Open Source SIEM in 2026: An Honest Comparison of Wazuh, Elastic, Security Onion and Graylog

"Free SIEM" is one of the highest-intent searches in this industry, and almost every result is a vendor page pretending its own product has no downsides, or a listicle that ranks eight tools it clearly never installed. The honest version is less flattering: every option on this list is genuinely free (or close to it), genuinely capable, and genuinely going to cost you something — RAM, operational time, or detection content you have to build yourself.

This is a comparison for SMBs and lean teams who are actually going to run one of these, not evaluate them for a Gartner report. Four tools, no hero: Wazuh, the Elastic Stack (and Security Onion, which is built on it), Graylog, and a nod to OpenSearch.

What "open source SIEM" actually means here

The phrase hides a lot of variation, so a quick sort before the table:

• Wazuh is fully open source under GPLv2 — no paid tier exists, no feature is gated.
• Elasticsearch and Kibana were relicensed away from Apache 2.0 in 2021 (SSPL / Elastic License), then in September 2024 Elastic added AGPLv3 as an option — so the core is genuinely open source again. The Security app's advanced features are still gated by subscription (Basic / Platinum / Enterprise), even self-managed.
• Graylog Open is "source-available" under SSPL, not an OSI-approved open-source license, and — this matters — it is missing features you would assume are core to a SIEM. More below.
• OpenSearch is the AWS-led Apache 2.0 fork of Elasticsearch/Kibana from the 2021 split. No license gating, no subscription tiers.

None of that disqualifies anything here. It just means "open source" and "free to actually alert on something" are not always the same claim.

Wazuh

Wazuh is a unified agent-based platform: a Manager that analyzes data and pushes config to agents, an Indexer (a fork of OpenSearch — worth knowing, since it means Wazuh inherits OpenSearch's storage and query characteristics), a Dashboard, and lightweight Agents for endpoints, cloud workloads and containers.

Strengths: genuinely free with no artificial limits — no agent cap, no log-volume cap, no paid tier waiting behind a feature flag. It ships useful things out of the box: file integrity monitoring, vulnerability detection against installed software, and CIS/PCI-DSS/GDPR compliance dashboards. One stack, one install path, active development (Wazuh 5.0 was in beta as of mid-2026, moving to clustering-by-default and dropping the Filebeat dependency).

Weaknesses: Wazuh's native detection format is its own XML rules-and-decoders syntax, not Sigma. There is no built-in Sigma engine — you convert Sigma rules to Wazuh's format with a community backend (pySigma-backend-wazuh or the SigWaz project) before they run. The default ruleset leans heavily toward compliance and vulnerability signatures; behavioral, ATT&CK-mapped detection content for things like living-off-the-land abuse or credential access is thin unless you add it. And because the Indexer is OpenSearch under the hood, it inherits OpenSearch's appetite for RAM once you're past a handful of agents.

Best for: an SMB that wants one free platform covering endpoint telemetry, FIM, vulnerability scanning and basic compliance reporting, and is willing to bring (or buy) its own behavioral detection content.

Elastic Stack and Security Onion

Elastic Stack (Elasticsearch, Kibana, plus Beats or Elastic Agent for shipping) is the general-purpose search-and-analytics engine that the Security app sits on top of. On the free Basic self-managed license, you get Elasticsearch, Kibana, Elastic Common Schema, and — genuinely useful — a set of prebuilt SIEM detection rules with ATT&CK mapping. Machine-learning-based anomaly jobs, prebuilt-rule customization workflows, and alert suppression sit behind Platinum.

Security Onion is a free Linux distribution that pre-wires Elastic Stack together with Suricata (network IDS), Zeek (network security monitoring), Wazuh (as its host-agent layer), TheHive (case management) and CyberChef. It is the closest thing on this list to a turnkey SOC-in-a-box, and it is the one tool here that gives you real network visibility, not just log aggregation.

Strengths: Elastic's query surface (Lucene, EQL, ES|QL) is the best of the group, the Basic-tier prebuilt rules are a real head start compared to Wazuh's or Graylog's out-of-the-box content, and Security Onion adds packet-level detection that none of the others offer. Both are actively maintained with large communities.

Weaknesses: operationally, this is the heaviest option. Security Onion's own sizing guidance scales with network traffic volume (Mbps), not endpoint count — a modest evaluation install commonly wants 12+ CPU cores and well over 20GB RAM, and production distributed deployments go up from there. Elastic alone is lighter but still a cluster you have to run, tune, and upgrade. And Security Onion still inherits Elastic's licensing tiers underneath for anything beyond Basic-level Security app features.

Best for: teams with real networking chops who want network-level detection (not just host and log data) and can dedicate hardware and time to it — or teams that already have Elastic skills in-house.

Graylog

Graylog is a log management platform first, with a security layer bolted on top in the paid tiers. Graylog Open covers ingestion, parsing, pipelines, streams, dashboards and search — genuinely unlimited on log volume, with no artificial ingest cap.

Strengths: it is the lightest of the four to actually operate, the pipeline/parsing UI is clean, and there is no volume-based pricing anxiety in the free tier.

Weaknesses, and this is the one that matters most: Graylog Open has no alerting, no correlation engine, and no Sigma rule support. All three are reserved for the paid Graylog Security edition (list pricing starts around $18,000/year). That is not a minor gap — it means the free edition cannot fire an alert on a detection rule at all. You can centralize and search your logs for free; you cannot get Graylog to tell you when something bad happened without paying. Calling Graylog Open a free SIEM is a stretch; it is a genuinely good free log management tool with a clear, budgeted upgrade path to become a SIEM.

