Open source EDR for financial services

Overnight triage is done either by your own rota of analysts or by a partner's monitoring service, and open-source tooling does not change that fact. Wazuh and Velociraptor produce alerts and collections, but someone must decide whether each alert is benign, suspicious or an incident. Confirm three things before you commit: who is named on the rota, what their decision authority is at 2 a.m., and how quickly a critical alert must be acknowledged. Ask any partner to show the written triage runbook and the shift handover record, not just a staffing diagram.

Build in-house when you already run a staffed security operations center with enough depth to cover nights and holidays, and partner when you cannot justify that headcount. Many institutions split the work: they keep investigation and decisions in-house and buy monitoring hours or implementation help from a partner. The main cost drivers are analyst coverage across shifts, detection engineering time, on-call rules and support subscriptions for the platform. Ask for a quote that separates implementation, detection content, monitoring hours and escalation responsibilities so you can compare build and partner options on the same basis.

An escalation path needs named roles, severity criteria, timed handoffs and a record of every decision. Write down who receives a critical alert, who can isolate a host, who informs the incident commander and who contacts legal, the regulator liaison or the insurer. The path should also say what happens when the primary contact does not answer. Test it with a tabletop exercise before go-live, and keep the outcome in your incident records because examiners and insurers will ask for it.

Only actions your institution has explicitly approved should run automatically, and destructive actions should require a person. Wazuh active response can execute scripts on agents in response to rules, so the approval model belongs in the rule design. A common pattern is to automate low-impact steps such as enrichment, tagging and blocking a known malicious hash, while host isolation, account disablement and process termination on production systems go through an approver. Document each automated action, its trigger, its rollback and the owner who signed off on it.

Every change to a rule, suppression, threshold or active response script should be recorded with the reason, the reviewer, the test evidence and the date. Keep these records in version control where possible, so you can show which detections were active during any given period. Tuning without a trail makes it hard to explain a missed detection to an examiner or a forensic reviewer. Ask any implementation partner how changes are proposed, tested on a non-production group and approved before they reach the production rule set.

The main recurring cost is people: analysts covering every shift, a detection engineer who maintains rules, and an escalation contact who can make decisions after hours. The cost rises with the number of hours covered, the severity of your service levels and how often alerts need manual investigation. Infrastructure and support subscriptions add to that, and the platform itself may still need upgrades and capacity planning. Ask for a breakdown of recurring staff hours, one-time setup work and support terms so you can compare the figures with a partner or a commercial service without guessing.

Commercial EDR or managed detection and response often sits alongside open-source tooling where you need proven vendor content, managed monitoring or a prevention capability that your open-source stack does not provide. Open-source Wazuh and Velociraptor remain useful for telemetry, hunting, forensic collection and integration with your SIEM. Confirm whether the commercial service supports your operating systems, whether it can run in your environment and where its data is stored. For DORA-regulated entities, also check the contract terms on data location and exit, which are set out in the supplied regulatory facts.

A small team can cover night alerts alone only if the alert volume is low, the decision rules are clear and the on-call burden is sustainable over time. Most teams find that tuning reduces noise, but it does not remove the need for a person who can act when a critical alert fires. Ask yourself how many people can be on call, how often they are paged and whether they are trained to isolate a host safely. If the answer is uncertain, a partner can provide monitoring hours while your team keeps decision authority.

The main drivers are the size and mix of the endpoint estate, the staffing model for monitoring and response, and how long you keep telemetry. Open-source software itself carries no license fee for the core products, so the spend sits in infrastructure, storage, detection engineering, 24x7 analyst coverage, and any support or retainers you buy. Each endpoint adds agent management and alert volume, and Windows, Linux and legacy Unix hosts need different collection and tuning. Retention multiplies storage and indexer capacity, so decide retention periods with compliance and legal before sizing hardware. Ask any partner to split the quote into these components so you can see which ones scale with headcount and which scale with endpoints.

One-time costs usually include architecture and design, initial deployment of the Wazuh server, indexer, dashboard and agents, Velociraptor setup, integration with your SIEM or SOAR, and the first set of detection rules and artifacts. Recurring costs include infrastructure running costs, storage growth, staff time for alert triage and tuning, patching and upgrades (Wazuh has shipped 4.14 patch releases roughly every one to two months in 2026, so budget for regular maintenance), vulnerability data updates, and any retainers for support or continuous testing. Ask the quote to mark each line as one-time or recurring and to state which items renew annually.

A bank with mature security engineering can run Wazuh and Velociraptor in-house, provided it has people who can operate Linux servers, manage agents at scale, write and tune detection rules, and perform forensic collections. The harder part is staffing: alert triage needs trained analysts across all hours if you claim 24x7 coverage, and that is a people cost rather than a software cost. Many banks choose a hybrid model in which internal staff own the platform and a partner supplies deployment, hardening, documentation or retainer-based support. Decide this by mapping existing skills against the workload, not by the software license.

Duration depends on scope: how many endpoint groups are in scope, whether the server is deployed on-premises or in a cloud account, how many operating systems and legacy hosts need separate handling, how many integrations are required, and how quickly change approvals move. A pilot on one business unit typically runs before a wider rollout, and offline or segregated networks add time for media transfer and update procedures. No fixed duration is supplied here, so ask any implementation partner for a phased plan with milestones and the approval steps it depends on, then confirm the timeline in the written scope before work starts.

The project depends on accurate asset data, including an inventory of endpoints, servers, operating system versions and owners, because Wazuh vulnerability detection and agent deployment both rely on knowing what exists. You will also need change approvals for agent rollout, firewall and network changes, and any active response actions that could disrupt a business system. SOC staff must be named for alert handling, escalation paths and after-hours response, and someone must own detection tuning. Legal and compliance should confirm evidence handling and retention requirements before forensic collections begin. Put these dependencies in the scope so delays are visible and assigned.

No single tool satisfies these frameworks by itself. The FTC Safeguards Rule requires multi-factor authentication for any individual accessing an information system unless the Qualified Individual approves an equivalent control in writing, and it requires logging and monitoring of authorized user activity. Wazuh can collect and alert on logs and provides dashboards aligned to frameworks such as PCI DSS, but MFA enforcement comes from your identity stack, and PCI DSS anti-malware and other requirements may need a dedicated product. Velociraptor supports investigation and collection. Map each control to the tool, process or evidence that covers it, and have your QSA or the FTC-applicable counsel confirm the gaps. The PCI SSC does not enforce compliance, and assessments are issued by a Qualified Security Assessor or through a Self-Assessment Questionnaire.

Ask for a fixed scope listing endpoint counts by operating system, server and storage sizing with the retention period, the deployment model and hosting location, and every integration with the SIEM, SOAR and identity systems. The quote should separate implementation, hardening, documentation, training and handover from ongoing support, retainers and 24x7 monitoring, and state which items are one-time and which recur. Require named deliverables, acceptance criteria, assumptions about bank-provided inputs, change control for scope growth, and the upgrade and patching process. Also ask how the partner handles evidence for auditors and what is excluded, such as commercial anti-malware or external staffing. Fixed-scope agreements are the norm, so the written scope is what sets the price.

Staffing and retention shape the program more than the software does. Staffing decides whether alerts are triaged in business hours, after hours or around the clock, and it determines how fast a suspicious host is isolated. Retention determines how far back investigators can search for ransomware dwell time, insider activity or evidence needed by regulators and insurers, and it sets indexer and storage capacity. A bank that keeps detailed telemetry for longer periods will carry higher infrastructure and reporting costs. Model both variables together with your incident response requirements, and ask the partner to show how each choice changes the quote.