LogRhythm SIEM vs Wazuh comparison

Read 45 Wazuh reviews

34,744 Views
20,524 Comparison Views

79% willing to recommend

LogRhythm SIEM

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 18, 2024

LogRhythm SIEM and Wazuh both compete in the SIEM solutions category. Based on user feedback and features, Wazuh seems to have the upper hand due to its cost-effectiveness and ease of deployment.

Features: LogRhythm SIEM offers advanced threat detection, automated responses, and integration capabilities. Wazuh provides an open-source model, real-time monitoring, and scalability.

Room for Improvement: LogRhythm SIEM could benefit from a reduction in complexity, enhancements in performance speed, and better user interface. Wazuh needs improvements in documentation, enterprise-level features, and user experience design.

Ease of Deployment and Customer Service: LogRhythm SIEM is often noted for its challenging deployment but receives high marks for responsive customer support. Wazuh is appreciated for its simpler deployment process but has mixed reviews regarding customer service.

Pricing and ROI: LogRhythm SIEM typically has higher setup costs, which some users believe are justified by its feature set and support. Wazuh's open-source nature leads to significantly lower costs and a quicker ROI.

To learn more, read our detailed LogRhythm SIEM vs. Wazuh Report (Updated: December 2024).

Download the complete report

LogRhythm SIEM vs. Wazuh

December 2024

Helped 824,067 peers since 2012

Categories and Ranking

LogRhythm SIEM

Ranking in Log Management

10th

Ranking in Security Information and Event Management (SIEM)

7th

Average Rating

8.4

Reviews Sentiment

6.7

Number of Reviews

172

Ranking in other categories

No ranking in other categories

Wazuh

Ranking in Log Management

2nd

Ranking in Security Information and Event Management (SIEM)

2nd

Average Rating

7.4

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Extended Detection and Response (XDR) (3rd)

Mindshare comparison

As of December 2024, in the Log Management category, the mindshare of LogRhythm SIEM is 2.5%, down from 3.8% compared to the previous year. The mindshare of Wazuh is 17.0%, up from 13.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Joseph W.

System Administrator at GOLDENWEST FEDERAL CREDIT UNION

Has pre-built pieces for third party vendors and does not take a long time to implement

One of the main features that I like about LogRhythm SIEM is that there are a lot of pre-built pieces. Like with our AV, we didn't have to tell it how to read the logs; they already had it pre-made. So, we essentially just had to follow their guide to get the logs imported in and set up some rules for it. We've only had to manually create the parsing rules for a few of our vendors so that we could interpret the logs correctly. Most of them had already been pre-created for us. We use the Event Log Filtering feature a lot. We use it for simple troubleshooting tasks like when a user is logged out, to more important tasks like trying to investigate a threat. As far as its effect on productivity, we can go and search instead of trying to troubleshoot and guess what is causing an error. We can identify what the program is or where the hiccup is. LogRhythm helped us to identify a lot of blind spots. Originally, we didn't have a SIEM tool. We had auditors say that this is something that we should be doing. My management team asked me to go and find a product, and I researched a bunch of them and found LogRhythm. It really opened our eyes to see how much traffic we have, whether it's other IP addresses that are scanning us or external users trying to hit certain ports that could then get closed. It helped us tighten down some of those firewall rules that may have been left open unintentionally through other changes. It helped us a lot early on to identify who was trying to communicate with us or, essentially, who was trying to attack us. As far as our overall security posture, our SIEM tool was the initial push that really got us going into identifying where all of our threats were. We expanded over the seven years that we've had it, and I implemented at least eight other products that are all security related because the SIEM tool indicated the need to identify other risks. It really helped us as an organization to identify risks and move forward to a more secure environment.

Read full review

AKASH MAJUMDER

SOC Analyst at Ovelosec

Open-source platform with custom alerting

There are three key strengths of Wazuh that stand out to me. Firstly, Wazuh offers an enhanced HDR version that outperforms the Elastic Stack. Wazuh has achieved this by running a config or a sec in the background, which has improved the XBR for endpoint security significantly. Secondly, Wazuh comes with built-in frameworks, such as the NISC and ISO, that make it easy to comply with various industry standards. We didn't need to configure any custom frameworks for this, as Wazuh had it built in. Lastly, Wazuh has the ability to collect terabytes of data within seconds, which is a crucial feature for modern enterprises dealing with large amounts of data.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It gives us insight into our entire installation, where we are multiple sites, going as far as the East Coast to the Central West Coast."

