AlienVault OSSIM vs Wazuh comparison

Read 39 Wazuh reviews

28,493 Views
15,700 Comparison Views

75% willing to recommend

AlienVault OSSIM

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 6, 2024

We compared AlienVault OSSIM and Wazuh based on our user's reviews in several parameters.

According to user reviews, AlienVault OSSIM is praised for its comprehensive threat detection, real-time monitoring, and strong asset management capabilities, while Wazuh is highlighted for its advanced threat detection, seamless integration with other tools, and easy installation process. AlienVault OSSIM users appreciate the customer service and pricing structure, while Wazuh users value the customer support and flexible licensing options. However, AlienVault OSSIM users desire improvements in the user interface and documentation, while Wazuh users suggest enhancements in system resource consumption. Overall, both products offer positive ROI and efficient security monitoring capabilities.

Features: AlienVault OSSIM stands out for its comprehensive threat detection and strong asset management capabilities. On the other hand, Wazuh is known for its advanced threat detection, efficient log analysis, and flexibility in tailoring the solution to specific needs.

Pricing and ROI: AlienVault OSSIM has been positively evaluated for its pricing, setup cost, and licensing. Users find the pricing structure reasonable and affordable. The setup process is straightforward and requires minimal effort. AlienVault OSSIM offers flexible licensing options. In comparison, Wazuh is also considered cost-effective with reasonable pricing options. The setup cost is hassle-free and the licensing is customizable., AlienVault OSSIM has been praised for its valuable and efficient security monitoring capabilities, cost-effectiveness, and ability to address security threats effectively. On the other hand, Wazuh users have reported various benefits and advantages from using the product.

Room for Improvement: Users have identified room for improvement in both AlienVault OSSIM and Wazuh. AlienVault OSSIM needs enhancements in user interface, documentation, support, customization, and integration capabilities. Wazuh could benefit from improvements in interface, documentation, configuration options, and system resource consumption.

Deployment and customer support: The reviews for AlienVault OSSIM highlight varying timeframes for the different phases of establishing a new tech solution. Some users took three months for deployment and an additional week for setup, while others only needed a week for both. In contrast, the reviews for Wazuh emphasize the importance of considering both deployment and setup timeframes. Some users spent three months on deployment and a week on setup, while others required a week for both., Customers have expressed positive feedback about the customer service provided by both AlienVault OSSIM and Wazuh. Users appreciate the helpful and responsive team of AlienVault OSSIM, while Wazuh's customer service is commended for their knowledge, efficiency, and helpfulness.

The summary above is based on 41 interviews we conducted recently with AlienVault OSSIM and Wazuh users. To access the review's full transcripts, download our report.

To learn more, read our detailed AlienVault OSSIM vs. Wazuh Report (Updated: July 2024).

AlienVault OSSIM vs. Wazuh

July 2024

Download the complete report

Helped 793,295 peers since 2012

Categories and Ranking

AlienVault OSSIM

Ranking in Security Information and Event Management (SIEM)

11th

Average Rating

7.4

Number of Reviews

Ranking in other categories

No ranking in other categories

Wazuh

Ranking in Security Information and Event Management (SIEM)

3rd

Average Rating

7.4

Number of Reviews

Ranking in other categories

Log Management (2nd), Extended Detection and Response (XDR) (3rd)

Mindshare comparison

As of July 2024, in the Security Information and Event Management (SIEM) category, the mindshare of AlienVault OSSIM is 4.3%, up from 1.8% compared to the previous year. The mindshare of Wazuh is 15.3%, up from 10.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Unique Categories:

No other categories found

Log Management

18.6%

Extended Detection and Response (XDR)

15.6%

Featured Reviews

Aman Aijaz

Assistant Manager Global Security at Convergys Corporation

Jun 28, 2023

An easy-to-scale open-source solution used for monitoring events on devices

The area for improvement is a lot. When I started using it on our enterprise side, the issue we faced was, for example, if we were running at that time on AlienVault OSSIM v5.7.4. So, for some orders, we had to install some packages, and when we tried installing that package, some dependencies got upgraded to a new version. Now once that dependency got upgraded, the SQL, since you might be aware that OSSIM uses SQL database, now SQL and all the dependency in everything was not on the same version, and that caused the database to crash. The aforementioned area should be eased out by upgrading the patches and upgrading dependencies. This kind of thing is a disadvantage of OSSIM, and I would like them to work on this. But I have also raised service requests many times and gave it a push on the community section too. However, since it is a local source, they don't reply much over there. That is why I don't like to work on OSSIM because it is unpredictable. Once the storage goes above 50 percent, it starts behaving unpredictably. If you get stuck with a situation, then you need to drill a lockdown into that. Sometimes you get no luck. Then you have to just reimage the server with the new fresh OS of AlienVault. As for additional features, not much because if you move to the newer version, it is kind of getting more stable. But, to make my life easier, then I would say try to give more features. I know it's open source, so they also cannot provide me with more features. But still, if they can provide me with more features because right now it's becoming old. Right now, we are even moving from SIEM to Security Data Lake. So when we move to it, this will be literally outdated. No one can even expect anything out of it. The way security is moving, it will be outdated very soon. They have to also provide something new to keep this going for the future also.

