Analysis with context
Agents, Syslog and integrations feed decoders and rules. Acceptance must demonstrate interpretation, correlation and the alert destination.
WAZUH · OPEN SOURCE SIEM AND XDR
Wazuh for threat visibility and detection.
Centralize security events, track critical changes and investigate vulnerabilities with an open SIEM and XDR platform. Actual coverage depends on well-integrated sources, tuned rules and an operations team ready to act.
Add Solution assesses architecture, integrations, retention, security and acceptance criteria to build a project aligned with your infrastructure and risks.
COBERTURA COM CONTEXTO
Centralizing signals is the start. The engineering lies in turning them into useful evidence.
Wazuh combines log analysis, integrity monitoring, configuration assessment, inventory and vulnerability detection. The platform can form a central monitoring and investigation layer while retaining the specialized controls that each environment still needs.
Official configuration assessment example with checks, results, rationale, remediation and references. Features and coverage vary by version, policy, system and configuration.
FIM with a controlled scope
Hashes, attributes and changes in selected paths, with care around noisy directories and operating-system-specific limits.
SCA and configuration drift
Assessment policies guide remediation; they do not apply fixes or certify compliance on their own.
Inventory and vulnerabilities
Syscollector provides context and the module correlates software with known vulnerabilities, subject to source coverage and updates.
SIEM/XDR describes the platform's scope. It does not imply automatic equivalence with any EDR, antivirus, NDR or SOC service.
COMPONENTES E FLUXOS
Agents and sources send events; the server, indexer and dashboard play different roles.
The Wazuh server analyzes events and coordinates agents. Filebeat forwards alerts to the indexer; the indexer stores and searches; the dashboard provides investigation and administration. The server API has its own access flow.
The flow shows configured sources, Wazuh server, Filebeat, indexer connector, Wazuh indexer, dashboard and separate access to the server API. It omits clustering, load balancing, sizing, high availability and active response; it does not represent a deployment.
- FONTES
Agents, Syslog, clouds, applications and integrations according to validated coverage.
- WAZUH SERVER
Reception, decoding, rules, analysis and agent coordination.
- INDEXER
Indexing, search, retention and capacity sized according to the data.
- DASHBOARD
Queries, investigation and administration with controlled access.
CASOS DE USO
Detection quality depends on the source, parser, rule and test.
Receiving a log file is not enough. User, origin, outcome and time must be interpreted; positive and negative rules must be tested with sanitized samples.
Official log analysis example with events, rules, tactics and investigation details. Its usefulness depends on the environment's sources, parser, rules and tests.
Decoders and correlation
Consistent fields support custom rules and combinations of events within time windows.
Mapping, not complete coverage
Linking alerts to techniques helps investigation but does not prove complete coverage of a technique or campaign.
Automation with rollback
Actions require a target, exceptions, permissions, approval and rollback; a false positive can affect availability.
Conditional integrations
Reputation and enrichment require appropriate terms, curation and assessment of the data sent to the provider.
COLETA E COBERTURA
Not every source delivers the same context — and not every asset needs the same method.
Agents provide local telemetry; Syslog serves equipment; APIs and specific modules connect external services. Agentless covers bounded scenarios without automatically reproducing the agent's inventory, FIM and execution context.
Official File Integrity Monitoring example with changes, users, hashes and recent events. Coverage must not be extrapolated to any file, system or share.
Wazuh agent
Events, inventory, integrity and configurations vary by system and policy.
Syslog and devices
Normalization and rules determine whether a received message becomes evidence that can be investigated.
APIs and integrations
Permissions, API limits, latency, cost and scope must be included in acceptance criteria.
Custom parsers when needed
Feasibility depends on data access, a stable format and events that can represent the use case.
VOLUME, RETENTION AND CAPACITY
Sizing starts with events and the investigation horizon — not just the number of endpoints.
The project must measure daily growth, peaks, average size, indexed alerts, archived data, replicas and backups. High-volume sources can dominate storage and processing.
- FONTES
Which data comes in and at what rate.
- PICO
Variations and events per second.
- RETENTION
Searchable period and archives.
- REPLICAS
Availability and storage cost.
- BACKUP
RPO, RTO and tested restoration.
Retention without a policy can exhaust capacity. Deleting without validating requirements can eliminate necessary evidence.
