Wazuh Reviews

Name: Wazuh
Brand: Wazuh
Rating: 3.7 (48 reviews)

Vendor: Wazuh

3.7 out of 5

48 reviews
80% willing to recommend

What is Wazuh?

Wazuh is an enterprise-ready platform used for security monitoring. It is a free and open-source platform that is used for threat detection, incident response and compliance, and integrity monitoring. Wazuh is capable of protecting workloads across virtualized, on-premises, containerized, and cloud-based environments.

Get the Wazuh Buyer's Guide and find out what your peers are saying about Wazuh, CrowdStrike Falcon, Microsoft Sentinel and more!

Wazuh is the #1 ranked solution in Log Management Software, #2 ranked solution in top Security Information and Event Management (SIEM) solutions, and #5 ranked solution in XDR Security products. PeerSpot users give Wazuh an average rating of 7.4 out of 10. Wazuh is most commonly compared to CrowdStrike Falcon: Wazuh vs CrowdStrike Falcon. Wazuh is popular among the large enterprise segment, accounting for 46% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 15% of all views.

Helped 865,295 peers since 2012

Featured Wazuh reviews

Sandip_Patel

Student at Dakota State University

Wazuh's most valuable features include file monitoring and compliance reporting, which do not require excessive costs. These aspects are vital as they provide alerts for changes and facilitate the monitoring of compliance. The platform is also relatively easy to set up and operate. Reports are straightforward to extract and prove useful for compliance requirements.

Read full review

Godwin Edmond

Senior Security Information Analyst at Carbon MFB

The most valuable feature of Wazuh is its EDR capabilities. It operates in a server-agent mode, which allows us to aggregate logs from endpoints and monitor server activities, such as vulnerability scans and compliance checks. Wazuh is open to numerous integrations with third-party tools like forensics tools, adding to its versatility.

Read full review

PubuduWijerathne

Systems Administration Engineer at 5G Networks Ltd

Regarding Wazuh, I find the SCA (Security Configuration Assessment) features most valuable. It's crucial for asset management and inventory, allowing us to monitorendpoints and servers' changes easily. This is particularly important for my customers, who aren't heavily focused on incident response but rely on asset management and inventories. Wazuh's compliance management features are very supportive, especially in regions like the Americas and Europe. However, it's less effective in the ANZ (Australia and New Zealand) region since Wazuh doesn't cater to the specific compliance standards there, such as those required in Australia. I appreciate that Wazuh fully complies with PCI DSS and GDPR standards, allowing us to generate necessary reports.

Read full review

Wazuh mindshare

Product category:

As of August 2025, the mindshare of Wazuh in the Security Information and Event Management (SIEM) category stands at 11.8%, down from 16.4% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

PeerResearch reports based on Wazuh reviews

Type	Title	Date
Category	Security Information and Event Management (SIEM)	Aug 19, 2025	Download
Product	Reviews, tips, and advice from real users	Aug 19, 2025	Download
Comparison	Wazuh vs Splunk Enterprise Security	Aug 19, 2025	Download
Comparison	Wazuh vs Microsoft Sentinel	Aug 19, 2025	Download
Comparison	Wazuh vs IBM Security QRadar	Aug 19, 2025	Download

Title	Rating	Mindshare	Recommending
CrowdStrike Falcon	4.3	4.7%	96%	132 interviews Add to research
Microsoft Sentinel	4.1	6.6%	93%	98 interviews Add to research

Valuable Features

Wazuh's most valued features include SCA capabilities, intuitive interface, open-source nature, visualization and indexing services, file integrity and vulnerability management, scalability on Azure, integration with various security solutions, EDR, SIEM modules, flexibility, easy deployment, PCI compliance, threat hunting, intrusion detection, customizable dashboards, cloud-native infrastructure, vulnerability assessment, and comprehensive compliance support. Users appreciate its ability to monitor endpoints and integrate with AWS cloud services.

"I recommend Wazuh to everyone and believe more platforms, not just SIEM and XDR capability platforms, should be open source, allowing people to leverage these tools for the greater good."
"Overall, I rate Wazuh a nine out of ten."
"I would recommend Wazuh to others."

Room for Improvement

Wazuh's user interface requires improvement. Its scalability and integration capabilities could benefit from enhancements, particularly for large enterprises. Users express dissatisfaction with threat intelligence, alerting complexity, and absence of AI features. Deployment and configuration complexities hamper usability. Real-time monitoring for Unix systems, log data analysis, and cloud integration are areas needing attention. The lack of inbuilt templates and limitations with rule customization and reporting creates challenges in achieving optimal functionality. AI capabilities and user guidance require further development.

"Wazuh requires substantial maintenance. The indexer frequently times out, requiring system restarts. When it comes to errors, debugging takes considerable time."
"When I face a challenge, I prefer not to spend too much time on it and may move to another solution that will give us the results."
"There is room for improvement by integrating more AI into Wazuh. It requires constant nurturing, as I have to provide it with code and specific requirements."

ROI

Users report that Wazuh significantly reduces time to detect and respond to threats, lowering detection from months to an hour and response from weeks to days. It offers substantial cost savings compared to other security options, beneficial for small to medium businesses. Users have avoided large lump sum payments and enjoyed using their own security systems. Though specifics are confidential, cost-effective security costs were highlighted, without any comparison to previous solutions.

