Wazuh is an open source security platform that unifies XDR (extended detection and response) and SIEM (security information and event management) capabilities in a single tool. It lets IT teams monitor endpoints, detect threats, respond to incidents, and meet regulatory frameworks from a centralized console, with no licensing costs.
For a CTO, CISO, or infrastructure manager who needs visibility into what happens across servers, workstations, and cloud environments, Wazuh solves a concrete problem: it brings the security information of the entire organization into one place, with automated response capabilities.
In this guide, updated for 2026, we explain how Wazuh works, what its components are, which use cases it solves, and why it is one of the most widely adopted platforms for security operations in Latin America.
What is Wazuh and what is it used for?
Wazuh is an open source platform that started as a fork of OSSEC in 2015 and has grown into one of the most complete security tools in the open source ecosystem. Its purpose is to give organizations a unified solution that covers intrusion detection, log analysis, file integrity monitoring, configuration assessment, and automated incident response.
What sets Wazuh apart from commercial platforms is its licensing model: it is completely free. That does not mean it is limited. According to Wazuh Inc., the platform protects more than 10 million endpoints worldwide, with deployments in industries such as banking, healthcare, government, and telecommunications.
Wazuh combines two functions that traditionally required separate tools:
-
XDR (Extended Detection and Response): collects data from multiple sources (endpoints, network, cloud) and correlates it to detect complex threats that no single source would reveal.
-
SIEM (Security Information and Event Management): centralizes security logs and events, indexes them, and enables advanced searches, real-time alerts, and audit reporting.
For companies in Mexico, Colombia, and Chile that work with limited security budgets but must comply with frameworks such as ISO 27001, PCI DSS, or the LFPDPPP (Mexico's federal personal data protection law), Wazuh is a viable alternative to commercial solutions that can cost tens of thousands of dollars a year.
Wazuh architecture: how it is built
Understanding the Wazuh architecture is key to sizing a deployment correctly. The platform is made up of three main components that work together.
Wazuh agent
The agent is a lightweight program installed on every device you want to monitor: Linux or Windows servers, workstations, virtual machines, or containers. The agent collects operating system events, application logs, file changes, and security configurations, and sends everything to the central server for analysis.
In version 4.14.0 (released in 2026), agents support hot reloading, which lets you update their configuration without restarting the service. This reduces downtime windows in production environments.
Wazuh server (Manager)
The Manager is the brain of the platform. It receives data from all agents, processes it against a set of rules and decoders, and generates alerts when it detects suspicious activity. It also runs active responses, such as blocking an IP address or stopping a compromised process.
The Manager stores the detection rules (more than 3,000 predefined), manages agent configuration centrally, and exposes a REST API for integrations with third-party tools.
Indexer and dashboard
Wazuh uses an indexer based on OpenSearch (a fork of Elasticsearch) to store and search events. The web dashboard lets you view alerts, explore logs, build custom panels, and generate compliance reports. Since version 4.14.0, the dashboard includes expanded endpoint inventories covering browser extensions, active services, and system users.
Key Wazuh capabilities
Threat and intrusion detection
Wazuh analyzes the events collected by agents and compares them against detection rules that identify malicious patterns. It can detect brute force attempts, privilege escalation, lateral movement, and techniques such as Living off the Land (LOTL) attacks, where attackers use legitimate system tools to avoid detection.
Rules are customizable. You can write your own rules to cover in-house applications or scenarios specific to your industry. This is especially useful in sectors such as finance, where attack patterns have distinct characteristics.
File integrity monitoring (FIM)
The FIM (File Integrity Monitoring) module watches for changes to critical system files and directories. If someone modifies a configuration file, alters a system binary, or tampers with logs, Wazuh raises an alert immediately.
Since version 4.12.0, FIM supports eBPF (Extended Berkeley Packet Filter) on Linux, which enables real-time detection directly from the operating system kernel, including which user and which process made each change.
Security configuration assessment (SCA)
Wazuh includes an SCA (Security Configuration Assessment) module that checks whether systems follow the security best practices defined by the CIS (Center for Internet Security) benchmarks. This helps identify insecure configurations, such as unnecessary services left enabled, excessive permissions, or weak password policies.
Vulnerability detection
Wazuh compares the software inventory of each endpoint against databases of known vulnerabilities (CVEs). The Wazuh CTI (Cyber Threat Intelligence) service, officially launched in 2025, aggregates data from vendors such as Microsoft, Red Hat, and Canonical, as well as the NVD (National Vulnerability Database), and normalizes it into a standard format so security teams can prioritize patches with real exploitability context.
Active response and automation
When Wazuh detects a threat, it can run predefined automatic actions: block an IP on the firewall, terminate a session, stop a process, or run a custom script. These actions are configured as active responses and can contain incidents in seconds, with no human intervention.
For teams that operate with limited resources or do not have a dedicated 24/7 SOC, this automation capability is critical to shorten the time between detection and containment.
