Self-hosted Microsoft Sentinel alternative for air-gapped networks

The cost depends on the written scope, not on a fixed package. The main components are the engineering and implementation effort, the hardware or virtual machines for the Wazuh indexer, server and dashboard, storage sized for your retention period, the agent rollout across endpoints, and the internal staff time your team spends on access, change approval and testing. Software licensing is not a line item because Wazuh is free and open source under GPLv2. Ask for a quote that separates one-time work such as design, installation, offline packaging and integration from recurring work such as upgrades, patch cycles and support. DeployOpen does not publish a price list. A quote follows from the written scope, which should state the number of endpoints, log sources, retention and the transfer process into the isolated network.

Endpoint count and log volume are the two largest sizing inputs. Agents run on Linux, Windows, macOS, Solaris, AIX and HP-UX, and agentless devices such as firewalls can send syslog. Each platform type adds packaging, testing and configuration work, and each additional source adds decoders or rules to review. The Wazuh server can run as a cluster for horizontal scaling, so larger estates may need more nodes. Ask for a sizing review that records events per second, retention period, alert volume and the number of distinct operating systems before any hardware is ordered.

A capable internal team can do it, but the work is more than installing packages. Teams usually need people who understand Linux administration, certificates, indexer tuning, agent deployment and change control, plus someone who owns the offline update process. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms in your own infrastructure, including isolated networks, and can work as a fixed-scope engagement or a retainer. Decide early which tasks stay in-house, such as day-to-day alert triage, and which need a partner, such as the first build, the transfer procedure and the first offline update cycle.

The duration depends on scope, the number of environments and how quickly approvals and transfer media can move through your accreditation process. No general timeline is supplied here, so treat any single number with caution. Phases that usually take the most time are the network and access review, building the offline media set, validating each package before it crosses the boundary, and agent rollout in change windows. Ask for a written plan with milestones, dependencies on your security and change boards, and the testing you expect before production sign-off.

Your staff need to provide access, approvals and operational knowledge. Expect requests for network diagrams, asset inventories, the list of log sources, retention requirements, identity and certificate standards, and named owners for change control. Security and compliance staff should confirm how software and patches are verified before entering the isolated network, which aligns with the supply chain control in NERC CIP-013-2 for utilities. Operations staff will be needed for agent deployment windows and for testing alerts against real activity. Agree these responsibilities in the written scope so that delays are visible.

Wazuh's offline installation guide covers systems without internet connectivity, so a deployment can be built and run without a live connection. The point to confirm is which features depend on outside services. Vulnerability detection normally correlates agent software inventory with data from the Wazuh Cyber Threat Intelligence platform, but it can use an offline vulnerability repository instead. Any feature that calls an external update or lookup service must be replaced or disabled in your design. Review the offline installation guide and the vulnerability detection documentation with your engineers before committing to an architecture.

Wazuh is free and open source and is distributed under the GNU General Public License version 2. The license includes an exception that permits linking with the OpenSSL library. In practice this means you can deploy and modify Wazuh without a per-GB or per-endpoint license fee, but you still need to meet GPLv2 obligations if you distribute modified copies. Have your legal or procurement team read the LICENSE file in the Wazuh repository and confirm how it applies to your internal use, any packaged builds you create for the isolated network, and any third-party components you add.

An offline vulnerability repository replaces the online Wazuh Cyber Threat Intelligence feed as the source of vulnerability data, so it only knows what it was given at the time of the last transfer. It will not reflect newer advisories until a new data set is imported, which means there is a lag between vendor disclosure and detection. It also depends on the accuracy of the software inventory that agents report, so unmanaged or unusual software may be missed. Confirm with your team how often the repository will be refreshed, who checks each import for integrity, and which assets sit outside agent coverage, since those need separate scanning.