Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response, and regulatory compliance. The solution includes the Wazuh manager, which is in charge of analyzing the data received from the agents, processing events through decoders and rules, and using threat intelligence to look for well-known IOCs (Indicators Of Compromise). A single Wazuh manager can analyze data from hundreds or thousands of agents. Alerts generated by Wazuh are sent to Wazuh indexer, where they are indexed and stored. The unique integration between Wazuh and Wazuh dashboard provides a powerful user interface for data visualization and analysis. The manager is also used to manage the agents, configuring and upgrading them remotely when necessary. Additionally, the manager is capable of sending orders to the agents, for example, to trigger a response when a threat is detected. Wazuh provides a security solution capable of monitoring your infrastructure, detecting threats, intrusion attempts, system anomalies, poorly configured applications, and unauthorized user actions. It also provides a framework for incident response and compliance, all in one platform.
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
This listing is free software; you pay only for the AWS ARM64 compute you run it on. Each dimension maps to a specific ARM64 EC2 instance type, billed hourly. The instances span several families: general purpose (m, a, t), compute-optimized (c), memory-optimized (r, x), storage-optimized (i, im, is), and GPU-capable (g5g). Within each family, sizes range from xlarge up through metal configurations. Larger instances carry more vCPUs, memory, and storage, so hourly rates rise with size. You pick one instance type to match your endpoint count and data volume. No commitment applies.
Top-of-mind questions for buyers
What does one hour of billing cover for a chosen instance type?
You are billed per hour that the selected ARM64 EC2 instance runs. One unit equals one running instance-hour of that specific type. The Wazuh software itself is free, so the hourly charge reflects only the underlying AWS compute you launch.
Am I charged when the instance is stopped or powered off?
Software charges meter running time only, so a fully stopped instance stops accruing hourly compute charges. Underlying AWS storage attached to a stopped instance may still incur separate AWS fees. You are billed again once you restart the instance.
How do I know which instance size to pick for my deployment?
Instance choice depends on how many endpoints and how much alert data you monitor. A single all-in-one host suits smaller environments, while larger endpoint counts and longer data retention need instances with more vCPUs, memory, and storage. Bigger environments may warrant a distributed, multi-node setup.
documentation.wazuh.com
Helpful?
Vendor refund policy
We do not currently support refunds.
How can we make this page better?
Tell us how we can improve this page, or report an issue with this product.
Give us feedbackReport a problem with this product or seller
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA).
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
To access the instance by ssh, you will need to use the user: wazuh-user
When the instance is launched, the user passwords are automatically changed to the instance ID with the first letter capitalized. For example: I-07f25f6afe4789342. This ensures that only the creator has access to the interface. This process can take an average of five minutes, depending on the type of instance. During this time, both SSH access and access to the Wazuh dashboard are disabled.
Wazuh has one of the largest open source security communities in the world. You can become part of it to learn from other users, participate in discussions, talk to our development team, and contribute to the project.
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Deploy a production-ready Wazuh security monitoring and SIEM stack on AWS in minutes. Includes Wazuh, OpenSearch, Filebeat, and Grafana for log management, threat detection, and compliance.
Be the first to review this product. We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.