Wazuh for regulatory compliance
One reason Wazuh has gained adoption in Latin America is its native ability to map security events to regulatory frameworks. The platform includes preconfigured dashboards and rules for:
-
PCI DSS: access controls, integrity monitoring, protection of cardholder data.
-
ISO 27001: risk management, access control, continuous monitoring.
-
NIST 800-53: security controls for federal information systems, adopted as a reference in Mexico and Colombia.
-
GDPR / LFPDPPP: personal data protection, detection of sensitive information exposure.
-
HIPAA: security of health information.
The Wazuh compliance dashboard shows the status of each control in real time, which alerts are linked to each requirement, and what percentage of coverage the organization has. This makes preparing for compliance audits in LATAM significantly simpler.
Wazuh use cases in enterprise environments
Wazuh as an open source SIEM
Many mid-sized companies in Mexico adopt Wazuh as their primary SIEM, replacing expensive commercial tools. The combination of log collection, event correlation, real-time alerts, and indexed search covers the core requirements of an enterprise SIEM without licensing.
Wazuh in Windows and Active Directory environments
Wazuh integrates with Windows environments and Microsoft Entra ID (formerly Active Directory) to monitor authentication events, group policy changes, privileged account modifications, and suspicious activity on domain controllers.
Wazuh in the cloud
The platform supports deployments on Azure, AWS, and Google Cloud. Since version 4.14.0, it includes a dedicated panel for the Microsoft Graph API that lets you monitor security events in cloud services such as Azure and Microsoft 365, with event geolocation and CSV export.
Wazuh as a SOC component
At TecnetOne, Wazuh is one of the core components of our SOC as a Service. We use it as the detection and correlation engine within a managed security operation that includes continuous monitoring, incident response, and compliance reporting for clients in industries such as fintech, healthcare, and manufacturing.
Our methodology combines Wazuh's native capabilities with custom detection rules for the Latin American context, regional threat intelligence, and SLA-defined escalation processes, turning an open source tool into a managed security service with a defined scope and shared responsibility.
Wazuh vs. commercial security platforms
The most common question among IT teams is whether Wazuh can replace commercial tools such as Splunk, IBM QRadar, or Microsoft Sentinel. The answer depends on the context:
-
Where Wazuh stands out: zero licensing cost, full customization flexibility, on-premises or cloud deployment, an active community with frequent updates (four major releases in 2024-2026), and support for multiple operating systems, including ARM since version 4.12.0.
-
Where commercial platforms have the edge: premium support with a guaranteed SLA, native integrations with proprietary ecosystems (Sentinel with Azure, QRadar with IBM), and a lighter operational maintenance burden.
For companies that want Wazuh's capabilities without taking on the operational burden of running it in-house, a managed Wazuh model for businesses is the most practical option.
Recent Wazuh versions
Wazuh keeps a steady release cadence. The most relevant versions of the last two years include:
-
Wazuh 4.12.0 (2025): support for ARM architecture, FIM with eBPF, CTI integration in vulnerability detection.
-
Wazuh 4.13.0 (2025): IT hygiene dashboard, live reloading of rules and decoders without restarting the Manager, restriction of UNC paths on Windows to prevent exposure of NetNTLMv2 hashes.
-
Wazuh 4.14.0 (2026): expanded endpoint inventory (browser extensions, services, users, and groups), Microsoft Graph API panel, hot reloading of agent configuration.
You can find the details of each version in our dedicated articles: What's new in Wazuh 4.14.0.
Frequently asked questions about Wazuh
Wazuh is an open source security platform that combines XDR and SIEM capabilities in a single tool. It lets you monitor endpoints, detect threats, automate incident response, and generate regulatory compliance reports with no licensing costs.
Yes. Wazuh is distributed under the GNU General Public License v2. There are no license fees per agent or per data volume. The associated costs are infrastructure (servers for the Manager and indexer) and operations (staff to manage it).
Wazuh offers functionality comparable to a commercial SIEM (event correlation, alerts, dashboards, compliance) with no license cost. The main difference is that it requires an in-house team or a managed provider to operate it, while commercial SIEMs usually include premium support.
Yes. Wazuh can be deployed on Azure, AWS, and Google Cloud. It can also monitor native cloud services such as Azure AD (now Microsoft Entra ID), AWS CloudTrail, and Google Workspace through dedicated integrations.
Not directly. Wazuh is a detection and response platform, not a traditional antivirus. However, it integrates with endpoint protection solutions such as Microsoft Defender and Sophos, correlating their alerts within a unified view of security.
Yes. Wazuh includes preconfigured dashboards and rules for PCI DSS, ISO 27001, NIST 800-53, GDPR, HIPAA, and other regulations. It automatically maps security alerts to the controls of each framework, making audit preparation easier.
Microsoft Cloud and Cybersecurity expert with more than a decade of experience in the technology industry. He is recognized for his extensive knowledge in implementing cloud-based solutions and protecting data and systems against cyber threats. As a leader and speaker, Gustavo continues to share his knowledge and best practices at technology events and training programs.