"Technical support has always been helpful."

"It allows us to automate a lot of things with a smaller team."

"The most useful feature that I've found so far is the search function. I like all the different ways you're able to search through metadata and the different ways you're able to correlate or search through logs to find out what's going on."

"The correlation engine is extremely valuable because it uses machine learning to process information from the central manager and identifies issues in the network."

"The most valuable features of the solution are network monitoring, user behavior analytics, and log collection."

"The AI Engine can take an event and correlate it into something else giving us meaningful context regarding what is going on. We integrated it in with our ticketing system, so if an alarm fires, it raises a ticket in our system."

"The artificial intelligence engine."

More LogRhythm SIEM pros

"It is excellent in terms of visualization and indexing services, making it a powerful tool for malware detection."

"The deployment is easy and they provide very good documentation."

"Some of the strengths of Wazuh that stand out for us include its scalability when deployed on Azure, its open-source nature, which allows for customization based on our needs, and its compatibility with various security solutions like threat intelligence platforms."

"It is a stable solution."

"I find the PCI DSS feature the most valuable, along with the feature that monitors the compliance of Windows and the CIS benchmarks on other devices like Unix or Linux systems."

"One of the most beneficial features of Wazuh, particularly in the context of security needs, is the machine learning data handling capability."

"It allows you to aggregate all your logs in one place and provides a unified view to monitor your security environment."

"Wazuh's most beneficial features for our security needs are flexibility, built-in rules, integration capabilities, and documentation."

More Wazuh pros

Cons

"When we originally got LogRhythm, their tech support was fantastic, and I loved them. Now, we don't quite get as quick of a response. I've been disappointed in the more recent tech support. When you call in, they'll say that they will get you somebody, and you'll finally get someone who will contact you back a day or so later. Whereas before, I would get help right away."

"It should have some more message monitoring features. It can also have some free message monitoring tools."

"We're still struggling to get a real return on it and finding something that isn't false noise."

"I would like to see case management become more independent from LogRhythm itself."

"We use Windows Event Forwarding to collect the logs from our Windows clients, and the logs get aggregated as one data source on that collector. Therefore, finding logs specific to one particular Windows system requires some creativity in how we search the SIEM."

"In the next release, I would certainly like to see more HIPAA compliance. I would also like to see more integration with Palo Alto Networks, particularly their Traps, which is their endpoint solution."

"I would really love to be able to take some of the data and not have to export it to a CSV file, so I can pull it into Excel to turn it into some other kind of graph."

"The reporting on the dashboard should be improved from a management perspective. It would be helpful if they adjusted the colors and the presentation to make things clearer and easier to read."

More LogRhythm SIEM cons

"Wazuh could improve the detection, it is not detecting all of the attacks. Additionally, it is lacking features compared to other solutions."

"The tool does not provide CTI to monitor darknet."

"There's not much I like about Wazuh. Other products I've used were a lot more functional and user friendly. They came with reports and use cases out of the box. We need to configure Wazuh's alerts and monitoring capabilities manually. It'd be nice if we could select from templates and presets for use cases already built and coded."

"The support channel is not optimal, and extensive research is required on our part to implement Wazuh effectively."

"Alerts should be specific rather than repeatedly triggered by integrating multiple factors. This issue needs improvement to create a more efficient alert system."

"There could be a hardware monitoring tool for the solution."

"An issue I noticed is with tag values in certain rules not functioning properly."

"I have yet to find the same capability in Wazuh to get logs from different sources into the system"

More Wazuh cons

Pricing and Cost Advice

"I would rate the tool's pricing around eight out of ten."

"I give the price a six out of ten."

"We work with French-speaking African countries, and it costs more than the average SIEM solution. Also, the pricing isn't too flexible. AlienVault, Splunk, and IBM QRadar are more suitable for customers on a tight budget."

"NextGen SIEM's pricing is moderate."

"In comparison to the competition, they are more affordable. This allows us to do more with less."

"On a scale of one to ten, where one is low, and ten is high, I rate the pricing between six and seven."

"Look for whatever will give you the most value. That's the main point. It is not one size fits all."

"LogRhythm's licensing is based on MPS. There are some add-on features like advanced UEBA, the cloud component for advanced UEBA, and SIEM."

More LogRhythm SIEM pricing and cost advice

"Wazuh is open-source, so I think it's an option for a small organization that cannot go for enterprise-grade solutions like Splunk."

