Wazuh
The open-source SIEM and XDR platform — free under GPLv2 with no agent cap, no ingestion meter and no feature paywall. What you buy is operation: Wazuh Cloud runs it for you, Professional Support backs the deployment you run yourself — air-gapped included. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Two intel pages. One free platform, two ways to run it.
The complete Wazuh offering — every linked card is a full intel page, from the managed edition to support for the deployment you run yourself.
Wazuh Cloud
The whole platform run for you, priced by agent.
Wazuh runs the manager, indexer, dashboard and upgrades; the 100, 250 and 500-agent tiers differ only in capacity and retention.
Wazuh Professional Support
You keep the cluster; the vendor is accountable.
Self-hosted or air-gapped: Standard is 8/5 with an eight-hour SLA, Premium 24/7 on critical issues; quoted per environment.
The open-source platform
Platform & engineFree under GPLv2 — not a purchase, so not a product page
Agentic AI patterns
Platform & engineEmerging: AI-generated decoders tested through logtest
Wazuh is one of 35 SIEM & log management products TechBag carries. The Security guide shows how the category splits and which part is yours. →
Why “the licence is free, the system is not” is the whole story
Almost every SIEM meters you on the thing you most need to do — collect security data — so the budget conversation quietly becomes an argument for logging less. Wazuh removes that meter entirely: the core is free under GPLv2, with no agent cap and no feature paywall— the detection engine, compliance mappings, vulnerability detection and active response are all in the free core, not held back for an enterprise edition. What Wazuh sells is not features but the removal of operational burden: Cloud runs the cluster for you, Professional Support makes the vendor accountable for the one you run yourself. The honest consequence is that your real cost is infrastructure plus engineering time, which at Indian salaries lands close to the subscription you were avoiding — so choose self-hosting for sovereignty, control or scale, not for a saving that may not exist.
One agent across a genuinely mixed estate
One agent covers Windows, Linux, macOS, Solaris, AIX, HP-UX, containers and cloud, collecting far more than syslog. Mixed Indian estates avoid a real integration tax.
Detection logic you can actually read
Decoders structure raw logs and rules turn them into MITRE ATT&CK-mapped alerts. Both are plain, editable files, so detection is inspectable for auditors and portable if you leave.
Compliance and configuration assessment, continuously
Configuration assessment checks endpoints against CIS benchmarks continuously, mapped to PCI-DSS and HIPAA. Self-hosted, it meets CERT-In’s 180-day log rule.
Vulnerability detection that survives an air gap
The agent inventories packages and matches them to CVE feeds without network scans. Feeds can be loaded offline, so vulnerability detection keeps working air-gapped.
The licence is free; the system is not
The core is free; infrastructure and engineering are not. At 250 agents self-hosting costs about the same as Cloud. It wins above about 500 agents or under an air-gap mandate.
Start with who operates it — Wazuh Cloud if nobody on your team should run an indexer cluster, Professional Support if a mandate keeps the platform on your infrastructure.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Cybersecurity Stars Awards 2026
Double winner: Best SIEM and Best Cloud Security
15 million+ endpoints
Vendor-reported deployment scale
100,000+ organisations
Among the largest install bases in SIEM
Bootstrapped since 2015
No VC funding at 200+ staff — unusual, and reassuring
Gartner Peer Insights 4.4/5
Across roughly 40 verified SIEM reviews
G2 4.5/5
Around 65 reviews as of early 2026
PCI-DSS and SOC 2
Attestations covering the managed Cloud platform
Air-gap capable
Documented offline install and offline CVE feeds
The company in six figures
See the platform, hear the pitch
Wazuh — the open source security platform
The platform, explained by Wazuh.
Introducing Wazuh 4.8
What a major Wazuh release brings.
Where Wazuh sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Wazuh Across Its Platform
Each dot is a Wazuh product: competitive position vs category momentum.
Managed — all-in per agent, no feature tiering.
The Depth × Flexibility Map
Analytical depth vs how freely you can deploy the platform and control what it costs.
Free core, air-gap capable, real commercial support behind it.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Wazuh?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. Where must the platform run?
2. What does your team look like?
3. How many agents?
SIEM, XDR, and why Wazuh is sold as both
What each term covers, where they overlap, and why one agent-plus-manager architecture can legitimately claim both.
Read →What 'free and open source' actually costs
Separating the licence line from the infrastructure and engineering lines — and why only the first is zero.
Read →Reading the Cloud tiers properly
Agents versus retention, indexed versus archive — and which of the two usually forces the upgrade first.
Read →CERT-In's 180 days, and where your logs sit
The rolling retention rule, the Indian-jurisdiction requirement, and how a deployment satisfies them.
Read →Air-gapped Wazuh, done properly
Offline installation and offline CVE feeds — why a vulnerability module that stops updating is worse than none.
Read →Wazuh vs Elastic vs Log360
The honest matrix — completeness out of the box against analytical depth against India-built commercial support.
Read →The acronym decoder
Every term on these pages, in one place- Agent
- The lightweight collector installed on each endpoint; ships logs, inventory and integrity events to the manager.
- Manager
- The central server that decodes, correlates and applies rules to everything agents send.
- Indexer
- The search and storage layer for processed events; usually the biggest driver of cost and ops effort.
- Decoder
- A file that parses a raw log line into named fields so rules can act on it. Plain text you can read and edit.
