Wazuh: an open source security platform with agents, SIEM and XDR

Wazuh (about 17,000 stars on GitHub) is a free, open source security platform that combines host based intrusion detection, log analysis, file integrity monitoring, vulnerability detection and configuration assessment in one product. It began in 2015 as a fork of the older OSSEC project and is developed by Wazuh, Inc., a company that sells cloud hosting and support around the open source core. The main repository holds the agent and the manager written mostly in C and Python; the dashboard, indexer and installation packages live in sibling repositories under the same organisation.

What it does

The platform has three parts. A lightweight agent runs on each Linux, Windows or macOS machine and collects system logs, watches directories for file changes, lists installed packages and runs configuration checks. A central manager receives that data, matches it against several thousand built in rules, compares package versions with public vulnerability feeds and raises alerts. An indexer and dashboard, based on OpenSearch, store the events and present them in a web interface with views for security events, compliance standards such as PCI DSS and GDPR, and the MITRE ATT&CK catalogue of attacker techniques. Together this makes Wazuh both a host based intrusion detection system (HIDS) and a small SIEM, and the project describes the combination as XDR, extended detection and response.

Who it is for

• Small and medium teams that want a complete security monitoring stack without a licence fee.
• Administrators who already centralise logs and want detection rules, file integrity checks and vulnerability reports on top.
• Organisations that need audit evidence for a compliance standard and want a tool that maps alerts to its controls.
• People migrating from OSSEC who want an actively maintained successor with a web interface.

How to install it

The project publishes an all in one installer script that sets up the manager, indexer and dashboard on a single Linux server, plus packages and container images for larger deployments. The documentation also covers Docker Compose, Kubernetes and cloud marketplace images. A single server with four gigabytes of memory is enough to try it:

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

Agents are then installed from the dashboard, which generates the exact package command for each operating system. Read the quickstart before running the installer on a machine you care about, and plan for disk space, since the indexer keeps every event.

Credit

Wazuh is developed by Wazuh, Inc. and a community of contributors, and builds on the earlier OSSEC project by Daniel Cid. The code is released under the GNU General Public License version 2 with an OpenSSL exception; see the LICENSE file in the repository for the exact terms.