Wazuh is an open source security platform that works as a SIEM and XDR: it centralizes the logs from all your servers and devices, detects threats in real time, monitors the integrity of critical files and generates automatic alerts. It's free, complies with standards like ENS and ISO 27001, and it's the most widely used option among SMBs that need real cybersecurity without paid licenses.
What exactly is Wazuh?
Wazuh is an open source security platform that combines the capabilities of a SIEM (Security Information and Event Management) and an XDR (Extended Detection and Response). This means it doesn't just collect and analyze security logs, it can also detect advanced threats and respond automatically to incidents.
In a typical business environment you have dozens (or hundreds) of servers, workstations, firewalls, applications and cloud services. Without a tool like Wazuh, monitoring the security of all of this is practically impossible.
Explainer video: What Wazuh is and how it works
What is Wazuh used for? The 6 key features
How does log centralization and analysis work?
Imagine having to review the logs of 50 different servers every day. Without Wazuh, you would have to connect to each server individually, browse raw log files (many in different formats), and manually search for suspicious patterns. This can take hours and is prone to human error.
With Wazuh, all the logs from all your devices are sent to a central point. You can:
- Search events across every server from a single dashboard
- Filter by specific criteria: user, IP, event type, date, severity
- Correlate events: detect that the same attacker is testing credentials on several servers
- Retain history: investigate incidents that happened weeks or months ago
Real savings: What used to take 2-3 hours reviewing logs server by server now takes 5-10 minutes from the centralized dashboard.
How does Wazuh detect threats in real time?
Wazuh continuously monitors the activity of your systems and compares it against databases of known threats and detection rules. For example:
- New exploits: If a vulnerability (CVE) is published that affects a package installed on your servers, Wazuh notifies you immediately
- Intrusion attempts: It detects SSH brute force, SQL injection, port scanning
- Known malware: It identifies malware signatures and malicious behavior
- Anomalous activity: Users connecting at unusual hours, from strange countries, or accessing resources they never use
Practical example: A critical exploit for Apache Log4j comes out at 10:00. By 10:15 Wazuh has already told you which servers run vulnerable versions and need an urgent update.
What is the SCA configuration monitoring module?
Wazuh's Security Configuration Assessment (SCA) module automatically reviews the configuration of your servers and compares it against official security benchmarks such as:
- CIS Benchmarks: Secure configuration guides for Windows, Linux, databases, etc.
- PCI-DSS: Requirements for companies that process card payments
- HIPAA: Regulation for healthcare data
- GDPR: Personal data protection in Europe
- ENS: Spain's National Security Framework (mandatory for companies working with Spanish public administrations)
The SCA generates reports with specific recommendations: "Server WEB-01 has SSH configured to allow direct root access. Recommendation: Disable PermitRootLogin in /etc/ssh/sshd_config".
How does vulnerability assessment work in Wazuh?
Wazuh keeps an up-to-date inventory of the software installed on each monitored device and cross-references it with databases of known vulnerabilities (CVE). This lets you:
- Detect ransomware and advanced threats in real time
- Identify outdated software with known vulnerabilities
- Prioritize patches: See which vulnerabilities are critical and which can wait
- Generate compliance reports for audits
What is Wazuh's File Integrity Monitoring (FIM)?
The File Integrity Monitoring (FIM) module watches critical system files and alerts you when they are modified, deleted or when their permissions change. This is crucial because:
- If you get hacked: Attackers often modify system files to persist (backdoors, rootkits)
- Unauthorized changes: An administrator changes configurations without documenting them
- Malware: Many ransomware strains change file extensions or delete backups
You can configure which directories to monitor: /etc/, /bin/, /usr/sbin/, configuration files of critical applications, etc.
Real case: An attacker gains access to a server and modifies /etc/passwd to create a hidden user. FIM detects the change immediately and generates a high-priority alert.
How does automated incident response work in Wazuh?
This is one of Wazuh's most powerful features. It doesn't just detect threats, it can react automatically:
- Isolate a machine from the network if it detects ransomware behavior
- Disable a user after multiple failed access attempts
- Block an IP on the firewall automatically
- Run custom scripts: Send an alert to Slack/Teams, create a ticket in Jira, etc.
- Integrate with external APIs: TheHive, MISP, VirusTotal, and more
All of this is configured through active response rules. For example: "If a user fails login 5 times in 2 minutes, block their IP for 30 minutes".
Related articles:
- AI for Threat Hunting in Wazuh: Installation Guide
- Monitoring Docker containers with Wazuh
- Wazuh + Elastic Security: Full SIEM setup
Need help with Wazuh?
Let us handle it with a professional implementation tailored to your environment.