Wazuh has many valuable features including easy integration with other SOC tools, active response, endpoint security monitoring, malware detection, inventory, detection of hidden processes, and cloud security. In addition, it can collect terabytes of data quickly, it's open-source and free to use, and provides vulnerability assessment and scoring.
The customizable log configuration are also appreciated as are its dashboard and reporting, flexibility for cloud and on-premises use, syscheck, pile integrity monitoring, integration with AWS cloud-native services, and support for PCI DSS compliance. It can integrate with various operating systems and applications. The ELK for investigation and log monitoring and analysis tools are also highly regarded.
It also has built-in frameworks for compliance with industry standards.
- "Integrates with various open-source and paid products, allowing for flexibility in customization based on use cases."
- "The product is easy to customize."
- "One of the most beneficial features of Wazuh, particularly in the context of security needs, is the machine learning data handling capability."
Wazuh's configuration and integration capabilities could be improved, specifically with cloud applications. Scalability and false positives are also areas that need attention. Some users have experienced technical issues with the rules and agent upgrades. The solution is noted as resource-intensive and lacking security features, such as threat intelligence and vulnerability assessment plug-ins. Unix systems also pose a challenge for real-time monitoring.
Some users find Wazuh less user-friendly than other products and would like to see more built-in use cases.
- "Alerts should be specific rather than repeatedly triggered by integrating multiple factors. This issue needs improvement to create a more efficient alert system."
- "The tool does not provide CTI to monitor darknet."
- "They could include flexibility and customization capabilities by modifying for customers based on partner agreements."
