Wazuh vs Graylog: when each one is the right choice
Choose Wazuh when the main job is detecting threats on endpoints and showing compliance posture, and Graylog when the main job is collecting, routing and searching logs from many sources. Wazuh is an agent-based platform: its agents run on Linux, Windows, macOS, Solaris, AIX and HP-UX, and its server applies decoders and rules to what those agents send. The Wazuh ruleset ships over 3,000 built-in rules and decoders and maps alerts to MITRE ATT&CK, and the dashboard includes prebuilt views for PCI DSS, GDPR, HIPAA and NIST 800-53. Wazuh server and agent are licensed under GPL-2.0 with an OpenSSL linking exception, and the indexer and dashboard are Apache-2.0. A team that needs file integrity monitoring, vulnerability detection and active response on hosts will get more of that out of the box from Wazuh.
Choose Graylog when the center of gravity is log pipelines. Graylog Open ingests logs over syslog, GELF and Beats, routes them through streams and processing pipelines, and manages retention by index rotation. Its search backend can be Graylog Data Node, which Graylog recommends, or self-managed OpenSearch within the versions its compatibility matrix lists. The trade-off is licensing: Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0), which is not OSI approved, so a team with an OSI-only policy should not shortlist it on the free edition. Your legal and procurement teams should confirm whether the SSPL terms are acceptable before any technical evaluation begins.
The decision turns on three questions. First, is endpoint detection the goal, or is central log search? Second, is an OSI-approved license a requirement? Third, is paid budget available for Graylog Enterprise or Graylog Security, since archiving, correlation, reporting and prebuilt Illuminate detection content sit in those editions, not Graylog Open. Ask Graylog for a written quote based on your daily ingest and retention, and confirm which features each tier includes before you commit. If the answer to the first question is endpoint detection, Wazuh is the more direct fit. If it is log routing and search across many systems, Graylog fits better, provided the license and edition questions are settled.
Which platform fits which scenario
This table maps common buyer scenarios to the platform that usually fits better and the condition that changes the answer. Read each row as a starting point: the deciding factor is often the team's skills, its license policy, or whether it already runs OpenSearch. Confirm the conditions against your own estate before shortlisting.
| Scenario | Better fit | Reason and conditions |
|---|---|---|
| Endpoint detection on a mixed Linux and Windows estate | Wazuh | Wazuh agents run on Linux, Windows, macOS, Solaris, AIX and HP-UX, and the ruleset ships over 3,000 built-in rules and decoders mapped to MITRE ATT&CK. Graylog ingests endpoint logs but does not ship an agent of its own, so you would assemble collection and detections yourself. |
| Log consolidation for application and network syslog | Graylog | Graylog Open takes syslog, GELF and Beats inputs and routes events through streams and processing pipelines. It fits best when the goal is central search and retention of logs you already produce. Confirm your required input formats and whether you need archive restore, which sits in paid editions. |
| Regulated team that must use OSI-approved licenses | Wazuh | Wazuh server and agent use GPL-2.0 with an OpenSSL exception, and the indexer and dashboard use Apache-2.0. Graylog Open is under SSPL-1.0, which is not OSI approved. Confirm with your legal and procurement teams whether the policy requires OSI approval for every component. |
| Team already running OpenSearch | Graylog or Wazuh, depending on the goal | Graylog can use self-managed OpenSearch 1.1.x to 3.7.x as its search backend, but Graylog recommends Data Node and deprecates OpenSearch 1.x. Wazuh's indexer is an OpenSearch fork, so the platform choice depends on whether you need agents and rules (Wazuh) or log pipelines (Graylog). |
| Team that needs SIEM detection content without paying | Wazuh | Wazuh includes its ruleset and compliance dashboards in the open source distribution. Graylog Open does not include correlation, reporting or prebuilt Illuminate detection content, which sit in paid Graylog Enterprise or Graylog Security editions. Confirm which Wazuh features your use case needs before committing. |
| Team with strong pipeline skills and a log-first mandate | Graylog | Stream routing and pipeline rules give fine control over what is stored and where. This suits teams that already manage log flows and want to keep the search layer under their control. Expect to build detections and host sizing yourself. |
How Wazuh and Graylog are built and what that means for operations
Wazuh and Graylog both split a SIEM into several moving parts, but they divide the work differently. Wazuh bundles agents, analysis, storage and a dashboard into one product family, while Graylog depends on a separate configuration database and a search backend that you size and operate yourself. The cards below show where each component sits and what that means for patching, backups and staffing.
