Wazuh Reviews

Name: Wazuh
Brand: Wazuh
Rating: 4 (43 reviews)

Vendor: Wazuh

3.7 out of 5

43 reviews
78% willing to recommend

119 followers

Post review

What is Wazuh?

Wazuh is an enterprise-ready platform used for security monitoring. It is a free and open-source platform that is used for threat detection, incident response and compliance, and integrity monitoring. Wazuh is capable of protecting workloads across virtualized, on-premises, containerized, and cloud-based environments.

Get the Wazuh Buyer's Guide and find out what your peers are saying about Wazuh, CrowdStrike Falcon, Splunk Enterprise Security and more!

Wazuh is the #2 ranked solution in Log Management Software, #3 ranked solution in top Security Information and Event Management (SIEM) solutions, and #4 ranked solution in XDR Security products. PeerSpot users give Wazuh an average rating of 7.4 out of 10. Based on the analysis of the 43 most recent Wazuh reviews, the overall sentiment is positive, with a sentiment score of 7.1. (Among the highest in the category). Wazuh is most commonly compared to CrowdStrike Falcon: Wazuh vs CrowdStrike Falcon. Wazuh is popular among the large enterprise segment, accounting for 47% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 16% of all views.

Helped 814,763 peers since 2012

Featured reviews

SyedAli17

Confidential at PTA

We primarily use Wazuh for internal security monitoring to ensure the safety of our organization's internal systems. We have two specific requirements: first, we use it to monitor our internal operations, which is essential for general security purposes. Second, we rely on Wazuh to manage the…

Read full review

Vikrant Puranik

Manager Cloud Security Operations at TraceLink, Inc.

I worked with Splunk, Curator, ArcSight, and some legacy solutions that no longer exist. They became obsolete or transitioned to a different product. Cost-effectiveness was one reason we switched. We had to decide whether to spend $500,000 on a commercial product or rely on our skills to deploy an open-source solution. The big difference between Wazuh and other solutions is maturity and customization. Wazuh's scalability and out-of-the-box functionality are slightly lagging behind, but Wazuh has improved a lot since the first time we saw it. Others have more search capabilities, whereas Wazuh depends on Elasticsearch. Searching is a bit slower in Wazuh.

Read full review

AKASH MAJUMDER

SOC Analyst at Ovelosec

There are three key strengths of Wazuh that stand out to me. Firstly, Wazuh offers an enhanced HDR version that outperforms the Elastic Stack. Wazuh has achieved this by running a config or a sec in the background, which has improved the XBR for endpoint security significantly. Secondly, Wazuh comes with built-in frameworks, such as the NISC and ISO, that make it easy to comply with various industry standards. We didn't need to configure any custom frameworks for this, as Wazuh had it built in. Lastly, Wazuh has the ability to collect terabytes of data within seconds, which is a crucial feature for modern enterprises dealing with large amounts of data.

Read full review

Wazuh mindshare

Product category:

As of November 2024, the mindshare of Wazuh in the Log Management category stands at 17.1%, up from 13.0% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Log Management

Key learnings from peers

Last updated Oct 31, 2024

Valuable Features

Wazuh's key features include MITRE ATT&CK correlation, easy integration with cloud and on-prem environments, ELK for investigations, PCI DSS and CIS compliance monitoring, SIEM capabilities, file integrity monitoring, vulnerability detection, open-source flexibility, built-in frameworks, scalability, customizable dashboards, malware detection, and active response. Users appreciate its cost-effectiveness, comprehensive compliance, seamless integration with AWS services, compatibility with various operating systems, and intuitive interface.

"The most valuable feature of Wazuh is its EDR capabilities."
"It allows you to aggregate all your logs in one place and provides a unified view to monitor your security environment."
"The solution is easy to maintain."

Room for Improvement

Wazuh requires improvements in user interface, scalability, and integration capabilities. Its threat intelligence and detection features are limited compared to competitors like Splunk. Wazuh's configuration and deployment processes are complex, lacking automation and AI integration. Real-time monitoring and efficient alert systems need enhancement, as does support for cloud and enterprise environments. Overall, users seek better log management, security features, and compliance support to improve Wazuh's performance and usability for larger organizations.

"So far, the recent updates have addressed most challenges we previously faced."
"Wazuh doesn't have native support for some enterprise solutions."
"The product's configuration part and lack of AI capabilities are some of the major concerns associated with Wazuh."

ROI

The ROI has not been commented on by users to much extent. Wazuh does offer an MSP program with partnership offerings and related services.

Pricing

Wazuh is an open-source cybersecurity tool that attracts enterprises due to its absence of licensing costs. While the base solution is free, users must account for total ownership costs, including support, managed services, and resource expenses like Elasticsearch and log storage. Support subscriptions start at $1,000 annually, while cloud-based services may incur additional fees. As a cost-effective option compared to competitors, Wazuh is appealing for enterprises seeking affordable security solutions.

"The product price is neither too high nor too low."
"Wazuh is an open-source tool."
"Wazuh is a cheaply priced product."

