Question 1

What exactly am I buying, and what am I definitely not buying?

Accepted Answer

You are buying vendor accountability on a deployment you continue to operate yourself. Concretely: response SLAs, structured health checks, architecture and sizing guidance, upgrade planning, custom decoder, rule and dashboard development, and a named customer success manager. Standard is 8/5 with an eight-hour response target and two health checks a year; Premium is 24/7 on critical issues with a four-hour target and four health checks. What you are not buying matters just as much, because conflating these three is the commonest disappointment on this product. This is not a managed service — Wazuh does not run your cluster, does not own your upgrades and does not carry your pager. If you want that, you want Wazuh Cloud. And this is emphatically not MDR: nobody at Wazuh is watching your alerts, triaging them or responding on your behalf, and Wazuh does not sell that service at any tier. If what you actually need is a team monitoring your environment around the clock, that is a genuinely different purchase and we would rather point you at one than sell you this and watch it disappoint you. The mental model that keeps this straight: Cloud removes the operational job. Support makes the vendor answerable while you keep the job. MDR removes the analysis job. Wazuh sells the first two.

Question 2

Who is this genuinely right for?

Accepted Answer

Three buyers, and it is worth being specific because the wrong ones are easy to spot in hindsight. First and most clearly: organisations whose mandate rules out SaaS. RBI, SEBI and IRDAI-regulated entities, government and public-sector bodies, defence-adjacent manufacturers, and anyone whose contracts prohibit sending security telemetry offshore. For these buyers the deployment model is not a preference to be traded against price — it is a constraint, and it eliminates most of the SIEM market before any comparison begins. Second: air-gapped environments. If there is no internet path, the entire cloud-native category is unavailable to you at any budget, and Wazuh's documented offline installation and offline CVE feeds make it one of very few credible options. Third: large agent counts. Cloud tiers cap at 500 and price per agent, while self-hosted infrastructure grows with data volume and engineering cost grows barely at all — the same person can run 500 agents or 5,000. Above roughly 500 the economics tilt steadily toward self-hosting. Who it is wrong for: the organisation with no platform-engineering capacity that chose self-hosting to save money. That buyer has bought a support contract for a cluster nobody has time to run, which is the worst of both paths — paying for accountability while accumulating operational debt. If you cannot name the person and the hours, buy Cloud instead, and we will tell you so.

Question 3

What does it cost? And why can nobody tell me a price?

Accepted Answer

Professional Support is a bespoke annual contract quoted per environment. There is no published list, no per-agent rate card and no public benchmark, and that is a genuine structural disadvantage for you rather than a minor inconvenience. Pricing depends on deployment size and complexity, the number of environments, whether you need Standard or Premium coverage, and how much custom detection engineering you expect to consume. Two things worth holding onto during that conversation. First, the licence remains free — you are negotiating the price of expertise and accountability, not of software, and if you walk away you keep the platform and keep running it exactly as before. Very few enterprise purchases leave you that fallback, and it is real leverage. Second, the total cost of the self-hosted path is not this contract. It is this contract plus your infrastructure — realistically ₹2.5 to 5 lakh a year for a 250-agent production deployment with meaningful retention — plus 0.3 to 0.5 FTE of engineering time, which at ₹15 lakh CTC is another ₹4.5 to 7.5 lakh. Budget the whole thing or the comparison against Cloud is meaningless. This is exactly where TechBag earns its place: you negotiate a bespoke security contract perhaps once every three years, and we do it constantly. We know what these settle at, and we will tell you when a quote is out of line.

Question 4

Does self-hosting solve my India data-residency and CERT-In obligations?

Accepted Answer

It gives you the ability to solve them, which is not the same thing, and the distinction matters enough to be pedantic about. Self-hosting means you choose where the indexer physically sits and you can evidence that choice to an auditor. It does not mean the placement is automatically correct — plenty of self-hosted deployments sit in a foreign cloud region because that is where the team already had capacity. Control is a precondition for compliance, not a substitute for it. On the obligation itself, be careful of the strict reading, including when we or any on-premises vendor offers it, because it happens to favour what we are selling. CERT-In's April 2022 Directions require logs of all ICT systems to be enabled and retained for a rolling 180 days and maintained within the Indian jurisdiction. But Q35 of the May 2022 FAQ that CERT-In itself published allows the logs to sit outside India, so long as they can still be produced to CERT-In within a reasonable time; only records of financial transactions carry a strict duty to stay in India. So CERT-In alone does not forbid a foreign-hosted SIEM. Where residency genuinely bites is sectoral. IRDAI's 2023 guidelines take on the same 180-day rule, and the audit annexure they make mandatory includes a yes/no question, which an insurer has to answer yes, on whether its ICT infrastructure logs are kept in India. RBI-regulated entities face payment-data localisation and must secure RBI audit and inspection rights over any foreign provider. If one of those describes you, self-hosting is not merely convenient — it is the straightforward way to answer the question, and this contract is how you do it without carrying the platform alone.

Question 5

Standard or Premium — how do I choose without overbuying?

Accepted Answer

Choose on your coverage window rather than on your budget, because that is the difference that will actually matter to you at the moment it matters. Standard is 8/5 with an eight-hour response SLA and two health checks a year. Premium is 24/7 on critical issues with a four-hour SLA and four health checks. The question to ask is concrete: if your indexer cluster fails at 2am on a Saturday, what happens? Under Standard, the clock does not start until business hours resume, so a Friday-night failure could mean a weekend of no security visibility — and the honest follow-up is whether anyone on your team would even be awake to notice. If your estate genuinely runs business hours and a night outage means fixing it Monday, Standard is honest value and Premium is overbuying. If you run 24/7 operations, or you are in a sector where a gap in log collection is itself a reportable problem, Premium is what you are actually buying and the four-hour SLA is the line item that justifies it. One more consideration people miss: the health-check cadence differs too, four a year against two. For teams where Wazuh expertise sits with one or two people, that extra structured review is often worth more than the SLA difference, because it catches slow drift — retention quietly falling short, rules that stopped firing after a log source changed format — that nobody internally has time to hunt for.

