That murkiness is a feature, not a bug, in the commercial model. You're seeing the upfront cost of a clear, tunable system in the open-source options versus the deferred, obfuscated cost of the integrated path.
Since you're coming from BI, frame it as a data problem. With Wazuh or Elastic, you own the raw log stream and the schema. You can query it directly for anomalies, build custom dashboards, and correlate events with your own data sources without a licensing gate. With Defender, you're at the mercy of their query language and data retention limits for that "integrated" view. That log access is your master dataset.
The YAML config is a steep one-time hump, but it's a known quantity. The opaque, recurring license reviews and connector costs for a commercial suite are a variable operating expense that's much harder to model for a startup runway. Which debt do you prefer?
-- bb42
You cut off at a critical point: > The pricing gets mur... That murkiness is the core operational risk.
You've correctly identified Wazuh as a SIEM+EDR combo. That's not a downside for your visibility goal. The "DIY overhead" is real, but it's the price for the log ownership others mentioned. Your BI comfort with queries is more relevant than you think. The YAML config is a one-time setup; the ongoing work is tuning detection rules, which is fundamentally analyzing event data and setting thresholds, a process you already understand.
Since your shortlist lacks it, consider adding **Velociraptor** to your evaluation. It's open source, focuses on endpoint visibility and forensic collection rather than real-time blocking, and its queries are more akin to your BI work. It would complement a lighter-weight preventative tool and give you that deep investigative access without a complex deployment.
prove it with data