"The solution's pricing is very competitive."

"The product is cheaper compared to other tools."

"It is a cost-effective solution."

"They have a good pricing strategy for market expansion."

"It is a free-of-cost solution."

"Wazuh is an open-source tool."

"The current pricing is open source."

More Wazuh pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

824,067 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Educational Organization

45%

Computer Software Company

Government

Financial Services Firm

Computer Software Company

16%

Comms Service Provider

University

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What is the difference between log management and SIEM?

Rony, Daniel's answer is right on the money. There are many solutions for each in the market, a lot depends upon your ability to manage such tools and your budget. A small operation may be best s...

What needs improvement with LogRhythm NextGen SIEM?

The integration is slightly difficult with other assets, like EDR technologies or firewalls. Also, the back end is not as user-friendly as other solutions like IBM QRadar. The technical support is ...

What do you like most about LogRhythm SIEM?

I find LogRhythm's log management capabilities to be beneficial.

What do you like most about Wazuh?

Integrates with various open-source and paid products, allowing for flexibility in customization based on use cases.

What needs improvement with Wazuh?

I am investigating more about the community support for Wazuh. I can't provide a definitive answer yet. An issue I noticed is with tag values in certain rules not functioning properly. It's unclear...

What is your primary use case for Wazuh?

I am currently evaluating and using Wazuh for file monitoring and compliance reporting. We are in the process of conducting a POC to understand how the rules work. I lead this effort to explore and...

IBM Security QRadar vs LogRhythm SIEM

Comparisons

Compared 14% of the time

Splunk Enterprise Security vs LogRhythm SIEM

Compared 13% of the time

LogRhythm Axon vs LogRhythm SIEM

Compared 6% of the time

Fortinet FortiSIEM vs LogRhythm SIEM

Compared 5% of the time

VMware Aria Operations for Logs vs LogRhythm SIEM

Compared 4% of the time

More LogRhythm SIEM Competitors

Security Onion vs Wazuh

Compared 16% of the time

AlienVault OSSIM vs Wazuh

Compared 9% of the time

Elastic Stack vs Wazuh

Compared 9% of the time

Elastic Security vs Wazuh

Compared 9% of the time

Graylog vs Wazuh

Compared 5% of the time

More Wazuh Competitors

Product Reports

Download LogRhythm SIEM product report

LogRhythm SIEM

December 2024

Download Wazuh product report

November 2024

Also Known As

LogRhythm NextGen SIEM, LogRhythm, LogRhythm Threat Lifecycle Management, LogRhythm TLM

No data available

Learn More

LogRhythm

Overview

LogRhythm SIEM Platform is an award-winning platform in security analytics. With more than 4,000 customers globally, LogRhythm SIEM is an integrated platform that helps security operations teams protect critical infrastructure and information from emerging cyberthreats. Ultimately, LogRhythm SIEM is an integrated set of modules that contribute to the security team’s fundamental mission: rapid threat monitoring, threat detection, threat investigation, and threat neutralization. LogRhythm SIEM is for organizations that require an on-premises solution and offers:

● Streamlined workflow

● Secure data access

● Real-time visibility

● A unified user experience

● Management customization

Security information and event management (SIEM) solutions have been evolving for over a decade; their core functionality still acts as the most effective foundation for any organization’s technology stack. A SIEM solution enables an organization to centrally collect data across its entire network environment to gain real-time visibility into activity that may pose a risk to the organization. SIEM technology addresses threats before they become significant financial risks while simultaneously helping better manage an organization’s assets.

LogRhythm SIEM has many key features and capabilities, including:

● High-Performance Log Management: LogRhythm SIEM offers structured and unstructured search capabilities which allows users to swiftly search across an organization’s vast data to easily find answers, identify IT and security issues, and troubleshoot issues. Users can efficiently process and index terabytes of log data daily.

● Network and Endpoint Monitoring: Forensic sensors allow users to gain deep visibility into endpoint and network activity. Users can see behavioral anomalies and better respond to incidents.

● SmartResponse™ Automation: LogRhythm SIEM allows users to centrally execute pre-staged actions that automate incident investigatory tasks and responses.

● Automated Machine Analytics: LogRhythm SIEM's AI Engine continuously analyzes all collected security incidents and forensic data. Security teams are delivered precise, real-time intelligence about risk-prioritized threats.

