Wazuh
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| GPLv2Copyleft license. If you distribute it, modified or not, you must publish the source under GPLv2 too. No network-service clause — running it as a hosted service doesn't trigger that. | Single-vendor governed (Wazuh Inc.), not foundation-backed | Active | ❌ | Unlimited | ❌ |
Description
Wazuh is a unified SIEM/XDR platform — log analysis, file-integrity monitoring, vulnerability detection, and endpoint security in one stack, forked from OSSEC in 2015 and grown into its own full platform since (its own indexer and dashboard, no longer just an Elastic Stack add-on).
Features
- File-integrity monitoring built in — one of several modules, not a separate tool to bolt on.
- Log analysis and correlation — the same underlying job CrowdSec does, as one module of a much larger platform rather than a standalone, purpose-built tool.
- Endpoint agents plus a central manager/indexer/dashboard — genuinely a platform, not a single binary: agents report to a manager, which writes to an indexer, surfaced through its own dashboard.
Usage patterns
- Consolidating security monitoring into one platform — where this catalog otherwise favors narrow, purpose-built tools composed together (CrowdSec for log-based prevention, AIDE for file integrity, Beszel for stats), Wazuh's actual value proposition is doing all of it under one roof instead.
- Fleet-scale deployments — built around a manager handling many agents at once; a single-box deployment uses a small fraction of what it's designed for.
License and governance
GPLv2, copyright Wazuh Inc. (San José / Spain, founded 2015). Self-hosting is fully featured at zero license cost — the company monetizes through an optional managed Wazuh Cloud service and paid support, not by gating the self-hosted platform. Single-vendor governed, not foundation-backed, the same shape as other single-company projects flagged elsewhere in this catalog.
Conclusion
Why you would — real breadth: log monitoring, file-integrity monitoring, and more, in one platform with an existing ecosystem, if consolidating several monitoring concerns into a single system is actually the goal.
Why you wouldn't — the resource footprint doesn't fit a single small VM: even a bare-minimum single-node install wants 4 GB RAM / 2 CPU cores, 16 GB / 8 cores recommended. On a box that's 4 vCPU / 16 GB total, shared with everything else already running on it, that's a disproportionate share to dedicate to monitoring alone — CrowdSec plus AIDE cover the same two gaps at a fraction of the footprint.