Wazuh's four components
Wazuh runs as an indexer, a server, a dashboard and agents on endpoints. The indexer stores alerts, the server applies decoders and rules to agent data, and the dashboard is the web interface. Before you commit, confirm which of these your team will patch as separate hosts and which versions must stay aligned across them during upgrades.
Wazuh server clustering and agent management
The Wazuh server can run as a cluster to scale horizontally, and it pushes agent configuration and upgrades remotely. This reduces manual work on large endpoint fleets. Ask how the cluster's master and worker roles are sized, how agent version upgrades are staged, and how a failed node is replaced before you plan a rollout across hundreds of hosts.
The Wazuh indexer as an OpenSearch fork
The Wazuh indexer is an open source fork of OpenSearch, so Wazuh's storage layer shares a lineage with the search engine many teams already run. Your operators may recognize its APIs and tooling, but the fork is maintained by the Wazuh project. Confirm how your team will track OpenSearch-related fixes and whether your security baseline accepts the fork's release cadence.
Graylog server nodes and MongoDB
Graylog runs as server nodes that process inputs, streams and pipelines, while MongoDB holds configuration and metadata. Graylog 7.2 stores configuration in MongoDB 7.x through 8.2.x. Because the configuration database is a second stateful system, your team owns its replication, backups and version compatibility alongside the Graylog servers.
Graylog Data Node or self-managed OpenSearch
Log data is indexed in a search backend: either Graylog Data Node, which Graylog recommends, or self-managed OpenSearch from 1.1.x to 3.7.x. Use of OpenSearch 1.x is deprecated since Graylog 7.0 and will be removed in Graylog 8.0. If you already run OpenSearch for other workloads, confirm whether sharing that cluster is supported before you choose it.
Graylog's recommended multi-node layout
For medium to large deployments, Graylog's multi-node guide recommends three Graylog and MongoDB nodes with MongoDB as a replica set, three Data Nodes on their own cluster, and a load balancer, with follower Graylog nodes set to is_leader false. That is six or more hosts before any Wazuh-style sizing. Ask who will provision the load balancer and who is accountable when a Data Node cluster loses quorum.
Patching, backups and who runs each layer
Wazuh patching covers the indexer, server, dashboard and agents, and the 4.14 line had six patch releases in 2026 alone, so the cadence matters. Graylog patching covers server nodes, MongoDB and the search backend, each with its own compatibility range. Plan backups per stateful layer, including the Wazuh indexer and the Graylog MongoDB configuration, and assign one owner for each component before go-live.
How each platform gets installed, split by environment
On a connected network, both platforms can be installed directly from vendor-supplied packages, and the main decisions are about host layout and which installer path your team will repeat. Wazuh documents an all-in-one and a step-by-step installation, a prebuilt OVA virtual machine and an Amazon Machine Image, plus Ansible and Puppet paths for fleet automation. Graylog documents Debian and RPM packages for Ubuntu, Red Hat, SUSE and Debian, and expects you to pair the Graylog server nodes with MongoDB and a search backend.
- Wazuh installer paths: The all-in-one and step-by-step installs suit a lab or a single host, while the OVA and AMI options suit teams that want a prebuilt image.
- Wazuh automation: Ansible and Puppet options fit teams that already manage configuration this way.
- Graylog packages: Debian and RPM packages cover the main Linux families, but MongoDB and the search backend are separate installs you must plan for.
- Graylog search backend: Graylog documents Data Node as the recommended search backend, and OpenSearch 1.x use is deprecated since Graylog 7.0.
- Version checks: Confirm the target OS release and the Graylog 7.2 or Wazuh 4.14 compatibility notes before you build the image.
Check the supported OS list and component versions against the vendor compatibility material for your exact target before you plan the build.
