Wazuh vs Elastic Security vs Security Onion: which to choose

Which SIEM fits your situation: Wazuh, Elastic Security or Security Onion

If your priority is endpoint-first monitoring, Wazuh is the platform on this shortlist built around host agents, with file integrity monitoring, active response and vulnerability detection on Linux, Windows and macOS endpoints. If you already run an Elastic estate and want detections, cases and endpoint prevention on the same stack, Elastic Security is the natural fit, provided you accept that several capabilities sit in paid Elastic tiers. If your gap is network visibility, Security Onion brings Suricata, Zeek and full packet capture into one distribution, and it suits teams that need to see traffic on the wire before they see endpoints. Licensing is the first filter to run. The Wazuh server and agent are licensed under GPL-2.0 with an OpenSSL linking exception, and the Wazuh indexer and dashboard are Apache-2.0. Elastic Security runs on Elasticsearch and Kibana, which are available under the Elastic License 2.0 by default, with SSPL 1.0 and AGPLv3 also offered for source code. Security Onion is published under the Elastic License 2.0, which is source-available rather than OSI approved. Ask counsel to confirm how ELv2 terms apply to your intended use, especially if you plan to offer the service to others.

These three options are not mutually exclusive. Many teams run Wazuh agents for endpoint coverage and deploy Security Onion sensors for network traffic, and the Wazuh documentation describes a Suricata integration for exactly that pairing. Before you commit, confirm with each vendor which features your edition includes, and check your own hardware and staffing against the documented minimums for each platform.

Which platform fits which scenario

This table matches each common scenario to the platform that fits it best and the condition under which that fit holds. Read it as a starting filter: confirm the conditions in the right-hand column against your own estimates for endpoints, traffic, licensing and staffing before you shortlist.

Scenario	Best fit	Why, and the condition that makes it hold
Endpoint-first SIEM with compliance dashboards	Wazuh	Agents run on Linux, Windows, macOS, Solaris, AIX and HP-UX, the ruleset ships over 3,000 rules mapped to MITRE ATT&CK, and the dashboard has prebuilt PCI DSS, GDPR, HIPAA and NIST 800-53 views. Holds if host visibility is the priority and you accept building network sensing separately.
Network-first monitoring with packet capture	Security Onion	Bundles Suricata, Zeek, Strelka and full packet capture in one distribution. Holds if you can staff sensor placement and hardware, and if you accept the Elastic License 2.0 terms for the distribution.
Existing Elasticsearch estate	Elastic Security	Runs on the Elasticsearch and Kibana you already operate, with SIEM detections, Timeline and Cases. Holds if you already license the required tier, since prevention, host isolation and SSO sit in Enterprise and Platinum is closed to new buyers.
OpenSearch-based team	Wazuh	The Wazuh indexer is an OpenSearch fork, so the search layer matches your skills, and agents and rules come included. Holds if you want a turnkey detection layer; if you need Sigma-only analytics on OpenSearch, compare OpenSearch Security Analytics instead.
Air-gapped deployment	Wazuh or Security Onion	Wazuh documents an offline installation guide and an offline vulnerability repository. Security Onion's ISO carries packages and NIDS, YARA and Sigma rules with airgap updates. Holds only after you confirm the update workflow and rule refresh process for your enclave.
Team that must avoid ELv2 terms	Wazuh	Server and agent are GPL-2.0 with an OpenSSL linking exception, and the indexer and dashboard are Apache-2.0. Holds if OSI-approved licensing is a policy requirement; confirm with counsel how the Wazuh Cloud and paid services terms apply to you.
Team that needs endpoint prevention and host isolation	Elastic Security	Malware and ransomware prevention, host isolation and SAML or OIDC SSO are listed under Elastic's Enterprise tier. Holds if you will buy that tier; Wazuh offers active response and file integrity monitoring but is not a prevention-and-isolation product by default, so confirm needs in a proof of concept.

