGPL v3.
Version 4.14.9 came out on 14 October 2026, according to the release notes in the documentation, bringing hardened Linux binaries and a batch of agent fixes.
What Wazuh is for
The architecture rests on four parts. A single universal agent runs on every monitored machine and reports system and application logs, the list of installed software and changes to sensitive files. The server receives that data, decodes it and runs it against an extensive rule set. The indexer, a fork of OpenSearch licensed under Apache 2.0, stores alerts and makes them searchable, and the web dashboard lets analysts browse them, filter by host and keep an eye on the whole estate. Devices that cannot take an agent, such as firewalls or switches, can send their logs over syslog.
From there Wazuh handles a wide range of tasks. It flags modified files and names the user or process behind the change, matches the software inventory against CVE vulnerability data, checks system settings against hardening benchmarks and produces reports that help with frameworks such as PCI DSS. Its active response feature can trigger an automatic countermeasure, for instance blocking an address behind a brute-force attempt. Integration modules pull events from AWS, Azure and Google Cloud accounts, and the agent also watches Docker hosts and the containers running on them.
Wazuh sees machines from the inside, through what they record in their logs. Zeek and Suricata sit on the network instead and inspect the traffic flowing between hosts, while Falco focuses on the runtime behaviour of containers. These tools complement one another rather than compete, and once Wazuh has flagged a suspicious host, an investigator may turn to Volatility or Autopsy to examine its memory or disk in depth.
Who is it for?
Wazuh suits security teams and system administrators who want central monitoring without paying a per-seat licence: small and mid-sized companies, local authorities, schools and universities, managed service providers looking after several customers, and security operations centres still being built. Cybersecurity students also get a realistic lab that fits on a single virtual machine.
The requirements deserve attention, though. The documentation calls for at least four virtual CPUs, 8 GB of memory and 50 GB of disk for an all-in-one server covering up to twenty-five agents with ninety days of alerts, and recommends a distributed setup beyond about a hundred agents. Out of the box the rules produce a lot of alerts, and tuning them takes time and a good knowledge of the systems being watched. Wazuh is not a network probe either, nor a full antivirus suite, so anyone who needs to read the content of network conversations should look at Zeek or Suricata.
Download Wazuh safely
Everything comes from documentation.wazuh.com and the wazuh organisation on GitHub. The quickstart guide provides an assistant that installs the server, indexer and dashboard on a 64-bit Linux host running Ubuntu, Red Hat Enterprise Linux, CentOS Stream or Amazon Linux. The same documentation offers a ready-made virtual machine, a Docker deployment and the agent packages: an MSI file for Windows, two macOS packages for Intel and Apple Silicon machines, plus builds for Linux, Solaris, AIX and HP-UX.
The software costs nothing. The company sells professional support, consulting, training and Wazuh Cloud, a hosted edition it runs and upgrades itself. Cloud comes with a fourteen-day trial that needs no credit card, after which the Small plan is listed at $571 a month for a hundred agents, Medium at $923 for two hundred and fifty agents and Large at $1,467 for five hundred agents, with custom quotes above that. Since a security agent runs with high privileges on every endpoint, a package pulled from anywhere other than packages.wazuh.com would expose the fleet to the very threat the tool is meant to catch.
Frequently asked questions
Is Wazuh really free?
Yes. The server, indexer, dashboard and agents are open source and free to use, however many machines you monitor. Only Wazuh Cloud, professional support and training are paid services.
How does Wazuh differ from Zeek?
Wazuh relies on agents installed on each machine and analyses their logs, files and configuration. Zeek watches network traffic from a sensor without touching the endpoints. Many teams run both.
Can I use Wazuh without running my own server?
Yes, through Wazuh Cloud, the edition hosted by the vendor. You then only deploy agents on your machines. It is a paid service after a fourteen-day free trial.