Popular Use Cases

They primarily use Wazuh for log aggregation and monitoring in SOC environments, focusing on endpoint security, incident management, and compliance. It supports event management, vulnerability detection, and responding to security threats. Common applications include file integrity monitoring, SIEM capabilities, and inventory control. Users integrate it with cloud infrastructure for centralized log collection and perform searches using Elasticsearch. They also handle compliance with regulatory standards, benchmarking against CIS controls, and detecting malicious activities across diverse systems and sectors.

Service and Support

Wazuh's customer service receives mixed feedback. Paid support is praised, rated up to nine out of ten. Many rely on robust community forums and knowledge bases for assistance. Free version users often interact through community groups rather than direct contact. Some users find technical support efficient for role-based access control discussions, while others experience response delays. Time zone differences pose challenges. Users with purchased support find it decent, yet some note room for improvement.

Deployment

Wazuh's initial setup is generally straightforward, often completed within days. Users report minimal challenges, mainly when deploying in complex environments or without technical expertise. Comprehensive documentation and guides facilitate installation, though maintenance might require periodic attention. Deployments range from simple to complex based on customization and infrastructure. Technical users find it easier, while less experienced personnel may face challenges. The process is rated highly, with ease varying based on expertise and complexity.

Scalability

Wazuh is considered scalable by many users, though some note challenges and limitations, particularly with distributed architecture and larger data handling. It requires technical setup and configuration knowledge. Deployment can be complex, yet users find scalability satisfactory. Many rate it highly, suggesting confidence in its ability to expand. However, issues such as event sources and traffic impact scalability ease. Wazuh can be scaled on various platforms, including on-premises and cloud environments.

Stability

Wazuh is generally stable, with numerous updates that may cause occasional instability. It performs well for most users, with some experiencing minor glitches. Stability ratings vary, often around seven out of ten, highlighting room for improvement. Users noted challenges in initial setup and specific bugs but found stability improved with proper configuration. Wazuh suits small to mid-level businesses better than high-volume scenarios, and its performance is often compared favorably to other tools like Splunk.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Wazuh Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

16%

University

Government

Manufacturing Company

Financial Services Firm

Comms Service Provider

Educational Organization

Retailer

Healthcare Company

Media Company

Insurance Company

Construction Company

Hospitality Company

Real Estate/Law Firm

Non Profit

Energy/Utilities Company

Outsourcing Company

Wholesaler/Distributor

Legal Firm

Recreational Facilities/Services Company

Performing Arts

Transportation Company

Pharma/Biotech Company

Consumer Goods Company

Aerospace/Defense Firm

Compare Wazuh with alternative products

Learn more about Wazuh

It consists of an endpoint security agent and a management server. Additionally, Wazuh is fully integrated with the Elastic Stack, allowing users the ability to navigate through security alerts via a data visualization tool.

Wazuh’s agent can run on many different platforms, and is lightweight. It can successfully perform the tasks needed to detect threats in order to trigger responses automatically.
Wazuh manages the agents, can analyze agent data, and can scale horizontally.
Elastic Stack is where alerts are indexed and stored.

Wazuh Capabilities

Some of Wazuh’s most notable capabilities include:

Intrusion detection: Wazuh’s agents can detect hidden files, cloaked processes, or unregistered network listeners, as well as inconsistencies in system call responses. Wazuh’s server component uses a signature-based approach to intrusion detection, using its regular expression engine to analyze collected log data and look for indicators of compromise.
Log data analysis: Wazuh can read operating system and application logs, and securely forward them to a central manager for rule-based analysis and storage.
Integrity monitoring: File integrity monitoring can help identify changes in content, ownership, permissions, and attribute of files. Wazuh’s file integrity monitoring can be used in conjunction with threat intelligence.
Vulnerability detection: Wazuh agents can identify well-known vulnerable software so you can see where your weak spots are and take action before an attack can exploit them.
Configuration assessment: System and application configurations are monitored to make sure they are compliant with security policies. Periodic scans are used to detect applications that are known to be vulnerable, insecurely configured, or unpatched.
Incident response: Wazuh responds actively when active threats need to be addressed. It can perform countermeasures like blocking access to a system when a threat source is identified.
Regulatory compliance: Wazuh includes the security controls required to be compliant with industry regulations and standards.
Cloud security: Wazuh’s light-weight and multi-platform agents are commonly used to monitor cloud environments at the instance level. In addition, Wazuh helps monitor cloud infrastructure at an API level.
Security for containers: With Wazuh, you have increased security visibility into hosts and containers, allowing for easier detection of threats, anomalies, and vulnerabilities.

Wazuh Benefits

Some of the most valued benefits of Wazuh include:

No vendor lock-in
No license costs
Uses lightweight, multi-platform agents
Free community support

Wazuh Offers

Annual support and maintenance
Assistance with deployment and configuration
Training and instructional hands-on courses

Reviews From Real Users

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions." - Robert C., IT Security Consultant at Microlan Kenya Limited

“The MITRE ATT&CK correlation is most valuable.” - Chief Information Security Officer at a financial services firm