How the search backend shapes each platform

The search backend decides how each platform stores alerts, how it scales and what breaks when one component fails, so it belongs in the shortlist decision and not just the architecture review. Wazuh bundles its own Wazuh indexer, which the Wazuh documentation describes as an open source fork of OpenSearch, and the Wazuh server analyzes agent data with decoders and rules before alerts reach that indexer. Elastic Security runs on Elasticsearch and Kibana, distributed under the Elastic License 2.0 by default, so the search layer and the detection layer come from the same vendor stack. Security Onion bundles Elasticsearch together with Suricata, Zeek and Strelka in one distribution, which means your network telemetry, file analysis and log search share a single backend that you must size as a unit. These are not interchangeable search layers, and you should not assume that skills or tuning knowledge transfer cleanly between them.

The most important operational difference is failure behavior. In a Security Onion distributed deployment, the manager node, sensor nodes and search nodes depend on each other. The Security Onion architecture documentation notes that if the manager goes down, search nodes stop indexing because they cannot reach Redis. Ask your team to test that failure in a non-production environment and to define how long a manager outage can last before missed telemetry becomes a compliance or incident-response gap. Wazuh offers a different scaling path: the Wazuh server can run as a cluster for horizontal scaling, and the indexer can be deployed as a multi-node cluster. Confirm which components your chosen Wazuh deployment type includes, because the quickstart sizing and the HA design are separate decisions.

Before you commit, map each backend to the team that will operate it. Ask Wazuh whether your target endpoint count and retention need a clustered server and indexer, and ask Elastic or Security Onion Solutions how they expect search nodes to be patched and sized alongside the detection layer. Plan for indexer storage growth as a recurring cost, because it scales with event volume and retention, not with license tier. Where a vendor or partner quotes a sizing number, request the assumptions behind it in writing.

Capabilities side by side

This table sets Wazuh, Elastic Security and Security Onion against the capabilities that usually decide a shortlist: license, agent and sensor coverage, search backend, rules, compliance views, vulnerability detection, offline install, hardware floor and where single sign-on sits. Read each row as a fit question, and treat the paid-tier and confirm notes as the points to verify before you commit.

Capability	Wazuh	Elastic Security	Security Onion
License	GPL-2.0 with OpenSSL exception for server and agent; indexer and dashboard Apache-2.0	Elastic License 2.0 by default; SSPL 1.0 and AGPLv3 also offered for source code	Elastic License 2.0, not OSI approved; free to run, but no managed-service offering
Endpoint agents	Linux, Windows, macOS, Solaris, AIX and HP-UX agents with file integrity and active response	Elastic Agent with Elastic Defend for endpoint detection and response	No host agent; focuses on network sensors and Elastic Fleet agents
Network sensors	Agentless syslog and API collection for devices such as firewalls; no native packet sensor	Network data via integrations; confirm sensor scope for your traffic	Suricata, Zeek, Strelka and full packet capture built in
Search backend	Wazuh indexer, an open source fork of OpenSearch	Elasticsearch under Elastic License 2.0 by default	Elasticsearch bundled in the distribution
Rules and MITRE mapping	Over 3,000 built-in rules and decoders, mapped to MITRE ATT&CK	Prebuilt detection rules from elastic/detection-rules, updated automatically to the detection engine	Suricata NIDS rules, Sigma rules and YARA rules, with tuning in the Console
Compliance dashboards	Prebuilt views for PCI DSS, GDPR, HIPAA and NIST 800-53	Confirm which compliance dashboards your subscription tier includes	Confirm compliance reporting scope; Security Onion Pro adds reports
Vulnerability detection	Correlates agent software inventory with Wazuh CTI or an offline repository	Confirm vulnerability features and tier for your target environment	Not a stated core capability; confirm with the vendor
Offline install	Offline installation guide and offline vulnerability repository option	Confirm offline package and update path for your version	Full ISO install in airgap mode with packages and rule sets; updates via soup from newer media
Hardware floor	Sized by agent count and storage; confirm with the Wazuh quickstart for your deployment	Sized by cluster design; confirm with Elastic sizing guidance	Standalone: 4 cores, 24 GB RAM, 200 GB storage, 2 NICs; sensors need 12 GB RAM
Single sign-on location	Wazuh single sign-on documentation; confirm which features the free build includes	SAML and OpenID Connect sit in the paid Enterprise tier	OIDC single sign-on is a Security Onion Pro paid feature
Paid tier features	Wazuh Cloud is a managed service with published tiers; self-hosted core is open source	Detection engine, ML anomaly detection and case management under Platinum (closed to new buyers); endpoint prevention and SSO under Enterprise	Security Onion Pro adds OIDC SSO, FIPS, STIG hardening, API, notifications and reports

