Wazuh review
Broad security monitoring with free self-hosting and paid Wazuh Cloud plans.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Wazuh combines XDR and SIEM capabilities to monitor endpoints, cloud workloads, containers, and servers. It is aimed at security monitoring teams that want open-source software or a managed cloud option. The self-hosted software is free and open source; Wazuh Cloud has paid plans. Its remit extends beyond alerting to security event collection and analysis, vulnerability and malware detection, file integrity monitoring, configuration assessment, and compliance monitoring, making it a better fit for broader security operations than for teams seeking a standalone alert manager.
Alert generation uses rules and severity thresholds, with custom decoders and dynamic fields to add event context. Alerts can be forwarded to syslog, email, databases, and external systems. Listed integrations include MySQL, PostgreSQL, Slack, PagerDuty, VirusTotal, Shuffle, and Maltiverse. Dashboard-based visualization helps teams review indexed security data. This breadth suits teams that want collection, enrichment, and response within a security platform; teams whose central requirement is alert deduplication should look elsewhere, since deduplication is not a listed capability.
According to the vendor's pricing page, Wazuh Cloud's Small plan costs $571 per month for up to 100 active agents, with one month of indexed retention, three months of archive retention, and standard support. Medium costs $923 per month for up to 250 agents, three months indexed and one year archived retention, with standard support. Large costs $1,467 per month for up to 500 agents, the same retention as Medium, and standard support. These tiers make the paid service a substantial commitment for teams that only need general alert management. Choose Wazuh for open-source security monitoring or a wider XDR/SIEM workflow; consider an alternative if deduplication or lower-cost general alert handling is the priority.
Wazuh pros and cons
- Where it wins
- Collects and analyzes security events, then generates rule-based alerts
- Combines vulnerability, malware, file integrity, and compliance monitoring
- Forwards alerts to syslog, email, databases, and external systems
- Where it doesn't
- Wazuh Cloud starts at $571 per month
- Cloud retention and agent limits vary by plan
- No alert deduplication
Wazuh fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update