Wazuh vs Security Onion vs Graylog: which open source SIEM fits your team
Choose Wazuh when your main gap is host-level detection, file integrity monitoring and compliance reporting across servers and workstations. Its agents, more than 3,000 built-in rules and decoders, MITRE ATT&CK mapping and dashboard views for PCI DSS, GDPR, HIPAA and NIST 800-53 cover that job without assembling detections yourself. Choose Security Onion when you need network visibility, because it bundles Suricata, Zeek and full packet capture in one distribution. Choose Graylog when the core requirement is centralized log management, with inputs such as syslog, GELF and Beats, streams and processing pipelines. These three tools overlap less than the shortlist suggests, because each starts from a different data source. Before you shortlist, list the log sources you must cover in the first year, such as endpoints, firewalls, cloud control planes and network segments, and map each one to a product. Many regulated teams end up running two of these tools, for example an endpoint platform beside a network sensor.
The licenses matter for procurement and legal review. Wazuh server and agent are licensed under GPL-2.0 with an OpenSSL linking exception, and the Wazuh indexer and dashboard are Apache-2.0. Security Onion is published under the Elastic License 2.0, a source-available license that is not OSI approved and that forbids offering the software as a managed service, as described in the Security Onion license documentation. Graylog Open is licensed under SSPL-1.0, which is also not OSI approved. Paid features differ by platform: Security Onion Pro adds OIDC single sign-on, FIPS mode, OS STIG compliance and the Security Onion API, while Graylog Enterprise and Graylog Security add capabilities such as archive restore, correlation and prebuilt detection content. Confirm with each vendor which features your compliance scope requires in the free tier and which need a paid edition, because that difference can change the total cost more than the license fee itself.
Which platform fits which scenario
This table maps common operating situations to the platform that usually fits best, based on agent coverage, network visibility, log handling and offline support. Read each row against your own estate, and treat the hypothetical scenarios as illustrative only.
| Scenario | Best fit | Why |
|---|---|---|
| Endpoint-heavy estate (Linux, Windows, macOS, Solaris, AIX, HP-UX) | Wazuh | Wazuh agents cover all six listed operating systems, and the ruleset maps alerts to MITRE ATT&CK. Confirm agent coverage for your exact OS versions. |
| Need to see network traffic (IDS, Zeek metadata, packet capture) | Security Onion | Suricata, Zeek, Strelka and full packet capture ship in one distribution. Wazuh can integrate with Suricata, but it does not bundle Zeek or packet capture. |
| Log-centric team (syslog, GELF, Beats, custom pipelines) | Graylog | Graylog ingests syslog, GELF and Beats, routes events through streams and processing pipelines, and handles index rotation and retention. Correlation and archiving need paid editions. |
| Air-gapped site with no internet access | Security Onion or Wazuh (confirm) | Security Onion supports airgap installs, with an ISO that carries packages and NIDS, YARA and Sigma rules. Wazuh documents an offline installation guide. Confirm the offline vulnerability and rule update path for your classification level. |
| Illustrative: mixed estate that needs endpoint and network evidence | Wazuh plus Security Onion, or Wazuh with a Suricata integration | Wazuh covers hosts and Security Onion covers the wire. Running both adds hardware and staffing, so decide which signals you cannot skip. |
| Team that must keep a permissive open-source license for its stack | Wazuh (server and agent under GPL-2.0) | Wazuh server and agent use GPL-2.0 with an OpenSSL exception, and the indexer and dashboard use Apache-2.0. Security Onion uses ELv2 and Graylog Open uses SSPL, which is not OSI approved. |
| Teams that need Graylog correlation or prebuilt detections | Graylog with a paid edition | Correlation, archiving and prebuilt Illuminate content sit in Graylog Enterprise or Graylog Security, not Graylog Open. Ask for the edition scope in writing before you choose. |
How Wazuh, Security Onion and Graylog are built
The architectural difference that matters most is where each platform keeps its data and who depends on whom. Wazuh splits into four components: the Wazuh indexer, which stores and searches alerts, the Wazuh server, which decodes and analyzes agent data with rules, the Wazuh dashboard, and the agents installed on endpoints. The Wazuh indexer is an open source fork of OpenSearch, so an operator who already runs OpenSearch will recognize its storage model, but the Wazuh server, its ruleset and its agent management are Wazuh's own code. The server can run as a cluster for horizontal scaling and pushes agent configuration and upgrades remotely, which is why the agent fleet, not the dashboard, is usually the largest operational surface to plan for.
