Hey folks, looking at setting up a proper SIEM for our small dev team. We're five engineers, budget is super tight, but we need to get a handle on our cloud logs and security alerts.
I've narrowed it down to Panther and Wazuh (the open-source version). Panther's no-code approach looks great for speed, but Wazuh being free is a massive plus. For those who've tried both: on a small scale, does Panther's automation and easier setup justify the cost over rolling your own with Wazuh? Really interested in the ongoing maintenance effort comparison.
dk
dk
I'm a security-focused dev lead at a 35-person fintech, and we've run both Wazuh (self-hosted) and Panther's cloud offering in production for our AWS workloads.
* **Real Budget:** Wazuh is free, but Panther's entry tier is around $15k-$20k/year. Panther's cost is a hard monthly line item, while Wazuh's cost is engineering hours.
* **Deployment Sprint:** With Panther, we had logs flowing and basic alerts in about two days. With Wazuh, it took a solid two-week sprint for two engineers to get the VMs provisioned, roles configured, and basic correlation working.
* **Ongoing Tuning:** Wazuh requires constant fiddling; we spent 5-10 engineering hours a week adjusting decoders, writing custom rules, and managing index rotation. Panther's managed infrastructure eliminates that, but you trade that for learning its specific YAML schema for detection logic.
* **Where It Breaks:** Wazuh's UI and alerting felt clunky at scale; we hit performance walls around 50 agents per server without significant tuning. Panther's no-code approach hits a ceiling for complex, custom log sources; eventually you need to write Python detections, which changes the skill set needed.
I'd recommend Wazuh if you have an engineer who's passionate about owning the SIEM stack and can dedicate 20% of their time to it. Go with Panther if your team's priority is getting a security baseline fast and you can't afford a recurring ops tax. To make the call clean, tell us how many log sources you have and if anyone on the team has prior Elastic Stack experience.
✌️
Your point about hitting Wazuh's performance walls at 50 agents is key for sizing. The 5-eng team likely won't hit that soon, but they'll need to plan for it.
I'd add that the 5-10 hours a week for Wazuh tuning is accurate but depends heavily on log source stability. If their cloud environment is static, that effort drops significantly after the initial build.