License and paid editions for each platform

Wazuh splits its licensing by component. The Wazuh server and agent are distributed under GPL-2.0 with an OpenSSL linking exception, while the Wazuh indexer and dashboard are Apache-2.0. The supplied facts do not list a paid self-managed tier for the open platform, so the software itself carries no license fee to buy. Wazuh Cloud is a separate, managed offering, and its pricing and terms are outside this comparison.

Server and agent: GPL-2.0 with an OpenSSL exception, so copyleft obligations apply when you modify and distribute these components.
Indexer and dashboard: Apache-2.0, a permissive license that is OSI approved.
Paid tier: No paid self-managed edition appears in the supplied facts. Confirm with Wazuh whether any commercial support or add-on subscriptions apply to your deployment.
Managed service: Wazuh Cloud is a separate product from self-hosted Wazuh, so its commercial terms are not implied by the open source license.
Cost drivers: Your costs are infrastructure, storage, staff time and any outside support you buy, not a license line.

Before you commit, check the license of each component you plan to modify or redistribute, and ask whether any capability you need is offered only in Wazuh Cloud.

What drives running cost on each platform

None of the three platforms has a license fee for its core open-source edition, but running cost comes from storage, hardware, tuning effort and paid tiers. The cards below separate what each vendor charges for from what your own team, hardware and data volumes will cost. No price figures appear here, so request written quotes that break these components out.

Storage and retention

Wazuh stores alerts in its indexer, Elastic Security stores events in Elasticsearch, and Security Onion keeps Elasticsearch data alongside full packet capture on sensors. Retention period and daily event volume set the disk bill on all three, and packet capture on Security Onion usually grows faster than log data. Ask each vendor or integrator to model retention per data type, including hot and cold tiers, before you compare totals.

Cluster nodes and hardware floors

Security Onion's standalone minimum is 4 cores, 24 GB RAM, 200 GB storage and 2 NICs, and its documentation suggests 32 GB of RAM or more for even a small amount of traffic. Its recommended distributed design adds manager, search and sensor nodes, each with its own floor. Wazuh and self-managed Elastic clusters scale the same way, so confirm node counts for your endpoint and event volumes with the platform owner before you accept any total.

Rule tuning and detection staffing

Wazuh ships over 3,000 built-in rules and decoders, and Elastic delivers prebuilt rules to the detection engine, but every environment still needs tuning to cut false positives. Security Onion adds its own NIDS, Sigma and YARA tuning work in the Console. Most of the recurring cost here is analyst hours, so ask who owns tuning after go-live and how many hours per month the vendor or partner expects for it.

Paid tier fees

Wazuh's server and agents are GPL-2.0 with no license fee. Elastic's endpoint prevention, host isolation and SAML or OIDC single sign-on sit in the Enterprise subscription, and Platinum, which held the detection engine and case management, is closed to new self-managed buyers. Security Onion Pro, a paid license on 1 to 5 year terms, adds OIDC single sign-on, FIPS, STIG hardening and the API. Confirm which features you need, then ask each vendor for the subscription line items in writing.

