What you are evaluating
This profile covers the Wazuh platform rather than a guarantee of equivalent coverage to every commercial SIEM. Self-managed deployments require infrastructure and maintenance; managed cloud services have separate terms. Open-source licensing does not remove operating costs.
A useful evaluation context
Consider it for hands-on learning or environments that can support its operating model. Assess agent coverage, tuning effort and resilience requirements alongside the attraction of source availability.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Collect supported endpoint and log data through agents and configured integrations.
- Use rules and security monitoring functions such as file integrity and configuration assessment to identify relevant changes.
- Search and inspect the records behind alerts to distinguish expected administration from activity requiring investigation.
Where it fits in the work
- Deploy a training agent and verify that the central components receive the intended events.
- Configure a narrow monitoring rule and perform a harmless, documented change on the lab host.
- Investigate the alert and test collection failure, restoration and evidence retrieval before treating the lab as an operating service.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Monitor an explicitly chosen test file on a lab host, make a harmless change and record the expected alert behavior.
Evidence to look for
Show the file-change evidence, analyst interpretation and a successful repeat test. Stop the training agent and demonstrate a health-monitoring gap, then explain why no new alerts during that interval cannot prove the host was safe.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Who will patch, back up and scale the server, indexer and dashboard components?
- Which operating systems and telemetry types support the intended use cases?
- How will the team distinguish missing data from a quiet environment and retain evidence for the required period?
Names you may encounter: Wazuh SIEM. Historical names do not establish current availability or feature equivalence.