On an air-gapped or offline network, the main work moves from the installer to staging. You need the packages, container images, vulnerability data and update path on the isolated side before the first install. Wazuh publishes an offline installation guide for systems without internet connectivity, and it allows an offline vulnerability repository in place of the Wazuh Cyber Threat Intelligence platform, which matters for vulnerability detection. Graylog's documented install paths assume package or container sources you can mirror, but the Graylog docs in the supplied material do not describe a separate offline guide, so confirm that with Graylog before you commit to a design.
- Wazuh offline guide: Follow the offline installation guide for the component set you deploy.
- Wazuh vulnerability data: Build an offline vulnerability repository if agents must be assessed without internet access.
- Graylog mirroring: Mirror the Graylog, MongoDB and Data Node packages you plan to use into your internal repository.
- Update path: Define how patches and new release lines reach the isolated network and who approves them.
- Vendor confirmation: Ask Graylog whether its offline procedure covers your target version and search backend.
Confirm offline steps with each vendor for your exact version, since an offline plan that works for one release line can fail on another.
Containers change the install model from packages on hosts to images, compose files and manifests. Wazuh documents Docker and Kubernetes deployment options, which means you can run its components as containers, but you still need persistent storage for the indexer and a plan for certificates and secrets. Graylog documents Docker Compose as an install path, which suits evaluation and smaller setups, while a multi-node production layout depends on how your cluster handles MongoDB, Data Nodes and load balancing. Treat container choice as an operating decision as much as an install decision.
- Wazuh container options: Docker and Kubernetes are both documented, so choose one based on the platform team's existing skills.
- Persistent storage: Indexer and database volumes need durable, backed-up storage classes that fit your retention plan.
- Graylog Compose: Docker Compose is a documented path for Graylog, but review its fit for production before you adopt it.
- Upgrade mechanics: Image upgrades must line up with the index and database schema changes each vendor documents.
- Ownership: Decide who patches the base images and the Kubernetes layer that sits under the SIEM.
Confirm the supported container and Kubernetes versions, storage classes and upgrade procedure with each vendor before you size the cluster.
Side-by-side capabilities from supplied facts
This table compares what each platform ships with, how it collects and routes data, how it stores it, and where paid tiers begin. Read the cells as the baseline for your own evaluation: a yes means the capability is documented, and a confirm entry means the supplied documentation does not settle it, so ask the vendor before you rely on it.
| Capability | Wazuh | Graylog |
|---|---|---|
| Collection model | Agents on Linux, Windows, macOS, Solaris, AIX and HP-UX, plus agentless syslog and API collection for devices such as firewalls | Ingests over syslog, GELF and Beats inputs; no endpoint agent is described in the supplied facts, so confirm agent options with Graylog |
| Built-in rules and content | Over 3,000 built-in rules and decoders, with alerts mapped to MITRE ATT&CK | Event definitions for alerting; prebuilt Illuminate detection content sits in paid Enterprise or Security editions |
| Compliance dashboards | Prebuilt views for PCI DSS, GDPR, HIPAA and NIST 800-53 in the dashboard | Compliance packs are listed under Graylog Security; confirm which frameworks are covered and in which edition |
| Routing and processing | Decoders and rules analyze agent data on the Wazuh server | Streams and processing pipelines route messages before indexing |
| Alerting channels | Confirm the full set of notification integrations in the Wazuh documentation for your version | Notifications documented for PagerDuty, Slack and email on the Open product page |
| Vulnerability detection | Correlates agent software inventory with the Wazuh CTI platform or an offline repository | Not covered by the supplied facts; confirm with Graylog, and check whether it appears in Graylog Security |
| Single sign-on | Wazuh documents a single sign-on section in its user administration guide; confirm the protocols and tier that apply | Graylog documents user authentication; confirm SSO options and whether they need Enterprise or Security |
| Storage and retention | Alerts stored in the Wazuh indexer, an OpenSearch fork; confirm retention settings for your version | Index rotation by message count, size or time; retention deletes the oldest indices; sizing guidance in Graylog system architecture |
| Paid feature gate | Confirm which Wazuh Cloud or support options carry cost; the GPL-2.0 server and agent carry no license fee | Enterprise (archive restore, data tiering, correlation, 24/7 support) and Security (risk scoring, anomaly detection, compliance packs) are paid |
What the GPL-2.0 and SSPL licenses mean for each platform
Wazuh and Graylog license their components differently, and the difference affects what your legal team must review. The Wazuh server and agent are distributed under GPL-2.0 with an exception that permits linking with OpenSSL, while the Wazuh indexer and dashboard are Apache-2.0. Graylog Open has been licensed under the Server Side Public License version 1 (SSPL-1.0) since Graylog 4.0 in 2020, replacing the GPL v3 used by earlier releases. The SSPL is not approved by the Open Source Initiative, so it should not be described as open source in procurement documents.
