Wazuh

Wazuh is an open-source security monitoring platform: agents on hosts collect logs, file integrity data, and system state; a central manager correlates them against rules and raises alerts; and an Elastic-based interface presents the result.

The problem it solves is not detection on any single host. auditd, fail2ban, SELinux, and osquery all detect things locally and well. The problem is that nobody reads a hundred hosts’ logs. Per-host tooling produces per-host output, and beyond a handful of machines that output is not observed by anyone. Wazuh is the aggregation and correlation layer that makes it observable.

What aggregation makes possible

Correlation across hosts detects things no single host can see. A failed login on one machine is noise; the same source attempting logins across twenty machines within a minute is a pattern, and only the central view has it.

The other function is normalisation. Different services log in different formats, and Wazuh decodes them into a common structure so a rule can be written once rather than per log format. This is unglamorous and it is most of what makes central log collection useful rather than merely central.

File integrity monitoring, vulnerability detection against installed package inventories, and configuration assessment against benchmarks come built in — which is a reasonable amount of capability without assembling it from parts.

The honest costs

It is a substantial system to run. Manager, indexer, dashboard, and agents on every host. The Elastic stack underneath has real memory and storage requirements, and log retention grows quickly. This is infrastructure with its own operational burden, not a package to install.

Alert tuning is the entire project. Out of the box it generates far more alerts than anyone can review, and the failure mode is well known: alerts become noise, noise gets ignored, and the system produces the appearance of monitoring rather than monitoring. Getting to a tuned state takes sustained work and it is the difference between a SIEM that functions and one that exists.

I would not deploy it for a handful of hosts, where the effort is disproportionate. Across a fleet where the alternative is genuinely nobody looking, it changes the situation qualitatively.

See also: auditd, osquery, CrowdSec, rsyslog for the transport, and Linux administration in datacenters.