Investigate
Threat hunting across agents and techniques.
Analysts can filter events, examine alert levels, compare activity across agents, and use MITRE ATT&CK mappings to follow meaningful leads.
Wazuh Gold Partner · Platform overview
One unified platform for complete protection.
Wazuh brings XDR and SIEM together in an open-source security platform. It collects and analyses security data from endpoints, cloud workloads, networks, applications, and third-party services so teams can detect threats, investigate incidents, automate response, and support compliance.
Platform overview
Discover Wazuh, the all-in-one security platform.
A unified analyst workspace connects endpoint security, threat intelligence, security operations, and cloud monitoring. Teams can move from asset posture and inventory to investigation and response while working from one consistent view.
- Endpoint security
- Threat intelligence
- Security operations
- Cloud security
Wazuh platform descriptions and screenshots are reproduced or adapted with permission for Al-Rasedah Technology as a Wazuh Gold Partner. View the official platform overview.
Capabilities
What the platform covers.
Wazuh groups its functionality into a set of security use cases. Each one is a capability you can switch on and tune to your environment.
Configuration assessment
Checks system and application settings against hardening policies and flags drift from your baseline.
Malware detection
Looks for malicious activity and indicators of compromise on monitored endpoints.
File integrity monitoring
Watches files and registry keys for changes to content, permissions, and attributes, with an audit trail.
Threat hunting
Log analysis and visibility mapped to the MITRE ATT&CK framework so analysts can pursue leads.
Log data analysis
Collects operating system and application logs and analyses them against detection rules.
Vulnerability detection
Correlates your software inventory against CVE data to surface known flaws.
Incident response
Active response actions that can run automated countermeasures when a rule fires.
Regulatory compliance
Controls and reporting that support frameworks such as PCI DSS, NIST, HIPAA, and TSC.
IT hygiene
Builds an inventory of applications, processes, open ports, and hardware across your estate.
Container security
Monitors Docker hosts, images, volumes, and container behaviour at runtime.
Posture management
Integrates with cloud providers to detect misconfiguration and security risk.
Workload protection
Covers cloud and on-premise workloads across AWS, Azure, GCP, Microsoft 365, and GitHub.
Capability descriptions summarise the Wazuh platform's documented functionality. Which capabilities apply, and how well they perform, depends on architecture, configuration, and tuning.
Extended detection and response
Active XDR protection from modern threats.
Wazuh XDR combines telemetry from endpoints, networks, cloud workloads, applications, and third-party APIs. This gives analysts one place to detect, analyse, investigate, and respond across multiple layers of the environment.
- Threat hunting
- Behavioral analysis
- Automated response
- Cloud workload protection
- Threat intelligence
- Compliance and reporting
Respond
Automated active response.
Use rule-triggered actions to block or contain a threat, with every response recorded for investigation and review.
Detect change
File integrity monitoring.
Track file and registry changes with the affected path, event type, rule context, severity, and audit trail in one view.
Universal endpoint agent
Use one multi-platform agent for malware detection, file integrity monitoring, endpoint telemetry, vulnerability assessment, configuration scanning, and active response.
Third-party integrations
Ingest and consolidate telemetry through syslog and APIs from security products, devices, cloud platforms, applications, and SaaS services.
Open-source flexibility
Inspect, customise, and extend the platform to fit your architecture, detection requirements, and wider security ecosystem.
Security information and event management
A comprehensive SIEM solution.
Wazuh SIEM centralises security telemetry from endpoints, network devices, cloud workloads, and applications. Events are aggregated, stored, enriched, and analysed to support threat detection, investigation, response, and compliance.
- Security log analysis
- Vulnerability detection
- Security configuration assessment
- Regulatory compliance
Prioritise exposure
Vulnerability detection.
Correlate software inventory with vulnerability intelligence, then break exposure down by severity, operating system, agent, and package.
Measure posture
Configuration assessment.
Evaluate systems against CIS benchmarks, review each failed control, and give remediation teams the command or registry context they need.
Alerting and notification
Correlate events from multiple sources, add threat-intelligence context, and deliver customisable alerts that help teams respond quickly.
Reporting insights
Turn SIEM events into clear reports for management, investigations, remediation tracking, and evidence across relevant security standards.
Official Wazuh product screenshots are shown with permission. Dashboard data is illustrative; results vary by scope, data sources, and configuration.
Architecture
How the pieces fit together.
Agents installed on your endpoints ship telemetry to the central components, which index it, analyse it against rules, and present it for analysts.
Monitored endpoints
WindowsLinuxmacOSSolarisAIXHP-UX
The Wazuh agent runs on Windows, macOS, Linux, Solaris, AIX, and HP-UX. Agentless collection covers network devices and cloud APIs.
Central components
- Wazuh serverAnalyses agent data against rules and decoders, and triggers alerts.
- Wazuh indexerIndexes and stores alerts and events, and makes them searchable at scale.
- Wazuh dashboardThe web interface for investigation, reporting, and platform management.
Deployable on Docker, Kubernetes, Ansible, or Puppet — self-hosted on infrastructure you control, or on an official hosted service.
Services
Wazuh gives you the platform. Al-Rasedah makes it work in your environment.
Deployment consulting
Assessing the right fit — client-managed cloud, on-premise, or an official hosted service — based on your requirements.
Deployment & integration
Installing, configuring, integrating, documenting, and validating your Wazuh environment.
Detection engineering
Improving rules, decoders, dashboards, tuning, and detection validation within an agreed scope.
Professional support
Defining support needs and operational responsibilities without overstating service levels.
Advisory services
Architecture, log-source integration, agent onboarding, dashboards, and operational readiness.
Training
Hands-on training for managers, analysts, and the teams who will operate Wazuh.
- Log-source integration
- Rules & decoders
- Dashboards
- Alert tuning
- Detection validation
- Reporting
Value
From log collection to real detection capability.
Al-Rasedah focuses on the engineering layer around Wazuh: architecture, useful data, tuned alerts, documented rules, analyst workflows, and decision-supporting reporting. We don't just stand the platform up — we make it detect.
Assessment
Request a practical review of your Wazuh environment.
We can review architecture, agent coverage, alert quality, log sources, dashboards, operational gaps, and improvement priorities.
FAQ
Is Wazuh a SIEM or an XDR?
Wazuh is commonly used for both SIEM and XDR use cases, but the accurate description depends on architecture, integrations, operations, and team responsibilities.
Does installing Wazuh mean I have a SOC?
No. Wazuh provides a platform capability. A SOC requires people, processes, escalation paths, tuning, reporting, and continuous improvement.
Does Wazuh guarantee compliance?
No tool guarantees compliance. Wazuh can support compliance-related visibility and reporting when it's configured and operated correctly.
What does being a Wazuh Gold partner mean for me?
It means you work with a team recognized by Wazuh, with direct platform expertise — combined with our own detection engineering, so the platform is tuned to your environment rather than left at defaults.
Why open security technology
Openness isn't only about cost. It's about control.
Control your data.
Choose an architecture that respects operations, privacy, hosting, and governance.
Understand your tooling.
Build on a platform you can inspect, document, extend, and evaluate.
Adapt without rebuilding.
Extend detection, integrations, and workflows as your risk and business evolve.
Reduce unnecessary lock-in.
Keep a documented exit path instead of a closed operational dependency.
Invest in capability.
Direct budget toward engineering, operations, and outcomes — not just licenses.
Open technology does not deliver privacy or security automatically. Secure outcomes depend on architecture, configuration, maintenance, access control, monitoring, and capable operations.
Resources
Download the services brochure.