Pricing

Wazuh is an open-source solution, making it an affordable option for organizations. While there are no licensing fees for the software itself, costs can arise from supporting infrastructure and optional support services, which can range from $1,000 annually to third-party related expenses. Some users mention additional costs for log storage and managed services. Overall, users find Wazuh pricing competitive, especially against enterprise solutions like Splunk, with the open-source version being particularly cost-effective.

"The product price is neither too high nor too low."
"Wazuh is an open-source tool."
"Wazuh is a cheaply priced product."

Popular Use Cases

Organizations primarily use Wazuh for security information and event management, log aggregation, and endpoint monitoring. They integrate Wazuh with cloud infrastructure for compliance and event detection. Wazuh helps track vulnerabilities, ensures regulatory adherence, and performs threat detection. Many employ it for file integrity, forensic tasks, and customizing security modules, benefiting from its open-source and cost-effective nature. It is widely deployed in sectors like finance, healthcare, and telecommunications for ensuring robust cybersecurity frameworks.

Service and Support

Wazuh's customer service and support receive mixed feedback. Many benefit from the community resources, forums, and documentation, with some rating it eight out of ten. Paid support exists, but challenges like time zone differences and delayed responses are noted. Users often rely on third-party or community support, especially when using the open-source version. Satisfaction varies, with some describing it as excellent, while others see room for improvement in responsiveness and service quality.

Deployment

Wazuh's initial setup experiences vary. Many users find it straightforward, citing comprehensive documentation and pre-configured scripts. Some describe the process as simple and quick, with a few hours needed, while others report challenges, especially with complex configurations requiring expert support. Maintenance and integration can be demanding when involving multiple systems or custom solutions. Smaller projects tend to be simpler, but larger deployments sometimes demand more planning and resources. User ratings fluctuate between easy and moderate difficulty.

Scalability

Wazuh exhibits high scalability, though some users mention setup challenges. It efficiently supports small to medium enterprises, adapting to various environments. Users note flexibility in deployment and configuration, but technical expertise is required for optimal use. Some rate scalability highly, while others see room for improvement, especially with large data handling. Overall, Wazuh accommodates multiple endpoints effectively and can be scaled according to the resources and infrastructure available to users.

Stability

Wazuh is generally stable and receives a 7-9 out of 10 rating for reliability. Many users report it remains stable with regular updates. Some experience minor glitches, particularly with configuration issues, new features, or updates. Regular maintenance is crucial for optimal performance. While some face fewer incidents, others have encountered problems due to human error or environmental factors, indicating stability may vary depending on specific implementation and maintenance practices.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Wazuh Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

15%

Comms Service Provider

University

Manufacturing Company

Government

Educational Organization

Financial Services Firm

Retailer

Healthcare Company

Media Company

Hospitality Company

Construction Company

Non Profit

Real Estate/Law Firm

Insurance Company

Energy/Utilities Company

Outsourcing Company

Legal Firm

Wholesaler/Distributor

Transportation Company

Performing Arts

Consumer Goods Company

Recreational Facilities/Services Company

Aerospace/Defense Firm

Pharma/Biotech Company

Compare Wazuh with alternative products

Learn more about Wazuh

It consists of an endpoint security agent and a management server. Additionally, Wazuh is fully integrated with the Elastic Stack, allowing users the ability to navigate through security alerts via a data visualization tool.

Wazuh’s agent can run on many different platforms, and is lightweight. It can successfully perform the tasks needed to detect threats in order to trigger responses automatically.
Wazuh manages the agents, can analyze agent data, and can scale horizontally.
Elastic Stack is where alerts are indexed and stored.

Wazuh Capabilities

Some of Wazuh’s most notable capabilities include:

Intrusion detection: Wazuh’s agents can detect hidden files, cloaked processes, or unregistered network listeners, as well as inconsistencies in system call responses. Wazuh’s server component uses a signature-based approach to intrusion detection, using its regular expression engine to analyze collected log data and look for indicators of compromise.
Log data analysis: Wazuh can read operating system and application logs, and securely forward them to a central manager for rule-based analysis and storage.
Integrity monitoring: File integrity monitoring can help identify changes in content, ownership, permissions, and attribute of files. Wazuh’s file integrity monitoring can be used in conjunction with threat intelligence.
Vulnerability detection: Wazuh agents can identify well-known vulnerable software so you can see where your weak spots are and take action before an attack can exploit them.
Configuration assessment: System and application configurations are monitored to make sure they are compliant with security policies. Periodic scans are used to detect applications that are known to be vulnerable, insecurely configured, or unpatched.
Incident response: Wazuh responds actively when active threats need to be addressed. It can perform countermeasures like blocking access to a system when a threat source is identified.
Regulatory compliance: Wazuh includes the security controls required to be compliant with industry regulations and standards.
Cloud security: Wazuh’s light-weight and multi-platform agents are commonly used to monitor cloud environments at the instance level. In addition, Wazuh helps monitor cloud infrastructure at an API level.
Security for containers: With Wazuh, you have increased security visibility into hosts and containers, allowing for easier detection of threats, anomalies, and vulnerabilities.

Wazuh Benefits

Some of the most valued benefits of Wazuh include:

No vendor lock-in
No license costs
Uses lightweight, multi-platform agents
Free community support

Wazuh Offers

Annual support and maintenance
Assistance with deployment and configuration
Training and instructional hands-on courses

Reviews From Real Users

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions." - Robert C., IT Security Consultant at Microlan Kenya Limited

“The MITRE ATT&CK correlation is most valuable.” - Chief Information Security Officer at a financial services firm