Support and upgrade cadence

Wazuh shipped six 4.14 patch releases between March and October 2026, and Security Onion 2.4 reached end of life on October 1, 2026, which forced a move to 3.x for many installs. Each upgrade consumes engineering time whether you do it in house or under a retainer. Ask for the upgrade path, the support window for each release line and the expected effort per upgrade, and confirm whether support is included in the license or billed separately.

Sensor hardware for network monitoring

Network monitoring on Security Onion needs sensor nodes that see mirrored or tapped traffic, with a documented floor of 4 cores, 12 GB RAM and 2 NICs per sensor, and it supports x86-64 processors only. Wazuh covers endpoints through agents and does not need a sensor for the same job, while Elastic Security relies on Elastic Agent and Defend on hosts. Budget for taps, switch mirror ports and rack space if network visibility is part of the scope, and confirm NIC and storage sizing for your link speeds with the vendor.

What implementing each platform involves

Wazuh offers the most paths to a first deployment of the three. The all-in-one installation covers a single host, and the step-by-step guide places the indexer, server, dashboard and agents on separate hosts. Teams that want a quick evaluation can use the prebuilt OVA or an Amazon Machine Image, while Docker, Kubernetes, Ansible and Puppet suit container and configuration-management shops. Air-gapped sites should follow the offline installation guide and plan an offline vulnerability repository now, because vulnerability detection otherwise relies on the Wazuh Cyber Threat Intelligence platform. The Wazuh deployment options page lists each path. Docker and Kubernetes move patching, storage and scaling onto your container platform, so confirm which team owns that layer before you choose one.

Elastic Security runs on Elasticsearch and Kibana, so the first decision is hosting: self-managed or Elastic Cloud. Self-managed teams size the cluster, run upgrades and own backups, while Elastic Cloud moves that work to Elastic, which matters mainly if your data residency rules allow it. Endpoints enroll through Elastic Agent, which Fleet manages centrally, and Elastic Defend supplies endpoint protection on top of that agent. Before you commit, check the license tier for each feature you need. Malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on sit under Enterprise on the Elastic subscriptions page, and Platinum is no longer sold to new self-managed customers. Ask the vendor to confirm current edition terms in writing, and size the Fleet capacity for your endpoint count.

Security Onion has the narrowest platform constraints. Version 3.x runs on Oracle Linux 9 only, on x86-64 hardware. A standalone node needs at least 4 cores, 24 GB RAM, 200 GB storage and 2 NICs, and the hardware requirements suggest 32 GB RAM or more even for light traffic. Production should use the Distributed design with a manager, search nodes and sensors, knowing that search nodes stop indexing when they lose contact with the manager. For air-gapped networks, the ISO carries packages and NIDS, YARA and Sigma rules, and soup applies later updates from newer ISO media. Plan the upgrade path now: Security Onion 2.4 reached end of life on October 1, 2026. A 2.4 install on Oracle Linux 9 can move to 3.x after full packet capture changes from Stenographer to Suricata, but other distributions need a fresh install and a data migration plan.

How to pick between the three in four decisions

This sequence narrows the shortlist by coverage priority, license rules, existing search stack and environment constraints, so each decision points to one platform or a clear next check. Each step closes with an output you can record for the evaluation file.

