Wazuh

Wazuh is an open‑source security information and event management (SIEM) and host‑based intrusion detection system (HIDS) that builds upon the OSSEC project. It provides real‑time monitoring, log analysis, integrity checking, rootkit detection, vulnerability detection, compliance reporting, and active response capabilities. The platform is written primarily in C for the engine and Python for extensions, and it can run on Linux, Windows, macOS, FreeBSD, and other Unix‑like systems.

The core of Wazuh is the agent that runs on each monitored host. Agents collect system logs, file integrity data, and other indicators, then send this information to the Wazuh manager over a secure channel. The manager aggregates data, performs correlation and analysis, and can trigger active responses such as firewall rules or script execution. Optional components include an Elasticsearch cluster for scalable storage, a Kibana interface for visualization, and the Wazuh API for automation. The architecture emphasizes modularity, allowing customers to scale from local installations to large, distributed environments.

Wazuh supports a variety of use cases. It is widely used for compliance with regulations such as PCI‑DSS, HIPAA, GDPR, and NIST, providing pre‑built policy templates and audit reports. Security teams also use it to detect malware, privilege escalation attempts, unauthorized file changes, and other threats. The project enjoys an active community that contributes rules, configurations, and integrations, and it is maintained by Elastic, the company behind the Elastic Stack.

Because it is distributed under a permissive license, organizations can deploy Wazuh free of charge or opt for commercial support and services. The platform has grown from its OSSEC roots in 2015 and remains a key component of many modern security operations centers.