- Wazuh core components: The server and agent fall under GPL-2.0 with the OpenSSL exception, as stated in the LICENSE file in the wazuh/wazuh repository.
- Wazuh indexer and dashboard: These are Apache-2.0, as stated in the wazuh-indexer repository.
- Graylog Open: It is licensed under SSPL-1.0, which is not an OSI-approved open source license.
- Change history: Graylog moved from GPL v3 to SSPL-1.0 at version 4.0, so older Graylog code carries different terms.
- Cloud terms: Confirm Wazuh Cloud service terms separately, because hosted service terms are not the same as the software license.
Ask your counsel to review the LICENSE files for the exact versions you plan to deploy.
Graylog Open is free with no volume limits and community support. Features that many SIEM buyers expect, such as index archiving, correlation, reporting and prebuilt Illuminate detection content, sit in the paid Graylog Enterprise or Graylog Security editions. According to the Graylog pricing page, Graylog Enterprise starts at 15,000 US dollars per year and Graylog Security starts at 18,000 US dollars per year. Both carry a minimum of 10 GB per day or 100 Graylog Compute Units, and are licensed on processed data with no per-user or per-device fees.
- Graylog Enterprise: Adds a data lake with archive restore, data tiering, a correlation engine and 24/7 support.
- Graylog Security: Adds SIEM features such as risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content.
- Entry point: The published starting prices apply to the minimum volume tier, so larger ingest will change the quote.
- Licensing basis: Pricing follows processed data rather than users or devices, which affects how your costs grow as sources are added.
- Missing features in Open: If your SIEM requirements include correlation or compliance packs, plan for a paid edition rather than assuming Open covers them.
Request a written quote that states the edition, the daily volume basis and the support term before comparing totals.
The supplied facts do not describe a paid Wazuh edition. The Wazuh server, agent, indexer and dashboard are all listed under open source licenses, and the supplied facts make no claim that any feature is gated behind a commercial tier. That does not mean there is no commercial offering, so confirm this with Wazuh before you finalize a budget. Wazuh Cloud is a separate managed service, and its terms, tiers and features should be checked on its own page rather than assumed from the software license.
- Software license: The open source components are the only Wazuh terms covered by the supplied license facts.
- Feature gating: Ask Wazuh directly which features, if any, require a commercial agreement.
- Managed service terms: Wazuh Cloud has its own terms and should be reviewed separately.
- Support contracts: Any vendor support agreement is a separate cost and should be quoted in writing.
- Scope of review: Compare the same functions on each side, such as correlation and compliance views, when you assess paid features.
Confirm the Wazuh commercial position and Wazuh Cloud terms in writing before you compare total cost with Graylog.
What drives the running cost of Wazuh and Graylog
The main difference in running cost is where the money goes. Wazuh has no license fee in the supplied facts: the server and agents are GPL-2.0 and the indexer and dashboard are Apache-2.0, so your spend sits in hosts, storage, analyst time and rule tuning. Graylog Open is also free, with no volume limits and community support, but Graylog Enterprise and Graylog Security are licensed on processed data with no per-user or per-device fees, and the published pricing starts at 15,000 US dollars per year for Enterprise and 18,000 US dollars per year for Security, each with a minimum of 10 GB per day or 100 Graylog Compute Units. Ask Graylog for a written quote that shows how processed volume maps to the minimum before you assume the free edition covers your ingest.
Some costs recur and some are one-time. Recurring costs include the infrastructure that runs the Wazuh indexer and server or the Graylog server nodes, MongoDB and the search backend, the storage that holds retained data, any Graylog license renewal, and the staff hours spent tuning rules, reviewing alerts and patching. One-time costs include architecture and sizing, the initial build of decoders, rules, streams, pipelines or event definitions, and migration of existing sources. For Graylog, the Graylog system architecture page advises sizing log storage as daily ingest times retention days times 120 percent, and giving the message journal 3 to 5 times daily ingest on SSDs. Storage is usually the largest recurring driver, so the factors that push it up are higher daily ingest, longer retention, verbose sources that are not filtered before indexing, and any decision to keep data hot instead of archived.
