wazuh/wazuh

Wazuh is an open source security platform that provides unified XDR and SIEM protection for endpoints and cloud workloads.

Wazuh addresses the need for centralized threat detection and response across diverse infrastructure by combining endpoint agents with a management server that collects and analyzes security data. Agents deployed on monitored systems scan for malware, rootkits, and suspicious anomalies while reading operating system and application logs for rule-based analysis. The server uses signature-based intrusion detection with regular expression matching against collected log data, and can also receive syslog data from network devices when agents are not deployed. The platform integrates with the Wazuh Indexer for search and data visualization of security alerts. Key capabilities include file integrity monitoring that tracks changes to file content, permissions, ownership and attributes while identifying the users and applications responsible for modifications, vulnerability detection through correlation of software inventory against CVE databases, configuration assessment to ensure compliance with security policies and hardening guides, and active response mechanisms that can automatically execute countermeasures such as blocking access from threat sources.

Organizations should adopt Wazuh when they need comprehensive security monitoring across on-premises, virtualized, containerized, and cloud environments without licensing costs. It suits teams managing diverse workloads who require both log analysis and endpoint threat detection in a single platform. The file integrity monitoring and configuration assessment capabilities make it particularly valuable for organizations subject to regulatory compliance standards such as PCI DSS that mandate these controls.

The project maintains active development with regular updates to its detection rules and CVE correlation databases. The codebase is primarily written in C++ and the platform architecture separates concerns between distributed agents and centralized management, allowing independent scaling of components. The integration with a dedicated indexer component reflects a design that treats data storage and visualization as a distinct layer from threat detection logic.