Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response, and regulatory compliance. The solution includes the Wazuh manager, which is in charge of analyzing the data received from the agents, processing events through decoders and rules, and using threat intelligence to look for well-known IOCs (Indicators Of Compromise). A single Wazuh manager can analyze data from hundreds or thousands of agents. Alerts generated by Wazuh are sent to Wazuh indexer, where they are indexed and stored. The unique integration between Wazuh and Wazuh dashboard provides a powerful user interface for data visualization and analysis. The manager is also used to manage the agents, configuring and upgrading them remotely when necessary. Additionally, the manager is capable of sending orders to the agents, for example, to trigger a response when a threat is detected. Wazuh provides a security solution capable of monitoring your infrastructure, detecting threats, intrusion attempts, system anomalies, poorly configured applications, and unauthorized user actions. It also provides a framework for incident response and compliance, all in one platform.
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
This listing is free software; you pay only the hourly rate for the AWS EC2 instance you run it on. Pricing is not tiered by features—every option delivers the same all-in-one deployment, which bundles the server, indexer, and dashboard on one host. The dimensions are hundreds of EC2 instance types, all billed per hour. They differ by compute, memory, storage, and specialized hardware. You choose an instance that matches your workload size. Larger instances suit more monitored endpoints and longer data retention. Your hourly cost rises with the capacity of the instance type you select.
Top-of-mind questions for buyers
What does the hourly rate cover, and am I charged when the instance is stopped?
The software itself is free; you pay only the AWS EC2 rate for the running instance. Charges accrue per hour while the instance runs. A stopped instance stops accruing compute-hour charges, though attached AWS storage may still bill separately. Metering follows running time.
What does one instance actually run, and how many endpoints can it monitor?
Each instance runs the all-in-one deployment: the server, indexer, and dashboard on one host. A single host typically monitors up to 100 endpoints with about 90 days of indexed alert data. Larger monitoring needs call for an instance type with more compute, memory, and storage.
How do I move to a larger capacity, and does my cost change automatically?
There is no automatic tier upgrade. You choose one instance type, and its hourly rate is fixed by that selection. To handle more endpoints or longer retention, you deploy on a different instance type with more resources. Your hourly cost changes only when you switch instance types.
documentation.wazuh.com
Helpful?
Vendor refund policy
We do not currently support refunds.
How can we make this page better?
Tell us how we can improve this page, or report an issue with this product.
Give us feedbackReport a problem with this product or seller
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA).
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
To access the instance by ssh, you will need to use the user: wazuh-user
When the instance is launched, the user passwords are automatically changed to the instance ID with the first letter capitalized. For example: I-07f25f6afe4789342. This ensures that only the creator has access to the interface. This process can take an average of five minutes, depending on the type of instance. During this time, both SSH access and access to the Wazuh dashboard are disabled.
Wazuh has one of the largest open source security communities in the world. You can become part of it to learn from other users, participate in discussions, talk to our development team, and contribute to the project.
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Deploy a production-ready Wazuh security monitoring and SIEM stack on AWS in minutes. Includes Wazuh, OpenSearch, Filebeat, and Grafana for log management, threat detection, and compliance.
Be the first to review this product. We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.