Security Onion is built around sensors and a central manager rather than endpoint agents. Its recommended distributed design separates a manager node, one or more sensor nodes running Suricata, Zeek and Strelka against traffic, and one or more search nodes running Elasticsearch. The dependency to plan for is that if the manager goes down, search nodes stop indexing because they cannot reach Redis, according to the Security Onion architecture documentation. Receiver nodes can add pipeline redundancy and load balancing, so confirm with the vendor how your chosen layout behaves during a manager outage before you size the manager as a single point of failure.
Graylog separates its server nodes from its storage. Graylog server nodes handle inputs, streams, pipelines and alerting, MongoDB holds configuration and metadata, and log data sits in Graylog Data Node or a self-managed OpenSearch cluster. The compatibility matrix for Graylog 7.0 to 7.2 supports OpenSearch from 1.1.x up to 3.7.x, but use of OpenSearch 1.x is deprecated since Graylog 7.0 and is scheduled for removal in Graylog 8.0. If you already run OpenSearch 1.x for Graylog, plan an upgrade or a move to Data Node before the removal, and check the Graylog compatibility matrix for the exact pairing with your MongoDB version.
Capability and license comparison across the three platforms
This table sets license, coverage, detection content, compliance views, paid tier items, hardware floors and deployment types side by side for the three platforms. Read each row as a question about your environment: if most of your risk sits on endpoints, network visibility or log volume will decide which row matters most. Confirm current edition terms with each vendor before you rely on a paid feature in a quote.
| Capability | Wazuh | Security Onion | Graylog |
|---|---|---|---|
| License | GPL-2.0 with OpenSSL linking exception for server and agent; indexer and dashboard under Apache-2.0 | Elastic License 2.0, which is source-available and not OSI approved; forbids offering it as a managed service | SSPL-1.0 for Graylog Open since 4.0, not OSI approved; Enterprise and Security are paid editions |
| Host coverage | Agents on Linux, Windows, macOS, Solaris, AIX and HP-UX, plus agentless syslog and API collection | No host agent focus; collects network and sensor data through Suricata, Zeek and Strelka | Ingests host logs over syslog, GELF and Beats; no native endpoint agent described in supplied facts |
| Network coverage | Not its primary role; relies on Suricata integration for wire-level visibility | Suricata NIDS, Zeek, Strelka and full packet capture bundled in one distribution | Log-based only; network visibility depends on the devices and sources you forward |
| Search backend | Wazuh indexer, an open source fork of OpenSearch, stores alerts | Elasticsearch bundled in the distribution | Self-managed OpenSearch 1.1.x to 3.7.x or Graylog Data Node, which Graylog recommends |
| Rule content | Over 3,000 built-in rules and decoders, with alerts mapped to MITRE ATT&CK | Manages NIDS rules for Suricata, Sigma rules for ElastAlert and YARA rules for Strelka, with tuning and suppression | Event definitions and streams; prebuilt Illuminate detection content sits in paid editions |
| Compliance views | Dashboard views for PCI DSS, GDPR, HIPAA and NIST 800-53 | Not described as a compliance dashboard in supplied facts; confirm reporting needs with the vendor | Compliance packs are part of the paid Graylog Security edition |
| SSO and paid tier items | Single sign-on is documented; confirm which methods your Wazuh release supports | Security Onion Pro adds OIDC single sign-on, FIPS, STIG hardening, API, reports and professional support | Index archiving, correlation, reporting and Illuminate content are paid; SSO details sit in Graylog user authentication docs |
| Hardware floor | Sizing depends on endpoint count and retention; confirm with the Wazuh quickstart for your scale | Standalone: 4 cores, 24 GB RAM, 200 GB storage, 2 NICs; 32 GB RAM suggested for even small traffic; x86-64 only | Sizing follows daily ingest times retention times 120 percent, with journal sized at 3 to 5 times daily ingest |
| Deployment types | All-in-one or step-by-step install, OVA, AMI, Docker, Kubernetes, Ansible, Puppet and offline guide; clustering supported | Import, Evaluation, Standalone and Distributed; Distributed with manager, sensor and search nodes is recommended for production | Graylog server nodes with MongoDB and a Data Node or OpenSearch cluster; multi-node guide recommends three of each |
What each license allows and what is paid
Wazuh splits its licensing by component. The Wazuh server and agent are licensed under GPL-2.0 with an OpenSSL linking exception, and the Wazuh indexer and dashboard are Apache-2.0. The supplied facts do not list a paid Wazuh edition, so the open-source stack is the platform itself. Managed delivery is a separate question: Wazuh Cloud is offered as a managed option, and its terms, tiers and regions need confirmation with Wazuh.
- Server and agent under GPL-2.0: You can run, modify and redistribute the core under the terms of that license, subject to its obligations.
- Indexer and dashboard under Apache-2.0: These components use a permissive license, which is a different obligation set from the server and agent.
- No paid edition in the supplied facts: Cost comes from infrastructure, storage and staff, not a per-seat or per-device license fee.
- Wazuh Cloud as a managed option: Ask Wazuh how the managed service is licensed and what data leaves your environment.
- Staffing and support: Commercial support terms are not part of the supplied facts, so ask Wazuh what support is available and what it costs.
Confirm the GPL-2.0 and Apache-2.0 obligations with your legal team, and ask Wazuh whether any commercial support or managed tier applies to your deployment.
Security Onion is published under the Elastic License 2.0 (ELv2), a source-available license that is not OSI approved. Its key restriction is that ELv2 forbids offering the software as a managed service, so a third party cannot host it for customers under that license without a separate arrangement. Organizations running it for their own use inside their own infrastructure are in a different position from managed service providers, and the terms should be confirmed with the vendor.
- Elastic-2.0 license: The distribution moved from GPL to ELv2 starting with Security Onion 2.4, announced on August 31, 2022.
- Managed-service restriction: ELv2 prohibits offering the software as a managed service, which matters if a provider is planning to run it for you.
- Security Onion Pro as the paid tier: Pro is sold on 1 to 5 year terms and adds OIDC single sign-on, FIPS mode, OS STIG compliance, the Security Onion API, external notifications and Manager of Managers.
- Pro also adds reports, LUKS encryption and professional support: These are listed in the Pro documentation and should be checked against the current Pro scope.
- Pricing is not in the supplied facts: Ask Security Onion Solutions for Pro pricing, term length and renewal terms in writing.
Confirm with Security Onion Solutions whether your planned hosting or delivery model falls within ELv2 and which Pro features your compliance controls require.
Graylog Open is licensed under the Server Side Public License version 1 (SSPL-1.0), which is not OSI approved, and this has been the case since Graylog 4.0 in 2020. Graylog Open is free with no volume limits and community support. The paid editions are Graylog Enterprise and Graylog Security, both licensed on processed data with no per-user or per-device fees according to Graylog's pricing page.
- Graylog Open under SSPL-1.0: Free to use, with community support, and not an OSI open source license.
- Graylog Enterprise at 15,000 US dollars per year: Includes archive restore, data tiering and the correlation engine, with a minimum of 10 GB per day or 100 Graylog Compute Units.
- Graylog Security at 18,000 US dollars per year: Adds SIEM features such as risk scoring, anomaly detection, investigations, compliance packs and prebuilt threat detection content, with the same stated minimum.
- Index archiving, correlation, reporting and Illuminate content: These sit in the paid editions, not Graylog Open.
- Licensing basis: Pricing is tied to processed data, so ask how ingest growth and minimums are measured in your quote.
Confirm the current pricing, minimums and SSPL obligations with Graylog before budgeting, because list prices and terms can change.
What drives the running cost of each platform
Wazuh, Security Onion and Graylog are all free to download, so the running cost comes from hardware, storage, paid editions and the people who tune and operate them. Each card below names one cost component, whether it is one-time or recurring, and what to request in a written quote.
Wazuh indexer and server capacity
Wazuh has no license fee for the server or agents, but the indexer stores every alert and archived event, so storage and node count grow with endpoint count and retention. Hardware and cloud instances recur every month or year, while the initial sizing and cluster build are one-time work. Ask any implementer to state the endpoint count, daily event volume and retention period they sized for, and to separate hardware, storage and labor in the quote.
Wazuh rule tuning and staffing
Wazuh ships over 3,000 built-in rules and decoders, but every environment still needs tuning to suppress noise from its own software and business applications. This is ongoing labor that recurs as endpoints, applications and detections change. Ask for the scope of rule tuning, which analyst hours are assumed, and whether the work is included in a fixed-scope build or a retainer.
Security Onion sensor and search hardware
Security Onion's documented minimums are 4 cores and 24 GB RAM for a standalone node, 4 cores and 16 GB RAM for a manager or search node, and 4 cores, 12 GB RAM and 2 NICs for a sensor, with 32 GB RAM or more suggested for even small traffic volumes. Sensors need network taps or span ports, so network changes are a one-time cost that recurs whenever you add a link. Ask the implementer to size sensors for your peak throughput rather than the minimums.
Security Onion Pro subscription
Security Onion is free under the Elastic License 2.0, but Security Onion Pro is a paid license sold on 1 to 5 year terms. It adds OIDC single sign-on, FIPS mode, OS STIG compliance, the API, notifications, Manager of Managers and professional support. The fee recurs for the term, so compare it with the cost of building those controls and support in-house. Ask for the exact term length, renewal terms and which Pro features are included.
Graylog storage sized from ingest
Graylog's architecture guidance sizes log storage as daily ingest times retention days times 120 percent, and recommends a message journal of 3 to 5 times daily ingest on SSDs. Storage and the MongoDB and search nodes that hold it recur every month, and they grow with retention. Ask for the daily ingest figure, retention per stream and the storage tier used for the journal before accepting any quote.
Graylog Enterprise or Security fees and shared support
Graylog Open is free with no volume limits, but correlation, archive restore, data tiering, prebuilt detection content and 24/7 support sit in paid editions. Graylog Enterprise starts at 15,000 US dollars per year and Graylog Security at 18,000 US dollars per year, each with a minimum of 10 GB per day or 100 Graylog Compute Units, per Graylog's pricing page. Staffing for operations and on-call is a recurring cost on all three platforms, so ask each vendor and partner to quote run, upgrade and support hours separately.
What implementing each platform involves
Implementation effort differs more by platform shape than by license. Wazuh has four components to place: the Wazuh indexer, the Wazuh server, the Wazuh dashboard and agents on endpoints. The documented install routes include the all-in-one and step-by-step installation, a prebuilt OVA virtual machine, an Amazon Machine Image, Docker, Kubernetes, Ansible, Puppet and an offline installation guide for hosts without internet access. Choose the route before you size hardware, because the offline guide changes how vulnerability data reaches the server: the offline vulnerability repository replaces the Wazuh Cyber Threat Intelligence platform. Agent rollout is usually the longest phase. Confirm which of your Linux, Windows, macOS, Solaris, AIX and HP-UX hosts you will cover, and decide how agent enrollment and configuration pushes will be governed by your change process.
Security Onion's effort sits in its architecture. The recommended production design is Distributed, with a manager node, sensor nodes and search nodes, and if the manager goes down, search nodes stop indexing because they cannot reach Redis, so plan manager availability first. Version 3.x runs only on Oracle Linux 9, and an existing 2.4 installation can move to 3 on Oracle Linux 9 only after full packet capture moves from Stenographer to Suricata, while other distributions need a fresh install. Air-gapped sites should plan the ISO workflow: the ISO carries packages and NIDS, YARA and Sigma rules, and the soup tool updates from newer ISO media in airgap mode. Confirm sensor placement and traffic volume with your network team, since the hardware documentation suggests 32GB of RAM or more even for small traffic volumes.
Graylog is a set of services you assemble yourself. Graylog 7.x needs MongoDB for configuration and metadata, and the multi-node guide recommends three Graylog and MongoDB nodes with MongoDB running as a replica set, three Data Nodes on their own cluster and a load balancer in front of the Graylog nodes. Follower Graylog nodes must have is_leader set to false. Log source onboarding is ongoing work: each input (syslog, GELF or Beats), stream and processing pipeline is built by your team, and the Graylog system architecture guidance on storage sizing and message journal sizing should be applied to your daily ingest and retention. Ask whether your team will run the MongoDB replica set and Data Node cluster, or whether that operating burden is part of a quote. In every case, the work needs in-house Linux, networking and detection engineering skills. Each platform still requires people who can tune rules, onboard sources and respond to alerts, and that staffing should be costed alongside the install.
How to narrow the shortlist to one platform or a pair
This sequence turns three open source SIEM candidates into one platform or a deliberate pair by testing log sources, OS support, license terms, hardware and operating effort against the supplied facts.
Inventory the log sources that matter most
List every source you must collect from, then mark each as endpoint (servers, workstations, file integrity, host logs), network (traffic metadata, IDS alerts, packet capture) or application (vendor and custom application logs, syslog from appliances). Wazuh agents cover Linux, Windows, macOS, Solaris, AIX and HP-UX, and Wazuh also monitors agentless devices such as firewalls through syslog. Security Onion centers on Suricata, Zeek and full packet capture, while Graylog centers on inputs such as syslog, GELF and Beats. Done when each source has one category and an owner, and you can state whether endpoint, network or application data drives the decision.
Check operating system support against your fleet
Confirm which operating systems your servers and sensors run. Security Onion 3.0.0 supports only Oracle Linux 9, and it runs on x86-64 processors only. Earlier Security Onion 2.4 installations on Oracle Linux 9 can upgrade to 3, while other distributions need a fresh install. Check whether your Linux estate, Windows hosts or any ARM or non-x86 hardware would be excluded. Graylog and Wazuh are documented on other distributions, so confirm each platform's current compatibility matrix for your exact versions. Done when every platform on the shortlist has been marked as supported, unsupported or needs confirmation for each OS in your inventory.
Confirm license fit for your delivery model
Review the license terms with your legal and procurement teams. Wazuh server and agent are GPL-2.0 with an OpenSSL linking exception, and the Wazuh indexer and dashboard are Apache-2.0. Security Onion is under Elastic-2.0, which forbids offering the software as a managed service, and Elastic-2.0 is not OSI approved. Graylog Open is under SSPL-1.0, which is also not OSI approved. If you plan to run the platform for internal teams only, these terms may differ from a service you offer to others. Done when counsel has written down whether each license permits your intended use, and you have a documented decision for any platform that needs a different model.
Map paid features to the controls you need
Compare the features your program requires with what each free edition includes. Graylog Open excludes index archiving, correlation, reporting and prebuilt Illuminate detection content, which sit in Graylog Enterprise or Graylog Security. Security Onion Pro adds OIDC single sign-on, FIPS and STIG hardening, notifications, the API, Manager of Managers and reports. Wazuh's ruleset ships over 3,000 built-in rules and decoders and maps alerts to MITRE ATT&CK, and its dashboard includes prebuilt views for PCI DSS, GDPR, HIPAA and NIST 800-53. Ask each vendor for written pricing tied to your scope, since Graylog's published Enterprise and Security figures are per year with a minimum of 10 GB per day or 100 Graylog Compute Units. Done when every required feature is marked as free, paid or unconfirmed, with the paid edition named.
Size hardware from the documented minimums
Use the published minimums as a floor, not a sizing answer. Security Onion lists 4 cores, 24 GB RAM, 200 GB storage and 2 NICs for a standalone node, 4 cores and 16 GB RAM for a manager or search node, and 4 cores, 12 GB RAM and 2 NICs for a sensor, and it suggests 32 GB of RAM or more when monitoring even a small amount of network traffic. Graylog's architecture guidance advises log storage equal to daily ingest times retention days times 120 percent, with the message journal at 3 to 5 times daily ingest on SSDs. Wazuh storage depends on your agent count and retention, so confirm it with the vendor against your event rate. Done when you have a storage estimate per platform from your own daily ingest and retention figures, and a list of nodes for each design.
