Wazuh is an open source security platform that works as a SIEM and XDR: it centralizes the logs from all your servers and devices, detects threats in real time, monitors the integrity of critical files and generates automatic alerts. It's free, complies with standards like ENS and ISO 27001, and it's the most widely used option among SMBs that need real cybersecurity without paid licenses.
What exactly is Wazuh?
Wazuh is an open source security platform that combines the capabilities of a SIEM (Security Information and Event Management) and an XDR (Extended Detection and Response). This means it doesn't just collect and analyze security logs, it can also detect advanced threats and respond automatically to incidents.
In a typical business environment you have dozens (or hundreds) of servers, workstations, firewalls, applications and cloud services. Without a tool like Wazuh, monitoring the security of all of this is practically impossible.
Explainer video: What Wazuh is and how it works
What is Wazuh used for? The 6 key features
How does log centralization and analysis work?
Imagine having to review the logs of 50 different servers every day. Without Wazuh, you would have to connect to each server individually, browse raw log files (many in different formats), and manually search for suspicious patterns. This can take hours and is prone to human error.
With Wazuh, all the logs from all your devices are sent to a central point. You can:
- Search events across every server from a single dashboard
- Filter by specific criteria: user, IP, event type, date, severity
- Correlate events: detect that the same attacker is testing credentials on several servers
- Retain history: investigate incidents that happened weeks or months ago
Real savings: What used to take 2-3 hours reviewing logs server by server now takes 5-10 minutes from the centralized dashboard.
How does Wazuh detect threats in real time?
Wazuh continuously monitors the activity of your systems and compares it against databases of known threats and detection rules. For example:
- New exploits: If a vulnerability (CVE) is published that affects a package installed on your servers, Wazuh notifies you immediately
- Intrusion attempts: It detects SSH brute force, SQL injection, port scanning
- Known malware: It identifies malware signatures and malicious behavior
- Anomalous activity: Users connecting at unusual hours, from strange countries, or accessing resources they never use
Practical example: A critical exploit for Apache Log4j comes out at 10:00. By 10:15 Wazuh has already told you which servers run vulnerable versions and need an urgent update.
What is the SCA configuration monitoring module?
Wazuh's Security Configuration Assessment (SCA) module automatically reviews the configuration of your servers and compares it against official security benchmarks such as:
- CIS Benchmarks: Secure configuration guides for Windows, Linux, databases, etc.
- PCI-DSS: Requirements for companies that process card payments
- HIPAA: Regulation for healthcare data
- GDPR: Personal data protection in Europe
- ENS: Spain's National Security Framework (mandatory for companies working with Spanish public administrations)
The SCA generates reports with specific recommendations: "Server WEB-01 has SSH configured to allow direct root access. Recommendation: Disable PermitRootLogin in /etc/ssh/sshd_config".
How does vulnerability assessment work in Wazuh?
Wazuh keeps an up-to-date inventory of the software installed on each monitored device and cross-references it with databases of known vulnerabilities (CVE). This lets you:
- Detect ransomware and advanced threats in real time
- Identify outdated software with known vulnerabilities
- Prioritize patches: See which vulnerabilities are critical and which can wait
- Generate compliance reports for audits
What is Wazuh's File Integrity Monitoring (FIM)?
The File Integrity Monitoring (FIM) module watches critical system files and alerts you when they are modified, deleted or when their permissions change. This is crucial because:
- If you get hacked: Attackers often modify system files to persist (backdoors, rootkits)
- Unauthorized changes: An administrator changes configurations without documenting them
- Malware: Many ransomware strains change file extensions or delete backups
You can configure which directories to monitor: /etc/, /bin/, /usr/sbin/, configuration files of critical applications, etc.
Real case: An attacker gains access to a server and modifies /etc/passwd to create a hidden user. FIM detects the change immediately and generates a high-priority alert.
How does automated incident response work in Wazuh?
This is one of Wazuh's most powerful features. It doesn't just detect threats, it can react automatically:
- Isolate a machine from the network if it detects ransomware behavior
- Disable a user after multiple failed access attempts
- Block an IP on the firewall automatically
- Run custom scripts: Send an alert to Slack/Teams, create a ticket in Jira, etc.
- Integrate with external APIs: TheHive, MISP, VirusTotal, and more
All of this is configured through active response rules. For example: "If a user fails login 5 times in 2 minutes, block their IP for 30 minutes".
Frequently Asked Questions
Is Wazuh really free?
Yes. Wazuh is fully open source under the GPLv2 license, with no per-agent fees or paid tiers. You can monitor unlimited servers and endpoints without licensing costs; you only pay for the infrastructure you run it on or for optional professional support.
What is the difference between a SIEM and an XDR in Wazuh?
The SIEM side collects, stores and correlates logs to detect and investigate threats, while the XDR side adds extended detection and automated response across endpoints. Wazuh combines both in a single platform, so it not only finds threats but can also react to them automatically.
Which compliance standards does Wazuh help with?
Wazuh's Security Configuration Assessment (SCA) module audits your systems against CIS Benchmarks, PCI-DSS, HIPAA, GDPR and Spain's ENS framework. It produces reports with specific remediation steps, which is useful for passing audits.
How fast does Wazuh detect a new vulnerability?
Wazuh keeps a live inventory of installed software and cross-references it against CVE databases in near real time. When a critical exploit like Log4j is published at 10:00, Wazuh can flag the affected vulnerable servers within about 15 minutes.
Can Wazuh respond to incidents automatically?
Yes. Through active response rules Wazuh can block an IP on the firewall, isolate a machine, disable a user or run custom scripts. A common rule is to block an IP for 30 minutes after 5 failed logins in 2 minutes.
Related articles:
- AI for Threat Hunting in Wazuh: Installation Guide
- Monitoring Docker containers with Wazuh
- Wazuh + Elastic Security: Full SIEM setup
Need help with Wazuh?
Let us handle it with a professional implementation tailored to your environment.