Wazuh

Wazuh is a free, open source security monitoring platform that provides unified XDR and SIEM protection for workloads across on-premises, virtualized, containerized, and cloud-based environments. It started as a fork of OSSEC and has grown into a full-featured tool for threat detection, file integrity monitoring, log analysis, and vulnerability detection.

Wazuh uses a multi-platform agent architecture (Linux, Windows, macOS, Solaris, AIX, and HP-UX) that forwards security events to a central manager. The manager processes data using decoders and rules, feeding results into the Elastic Stack (Elasticsearch, Kibana) for visualization and alerting. It also integrates with cloud services like AWS, Azure, and GCP for log collection and resource monitoring.

The platform is ideal for security teams, SOC analysts, and sysadmins needing compliance coverage (PCI DSS, HIPAA, GDPR) without licensing costs. Wazuh is developed by Wazuh Inc., maintained by a large open source community, and deployed by organizations like NASA and IBM.