Wazuh has many valuable features including easy integration with other SOC tools, active response, endpoint security monitoring, malware detection, inventory, detection of hidden processes, and cloud security. In addition, it can collect terabytes of data quickly, it's open-source and free to use, and provides vulnerability assessment and scoring.
The customizable log configuration are also appreciated as are its dashboard and reporting, flexibility for cloud and on-premises use, syscheck, pile integrity monitoring, integration with AWS cloud-native services, and support for PCI DSS compliance. It can integrate with various operating systems and applications. The ELK for investigation and log monitoring and analysis tools are also highly regarded.
It also has built-in frameworks for compliance with industry standards.
Wazuh's configuration and integration capabilities could be improved, specifically with cloud applications. Scalability and false positives are also areas that need attention. Some users have experienced technical issues with the rules and agent upgrades. The solution is noted as resource-intensive and lacking security features, such as threat intelligence and vulnerability assessment plug-ins. Unix systems also pose a challenge for real-time monitoring.
Some users find Wazuh less user-friendly than other products and would like to see more built-in use cases.
