Relialbe SIEM with multiple EDR capabilites
Use Cases and Deployment Scope
Our Organization is a Security Service provider and we use Wazuh for Internal SOC as well as catering to multiple customers, it addresses the main problem of having visibility of all logs at a single place, the support of endpoint agents for linux windows or mac plus the capability of Wazuh manager to work as a syslog listener and support of RestAPI for log collection solves all kind of log coverage problems, simple xml based coding for decoders (parsers) and detection rules makes it easy for detection engineers to create detections easily, additional features like Sceure Configuration Assessment, IT Hygine, Compliance standard support and Vulnerability Management provides additional support to cover every aspect of SOC in terms of visibility, the ease of creating dashboards adds an additional layer of visibility and reporting
Pros
- Log Collection
- Annomaly Detection
- Dashbaord
Cons
- Container Security can be improved to collect better telemtry by default
- Endpoint Isolation feature can be added to make it one of the best EDR Present
Return on Investment
- Since it is an opensource project it has helped me deploy a SIEM and setup a SOC at a tighter budget basically free
- Also helped me comply to applicable standards
- made incidnet response easier
Usability
Alternatives Considered
Splunk Enterprise Security
Other Software Used
Microsoft Defender XDR, Fortinet FortiGate, Okta, JumpCloud, TheHive