Read full review

Rico Agung

Informatics Engineering Lecturer at Innovation Center STMIK AMIKOM

Sep 8, 2023

Affordable and powerful tool for malware detection

The primary use case for Wazuh is the detection of malware It is excellent in terms of visualization and indexing services, making it a powerful tool for malware detection. It is easy to install, configure, and run, requiring minimum resource investment, even for small-scale deployments on…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The open vault component and the checking of vulnerabilities are the most valuable features. The page management helps with this. If you know how your device is vulnerable at least you can do something about it."

"Better than other SIEM solutions because almost everything can be integrated."

"The solution is very stable. Compared to Qradar and Splunk, it's very stable."

"The most valuable features of AlienVault OSSIM are case management, ease of configuration, and investigation."

"The solution is free to use."

"There are a lot of people you will find using OSSIM since they are also offering OTX as a service"

"The initial setup is straightforward."

"The most valuable features of this solution are the data correlation and vulnerability assessment."

More AlienVault OSSIM pros

"It offers built-in modules for file integrity and vulnerability management."

"Wazuh offers an enhanced HDR version that outperforms its competitors."

"Wazuh's logging features integrate seamlessly with AWS cloud-native services. There are also Wazuh agent configurations for different use cases, like vulnerability scanning, host-based intrusion detection, and file integrity monitoring."

"One of the most beneficial features of Wazuh, particularly in the context of security needs, is the machine learning data handling capability."

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions."

"It's stable."

"Wazuh's best features are syscheck, its ability to immediately resolve vulnerabilities, and that it's open source."

"The tool is stable."

More Wazuh pros

Cons

"GUI could be improved."

"AlienVault OSSIM could improve by having better integration with some of the newer tools."

"I suggest more in-built rules based on modern threats and environments to make it a more competitive solution."

"There needs to be more support or some kind of training program so users can self-learn the system more effectively."

"The user interface could be improved."

"We need more dashboards and we need more customization for dashboards."

"It takes some time. It does not give me a prompt response for any such [malicious] traffic. It takes time to get that alert from the AlienVault system."

"The incidence reporting could be better."

More AlienVault OSSIM cons

"A lack of certain features creates limitations."

"The computing resources are consuming and do not make sense."

"It would be great if there could be customization for the decoder portion."

"The tool doesn't detect anomalies or new environments."

"One area where Wazuh could use some improvement is in its reporting mechanism, especially for high-level management like CSOs and CEOs."

"Wazuh needs more security and features, particularly visualization features and a health monitor."

"Wazuh doesn't cover sources of events as well as Splunk. You can integrate Splunk with many sources of events, but it's a painful process to take care of some sources of events with Wazuh."

"A more structured approach, perhaps with modular UI components, to facilitate easier integration and navigation within the Wazuh platform for custom integrations would be beneficial."

More Wazuh cons

Pricing and Cost Advice

"We are using a free version of the solution. If you purchase a license there are more features available but the price is a little high. The solution should be cheaper to allow more customers to be able to afford it."

"AlienVault OSSIM is expensive compared to its competitors."

"The solution is open source, so it's free to use."

"The price of AlienVault OSSIM is too high sometimes for us to present to our customers. The price should be lower. We are on a three-year license to use the solution. We had to pay extra for the support."

"The licensing fees for the non-community edition are paid on an annual basis, and there are no costs in addition to this."

"AlienVault OSSIM is free."

"We are using the community version, which can be used for free."

"The tool's licensing costs are yearly."

More AlienVault OSSIM pricing and cost advice

"It is a cost-effective solution."

"Wazuh is free and open source."

"Wazuh is open-source, therefore it is free. You can purchase support for $1,000 a year."

"Wazuh is an open-source tool, which means it is freely available for use."

"Wazuh is an open-source tool."

"When I contacted customer care, they mentioned bundling options, that I found to be overall affordable."

"Wazuh is not an expensive solution."

"The solution's pricing is very competitive."

More Wazuh pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

793,295 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

17%

Financial Services Firm

Educational Organization

Government

Computer Software Company

17%

Government

Manufacturing Company

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about AlienVault OSSIM?

Asset discovery is good.

What is your experience regarding pricing and costs for AlienVault OSSIM?