PROTEGER A PLATAFORMA
A security platform also needs identity, segregation, encryption and secrets management.
TLS, certificates, RBAC, SAML, APIs and credentials must be treated as part of the project. Validation includes allowed and denied access, rotation and behavior when an identity dependency fails.
SSO and roles
Permissions for data, operations and agents must be combined and tested.
TLS and certificates
Flow protection, certificate lifecycle and trust between components.
Credentials and APIs
Least privilege, appropriate storage, rotation and an audit trail.
AUTOGERENCIADO OU WAZUH CLOUD
The deployment model changes responsibilities; it does not eliminate architecture and operational decisions.
With self-managed deployment, the team and infrastructure take on installation, upgrades, capacity, backup and recovery. With Wazuh Cloud, the managed offering simplifies part of the platform, but retention, limits, integrations, API access and the division of responsibilities must be checked against the purchased plan.
Control and responsibility
Topology, sizing, upgrades, security, observability of the platform itself and continuity remain within the customer/project scope.
Service subject to conditions
Capacity and features depend on the current offering; do not assume unrestricted access, infinite retention or operational equivalence.
ESCOPO DE ENGENHARIA
The project starts with the required coverage and ends with acceptance evidence.
Add Solution can structure discovery, architecture, integration, rules, retention, security, testing, documentation and operational handover. Each stage must be bounded according to the environment and the contracted service.
- DISCOVERY
Assets, sources, risks, owners and use cases.
- ARQUITETURA
Components, networking, capacity, security and continuity.
- INTEGRATION
Agents, Syslog, APIs, parsers and destinations.
- DETECTION
Rules, exceptions, severity and controlled automation.
- ACEITE
Positive and negative tests, failures and recovery.
- OPERAÇÃO
Runbooks, ownership, triage, escalation and evolution.
VERIFIED TECHNICAL CONTEXT
The research for this content was validated using Wazuh 4.14.8 as a reference on 23/09/2026 (DD/MM/YYYY).
A version is engineering context, not a permanent promise. Examples and “current” pages may differ; before deployment, confirm patch compatibility between core components, release notes, advisories and documentation for the actual version.
PERGUNTAS FREQUENTES
What needs to be clear before choosing and operating Wazuh.
Clear answers, with limits that prevent incorrect technical and commercial expectations.
Does Wazuh replace an EDR or antivirus?
Equivalence should not be assumed. Wazuh combines detection and response functions and analyzes events from protection tools, but runtime prevention, isolation, investigation and tamper protection must be compared and tested in the environment.
Does Wazuh already deliver a SOC?
The platform can support a SOC. People, hours, triage, escalation, containment authorization and response processes must be defined; installing the software does not automatically create a 24x7 operation.
Does Wazuh automatically remediate vulnerabilities?
The module identifies exposure to known vulnerabilities. Remediation depends on an update, configuration change or other approved treatment and must be verified at the source and in the inventory.
Do I need to install an agent on every device?
Not always. Syslog, APIs and agentless serve specific scenarios but do not automatically provide the same inventory, FIM and execution context as a compatible agent.
How much storage will I need?
It depends on volume, peaks, retained data, the searchable period, replicas and backups. A pilot should measure daily growth; estimating only by endpoints can undersize high-volume sources.
Can I use SSO and separate access?
SAML integration and role-based control are available. The design must combine permissions for data, operations and agents, including denied-access tests through the interface and API.
Can the platform operate without direct internet access?
There are options for restricted networks and an offline repository. The project must define updates for packages, intelligence and integrations; isolation does not keep threat data current without a feed.
Does clustering eliminate downtime?
No. Availability depends on the design and testing of each layer. Failure of a worker, master, indexer or identity provider has different effects.
Does Wazuh guarantee compliance with standards or the LGPD?
It can produce useful evidence and technical controls. Compliance also depends on purpose, governance, processes and assessment of applicable requirements; reports do not amount to certification or a legal guarantee.
How can I compare Wazuh's cost?
Consider infrastructure or subscription costs, storage, integrations, detection engineering and operations. Compare total cost with coverage, maintenance and the actual capacity to investigate alerts.
SOLUÇÕES RELACIONADAS
Security integrated with operations.
ADD SOLUTION + WAZUH
Turn security signals into an operable investigation capability.
Discuss sources, architecture, rules, retention, security, Wazuh Cloud and acceptance criteria for your environment.