We made the switch from Elastic Endpoint to Wazuh for our production fleet about six months ago. The primary driver was cost—going from a substantial Elastic subscription to the open-source core of Wazuh brought our direct licensing spend to zero. On paper, it was a win for the budget.
However, the operational reality has been a stark trade-off. Our team dedicated to security monitoring and pipeline maintenance has essentially doubled. Where Elastic Endpoint gave us a consolidated, managed agent and a relatively turnkey data ingestion path into the Elastic stack, Wazuh requires us to build and maintain more of the plumbing ourselves.
Some specific friction points we're navigating:
* **Pipeline Complexity:** The Wazuh agent events flow into the manager, but then getting that data enriched, normalized, and into our data lake for broader analytics requires custom integration work. We're effectively building and owning a security event pipeline that was more implicit before.
* **Schema Management:** Keeping alert schemas consistent and managing updates across our custom integrations is now a manual process. I miss having a central schema registry for these security events.
* **Tuning Overhead:** The default rules are noisy. Tuning them for our environment and building reliable suppression logic is consuming significant analyst and engineer time.
The core tech is powerful, but it feels like we traded a managed service for a self-hosted data pipeline project. I'm curious if others have taken a similar path.
Has your team factored this "hidden" operational cost when moving from a commercial EDR to an OSS alternative like Wazuh? How are you managing the stream processing and data quality aspects of the alerts? I'm particularly interested in how you're handling the flow from detection into your SIEM or data lakes without it becoming a full-time data engineering job.
—Claire
I'm a security team lead at a 150-person SaaS shop. We've used both Elastic Endpoint and a Wazuh-based monitoring system in production over the last few years.
**Total Cost Range:** Elastic Endpoint cost us $45-$50 per endpoint annually. Wazuh's direct licensing cost is zero, but the operational lift was a team of 1.5 FTE for our 400-server fleet, effectively doubling our staffing cost.
**Deployment & Integration Effort:** Elastic Endpoint integrated in about two days with the existing stack. Wazuh manager setup took a week, but building the custom pipelines to parse and route alerts to our data lake took an additional 3-4 weeks of engineering time.
**Pipeline & Schema Ownership:** As you noted, Elastic provides a managed schema and normalized alert pipeline. With Wazuh, we spent roughly 20% of our maintenance time managing schema drift and updating our custom parsers for new agent versions.
**Break Point on Team Size:** The trade-off became clear around 200 nodes. Below that, Wazuh's overhead was manageable for one person. Beyond 200, the scaling wasn't linear and we needed dedicated pipeline oversight, which is when Elastic's model starts justifying its cost.
I'd recommend Wazuh if your team has dedicated security engineering resources and under 200 nodes. For teams above that size or without spare engineering cycles, Elastic Endpoint is the clear pick. To make it cleaner, tell us your exact node count and if your team can allocate a person full-time to pipeline maintenance.