- Rule
- The correlation logic turning decoded fields into an alert, with a severity level and a MITRE ATT&CK mapping.
- FIM
- File Integrity Monitoring — continuous watching of critical files and registry keys for unauthorised change.
- SCA
- Security Configuration Assessment — scanning endpoints against hardening benchmarks such as CIS and reporting drift.
- Active Response
- An automatic endpoint action when a rule fires, such as blocking an IP or quarantining a file.
- Indexed retention
- How long events stay hot and directly searchable in the dashboard. One month on Cloud Small, three on Medium and Large.
- Archive retention
- Colder, cheaper storage that is not instantly searchable: three months on Small, a year on Medium and Large.
- Air-gapped deployment
- A fully disconnected installation with no internet path, using offline packages and offline CVE feeds.
- GPLv2
- The licence covering Wazuh's core, granting free use and modification with no agent cap and no feature paywall.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Count agents and name your constraint
Count every endpoint, server, container and cloud workload needing an agent, and state whether SaaS is allowed. That answer rules out about half the market.
Decide the deployment model before the vendor
Pick Cloud, supported self-hosting or unsupported self-hosting by your ops capacity and mandate. The licence is zero either way.
Run the 14-day Cloud trial with real sources
No card needed. Point real production log sources at it and measure alert volume and noise on your actual estate before any sales process.
Price both paths over three years
Compare Cloud against infrastructure plus the engineering time self-hosting takes. At Indian salaries and 250 agents they come out roughly level.
Test retention against your obligation
Check indexed and archive retention against CERT-In’s rolling 180 days and sector rules. Retaining and investigating need different tiers.
Get the residency answer in writing
Wazuh Cloud offers Mumbai (AWS ap-south-1), fixed once created. Pick it at sign-up and get storage terms in writing; TechBag adds them to the quote.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| The core platform | Free under GPLv2 | Download and self-host — no purchase at all | Teams with spare platform capacity |
| Wazuh Cloud | Per agent-count tier, all-in (infrastructure + operations + Standard support) | 14-day trial, no card; tiers at 100, 250 and 500 agents | Up to ~500 agents, no platform engineer |
| Professional Support | Bespoke annual contract, quoted per environment; Standard or Premium by SLA | Standard (8/5, 8-hour SLA) or Premium (24/7 critical, 4-hour SLA) | Self-hosted or air-gapped by mandate |
The licence is zero on every row. What you pay for is operation: Cloud folds infrastructure and running it into one agent-count tier, and Professional Support is quoted per environment with no published list. On the self-hosted path the cost that surprises is your engineers’ time, not the licence. TechBag models both paths and quotes in INR with GST.
Five pitfalls that cost buyers quarters
Budgeting the licence at zero and stopping there
The licence is zero; the indexer, storage, upgrades and on-call are not. At Indian salaries 0.3-0.5 FTE costs several lakh a year, about the subscription you avoided.
Sizing on agent count and ignoring retention
Cloud tiers cap agents, but indexed retention is one month on Small and three on Medium and Large. With 80 agents and a 180-day obligation, retention may force the tier. Read that column first.
Assuming self-hosting automatically satisfies residency
Self-hosting gives you control over where data sits, not proof. Put the indexer in Indian jurisdiction and be able to show it; control is a precondition for compliance.
Confusing support with a managed service, or with MDR
Professional Support helps while you run it; Cloud means Wazuh runs it; MDR means someone watches and responds to alerts, which Wazuh does not sell. Know which one you are buying.
Underestimating tuning
Wazuh’s broad collection makes week one noisy, and untuned alerts go unread. Name the person and weeks for tuning before you buy; deployments fail here more than on technology.
The evaluation kit
Each product intel page carries a buyer checklist and a cost model:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directional synthesis of public analyst forecasts for the categories Wazuh competes in; verify exact figures before relying on them. Open-source security is the fastest line — the segment Wazuh sits in.
Open source displacing per-GB SIEM
Ingestion pricing punishes you for collecting security data.
What it means for you
Free-core platforms with paid operations are taking share on that argument alone.
CERT-In's 180 days driving purchases
Almost every Indian organisation must keep 180 days of logs within Indian jurisdiction, forcing a log-platform choice.
What it means for you
Decide whether you must keep or search 180 days of logs; it sets your tier or storage.
Residency mandates ruling out cloud-only SIEM
As RBI, SEBI and IRDAI expectations sharpen, the shortlist of SIEMs a regulated Indian buyer can legally deploy keeps shrinking.
What it means for you
A platform you can self-host keeps you on the shortlist whatever the regulator decides next.
SIEM and XDR consolidating
Buyers want SIEM and XDR as one purchase, favouring platforms built as one rather than acquired.
What it means for you
One agent and one manager doing both means fewer integrations to own and fewer consoles to watch.
Agentic AI for detection engineering
Wazuh has begun publishing patterns for AI-generated decoders tested through logtest.
What it means for you
Emerging rather than shipped — treat it as direction, not capability.
Managed subscriptions as ops costs surface
Teams that self-hosted to save on licence are moving to managed once they price the engineer honestly.
What it means for you
The licence was never the cost.
Questions buyers ask about Wazuh
Ready to shortlist Wazuh?
Open any of the three intel pages for the deep dive, or let a TechBag advisor build the case with you — Cloud-versus-self-hosted TCO at Indian salaries, retention sized to your obligation, the residency answer in writing, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.