● Case and Security Incident Management: LogRhythm SIEM offers an integrated workflow so that threats don’t slip through the cracks. Collaboration tools help centrally manage and track investigations.

● User and entity behavior analytics (UEBA): Embedded deterministic UEBA monitoring helps protect against insider threats.

● Security orchestration, automation, and response (SOAR): LogRhythm SIEM includes our embedded SOAR solution to increase efficiency and higher-quality incident response with low mean time to response (MTTR).

Benefits to Using LogRhythm SIEM

● The platform offers great value to security and IT operations. Users have the ability to map their security and IT operations to existing frameworks such as NIST and MITRE ATT&CK.

● The platform offers broad integration across security and IT vendors: Users benefit from support for integration with hundreds of security and IT solutions. In turn, this further extends SIEM capabilities and data collection.

● The platform provides compliance adherence, enforcement, and reporting: The prebuilt compliance modules automatically detect violations as they occur and remove the burden of manually reviewing audit logs.

Reviews from Real Users

LogRhythm SIEM stands out among its competitors for a number of reasons. Two major ones are its ability to be customized and its quick performance of queries.

Jason G., a senior cybersecurity engineer, writes, "I have found the Advanced Intelligence Engine has provided the most value to us because we can customize alarms based on our requirements and have created hundreds of alarms that notify different people for different scenarios."

Andy W., principal consultant at ITSEC Asia, notes, “LogRhythm SIEM covers all our primary security analysis needs. It makes it easier for us to analyze threats and improves our response times. It's a versatile platform that performs queries fast compared to other SIEM solutions.”

Wazuh is an enterprise-ready platform used for security monitoring. It is a free and open-source platform that is used for threat detection, incident response and compliance, and integrity monitoring. Wazuh is capable of protecting workloads across virtualized, on-premises, containerized, and cloud-based environments.

It consists of an endpoint security agent and a management server. Additionally, Wazuh is fully integrated with the Elastic Stack, allowing users the ability to navigate through security alerts via a data visualization tool.

Wazuh’s agent can run on many different platforms, and is lightweight. It can successfully perform the tasks needed to detect threats in order to trigger responses automatically.
Wazuh manages the agents, can analyze agent data, and can scale horizontally.
Elastic Stack is where alerts are indexed and stored.

Wazuh Capabilities

Some of Wazuh’s most notable capabilities include:

Intrusion detection: Wazuh’s agents can detect hidden files, cloaked processes, or unregistered network listeners, as well as inconsistencies in system call responses. Wazuh’s server component uses a signature-based approach to intrusion detection, using its regular expression engine to analyze collected log data and look for indicators of compromise.
Log data analysis: Wazuh can read operating system and application logs, and securely forward them to a central manager for rule-based analysis and storage.
Integrity monitoring: File integrity monitoring can help identify changes in content, ownership, permissions, and attribute of files. Wazuh’s file integrity monitoring can be used in conjunction with threat intelligence.
Vulnerability detection: Wazuh agents can identify well-known vulnerable software so you can see where your weak spots are and take action before an attack can exploit them.
Configuration assessment: System and application configurations are monitored to make sure they are compliant with security policies. Periodic scans are used to detect applications that are known to be vulnerable, insecurely configured, or unpatched.
Incident response: Wazuh responds actively when active threats need to be addressed. It can perform countermeasures like blocking access to a system when a threat source is identified.
Regulatory compliance: Wazuh includes the security controls required to be compliant with industry regulations and standards.
Cloud security: Wazuh’s light-weight and multi-platform agents are commonly used to monitor cloud environments at the instance level. In addition, Wazuh helps monitor cloud infrastructure at an API level.
Security for containers: With Wazuh, you have increased security visibility into hosts and containers, allowing for easier detection of threats, anomalies, and vulnerabilities.

Wazuh Benefits

Some of the most valued benefits of Wazuh include:

No vendor lock-in
No license costs
Uses lightweight, multi-platform agents
Free community support

Wazuh Offers

Annual support and maintenance
Assistance with deployment and configuration
Training and instructional hands-on courses

Reviews From Real Users

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions." - Robert C., IT Security Consultant at Microlan Kenya Limited

“The MITRE ATT&CK correlation is most valuable.” - Chief Information Security Officer at a financial services firm

Sample Customers

Macy's, NASA, Fujitsu, US Air Force, EY, Abbott, HD Supply, SAB Miller, UCLA, Raytheon, Amtrak, Cargill

Information Not Available