Wazuh Reviews & Product Details

I appreciate how Wazuh unifies SIEM and XDR capabilities into a single, open source platform. The endpoint agent provides incredible visibility into host level activities, allowing us to perform deep File Integrity Monitoring (FIM) and Security Configuration Assessments (SCA) seamlessly. I frequently test our custom rules by simulating attacks from a Kali Linux VM running in VirtualBox, and it is impressive how accurately Wazuh's decoders pick up the specific indicators of compromise across our network. Additionally, the built in MITRE ATT&CK mapping makes it incredibly easy to correlate these alerts with known adversary tactics, which drastically speeds up our incident triage workflows. Review collected by and hosted on G2.com.

Because it is so heavily reliant on rule based detection, managing and tuning the rules to avoid alert fatigue requires a lot of manual, hands-on engineering time. Out of the box, it lacks the advanced behavioral correlation and automated threat intelligence found in commercial enterprise SIEMs. Furthermore, scalability can become a significant headache; maintaining the performance of the underlying indexer and server clusters requires dedicated infrastructure monitoring. When troubleshooting complex deployment issues, you often have to dig through community documentation rather than relying on rapid vendor support. Review collected by and hosted on G2.com.

I like Wazuh for its log integration and dashboards, which I find genuinely helpful. I also appreciate how well Wazuh integrates with other tools. On top of that, the secure configuration assessment is valuable, and I like that it natively supports multiple clouds as well as other SaaS platforms. Overall, it lets me monitor all my logs smoothly in one place, under a single pane of glass. Review collected by and hosted on G2.com.

Things that could be improved on Wazuh’s side include its indexing. In addition, the documentation on how to manage indices and handle data more effectively is something that could be added to or improved further. Another feature I’d like to see in Wazuh is a built-in case management system. I’d also like better multi-log correlation, meaning I should be able to correlate and coordinate logs from multiple different sources at the same time. Last but not least, the pricing for Wazuh Cloud could be revised to make it more affordable for those who don’t want to rely on an on-prem deployment. Review collected by and hosted on G2.com.

What I like most about Wazuh is how it brings SIEM, XDR, file integrity monitoring, vulnerability detection, log management, and compliance monitoring together in one open-source platform. It also integrates smoothly with tools like Elastic, supports a broad range of operating systems, and offers highly customizable rules and dashboards—all without expensive licensing costs. Review collected by and hosted on G2.com.

Wazuh can be complex to deploy and maintain, especially in larger environments. Initial configuration, rule tuning, and reducing false positives require time, and major upgrades or integrations can sometimes involve additional manual effort. Review collected by and hosted on G2.com.

I love that Wazuh is open source and has active community support, along with support for various technologies like XDR, UEBA, threat hunting, and FIM. My favorite features are the scope and use case of the tool, especially the Anomaly Detector using AI and historical data patterns. The Anomaly Detector dashboard is user-friendly, and its integration with AI and machine learning utilizing the RCF algorithm is impressive. Review collected by and hosted on G2.com.

Wazuh lacks visual correlation, has heavy storage requirements, and complex SOAR integrations. The initial setup also requires many configurations compared to other SIEM tools, making it only moderately easy. Review collected by and hosted on G2.com.

The platform streamlined our security monitoring process by facilitating real-time log analysis and automated vulnerability detection which saves me hours each week instead of manually checking logs and I like the immediate threat alerts that also give us clear visibility into our system health. Review collected by and hosted on G2.com.

Nothing to dislike about it thus far it has been a great security monitoring platform and even the broader team also seems to feel the same. Review collected by and hosted on G2.com.

It’s an open-source platform that’s easy to install in an on-prem environment. I can easily create rules and decoders for custom logs, and the integrations are straightforward to set up. It also provides excellent tools for log analysis, vulnerability detection, FIM, threat detection, compliance management, and incident management. Deploying the agent across multiple hosts is simple via the command line. Wazuh supports real-time monitoring of system logs and configuration, with automated alerts and VM detection. The documentation is also well maintained. Review collected by and hosted on G2.com.

It’s very difficult for new users to learn and get started with. It also uses a lot of resources when working with large data. Sometimes, it causes problems when upgrading to a newer version. Review collected by and hosted on G2.com.

Wazuh helps keep all your computers and servers safe by watching for bad behavior, checking for weaknesses, and sending alerts when something suspicious happens. It’s free, open, and can be customized to fit any setup, from small networks to large companies. Review collected by and hosted on G2.com.

Some common drawbacks of Wazuh are that it can be complex to set up and configure, especially for large environments, and managing rules, alerts, and integrations can require significant time and expertise. Additionally, its UI and reporting features are less polished compared to some commercial alternatives, which can make monitoring at scale more cumbersome. Review collected by and hosted on G2.com.

Wazuh is the level of visibility and control it provides over security events across the entire infrastructure. The real-time threat detection, log analysis, and compliance monitoring are very powerful for an open-source platform. It delivers enterprise-level security capabilities without high licensing costs. Review collected by and hosted on G2.com.

The main drawback is the steep learning curve, especially for new users during initial setup and tuning. Some configurations and rule customizations can be time-consuming, and the UI could be more intuitive. Better guided setup and clearer documentation for advanced use cases would help a lot. Review collected by and hosted on G2.com.

which is a very good SIEM and is completely open source Review collected by and hosted on G2.com.

that in order for it to work optimally, you need to spend a lot of time fine-tuning the settings Review collected by and hosted on G2.com.

The main reasons that i like about wazuh is being free and opensouce, having simpler learning curve and ease of use, it is user friendly and best choice for small scale companies Review collected by and hosted on G2.com.

In my openion the down side of wazuh is it is difficult to integrate it with 3rd party solutions, and don't have built in plugins to do so compared to other SIEMs in the ecosystem. Review collected by and hosted on G2.com.