What each platform costs to run, by component
This table sets out the main running cost components for Wazuh and Graylog, who is paid for each one and what drives it up. Read it as a list of questions to put to a vendor or implementation partner, since the license terms for each platform differ in what is free and what is paid.
| Component | Wazuh (GPL-2.0 server, Apache-2.0 indexer and dashboard) | Graylog (SSPL-1.0 Open, paid Enterprise or Security) |
|---|---|---|
| Infrastructure | Self-hosted hosts for the indexer, server and dashboard, sized to endpoint count and retention. Scale-out is documented through a server cluster and a multi-node indexer. Ask for the node layout and host sizing in writing. | Graylog server nodes, MongoDB for configuration and a search backend on Graylog Data Node or OpenSearch. The multi-node guide adds load balancing and separate clusters. Ask for the full node count and where each role runs. |
| Search or indexer storage | Alerts are stored in the Wazuh indexer, so disk use grows with agent volume and retention. Ask the partner to size storage per device type and retention period, and to state the retention basis used. | Log storage is sized from daily ingest, retention days and overhead. Graylog's system architecture page advises daily ingest times retention times 120 percent, plus a journal of 3 to 5 times daily ingest on SSDs. Ask for the sizing worksheet with those inputs. |
| Skills | Staff must run agent rollout, ruleset tuning, decoders, custom rules and indexer operations. Ask who maintains the ruleset and who owns upgrades after handover. | Staff must run streams, pipelines, index sets, event definitions and the search cluster. Ask who writes and tests pipeline rules and who handles MongoDB and Data Node operations. |
| Support options | Community support is available for the open source components. Wazuh Cloud is a separate managed service with its own terms. Ask what support the partner provides, its response scope and what is excluded. | Graylog Open is listed with community support. Graylog Enterprise adds 24/7 support under its paid tier. Ask the vendor which support tier applies to the exact edition you buy. |
| Upgrades and patching | Wazuh 4.14 received patch releases through 2026, so patching is a recurring task. Wazuh 5.0 is in release candidate status, which means migration planning is a separate item. Ask for upgrade effort per release and whether the partner tests on your data. | Graylog 7.2 is the current line, and OpenSearch 1.x use is deprecated since Graylog 7.0 and will be removed in Graylog 8.0. Ask for a plan covering any backend migration, which can be a recurring cost. |
| Paid editions and licensing | No license fee for the GPL-2.0 server and agents. Wazuh features and hosting options outside the open source distribution carry their own terms. Confirm which features you need are in the open source build. | Graylog Enterprise and Graylog Security are paid editions. Archive restore, correlation, reporting and Illuminate detection content sit in those tiers. Ask for the annual price, the minimum data volume and what counts toward it. |
Moving from Graylog to Wazuh or from Wazuh to Graylog
This sequence moves log sources, retention and detection logic from one platform to the other while keeping alerting coverage intact at every stage. It ends with a documented, validated cutover and a retired pipeline rather than a last-minute switch.
Inventory sources, retention and alert logic
List every log source, agent and syslog feed that reaches the current platform, along with the retention period each one needs for audit and investigation. Export the Graylog streams, processing pipelines and event definitions, or the Wazuh rules, decoders and custom alert configuration, so the team knows exactly what is in use. The step is complete when each source has an owner, a retention requirement and a documented list of the alerts that depend on it.
Decide what stays in log search
Separate the data that must remain searchable in the new platform from the data that only needs to be kept for retention. Graylog stores logs in an OpenSearch or Graylog Data Node backend with index rotation and retention, while Wazuh stores alerts in its indexer, so the two platforms handle archive and search differently. Ask the vendors and your compliance owner which archive formats and restore paths they support, and confirm whether Graylog archive restore needs a paid edition. The step closes with a written decision for each data class.
Deploy agents and inputs in parallel
Stand up the new platform beside the existing one and connect the same sources to both. On the Wazuh side, install agents on endpoints and configure syslog collection for network devices. On the Graylog side, keep the existing inputs such as syslog, GELF or Beats running. Running both paths lets the team compare what each platform receives. Confirm that each source appears on the new platform with the expected fields before moving on.