Define the primary coverage priority
Start by deciding what the platform must see first: endpoint activity on servers and workstations, network traffic on the wire, or a general log search backend that other tools feed. Owned by the security lead with the SOC manager, write one sentence naming the priority and the two data sources that must be covered on day one. Wazuh fits when the priority is host telemetry, file integrity and vulnerability inventory from agents. Security Onion fits when the priority is Suricata, Zeek and packet capture. If the priority is only a searchable log store with rules added later, neither product is the default and the shortlist should be reopened. Done when the priority sentence and the data source list are signed off.
Check whether an OSI open source license is required
Next, the license and procurement owner confirms whether the organization requires an OSI-approved license for the security stack. Wazuh server and agent are GPL-2.0 with an OpenSSL linking exception, and its indexer and dashboard are Apache-2.0. Security Onion is published under the Elastic License 2.0, which is source-available and not OSI approved, and it forbids offering the software as a managed service. Elastic's default distribution is also Elastic License 2.0, with SSPL 1.0 and AGPLv3 offered for the source code, so an OSI requirement needs the AGPLv3 option confirmed with Elastic and its counsel. If a strict OSI rule applies, Wazuh moves forward and Security Onion and the default Elastic distribution need a written exception. Done when the license position is recorded with the legal reviewer's name and date.
Map the paid features you need
List every feature the team expects to use, then mark which edition carries it. For Elastic, the self-managed subscriptions page places the detection engine, machine learning anomaly detection and case management under Platinum, which is no longer sold to new self-managed customers, and endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on under Enterprise. For Security Onion, OIDC single sign-on, FIPS and STIG hardening, notifications, the API, Manager of Managers and reports sit in Security Onion Pro, a paid license on 1 to 5 year terms. Wazuh's ruleset, MITRE ATT&CK mapping and compliance dashboards are part of the open distribution, but confirm each required item against the current Wazuh documentation. Ask each vendor for the written edition matrix. Done when every required feature has a named edition and a cost line.
Confirm the existing search stack
Check whether the organization already runs Elasticsearch, Elastic Stack or OpenSearch for logs, because that changes the operating load. Security Onion is built on Elasticsearch and Elastic Agent, and Elastic Security runs on Elasticsearch and Kibana. Wazuh's indexer is an open source fork of OpenSearch, so an existing OpenSearch team has the closest skills for Wazuh's storage tier. OpenSearch Security Analytics can serve as a SIEM backend with Sigma rules, which is a build-it-yourself alternative to Wazuh's packaged agents and ruleset. The platform team lead records which search engine, version line and upgrade cadence they already support. Done when the team can name its search engine and whether it has in-house operators for it.
Test the environment constraints
Verify the hosting and network constraints before comparing hardware. Security Onion supports only x86-64 processors and lists a standalone node at 4 cores, 24 GB RAM, 200 GB storage and 2 NICs, with 4 cores and 16 GB RAM for a manager or search node, and 4 cores, 12 GB RAM and 2 NICs for a sensor. It runs on Oracle Linux 9 for its 3.x line. Security Onion supports full airgap installs through its ISO and soup updates from newer ISO media. Wazuh documents an offline installation guide and an offline vulnerability repository in place of its Cyber Threat Intelligence platform. Elastic Security can be self-managed, and its offline path needs confirmation with Elastic for the target network. The infrastructure lead confirms CPU architecture, operating system, and whether the network is air-gapped. Done when a constraint sheet lists each host type with the supported platform.
Score each platform against the constraints
Combine the answers from the first four steps into a short table with one row per requirement and one column per platform. A host-first priority with an OSI requirement and no Elastic skills points to Wazuh. A network-first priority with x86-64 hosts and tolerance for the Elastic License 2.0 points to Security Onion, often alongside Wazuh for endpoints. An existing Elastic team with Platinum-era features already contracted points to Elastic Security on Enterprise terms. Note each cell where the platform fails a requirement and where a paid edition is needed. The security architect reviews the table with the platform team. Done when the table has a clear leader for each requirement or a named conflict to resolve.
Validate the choice with a pilot scope
Before committing, run a bounded pilot on a small set of representative hosts or a sensor segment that matches the production constraints. Measure whether alerts arrive, whether the chosen edition includes the features the table required, and whether the team can operate the search backend without outside help. Record the total hosts, data sources and operator hours used, then compare them with the vendor quote for the production scope. If the pilot shows a gap, return to the scoring table and adjust. Confirm the outcome with the vendors in writing before the contract is signed. Done when the pilot report lists pass or fail for each requirement and the final platform decision is recorded with its named edition.

Questions buyers ask before choosing a self-hosted SIEM

What drives the cost of running Wazuh, Elastic Security and Security Onion?

