Hey everyone, been working through a security platform evaluation for a client in the retail space (~500 stores, e-commerce presence). They're currently using a mix of point solutions and need to consolidate visibility, especially for PCI DSS and detecting suspicious internal activity. The budget points us towards the open-core/self-managed route.
Two contenders that keep coming up are **Elastic Security** (the SIEM/Endpoint features bundled with the Elastic Stack) and **Wazuh**. Both seem capable on paper, but the real-world operational fit is what I'm trying to nail down.
For a mid-market team with maybe 2-3 dedicated IT security folks, which one tends to be a more sustainable choice? I'm thinking about:
* **Onboarding & Daily Management:** How steep is the learning curve for building detection rules and maintaining the system? My team is good but not "PhD in Elasticsearch" good.
* **Retail-Ready Content:** Out-of-the-box rules for POS systems, file integrity monitoring for sensitive directories (like /etc/passwd or registry changes), and pre-built compliance mappings (PCI DSS especially).
* **The Cost of Scale:** We'll be ingesting logs from firewalls, endpoints, their Azure AD, and some on-prem servers. I've heard Elastic's data ingestion costs (if we go for paid features) can scale sharply. Wazuh being free up-front is attractive, but does that just shift the cost to heavier internal labor?
* **SOAR-lite Capabilities:** Basic automated response is a goal—like isolating an endpoint or blocking an IP on a firewall via a playbook. Which platform makes that more straightforward to implement without a ton of custom scripting?
Would love to hear from anyone who's operated both, or made a similar choice for a similar environment. Real-world gotchas and "I wish I'd known" insights are pure gold.
Cheers,
Billy
Always A/B test.