Question 1

What is Wazuh, and how does the free-versus-paid split really work?

Accepted Answer

Wazuh is a unified SIEM and XDR platform. Agents installed on endpoints and servers collect logs, file-integrity events, package inventories and configuration-assessment results, and send them to a central manager that decodes, correlates and alerts on them, storing everything in an indexer you can search. The core of that platform is free under GPLv2, and we want to be unambiguous because getting this wrong would waste your time: there is no licence fee, no per-agent charge, no ingestion metering and no feature paywall. The detection engine, the compliance mappings, the vulnerability detection, the active response — all of it is in the free core. There is no enterprise edition holding features back. You can run Wazuh across ten thousand endpoints and pay Wazuh nothing. So what is sold? Two things, and neither is a feature unlock. Wazuh Cloud sells you the operation of the platform: Wazuh runs the manager, indexer, storage, upgrades and availability, and you consume it as a tenant. Professional Support sells you vendor accountability on a deployment you continue to run yourself: SLAs, health checks, architecture guidance, custom rule development and a named customer success manager. The mental model that helps is that Wazuh does not sell software, it sells the removal of operational burden — which is why the pricing is structured around agents and support hours rather than features or data volume. Your decision is therefore not 'free version or paid version'. It is 'who operates this'. If you have a capable platform team with spare capacity, the free core on your own infrastructure is a legitimate and fully supported answer. What you should not do is assume it costs nothing.

Question 2

What does Wazuh Cloud cost, and what is actually included?

Accepted Answer

Reported pricing, which you should treat as indicative and confirm at quote: Small at about $571 a month for up to 100 agents, with one month of indexed retention and three months of archive; Medium at about $923 for up to 250 agents, three months indexed and a year of archive; Large at about $1,467 for up to 500 agents, with the same retention as Medium. Above 500 agents the terms are custom. There is a 14-day free trial with no credit card required. Every tier includes the Standard support plan, PCI-DSS and SOC 2 attestation on the platform, threat intelligence, continuous updates and the full XDR and SIEM feature set. There is no feature difference between tiers — Small and Large run identical capability. What changes is agent capacity and retention. The important structural point is that the subscription folds infrastructure and operations together. This is not a licence you then pay a cloud provider to host. When you compare against self-hosting, compare against your total infrastructure plus operations bill, not against a hosting line alone — otherwise you are comparing an all-in price to a partial one. Two sizing warnings. First, retention often forces the tier before agents do: a 90-agent organisation fits Small on agent count, but Small holds one month of indexed data, so if you need longer searchable history you are looking at Medium or a custom arrangement regardless. Second, note the distinction between indexed and archive retention — indexed is hot and directly searchable, archive is retained but not instantly queryable. If your obligation is to retain, archive may satisfy it; if your obligation is to investigate across, it may not.

Question 3

Self-host or Wazuh Cloud? Work the TCO at Indian salaries.

Accepted Answer

This is the real decision, so let us do the arithmetic rather than assert a conclusion. The Cloud side is simple: Medium at roughly $923 a month is about ₹77,000 a month, or ₹9.2 lakh a year at approximately ₹83 to the dollar. All in — infrastructure, operations, upgrades, availability, Standard support. The self-hosted side has two lines. Infrastructure first: a production deployment for 250 agents with meaningful retention needs a manager, a multi-node indexer cluster and storage that grows with retention. On Indian cloud pricing, realistically ₹2.5 to 5 lakh a year, more if retention is long — call it ₹3.5 lakh mid-range. Then engineering, which is where the decision actually turns. A security engineer with SIEM skills in India averages around ₹10 lakh CTC; platform and DevOps engineers who can competently run a distributed indexer cluster sit meaningfully higher, ₹15 to 25 lakh being a fair band for someone you would trust with it. Running Wazuh well is not a full-time job at 250 agents, but it is not free either — honest steady state is 0.3 to 0.5 FTE covering cluster health, upgrades, storage, rule tuning and being available when it breaks. At ₹15 lakh CTC that is ₹4.5 to 7.5 lakh a year, plus a heavier first year. So: Cloud around ₹9.2 lakh, self-hosted around ₹8 to 11 lakh. At this scale they are roughly the same number, and anyone telling you self-hosting Wazuh saves lakhs at 250 agents has not counted the engineer. The comparison shifts in both directions. Self-hosting genuinely wins when you already employ that platform capability with spare capacity, at large agent counts where your engineering cost grows slowly while per-agent tiers keep climbing, and absolutely where air-gap or residency requirements make SaaS impossible. Cloud wins when you would have to hire, when your security team's time is better spent on detection than cluster maintenance, or when you want a predictable line item rather than a dependency on one engineer who might resign — a risk that is systematically underpriced.