Best for: centralizing and searching logs today, on a deliberate path to pay for Graylog Security once alerting becomes a requirement — not a standalone free detection platform.

The one worth a nod: OpenSearch

OpenSearch (the Apache 2.0 fork Elastic's 2021 relicensing spawned) doesn't get the marketing budget of the other three, but its Security Analytics plugin is arguably the most Sigma-native tool on this list: it ships with roughly 2,200 prepackaged, open-source Sigma rules already converted, a detector framework that maps them to your log sources, and a free alerting engine wired into OpenSearch Alerting — no license tier stands between you and an alert firing.

The trade-off is that OpenSearch gives you fewer turnkey pieces than Wazuh: no built-in endpoint agent (you bring Beats, Fluent Bit, or a Wazuh agent as a data source), a smaller ecosystem, and rougher UI edges. And since Wazuh's own Indexer is OpenSearch, picking "Wazuh" and "OpenSearch" isn't really an either/or — plenty of teams end up running both, Wazuh for endpoint collection, Security Analytics for native Sigma-driven alerting on top.

Comparison table

Realistic resource requirements

Vendor "minimum requirements" pages describe what boots, not what you actually want running detection content against real traffic. Rough, honest planning numbers for a lean SMB deployment:

Treat these as planning starting points, not guarantees — always check the current official sizing guide before committing hardware, and re-check at every major version bump (Wazuh 5.0's architecture changes alone will shift its numbers).

The part that actually matters: an empty SIEM detects nothing

Here is the thing none of these comparisons tell you, because it isn't a feature any vendor page can put a checkmark next to: installing any of these tools gets you a very capable, very empty box. A SIEM without detection rules is a log search engine with better branding. It will hold your data, it will let you query it, and it will alert on precisely nothing until something tells it what "bad" looks like.

Every tool above ships thin default coverage for exactly this reason:

• Wazuh's defaults lean compliance and vulnerability, not behavioral detection.
• Elastic's Basic-tier rules are a decent start but stop well short of comprehensive ATT&CK coverage.
• Graylog Open doesn't even let you alert, paid or not, without buying Sigma support.
• OpenSearch's Security Analytics plugin is the exception — genuinely strong out-of-the-box Sigma coverage — but even a good starting ruleset goes stale. New techniques appear, false-positive tuning is per-environment, and nobody is testing that 2,200-rule bundle against your logs.

That gap — thin default content, or good-but-aging default content — is the actual work of running a SIEM. It's not the install; it's writing, mapping to ATT&CK, false-positive-testing, and continuously updating detection rules. That's the part that never shows up on a comparison chart, and it's also exactly where ThreatClaw's Sigma feed and detection rules feed are built to help — a maintained, tested stream of Sigma content mapped to ATT&CK, regardless of which of the four platforms above you land on.

How each ingests Sigma

Sigma is a shareable rule format, not a query language any of these tools execute natively — every one of them needs a conversion step, and how painful that step is varies a lot:

If you're going to standardize on one format to write and maintain your own detections in, regardless of backend, Sigma is still the right call — it's the only one of these that isn't locked to a single platform.

FAQ

What is the best free SIEM? There isn't a single best one — it depends on what you're optimizing for. Wazuh is the best all-in-one free platform if you want endpoint agents, FIM and vulnerability scanning bundled in. OpenSearch with Security Analytics is the best choice if native Sigma support and free alerting matter most. Security Onion is the best choice if you need real network traffic visibility. Graylog Open is a strong free log management tool, but it is not a standalone free SIEM — it can't alert without a paid upgrade.

Is Wazuh really free? Yes. Wazuh is licensed under GPLv2 with no paid tier, no agent limit, and no feature gated behind a subscription. The cost isn't licensing — it's the engineering time to run, tune, and — the part this article is about — feed it detection content, since its native rule format isn't Sigma and its default ruleset is thin on behavioral detections.

Do I need to write my own detection rules? You need someone to provide them, whether that's you, a community feed, or a maintained commercial feed — but "writing your own from scratch" is the expensive option, not the required one. All four platforms above ship with some default content, but it ranges from thin (Wazuh, Graylog) to decent-but-static (Elastic Basic, OpenSearch's Sigma bundle). None of it stays current on its own; someone has to track new techniques, map them to ATT&CK, and false-positive-test them against real environments.

Can I just run any Sigma rule against these SIEMs directly? No — Sigma is a shareable, platform-agnostic format, not a query language any of these tools execute natively. Every platform needs a conversion step (see the table above), and the fidelity of that conversion varies: OpenSearch's Security Analytics plugin is closest to "native," Wazuh and Elastic both need a backend converter, and Graylog Open can't consume Sigma at all without paying.

None of these four tools is wrong, and none is a free lunch — pick based on what you're actually going to operate: endpoint-heavy and want one stack (Wazuh), network-heavy and have the hardware (Security Onion), search-first with Elastic skills in-house (Elastic Basic), pure log centralization today with a paid alerting path later (Graylog), or the most native Sigma support for free (OpenSearch). Whichever you land on, the install is the easy 10%. ThreatClaw's Sigma feed and detection rules feed exist for the other 90% — keeping the rules behind your SIEM current, mapped to ATT&CK, and tested, so the box you just stood up actually catches something.