The software fee is the smallest variable for Wazuh and Security Onion, while Elastic Security costs depend on the subscription tier you need. Wazuh's server and agents are GPL-2.0 and its indexer and dashboard are Apache-2.0, so there is no license fee for the core platform. Security Onion is free to download under the Elastic License 2.0, but Security Onion Pro is a paid edition sold on 1 to 5 year terms. For all three, the larger recurring costs are storage for retained logs, cluster nodes, rule tuning and the staff who run the platform. Ask each vendor or implementation partner for a written breakdown of which tier, hosts, retention period and support hours the quote includes.

How long does a self-hosted SIEM take to set up?

Setup time depends on scale, architecture and how much of the environment you must connect, so no fixed duration applies to all three. Wazuh offers several documented install routes, including an all-in-one installation, a prebuilt OVA, Docker, Kubernetes and Ansible, and the offline guide covers networks without internet access. Security Onion has minimum hardware of 4 cores, 24 GB RAM and 200 GB storage for a standalone node, and its recommended production design is distributed, with a manager, sensors and search nodes. Elastic Security needs a deployed Elasticsearch and Kibana stack plus Elastic Agent rollout through Fleet. Ask for a milestone plan that lists sensor placement, data sources, detection tuning and handover, then compare it against your change calendar.

Can our internal team run a self-hosted SIEM without a partner?

A team with Linux, search cluster and detection engineering skills can run any of the three, but the workload is continuous rather than a one-time install. Ongoing work includes patching the platform, tuning rules to cut false positives, managing agent upgrades, backing up indexes and keeping detections current. Wazuh's server can manage agent configuration and upgrades remotely, and Elastic's detection rules are delivered to the detection engine automatically, which reduces some manual work. Security Onion's architecture notes that search nodes stop indexing if the manager goes down, so availability planning matters. An outside partner can take on planning, implementation, documentation and retainer-based support, and DeployOpen offers those under fixed-scope agreements. Your own staffing gap is the real question to answer before choosing.

Can Wazuh and Security Onion run together in one environment?

Yes, the two are often deployed side by side because they cover different layers: Wazuh agents on endpoints and Security Onion's Suricata, Zeek and full packet capture on the network. Each platform keeps its own data stores and console, so you need a plan for where alerts are correlated and who triages them. Wazuh's documented Suricata integration is a useful starting point for sharing network alerts with endpoint data, and you should confirm the exact integration steps and versions for your release before committing. Security Onion's ELv2 terms apply to that distribution, while Wazuh remains GPL-2.0, so review the license obligations for each component you deploy.

Does Elastic Defend prevention require an Enterprise subscription?

Based on Elastic's self-managed subscription page, endpoint malware and ransomware prevention, host isolation and SAML or OpenID Connect single sign-on sit under the Enterprise tier. Elastic's subscription page also lists detection engine, machine learning anomaly detection and case management under Platinum, which Elastic no longer sells to new customers. New self-managed buyers of paid security features therefore choose between Basic and Enterprise, or move to Elastic Cloud. Confirm current tier names and feature placement directly with Elastic before budgeting, because subscription pages change. Wazuh's active response and file integrity monitoring are part of the open platform, so you should compare what each option blocks against what it only alerts on.

Does the Elastic License 2.0 stop us from offering Security Onion as a managed service?

Yes, Security Onion's license documentation states that the Elastic License 2.0 forbids offering the software as a managed service. ELv2 is also not OSI approved, so it is source-available rather than open source. An internal team running Security Onion for its own organization is the normal use case, but a provider who hosts it for customers needs to read the license terms carefully. Wazuh's server and agents are GPL-2.0, which has different obligations, and Elastic's source code is also offered under SSPL 1.0 and AGPLv3 alongside the default ELv2. Ask a qualified lawyer to review your specific service model before you commit.

What should we confirm about hardware and staffing before we buy?

