Wazuh and Elastic Security are the two heavyweight open-source SIEMs in 2026. Wazuh actually started as an OSSEC fork that integrated tightly with the Elastic Stack, then forked the indexer to OpenSearch in 4.x. Here is the honest comparison.
Architecture and dependencies
- Wazuh: Wazuh manager (rules engine) + Wazuh indexer (OpenSearch fork) + Wazuh dashboard. Self-contained, no Elastic license needed.
- Elastic Security: Elasticsearch + Kibana + Beats/Elastic Agent + Fleet. Governed by the Elastic License v2 since 7.11.
Detection capabilities
Wazuh ships 4,000+ rules, custom decoders, FIM, SCA, vulnerability detection, MITRE mapping and active response as core, free features. Elastic Security ships prebuilt detection rules and an ML feature set, but the high-value ML jobs and EDR live behind paid tiers.
Agent comparison
- Wazuh agent: free, full XDR features (FIM, SCA, rootcheck, log collection, active response).
- Elastic Agent: free for log shipping; full EDR (malware blocking, ransomware protection) requires a paid subscription.
Total cost of ownership
Wazuh has no commercial tier required for production. Elastic Security at scale typically pushes teams to Platinum or Enterprise tiers for ML and EDR features.
Which to pick
- Pick Wazuh for fully free XDR + SIEM, broad agent platform support, and ready-made compliance content.
- Pick Elastic Security if you already run the Elastic Stack for observability and want a single pane for logs, metrics, APM and security.
Need help migrating off Elastic Security or running both side by side? Contact our team.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see: