Wazuh
Comparisons anchored on Wazuh, the GPL-2.0 XDR and SIEM platform: against Elastic Security, its OSSEC ancestor, Security Onion, Graylog and plain OpenSearch.
SIEM and security monitoring
Head-to-head comparisons of self-hosted log management, SIEM and host intrusion detection platforms: licensing, editions, storage architecture and the operating effort each one needs.
OpenSearch
Comparisons anchored on OpenSearch, the Apache-2.0 search and analytics engine forked from Elasticsearch 7.10, as a log and SIEM backend.
Graylog
Comparisons anchored on Graylog, the log management platform whose free Graylog Open edition is SSPL licensed and therefore not OSI open source.
Security Onion
Comparisons anchored on Security Onion, the free Linux distribution for threat hunting, network security monitoring and log management from Security Onion Solutions, published under the Elastic License 2.0.
Suricata
Comparisons anchored on Suricata, the GPL-2.0 network IDS/IPS and network security monitoring engine owned by the non-profit OISF: against Snort and Zeek.
Zeek
Comparisons anchored on Zeek, the BSD-licensed passive network traffic analyzer used for network security monitoring: against Snort.
Velociraptor
Comparisons anchored on Velociraptor, Rapid7's AGPL-3.0 endpoint visibility and digital forensics platform: against osquery and Google's GRR Rapid Response.
SIEM and security monitoring compared
Roundups of the self-hosted SIEM and network monitoring options, each comparing three or more open-source platforms on license, coverage and operating cost.
Elastic Security
Comparisons anchored on Elastic Security, the SIEM and endpoint security solution on Elasticsearch and Kibana: against OpenSearch Security Analytics, and between its tiers, hosting models and deployment options.
CrowdSec
Comparisons anchored on CrowdSec, the MIT-licensed security engine with separate remediation components and a crowdsourced blocklist: against Fail2ban, and between its free and paid plans and deployment models.
Falco
Comparisons anchored on Falco, the Apache-2.0 CNCF graduated runtime security tool: against Tetragon and Tracee, and between its eBPF and kernel module drivers.