Confirm the hardware for your event volume, retention period and network throughput, because the minimums published by each project are starting points, not sizing. Security Onion supports only x86-64 processors, lists 4 cores, 24 GB RAM, 200 GB storage and 2 NICs for a standalone node, and suggests at least 32 GB RAM when monitoring even small traffic volumes. Wazuh sizing depends on the number of agents and the indexer cluster design, and Elastic sizing depends on the data tiers you deploy. On staffing, confirm who owns the on-call rota, who triages alerts, and who maintains detections. Ask every vendor for a sizing worksheet based on your own endpoint count and log volume, and check it against your own environment before signing.

Which SIEM costs the least to switch away from later?

Switching cost depends mostly on how much custom content and data you build up, not on the license. Wazuh rules and decoders, Elastic detection rules and Security Onion's Suricata, Zeek and Sigma content each need export, mapping and retesting before they work elsewhere. Wazuh is built on an OpenSearch-based indexer, and Security Onion uses Elasticsearch, so the data layer is related to, but not directly interchangeable with, the others. Retained log archives are the largest migration risk, so confirm export formats and retention before adopting any platform. A short exit plan, written during the scoping stage, is cheaper than a rushed migration later.

Primary sources for license and release facts

Before you commit budget or sign an order form, read the license and release documents yourself, because the three platforms on this shortlist have different license structures and the terms that matter sit in different places. Start with the Wazuh LICENSE file in the wazuh/wazuh repository, which covers the server and agent under GPL-2.0 with an OpenSSL linking exception, and the Wazuh indexer and dashboard under Apache-2.0. Then read the Wazuh release notes to confirm which 4.x line your team will deploy and whether a 5.0 release is planned for your timeline. Ask your Wazuh contact to confirm which features, if any, are offered outside the open-source distribution.

For Elastic Security, the license question is about tiers as much as the underlying code. The Elastic subscriptions page lists which self-managed features sit under Platinum and Enterprise, and it states that Platinum is no longer available to new customers, so a new self-managed buyer should map each required feature (detections, machine learning, case management, endpoint prevention, host isolation, single sign-on) to Basic or Enterprise. Pair that with the Elastic licensing FAQ, which explains that Elasticsearch and Kibana are distributed under the Elastic License 2.0 by default, with SSPL 1.0 and AGPLv3 also offered for the source code. Confirm with Elastic in writing which license applies to the exact distribution you intend to run.

For Security Onion, read the Security Onion license page to confirm that the Elastic License 2.0 forbids offering the software as a managed service, which matters if a partner will operate it for you. Then check the Security Onion release notes and the Security Onion EOL page. Version 2.4 reaches end of life on October 1, 2026, and 2.4 installs on Oracle Linux 9 can upgrade to 3 only after full packet capture moves from Stenographer to Suricata. Other distributions need a fresh install, so plan that migration before you select a release line.

How DeployOpen helps teams choose and implement a SIEM

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so the Wazuh, Elastic Security and Security Onion choice is tested against your estate before anything is built. Engagements are fixed-scope, with the scope, deliverables and timelines agreed in writing before work starts.

How we scope

We map your endpoint, network and log sources to see whether agents, sensors or both are needed.
We record which license terms, editions and paid features your use case depends on, in writing.
We agree hardware, storage and search backend assumptions for your environment before any build starts.

How we build

We install the chosen platform in your cloud accounts, data centers or air-gapped network as scoped.
We tune detections, decoders and rules for your sources and document each change and its reason.
We test alert paths, agent enrollment and access controls against the requirements agreed at scoping.

How we hand over

You receive architecture, runbooks, configuration records and the compliance evidence we agreed to prepare.
We document the operating tasks your team will own, such as upgrades, backups and rule maintenance.
Handover covers each platform component, so your staff can run the SIEM without relying on us.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover release tracking for Wazuh, Elastic and Security Onion, with changes agreed in writing.
Confirm with the vendor which edition, tier or license each feature you need requires before you buy.

Wazuh vs Elastic Security vs Security Onion