Translate alert logic into the new model
Rebuild each detection by hand, since Graylog streams, pipelines and event definitions do not map one-to-one onto Wazuh rules and decoders. Graylog pipeline rules that parse and enrich fields need equivalent Wazuh decoders, and event definitions with thresholds or aggregations need matching Wazuh rule logic. Wazuh's built-in ruleset, which holds over 3,000 rules and decoders and maps alerts to MITRE ATT&CK, may already cover some of the old logic, so remove duplicates. The output is a mapping table from each old alert to its new rule or to a documented gap.
Validate detections with test events
Replay known events or generate controlled test activity on endpoints, then confirm that each rebuilt detection fires on the new platform and stays quiet on normal traffic. Check notification routing, such as email, Slack or PagerDuty, because Graylog notification channels do not carry over automatically. Record the expected and actual result for every test. The step is complete when each mapped alert has a passing test and every gap has an accepted owner.
Run both platforms during cutover
Keep the old platform receiving data and alerting while the new platform is in production for the same sources. Compare alert volumes, false positives and missed events between the two for a period the security owner agrees in advance. Review disagreements with the analysts who handle the alerts and fix the rules that differ. Do not switch notification ownership until the outputs match the agreed acceptance criteria.
Retire the old pipeline
Once acceptance criteria are met, disable the old inputs and alerts, then archive the configuration and retained data according to the retention plan. Confirm that archived data can still be restored or searched when an investigation needs it. Remove the old platform's access, service accounts and integrations, and update runbooks, dashboards and escalation documents. The step closes with a signed-off decommission record that lists what was retired, where archives are stored and who can restore them.
Where Wazuh and Graylog projects usually run long
Most Wazuh delays come from agent coverage and rule tuning, not from installing the server. Wazuh is typically run as the indexer, server, dashboard and agents, and the agent rollout is where schedules slip. Plan for an inventory of every endpoint class (Linux, Windows, macOS and any Solaris, AIX or HP-UX hosts), a check of which hosts actually report, and a decision on agentless coverage for devices such as firewalls, which use syslog collection and API probing. Decoder and rule work follows: the ruleset ships with over 3,000 built-in rules and decoders, but custom log sources need decoders written or adjusted, and alert severity usually needs tuning before the queue is quiet enough to act on. Configure the dashboard's regulatory views (PCI DSS, GDPR, HIPAA and NIST 800-53) only after you have confirmed which control mappings your auditors expect, because the views report what the rules detect, not what your controls achieve.
Graylog delays cluster around pipeline design, stream rules, retention and search backend sizing. Graylog Open routes messages through streams and processing pipelines, so every new log source needs a stream rule and parsing logic before its events are searchable or alertable. Retention is set through index rotation and retention, and the Graylog system architecture page advises sizing storage as daily ingest times retention days times 120 percent, with the message journal at 3 to 5 times daily ingest on SSDs. Ask your team to produce that calculation from measured ingest, not estimated ingest, before ordering hardware. For production, the Graylog multi-node guide recommends three Graylog and MongoDB nodes, three Data Nodes on their own cluster and a load balancer, so a Data Node sizing review and a load balancer decision belong in the early plan.
Confirm which edition your alerting and correlation requirements need before you start the build. Event definitions and notifications to PagerDuty, Slack and email are part of Graylog Open, but index archiving, correlation, reporting and prebuilt detection content sit in paid Graylog Enterprise or Graylog Security editions. If your use cases depend on those features, a team that builds correlation by hand on Open may rebuild work later when it upgrades. Ask for written scope that names each detection, each log source and each retention period, so effort is estimated against a fixed list. Confirm current editions and pricing with Graylog directly, since the Graylog pricing page is the source for list figures.
Questions buyers ask before choosing Wazuh or Graylog
Is Graylog Open really open source?
No. Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0) since Graylog 4.0 in 2020, which replaced the GPL v3 used by earlier releases. SSPL is not approved by the Open Source Initiative, so legal and procurement teams should treat it as source-available rather than OSI open source. The practical question is whether your policy allows SSPL-licensed software to run in your environment, and whether any internal redistribution or hosting terms create obligations. Confirm the position with your legal counsel and read the Graylog LICENSE file directly before approving it.
