Wazuh 5.0 is looking great

General
, ,
1

I’ve been poking at alternatives for Elastic for a number of use cases, including including in The Homelab Almanac. While it’s still in beta (some sources say August release), version 5.0 of Wazuh is a complete rebuild. There’s a lot to like.

  • Non-alerted events visible by default (finally!)
  • Sigma rules as native detection engine language
  • YAML based custom decoders for exotic log types

The speed of standup for Wazuh now blows away Elastic.

This section of the docs really speaks to how things look now. I’m pretty hopeful.

2 Likes
2

Update on this: still really happy with it. The customization pipeline is really clean, and I’d argue it’s much easier to add log sources than Elastic, even. Documentation could use some work, but I’m still quite pleased.