Does anyone have experience or feedback regarding use of Wazuh as a SIEM, specifically for a small (~50 person) company and with all infrastructure in the public cloud?

Threat Intelligence & Incident Response Secure Code & Automation (DevSecOps)

2.1k views3 Comments

Sort by:

CISO in Education4 months ago

The new versión, 4.12 es PERFECT!!! I have 300 Devices....

CEO, MSSP - High Assurance Cybersecurity SOC in Services (non-Government)3 years ago

We've used stable versions in the past... takes a little bit of getting used to. For a small business well worth it if you have someone who can spend some time understanding it. At the end of the day it is a SIEM and will need nurturing and care.

CTO in Transportation3 years ago

Yes we are using it. We are using aws and we have been using Wazuh for close to 7 years now. No issues at all.

Content you might like

How do you monitor and restrict the types of visitor behavior information and PII 3rd-parties can discern, record, or extract via scripts and applications on your website?

We don't use any 3rd-party scripts16%

We can't monitor or restrict 3rd-party script behavior on our website31%

We trust vendors based on initial reviews22%

We test scripts periodically18%

We use Web Privacy Management, WebAppSec, or PriSec Software8%

We outsource website privacy and app security monitoring services2%

Other (please describe)

View Results

Are you seeing changes in the quality or speed of threat intelligence from sources you relied on in previous years? Can you share how you are being impacted so far by the uncertainty around public-private partnerships for cyber information sharing?

Have you ever done any sort of mental health check-in with your teams as part of the post incident assessment?

Yes, we always do this13%

We do this on occasion (if needed)63%

We haven’t before, but we will do this in future11%

No, we haven’t tried this and probably won’t9%

I don’t know / show results

View Results

How can security leaders in smaller organizations stay informed about emerging threats if they don’t have access to formal threat intelligence feeds?

Any examples you can share of effective use cases for threat intelligence beyond cybersecurity? Have you had success applying threat intelligence beyond IT/cybersecurity to increase its ROI or better justify that investment?