Wazuh: Open Source SIEM and Host Intrusion Detection
Wazuh is a security monitoring platform: agents on your machines, a server that correlates what they report, and a dashboard over the result. It covers the ground that would otherwise take several separate tools.
What the agents do
Log analysis. Collect and parse logs from the system and applications, matching against rules that fire alerts.
File integrity monitoring. Watch critical files and directories, alerting when something changes. This is how you notice a modified binary or an altered configuration.
Configuration assessment. Check the system against CIS benchmarks and report what fails, which turns hardening from a vague intention into a scored list.
Vulnerability detection. Compare installed package versions against vulnerability feeds.
Rootkit and anomaly detection. Look for the specific signs of compromise.
The honest assessment
Wazuh is capable and it is not lightweight. The server stack includes an OpenSearch-compatible indexer and the dashboard, and it wants real resources: several gigabytes of RAM at minimum, more as agents and retention grow.
It is also not a set-and-forget install. Default rules generate noise, and the work is tuning them until an alert means something. A Wazuh deployment nobody tunes becomes a dashboard nobody looks at, which is the same failure as any monitoring you do not alert on properly.
Who it suits
A homelab with several machines where you want file integrity monitoring and a real answer to “has anything changed.”
A small organisation needing compliance evidence, where the CIS benchmark scoring and audit trail are the point.
Not a single machine. For one server, CrowdSec and fail2ban plus attention to logs gives most of the value for a fraction of the operational cost.
Running it
Docker Compose is the practical path. Agents install on each monitored host and register with the server.
Plan storage before you start. Log retention is the thing that fills disks, and the indexer grows steadily.
License
Wazuh is released under the AGPL-3.0 License.