wazuh is a free, open source unified XDR and SIEM platform combining an endpoint agent, a central management server, and an integrated indexer for threat detection and response in authorized environments.

wazuh is one of the most widely deployed open source security platforms in the industry, and its repository at wazuh/wazuh reflects a mature, actively maintained C++ codebase with roughly 16928 stars. Where most tools covered here are offensive utilities, wazuh sits firmly on the defensive side of the house, and that alone makes it worth an operator's attention: understanding how a detection platform reasons about host telemetry is directly useful for anyone doing authorized red team work, purple team exercises, or detection engineering. The platform describes itself as a unified XDR and SIEM solution, which in practice means it spans endpoint telemetry collection, centralized rule-based analysis, indexed storage, and a visualization layer.

Architecturally, the README lays out three cooperating components. The first is the endpoint security agent, a lightweight multi-platform daemon deployed to monitored systems. The second is the management server, which collects and analyzes the data the agents gather. The third is the Wazuh Indexer, an integrated search engine and data visualization backend that lets analysts navigate security alerts. This agent-manager-indexer split is the classic pattern for scalable host monitoring, and it means detection logic can be centralized while collection remains distributed across on-premises, virtualized, containerized, and cloud environments.

On the endpoint side, the agent's intrusion detection capabilities are the most technically interesting part of the README. Agents scan monitored systems for malware, rootkits, and suspicious anomalies, specifically calling out detection of hidden files, cloaked processes, and unregistered network listeners — the traditional rootkit triad — as well as inconsistencies in system call responses. The syscall response check is a well-known anti-rootkit heuristic: it compares what the kernel reports through different query paths and flags divergence. For red teamers, this is a useful inventory of host-based tells; for defenders, it is baseline coverage that comes out of the box.

The server component complements agent-side scanning with signature-based log analysis. The README notes that the manager uses its regular expression engine to analyze collected log data for indicators of compromise, which is a descendant of the classic OSSEC rule-matching model. Rules are designed to surface application errors, misconfigurations, attempted or successful malicious activity, and policy violations. Agents read operating system and application logs and forward them securely to the central manager for this rule-based analysis and storage, and where no agent can be deployed, the server can still ingest data via syslog from network devices or applications.

File integrity monitoring is another core capability, and the README is specific about what is tracked: changes in content, permissions, ownership, and attributes of files you designate for monitoring. Notably, wazuh natively identifies the users and applications used to create or modify files, which elevates FIM from a binary change alert into attribution context. The README also points out that FIM satisfies explicit regulatory requirements, naming PCI DSS as an example, and that FIM data can be combined with threat intelligence feeds to flag compromised hosts.

Vulnerability detection follows an inventory-correlation model rather than active scanning. Agents pull software inventory data and send it to the server, which correlates it against continuously updated CVE databases to identify known-vulnerable software. This is a passive approach that avoids the disruption of authenticated network scanning, at the cost of depending on inventory accuracy. The framing in the README is explicitly preemptive: find weak spots in critical assets and take corrective action before attackers exploit them.

Configuration assessment extends the same scanning machinery into compliance territory. Agents perform periodic scans to detect applications that are known to be vulnerable, unpatched, or insecurely configured, measured against security policies, standards, and hardening guides. Checks are customizable to align with organizational baselines, and generated alerts include remediation recommendations and mapping to regulatory frameworks. The compliance story is rounded out with reporting and dashboards in the web UI covering PCI DSS, GPG13, and GDPR, with the README noting that payment processors and financial institutions use wazuh to meet PCI DSS requirements.

Incident response capabilities are where the platform gets closer to active operations, though always from the defender's seat. Agents provide out-of-the-box active responses that can execute countermeasures when defined criteria are met, such as blocking access from a threat source. The manager can also remotely run commands or system queries on agents to hunt for indicators of compromise and support live forensics. An operator running an authorized engagement should assume these active response hooks exist on any wazuh-managed host, since a tripwire rule can terminate a session the moment a detection fires.

Cloud and container coverage is treated as first-class rather than bolted on. Integration modules pull security data at the API level from AWS, Azure, and Google Cloud, with additional rules to assess cloud environment configuration and surface weaknesses. On the container side, the agent integrates natively with the Docker engine to monitor images, volumes, network settings, and running containers, and the README enumerates concrete runtime detections: containers running in privileged mode, vulnerable applications inside images, a shell running in a container, and changes to persistent volumes or images.

The software and libraries table in the README is unusually detailed and tells you a lot about implementation choices. Notable inclusions are libbpf and bpftool for eBPF-based instrumentation, the Linux Audit userspace for auditd integration, cPython 3.12.14 embedded for scripting, Lua 5.4.8, OpenSSL, libpcre2 powering the regex engine behind rule matching, and jemalloc for allocator performance under heavy event loads. The liblzma entry credits the upstream xz maintainers including Jia Tan, a quiet reminder that supply-chain scrutiny of your monitoring stack is itself a security task.

Deployment ergonomics are covered through a family of companion orchestration repositories maintained by the same team: wazuh-docker, wazuh-ansible, wazuh-chef, wazuh-puppet, wazuh-kubernetes, wazuh-salt, wazuh-bosh, and a dedicated AWS CloudFormation template. The README also warns that the main branch contains the latest code with possible bugs, so production rollouts should track tagged releases. The Wazuh WUI provides the management surface, with dashboard modules for security events, integrity monitoring, vulnerability detection, regulatory compliance, and agent fleet status.

For the authorized professional, wazuh earns its place in the toolkit from either direction. Blue teams get a genuinely capable open source XDR/SIEM stack without commercial licensing, spanning FIM, CVE correlation, compliance reporting, and cloud monitoring. Red and purple teams get a well-documented map of what a defender's telemetry looks like on the wire — agent log forwarding, syslog ingestion, syscall consistency checks, and Docker runtime alerts — which is exactly the knowledge needed to design engagements that are both realistic and respectful of the client's detection investment.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.