Wazuh

Wazuh is a free open-source security platform unifying SIEM and XDR capabilities into a single solution. Forked from OSSEC in 2015, it protects over 30 million endpoints across enterprises, government agencies, and educational institutions worldwide. The platform combines intrusion detection, log analysis, vulnerability detection, incident response, and compliance monitoring. Key components include the Agent (a lightweight endpoint agent that collects logs, monitors file integrity, checks system configuration, performs vulnerability detection, and responds to active threats), the Server (the central analysis engine with over 4,000 built-in detection rules), and the Indexer (a scalable Elasticsearch-based engine for storing security events). Core capabilities include Security Analytics (correlating events across endpoints, cloud services, and network devices), Vulnerability Detection (scanning installed software against CVE databases), File Integrity Monitoring, Configuration Assessment (CIS benchmarks), Incident Response (automated active responses), Cloud Security (AWS, Azure, GCP), Container Security (Docker, Kubernetes), and compliance reporting for PCI DSS, HIPAA, GDPR, NIST, and SOC 2. As of 2026, the project has over 12,000 stars.