Question 4

Can Wazuh run air-gapped or fully on-premises for a regulated Indian buyer?

Accepted Answer

Yes, and this is Wazuh's strongest structural advantage in the Indian regulated market. Every component — manager, indexer, dashboard — installs on your own hardware, in your own data centre, with no dependency on Wazuh's infrastructure and no mandatory vendor telemetry. Wazuh publishes a documented offline installation path: packages and dependencies downloaded on a connected host, transferred physically, and installed from local storage. Vulnerability detection continues to work air-gapped through offline CVE feeds — a detail that matters more than it sounds, because a vulnerability module that silently stops updating in a disconnected network gives false assurance, which is worse than none. For RBI, SEBI and IRDAI-regulated buyers, and for organisations whose DPDP position or contracts rule out sending security telemetry offshore, this is decisive. Security logs are among the most sensitive data an organisation holds — they describe your estate, your users and your weaknesses. Many Indian regulated buyers cannot place them in a foreign-hosted SaaS platform, and no amount of vendor assurance changes that mandate. This is exactly where the cloud-only competitors structurally cannot compete: Microsoft Sentinel, Google Security Operations and Securonix are cloud-native by architecture, so if your mandate says the data stays on your premises they are not expensive options, they are not options. It also addresses CERT-In cleanly, though we should be precise about what CERT-In actually demands, because the strict reading is frequently oversold — including by people selling on-premises platforms. Direction (iv) of the April 2022 Directions requires logs of all ICT systems be enabled and retained for a rolling 180 days “maintained within the Indian jurisdiction”. But CERT-In's own May 2022 FAQ, at Q35, softens this materially: logs “may be stored outside India also as long as the obligation to produce logs to CERT-In is adhered to” in reasonable time. Only financial-transaction records carry a firm obligation to remain in India. So CERT-In alone does not rule out a foreign-hosted SIEM, and any vendor telling you it does is overreaching. The requirement becomes real at sector level: IRDAI's 2023 guidelines carry over the 180-day retention rule, and its compulsory audit annexure poses a yes/no question that insurers must answer with a yes — are ICT infrastructure logs held in India? That is the checkbox a cloud-only SIEM with no Indian region cannot tick. Self-hosted Wazuh gives you complete control over both collection scope and physical storage location, which answers the strict reading and the sectoral one together. The trade-off is honest and unavoidable: choosing air-gapped means choosing self-hosting, which means owning the operational burden in full — which is precisely the buyer for whom Professional Support exists.

Question 5

How does Wazuh honestly compare with Elastic Security and ManageEngine Log360?

Accepted Answer

TechBag sells all three, so here is the real assessment rather than a pitch. Elastic Security is Wazuh's closest architectural relative — open-source-rooted, free at the Basic tier, self-manageable and air-gap capable. It is the strongest alternative and beats Wazuh in several places: more analytical depth, a far more powerful query language, better data-exploration ergonomics, and machine-learning-driven detections Wazuh does not match. Where Wazuh wins is endpoint breadth and out-of-the-box completeness: file integrity monitoring, configuration assessment against CIS, vulnerability detection and active response all ship in the free core, whereas the equivalent Elastic capability is split across tiers and the free tier lacks ML detections and the integrated endpoint agent. Elastic also carries a steeper learning curve. Simplified: Wazuh is more complete out of the box, Elastic goes deeper if you invest in it. Neither is a mistake. ManageEngine Log360 is the India-built commercial option, and for many Indian mid-market buyers it is the pragmatic choice. It prices per log source rather than per gigabyte, which is highly predictable and often cheaper than per-GB SIEMs for Windows and Active-Directory-heavy estates. Zoho is an Indian company with Indian support, Indian invoicing and Indian time zones, and that is a genuine operational advantage. Log360's AD auditing and UEBA are strong. Where it loses to Wazuh is on cost at high agent counts, on Linux and container depth, and on the fact that its detection logic is proprietary and less inspectable. If you are a 200-person Indian company running mostly Windows and you want something that works with minimal engineering, Log360 is very possibly the better buy, and we will sell it to you. Wazuh's clearest wins: you need air-gapped or on-premises, you have high agent counts where per-endpoint pricing hurts, or you want inspectable detection logic with no vendor lock-in.

