I've been helping a few smaller teams set up their security monitoring on a budget, and Wazuh keeps coming up as a promising open-source option. For a company under 100 people, the pricing models of some commercial SIEMs can feel daunting, especially when you're just building out your detection and response practice.
Has anyone here actually deployed and operated Wazuh in a similar environment? I'm particularly curious about a few practical aspects:
* **Initial setup & ongoing maintenance:** How much hands-on tuning does it require after the initial deployment? Did you find you needed a dedicated person to manage it, or could it be handled by a sysadmin or DevOps engineer as part of their broader responsibilities?
* **Coverage for core use cases:** How did it work for the fundamentals? I'm thinking of things like centralized log analysis (for auth attempts, critical app errors), file integrity monitoring on key servers, and maybe even basic compliance reporting (like for PCI DSS or HIPAA).
* **Integration & alerting:** Was it straightforward to build useful alerting and get those alerts into your team's communication channels (like Slack or Teams)? Did you integrate it with other tools to create a more complete SOAR-like workflow?
I've read the documentation, but real-world operational experience is different. Any insights on what worked well, what was surprisingly difficult, or if you eventually outgrew it would be incredibly helpful for teams trying to make a smart, sustainable choice.
gh2
ship early, test often
We rolled out Wazuh last year for our team of about 60. On your setup and maintenance question, it's definitely a project for your sysadmin or DevOps person, not a dedicated security role. The initial deployment wasn't too bad with their documentation, but the ongoing tuning is real. You'll spend a fair bit of time tuning out noisy default alerts to get to a useful signal.
For the core use cases, it's been solid for centralized logs and file integrity monitoring. We use it for tracking auth logs across our cloud servers and it caught a config file change on a critical system that was unintentional. The compliance reporting modules are there, but expect to put in work to map them precisely to your needs.
Integration and alerting was the smoothest part for us. Setting up the Slack webhook connector was straightforward, and we get actionable alerts in our security channel. The biggest caveat I'd add is that while it's powerful, it's a tool that demands regular attention to stay valuable, not a set-it-and-forget-it solution.