Decide whether two stacks are worth it
Test whether a pair justifies the extra operating load. Wazuh is host-focused with agents on endpoints, and Security Onion is network-focused with Suricata, Zeek and packet capture. Security Onion's Distributed design uses a manager, sensors and search nodes, and if the manager goes down, search nodes stop indexing, so plan for that dependency. Running Wazuh and Security Onion together means two ingest paths, two rule sets, two sets of upgrades and two license reviews. If one platform covers the top-priority sources, choose it and add the other later. Done when the team has written whether the pair meets a named requirement that one platform cannot, with the staff who will operate each stack identified.
Run a proof of concept on the top two candidates
Install the two leading candidates in a test environment that matches a representative slice of your fleet, using the offline installation paths if your network is isolated. Wazuh documents an offline installation guide and offline vulnerability repositories, and Security Onion supports airgap installs with an ISO that carries packages and NIDS, YARA and Sigma rules. Ingest a fixed sample of your real log sources, then check alert quality, tuning effort and the time your analysts need to triage. Done when the proof of concept produces a written comparison of coverage, alert handling and operating load, and that record is signed off by the security lead and the platform owner.
Record the decision and the switching exit
Document the chosen platform or pair, the license and feature conditions that support it, the hardware plan and the owner for each stack. Note what would force a change, such as a new OS in your fleet, a managed-service model, or a need for features that sit in a paid tier. Note the migration path if you later move: Security Onion 2.4 to 3 depends on the distribution and full packet capture change from Stenographer to Suricata. Done when the decision record is approved by the CISO or equivalent, and it lists the review date and the named owner for each platform.
Questions buyers ask before choosing a self-hosted SIEM
What does it cost to implement Wazuh, Security Onion or Graylog?
Software licensing is only one line in the budget, and for Wazuh and Graylog Open it is zero. Wazuh server and agents are GPL-2.0, so the cost is infrastructure, implementation labor and the staff who tune rules and run upgrades. Graylog Open is free with no volume limits, but Graylog Enterprise starts at 15,000 US dollars per year and Graylog Security at 18,000 US dollars per year, according to the Graylog pricing page, each with a minimum of 10 GB per day or 100 Graylog Compute Units. Security Onion is free to download, while Security Onion Pro is a paid license sold on 1 to 5 year terms. The main cost drivers are daily ingest, retention, sensor count and hardware, plus the scope of integrations. Ask each vendor or partner for a written quote that separates one-time setup from recurring license, hosting and support.
How long does a self-hosted SIEM rollout take?
No fixed duration applies to all three platforms, because the timeline depends on the number of endpoints, network sensors, log sources, detection content and the approval steps in your environment. Wazuh deployment is shaped by the agent rollout and the indexer and server layout you choose. Security Onion depends on sensor placement, packet capture and whether you use the Distributed design with manager, sensor and search nodes. Graylog depends on the search backend, MongoDB configuration and whether you run a multi-node cluster. Ask for a duration in the written scope, and ask who performs each stage, including the client team's time for access, change control and testing.
Can an in-house team run a self-hosted SIEM alone?
It can, but only if the team has the time and skills to tune detections, maintain storage and keep several components patched. Security Onion bundles Suricata, Zeek, Strelka, full packet capture and Elasticsearch in one distribution, and its Distributed design adds manager, sensor and search nodes that must stay in sync. Wazuh combines an indexer, server, dashboard and agents, and its ruleset ships over 3,000 built-in rules. Graylog requires MongoDB and a search backend in addition to the Graylog servers. Patch cadence is a real staffing input: Wazuh shipped 4.14 patch releases six times in 2026. Map your staff against those components before deciding, and consider a retainer for ongoing support and upgrades if internal capacity is thin.
Is Graylog Open enough for SIEM use cases?
Graylog Open covers log collection, search, dashboards, alerting and index retention, but several SIEM features sit in paid editions. Index archiving, correlation, reporting and prebuilt Illuminate detection content are available in Graylog Enterprise or Graylog Security, not Graylog Open, according to Graylog documentation. Graylog Open is also licensed under SSPL-1.0, which is not OSI approved, so legal review is needed if your policy requires OSI-approved licenses. If your goal is endpoint detection, file integrity monitoring or built-in MITRE ATT&CK mapped rules, Wazuh covers more of that ground without a license fee. Confirm the specific detection content you need against the current edition tables before deciding.
Can Security Onion run in an airgapped network?