Question 6

Why buy Wazuh through TechBag rather than direct?

Accepted Answer

The price is the same. What changes is everything around it. We will tell you not to buy it. We sell Elastic, Log360, Sentinel and Splunk too, so we have no incentive to push Wazuh where it does not fit. If you are a 150-person Windows shop with no platform engineer, we will probably point you at Log360 and explain why — a vendor's own sales team structurally cannot give you that answer. We do the TCO honestly, with your numbers. The arithmetic above uses market averages; we will run it on your actual agent count, retention obligation, existing infrastructure and existing team capacity, and if self-hosting the free core is genuinely right for you we will say so, even though it means we sell you nothing on that line. We handle the bespoke quotes: Professional Support pricing is not published and Cloud Custom above 500 agents is negotiated. Negotiating a bespoke security contract once every three years puts you at a structural disadvantage; we do it constantly. We get the residency question answered in writing — for regulated Indian buyers the hosting region and data-residency position of Wazuh Cloud is the question that decides viability, and we get it confirmed before you commit rather than after your auditor asks. Indian commercials: INR invoicing, GST-compliant documentation, purchase-order handling. And we stay after the sale — sizing the tier correctly, planning the retention posture against CERT-In, and being there at renewal when your agent count has grown. If Wazuh is right for you, we will get you the best terms available. If it is not, we will tell you before you sign.

Product	Licensing model	How you enter	Best for
The core platform	Free under GPLv2	Download and self-host — no purchase at all	Teams with platform capacity and no need for vendor accountability
Wazuh Cloud	Per agent-count tier, all-in (infrastructure + operations + Standard support)	14-day trial, no card; tiers at 100, 250 and 500 agents	Up to ~500 agents with no spare platform engineer
Professional Support	Bespoke annual contract, quoted per environment; Standard or Premium by SLA	Standard (8/5, 8-hour SLA) or Premium (24/7 critical, 4-hour SLA)	Self-hosted or air-gapped deployments under a mandate

Wazuh

Two intel pages. One free platform, two ways to run it.

Wazuh Cloud

Wazuh Professional Support

The open-source platform

Agentic AI patterns

Why “the licence is free, the system is not” is the whole story

One agent across a genuinely mixed estate

Detection logic you can actually read

Compliance and configuration assessment, continuously

Vulnerability detection that survives an air gap

The licence is free; the system is not

Peer & market recognition

Cybersecurity Stars Awards 2026

15 million+ endpoints

100,000+ organisations

Bootstrapped since 2015

Gartner Peer Insights 4.4/5

G2 4.5/5

PCI-DSS and SOC 2

Air-gap capable

The company in six figures

See the platform, hear the pitch

Wazuh — the open source security platform

Introducing Wazuh 4.8

Where Wazuh sits — the grids

Wazuh Across Its Platform

The Depth × Flexibility Map

New to this? Learn it properly.

Where should you start with Wazuh?

SIEM, XDR, and why Wazuh is sold as both

What 'free and open source' actually costs

Reading the Cloud tiers properly

CERT-In's 180 days, and where your logs sit

Air-gapped Wazuh, done properly

Wazuh vs Elastic vs Log360

The acronym decoder

Buy it like you’ve done this before

Count agents and name your constraint

Decide the deployment model before the vendor

Run the 14-day Cloud trial with real sources

Price both paths over three years

Test retention against your obligation

Get the residency answer in writing

The licensing cheat-sheet

Five pitfalls that cost buyers quarters

Budgeting the licence at zero and stopping there

Sizing on agent count and ignoring retention

Assuming self-hosting automatically satisfies residency

Confusing support with a managed service, or with MDR

Underestimating tuning

The evaluation kit

Skip the homework entirely

The forces shaping this market

Category momentum — estimated market growth

Open source displacing per-GB SIEM

CERT-In's 180 days driving purchases

Residency mandates ruling out cloud-only SIEM

SIEM and XDR consolidating

Agentic AI for detection engineering

Managed subscriptions as ops costs surface

Questions buyers ask about Wazuh

Ready to shortlist Wazuh?