The solution is free.

What needs improvement with AlienVault OSSIM?

Collecting logs can sometimes be tedious, especially compared to my experience with Microsoft Sentinel. I suggest more in-built rules based on modern threats and environments to make it a more comp...

What do you like most about Wazuh?

Integrates with various open-source and paid products, allowing for flexibility in customization based on use cases.

What needs improvement with Wazuh?

I have built some rules that produce duplicate alerts two or three times. Therefore, these rules should be consolidated. Alerts should be specific rather than repeatedly triggered by integrating mu...

What is your primary use case for Wazuh?

We use Wazuh for the onboarding of both Windows and Linux machines, as well as for firewall and SIM configuration. The IP address is automatically blocked if a server has multiple wrong passwords.

Elastic Security vs AlienVault OSSIM

Comparisons

Compared 5% of the time

USM Anywhere vs AlienVault OSSIM

Compared 4% of the time

Splunk Enterprise Security vs AlienVault OSSIM

Compared 2% of the time

Fortinet FortiSIEM vs AlienVault OSSIM

Compared 2% of the time

Microsoft Sentinel vs AlienVault OSSIM

Compared 2% of the time

More AlienVault OSSIM Competitors

Security Onion vs Wazuh

Compared 15% of the time

Elastic Security vs Wazuh

Compared 13% of the time

Splunk Enterprise Security vs Wazuh

Compared 9% of the time

Graylog vs Wazuh

Compared 6% of the time

Elastic Stack vs Wazuh

Compared 3% of the time

More Wazuh Competitors

Product Reports

Download AlienVault OSSIM product report

AlienVault OSSIM

July 2024

Download Wazuh product report

June 2024

Also Known As

OSSIM

No data available

Learn More

AT&T

Overview

AlienVault OSSIM, Open Source Security Information and Event Management (SIEM), provides you with a feature-rich open source SIEM complete with event collection, normalization and correlation. Launched by security engineers because of the lack of available open source products, AlienVault OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility.

Wazuh is an enterprise-ready platform used for security monitoring. It is a free and open-source platform that is used for threat detection, incident response and compliance, and integrity monitoring. Wazuh is capable of protecting workloads across virtualized, on-premises, containerized, and cloud-based environments.

It consists of an endpoint security agent and a management server. Additionally, Wazuh is fully integrated with the Elastic Stack, allowing users the ability to navigate through security alerts via a data visualization tool.

Wazuh’s agent can run on many different platforms, and is lightweight. It can successfully perform the tasks needed to detect threats in order to trigger responses automatically.
Wazuh manages the agents, can analyze agent data, and can scale horizontally.
Elastic Stack is where alerts are indexed and stored.

Wazuh Capabilities

Some of Wazuh’s most notable capabilities include:

Intrusion detection: Wazuh’s agents can detect hidden files, cloaked processes, or unregistered network listeners, as well as inconsistencies in system call responses. Wazuh’s server component uses a signature-based approach to intrusion detection, using its regular expression engine to analyze collected log data and look for indicators of compromise.
Log data analysis: Wazuh can read operating system and application logs, and securely forward them to a central manager for rule-based analysis and storage.
Integrity monitoring: File integrity monitoring can help identify changes in content, ownership, permissions, and attribute of files. Wazuh’s file integrity monitoring can be used in conjunction with threat intelligence.
Vulnerability detection: Wazuh agents can identify well-known vulnerable software so you can see where your weak spots are and take action before an attack can exploit them.
Configuration assessment: System and application configurations are monitored to make sure they are compliant with security policies. Periodic scans are used to detect applications that are known to be vulnerable, insecurely configured, or unpatched.
Incident response: Wazuh responds actively when active threats need to be addressed. It can perform countermeasures like blocking access to a system when a threat source is identified.
Regulatory compliance: Wazuh includes the security controls required to be compliant with industry regulations and standards.
Cloud security: Wazuh’s light-weight and multi-platform agents are commonly used to monitor cloud environments at the instance level. In addition, Wazuh helps monitor cloud infrastructure at an API level.
Security for containers: With Wazuh, you have increased security visibility into hosts and containers, allowing for easier detection of threats, anomalies, and vulnerabilities.

Wazuh Benefits

Some of the most valued benefits of Wazuh include:

No vendor lock-in
No license costs
Uses lightweight, multi-platform agents
Free community support

Wazuh Offers

Annual support and maintenance
Assistance with deployment and configuration
Training and instructional hands-on courses

Reviews From Real Users

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions." - Robert C., IT Security Consultant at Microlan Kenya Limited

“The MITRE ATT&CK correlation is most valuable.” - Chief Information Security Officer at a financial services firm

Sample Customers

Council Rock School District

Information Not Available