Wazuh — Open Source XDR & SIEM Security Platform

What it is

Wazuh is a unified open-source security platform that combines SIEM (Security Information and Event Management), XDR (Extended Detection and Response), and cloud security posture management. It deploys a lightweight agent on endpoints to collect security events, detect threats, monitor compliance, and respond to incidents. The platform includes a centralized management server, an indexer for log storage and search, and a web dashboard for visualization.

Security operations teams, system administrators, and compliance officers who need threat detection, log analysis, and regulatory compliance monitoring across hybrid infrastructure use Wazuh as their primary security platform.

How it saves time or tokens

Commercial SIEM and XDR platforms carry significant licensing costs that scale with data volume and endpoint count. Wazuh provides equivalent capabilities at no licensing cost. The unified platform eliminates the need to run separate tools for intrusion detection, log management, vulnerability scanning, and compliance auditing. Pre-built rulesets cover common frameworks (PCI DSS, HIPAA, GDPR, NIST) out of the box.

How to use

1. Deploy with the official installer:

curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh
sudo bash wazuh-install.sh --all-in-one

1. Access the dashboard at https://your-server-ip with the generated admin credentials.
2. Install agents on endpoints:

# Debian/Ubuntu
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor -o /usr/share/keyrings/wazuh.gpg
echo 'deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main' | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt update && sudo apt install wazuh-agent

1. Configure the agent to connect to your Wazuh server and start it.

Example

<!-- /var/ossec/etc/ossec.conf -- Agent configuration -->
<ossec_config>
  <client>
    <server>
      <address>wazuh-server.example.com</address>
      <port>1514</port>
    </server>
  </client>

  <syscheck>
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/boot</directories>
    <frequency>43200</frequency>
  </syscheck>

  <rootcheck>
    <disabled>no</disabled>
  </rootcheck>
</ossec_config>

Related on TokRepo

• Security Tools -- explore security tools and platforms
• Monitoring Tools -- discover monitoring and observability solutions

Common pitfalls

• The all-in-one installer is suitable for small deployments. For production with high log volumes, deploy the manager, indexer, and dashboard on separate nodes.
• Default rules generate significant alert volume. Tune rule levels and exclusions to reduce noise before deploying to production endpoints.
• The Wazuh indexer (based on OpenSearch) requires adequate disk space for log retention. Plan storage based on your log volume and retention policy.