Which Graylog features require a paid edition?
Index archiving, correlation, reporting and prebuilt Illuminate detection content sit in the paid Graylog Enterprise or Graylog Security editions, not in Graylog Open. Graylog Enterprise adds a data lake with archive restore, data tiering, a correlation engine and 24/7 support. Graylog Security adds SIEM features such as risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content. The Graylog pricing page lists Enterprise from 15,000 US dollars per year and Security from 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units. Ask for a written quote that matches your daily ingest and the feature list you need.
Does Wazuh replace a log management platform?
Wazuh covers endpoint log collection, decoding, rule-based alerting, MITRE ATT&CK mapping and compliance dashboards, so it can replace a log platform for security-relevant host data. It is not a general log store for every application or network device by default. Graylog is built around inputs, streams, processing pipelines and index rotation, which suits broad log routing and retention. If your main need is wide log routing across many sources, compare the ingest paths, retention model and search performance before deciding that Wazuh alone is enough.
What does running either platform ask of our internal team?
Both platforms need staff who can operate a search backend, manage upgrades and tune detection content. Graylog requires Graylog server nodes, MongoDB for configuration and either Graylog Data Node or self-managed OpenSearch for storage, and its multi-node guide recommends three Graylog and MongoDB nodes plus three Data Nodes. Wazuh requires the indexer, server, dashboard and agents, and its server can run as a cluster. Ask your team to map existing skills against each stack, including Linux administration, index lifecycle management, agent deployment and rule tuning.
Can our own team run either platform without outside help?
Yes, many teams do, provided they have the skills listed above and a plan for upgrades, backups and on-call coverage. The harder part is usually detection engineering: writing, testing and maintaining rules that fit your environment. Graylog Open does not include the Enterprise or Security content, and Wazuh ships over 3,000 built-in rules and decoders that still need tuning. Outside help is often used for the initial build, hardening, documentation or ongoing support through a retainer. Decide which of these you need in writing before choosing a path.
How is the cost of a Wazuh or Graylog deployment quoted?
Software cost and services cost are separate. Wazuh and Graylog Open carry no license fee for the open components, but Graylog Enterprise and Graylog Security are paid per year on processed data, not per user or device. Your costs also include hosts, storage, compute, staff time and any implementation services. DeployOpen does not publish a price list. Engagements are fixed-scope, and a quote follows from a written scope that lists platforms, data sources, environments, deliverables and support terms. Ask for those items in writing so two quotes can be compared on the same basis.
How long does a typical implementation take?
Timelines come from the written scope, so no general duration applies. The main drivers are the number of data sources, the endpoint count, the storage design, the number of environments, the compliance mappings you need and how many detections must be tuned before go-live. A single-node deployment with a small set of sources differs greatly from a clustered build with custom pipelines and regulated evidence requirements. Ask for a milestone plan with the assumptions stated, and check which items the timeline excludes, such as customer approvals or access provisioning.
How DeployOpen helps choose, implement or migrate
DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so the Wazuh or Graylog choice is tested against your real estate before anything is installed. The work follows a written, fixed scope with agreed deliverables and timelines.
How we scope
- Map which log sources, endpoints and network devices must be covered before choosing between agent-based and inputs-based collection.
- Confirm which compliance views, alert types and retention periods the written scope must satisfy.
- Agree in writing whether Graylog paid editions or Wazuh-side features are in scope, and what each requires.
How we build
- Deploy the chosen platform in your cloud accounts, data centers or air-gapped network, with the search backend and storage sized to your retention.
- Build the detections, decoders, streams, pipelines or event definitions the scope requires, then test them against representative log samples.
- Integrate identity, notifications and ticketing, and apply hardening settings agreed with your security team.
How we hand over
- Document architecture, licensing position, configuration decisions and the operating runbook for your own engineers.
- Deliver backup, upgrade and retention procedures tested in your environment before acceptance.
- Provide evidence of configured controls that your compliance lead and independent auditors can review.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover, scoped separately from the build.
- Plan version upgrades around the release lines your chosen platform documents as current.
- Keep the migration path open by documenting what a later move to another platform would need to carry over.