Question 6

Why buy this through TechBag rather than direct from Wazuh?

Accepted Answer

The price is the same. What changes is everything around it, and on a product with no published price that is worth more than usual. We will tell you not to buy it. We sell Wazuh Cloud, Elastic, Log360, Sentinel and Splunk, so we have no incentive to push you toward self-hosting. If you have no platform-engineering capacity and you are choosing this to save money, we will show you the arithmetic and recommend Cloud instead — a vendor's own sales team structurally cannot give you that answer. We negotiate the bespoke quote. You will do this perhaps once every three years; we do it constantly, and we know where these settle and what is negotiable within them. We do the TCO with your numbers — your agent count, your retention obligation, your existing infrastructure and your real spare capacity — and if the honest conclusion is that the free core unsupported is right for you, we will say so even though it means we sell you nothing on that line. We handle Indian commercials: INR invoicing, GST-compliant documentation, purchase-order handling. And we stay after the sale, sizing the retention posture against CERT-In and your sectoral obligations, and being there at renewal when your agent count has grown and the Standard-versus-Premium question deserves asking again.

Dimension	Self-hosted, community only	Wazuh (self-hosted)
When it breaks	Community forums	Vendor SLA — 8h Standard, 4h Premium
Architecture	Sized by trial and error	Sizing guidance from Wazuh
Custom content	Built in-house	Custom decoders, rules and dashboards
Health	Nobody checks	Two or four health checks a year
Deployment	Yours	Still yours — on-prem or air-gapped
Licence	Free	Still free — you buy support
Honest caveat	—	Not managed, not MDR; no published price
Best fit	—	Mandates that rule out SaaS

Dimension	Wazuh	Elastic Security	ManageEngine Log360	Microsoft Sentinel	Splunk Enterprise Security
Position	Open-source SIEM + XDR, free core	The closest relative — open-source-rooted	India-built commercial SIEM	SIEM for Microsoft estates	The reference SIEM
Pricing axis	Free licence; pay for Cloud tier or support	Subscription tier + resources	Per log source — predictable	Per GB ingested per day	Ingest or workload — historically costly
Does the meter discourage collecting?	No meter at all	Indirectly, via resource sizing	Only if you add sources	Directly — every GB costs	Directly, and expensively
Out-of-the-box completeness	FIM, SCA, vuln detection, active response in core	Split across tiers; free tier lacks endpoint agent	Strong on AD auditing, narrower elsewhere	Broad, but assembled from Azure services	Deepest content library in the category
Analytical depth	No ML detections; simpler query model	ML detections, powerful query language	UEBA included, moderate depth	KQL and strong ML	SPL — the deepest, if you invest
Air-gapped deployment	Documented offline install and offline CVE feeds	Fully self-managed	On-premises available	Microsoft-operated, cloud-only	Fully self-hosted available
India data residency	Self-hosted: yours to place. Cloud: Mumbai region listed	Self-managed: yours to place	India-built; on-premises or India hosting	Azure India regions available	Self-hosted: yours to place
The thing to plan around	Ops cost is real; tuning effort in week one	You operate it unless you buy Cloud	Windows-centric strengths	Azure portal retires 31 Mar 2027	Cisco integration reshaping roadmap
Best fit	Air-gap or residency mandates, high agent counts, mixed estates	Teams who will invest in analytical depth	Indian mid-market, Windows-heavy, minimal engineering	Microsoft-standardised estates	Engineers who will build with it

Wazuh Professional Support

The Wazuh product family

Quick facts

Understand what support covers — and what it does not

What is it?

Unsupported self-hosting vs Wazuh Professional Support — the honest table

The six pieces of the platform

Your cluster

Offline installation

Offline CVE feeds

The support contract

Health checks

What stays yours

Seven capabilities. On infrastructure you control.

Response commitments you can hold them to

Two or four structured reviews a year

Custom rules, decoders and dashboards

Sizing and architecture guidance

Upgrade planning and support

Supported disconnected operation

A named customer success manager

Watch Wazuh in action

Wazuh — the open source security platform

Introducing Wazuh 4.8

Keep the cluster. Stop being alone with it.

It is the only Wazuh that goes where you must go

The residency answer becomes yours to give

Economics that improve with scale

Health checks catch what your team has no time to look for

You are still not paying for the software

The numbers behind the platform

What your Wazuh Professional Support rollout looks like

Confirm the mandate that put you here

Count the engineering honestly

Choose Standard or Premium on your coverage window

Get the architecture reviewed before you build

Use the health checks as an audit rehearsal

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag SIEM Grid — Depth × Flexibility

Analytical Depth × SIEM–XDR Convergence

Wazuh Professional Support vs the field

Does Wazuh Professional Support fit you?

Choose Wazuh Professional Support if…

Choose Wazuh Cloud instead if…

Choose Elastic Security if…

Choose ManageEngine Log360 if…

Choose Microsoft Sentinel if…

What the self-hosted path actually costs

Two support plans, quoted per environment

Standard

Premium

Both include

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 10 questions to ask before a support contract

Questions buyers ask

Ready to evaluate Wazuh Professional Support?