Yes, Security Onion supports full installs on networks without internet access. The ISO carries packages along with NIDS, YARA and Sigma rules, and the soup update tool can apply updates from newer ISO media in airgap mode, according to the Security Onion airgap documentation. You still need to plan how rule and package updates reach the isolated network, how media is verified and how the sensors and search nodes are placed. Security Onion supports only x86-64 processors and, with version 3.0.0, only Oracle Linux 9. Confirm the hardware and operating system against the current requirements before you commit to an airgapped design.
Can Wazuh and Security Onion run together?
Yes, they cover different layers and are often deployed side by side. Wazuh agents report host activity such as file integrity, log analysis and vulnerability data from endpoints, while Security Onion sees network traffic through Suricata, Zeek and full packet capture. Running both means two stacks to operate, two sets of hardware and two license models to review, since Wazuh is GPL-2.0 and Security Onion is published under the Elastic License 2.0. Decide first whether you need a single correlation point, and confirm how each platform's alerts will be routed to your ticketing or response process before rollout.
When running two of these platforms together makes sense
Running two of these platforms together makes sense when one tool cannot see both sides of the problem. A common pairing is Wazuh for endpoint monitoring and Security Onion for network monitoring. Wazuh agents on Linux, Windows and macOS hosts see file integrity changes, the software inventory and host logs, while Security Onion's Suricata and Zeek sensors see traffic on the wire and can run full packet capture. Before committing, confirm that the network sensors can be placed where your critical traffic crosses, and that your team is prepared to run a second distribution with its own x86-64 hardware, since Security Onion supports only that architecture and needs at least 4 cores and 24 GB RAM for a standalone node. Wazuh and Security Onion overlap on alert review, so decide which console is the primary queue before you deploy.
Adding Graylog makes sense when the main need is centralizing application, network device and cloud logs that do not come from Wazuh agents or Security Onion sensors. Graylog Open is free, but its index archiving, correlation, reporting and prebuilt Illuminate detection content sit in the paid Graylog Enterprise or Graylog Security editions. Graylog also needs MongoDB for configuration and a search backend, so each extra stack adds hosts, upgrades and a second set of retention settings. Ask the vendor which Graylog edition covers your daily ingest, and confirm the license position with your counsel, since the SSPL is not OSI approved. Each stack also has its own license terms, so a three-platform design multiplies the compliance review.
Any combined design needs one named owner for alert triage. Without that owner, Wazuh, Security Onion and Graylog each raise alerts into separate queues, and the same intrusion can appear three times with three severities. Assign a single triage process, define which platform is the system of record for each alert type, and document how a finding is handed from one console to another. Staffing is the real cost driver here: each platform needs its own engineers for tuning, upgrades and storage, so ask any implementation partner to quote the operating effort for each stack separately, and check that the written scope covers integration between them.
How DeployOpen helps you choose and implement a SIEM
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. We start by matching the choice between Wazuh, Security Onion and Graylog to your telemetry, staffing and license constraints, then build the platform you select in your environment.
How we scope
- Written scope lists which log sources, endpoints, network segments and retention periods the platform must cover.
- Scope records whether endpoint agents, network sensors, or log pipelines are in the first phase and which are deferred.
- Scope states the license position you accept, including SSPL and Elastic License 2.0 terms, before any build starts.
How we build
- Deployment follows the topology you choose, such as Wazuh all-in-one, Security Onion distributed or Graylog with Data Node.
- Sizing uses your ingest rate and retention with the vendors' documented hardware minimums and storage formulas.
- Detection content, such as Wazuh rules, Suricata rules or Graylog event definitions, is tuned against your own sample traffic.
How we hand over
- Handover documents the architecture, sizing assumptions, upgrade path and the paid features your chosen edition does or does not include.
- Runbooks cover agent enrollment, rule changes, index retention and recovery steps for the manager or search node.
- Your team receives evidence of configuration and testing that your internal auditors or certification bodies can review.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope engagement ends.
- Retainers can cover vendor release tracking, such as Wazuh 4.14 patches or Security Onion point releases, and planned upgrades.
- Confirm with DeployOpen what response coverage the retainer provides before you sign, since it is set in the written agreement.
