Short answer: Wazuh is a free, open-source security platform. Small agents on your computers and servers send it logs and changes; it flags suspicious sign-ins, altered files, known-vulnerable software and weak settings. For up to 25 devices its own guide suggests a server with 4 vCPUs, 8 GB of memory and 50 GB of storage for 90 days of alerts. It costs nothing to licence, but it needs a server, tuning and a person who reads and acts on what it finds.
What Wazuh is
Wazuh describes itself as a free and open-source security platform that unifies XDR and SIEM protection: in plain terms, it watches your devices for signs of attack and keeps the evidence. The code is published under the GNU General Public Licence version 2, so there is no licence fee and no limit on the number of devices. It has four parts: an agent installed on each computer or server, a server that analyses what the agents send, an indexer that stores and searches it, and a dashboard where people read it.
What it does well for a small business
- Collects the logs nobody reads. Sign-in failures, new administrator accounts and services starting at odd hours, gathered from every device into one place.
- Notices files changing. File integrity monitoring flags changes to system files and folders you choose, which is how many intrusions and ransomware attacks first show.
- Lists vulnerable software. It compares installed software against published vulnerabilities, so you get a list of what to patch first.
- Checks configuration. Security configuration assessment compares devices against published hardening benchmarks and shows where they fall short.
- Can act on its own. Active response can, for example, block an address that keeps failing to sign in. Use it carefully; an over-eager rule can lock out your own staff.
The Wazuh documentation lists these and more, with examples.
What it needs to run
The Wazuh quickstart gives these sizes for an all-in-one server holding 90 days of alerts:
| Devices monitored | vCPU | Memory | Storage (90 days) |
|---|---|---|---|
| 1 to 25 | 4 | 8 GB | 50 GB |
| 26 to 50 | 8 | 16 GB | 100 GB |
| 51 to 100 | 8 | 16 GB | 200 GB |
Treat those as a floor and leave room for the operating system. In South Africa, two local questions matter as much as the size. If the server sits in your office, it needs a UPS or it goes dark at exactly the moment the power does. If it runs in the cloud, you choose the region, which matters for where your logs, and the personal information in them, are stored.
What it will not do
- It will not read its own alerts. An unwatched dashboard is a log of what went wrong, found later. Decide who looks, how often, and what they do next.
- It will not be quiet at first. Out of the box it reports a great deal. Expect a few weeks of tuning before the alerts are worth reading every day.
- It will not fix anything. It tells you which software is vulnerable; someone still has to patch it.
- It is not a backup or a firewall. It complements both and replaces neither.
- It does not watch at 2am unless someone does. Round-the-clock monitoring is a staffing decision, not a software one.
Where it fits with POPIA
Section 19 of POPIA requires you to take reasonable technical and organisational measures to secure personal information, including identifying foreseeable risks, maintaining safeguards, regularly verifying that they work and keeping them updated. Monitoring is one of the few ways to show the "regularly verifying" part with evidence rather than intention. Section 22 then requires you to notify the Information Regulator and the people affected as soon as reasonably possible after a compromise is discovered. You can only notify what you detect.
Run it yourself, or get help?
| Your situation | Sensible route |
|---|---|
| Someone in-house runs IT and has a few hours a week | Install it yourself from the quickstart, start with sign-in alerts and vulnerability lists, and tune from there. |
| No in-house IT, under 25 devices | Have it installed and tuned, then reviewed monthly, with a short list of alerts that must reach a named person immediately. |
| Health, legal or financial information, or a client who asks for evidence | The same, plus written response steps and a monthly report you can show a client or the Regulator. |
| You need someone watching outside office hours | A security operations partner with a staffed rota, named in the contract. |
We can install, tune and review a Wazuh deployment for you and hand it over with written response steps. Where you need cover outside working hours, it comes through a partner with a staffed rota, and the contract says so. If you would rather start smaller, our security health check shows where monitoring would help most.