Wazuh, Elastic SIEM, Sentinel, Splunk UEBA — what they cost, what they require, what they actually do
This page covers the tools you can actually deploy — from free open-source options a single sysadmin can stand up on a weekend, to enterprise platforms that require a team and a budget conversation with management.
Each tool gets an honest assessment: what AI capabilities it actually has (not what the marketing page says), what it realistically costs to run, what skills and infrastructure it requires, and where it falls short. The goal is to help you match the right tool to your actual environment, not the environment the vendor assumes you have.
| Tool | Cost model | AI capability | Right for |
|---|---|---|---|
| Wazuh | Free / open-source | ML anomaly detection, rule correlation | Small-to-medium shops, budget-conscious, self-hosted |
| Elastic SIEM | Free tier + paid ML | ML jobs, anomaly scoring, behavioral analytics | Shops already running ELK, developers comfortable with configuration |
| Microsoft Sentinel | Pay-per-GB ingested | UEBA, Copilot for Security integration, ML analytics | Azure shops, Microsoft-heavy environments |
| Splunk UEBA | Licensed (expensive) | Deep behavioral analytics, peer group analysis, kill chain detection | Enterprise, dedicated SOC, large log volumes |
| OpenSearch + custom | Free / infrastructure cost | Whatever you build | Engineers who want full control and have the time to build it |
Wazuh is a security monitoring platform built on top of OSSEC, extended significantly over the years into a full SIEM with its own indexer, dashboard, and manager. It is the most realistic starting point for a sysadmin shop without a dedicated security budget.
Wazuh's ML capability centers on its anomaly detection module, which uses statistical analysis to baseline normal behavior per agent and flag deviations. It also does threat intelligence correlation — matching observed indicators against known bad IP/hash/domain feeds.
The rule correlation engine is not traditional ML but is worth understanding: it chains multiple lower-severity events into higher-severity alerts. Five failed logins followed by a success from the same IP is not three separate events — it is one brute-force-then-success alert.
# Wazuh all-in-one install (manager + indexer + dashboard)
# Minimum: 4 cores, 8GB RAM, 50GB disk for a small deployment
curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh
curl -sO https://packages.wazuh.com/4.7/config.yml
# Edit config.yml — set your node name and IP
# Then run the installer
sudo bash wazuh-install.sh -a
# Dashboard available at https://your-server-ip
# Default credentials printed at end of install# Deploy agent on a Linux host you want to monitor
# Run on the monitored host, pointing at your Wazuh manager
curl -sO https://packages.wazuh.com/4.7/wazuh-agent.sh
sudo WAZUH_MANAGER='your.manager.ip' bash wazuh-agent.sh
sudo systemctl enable --now wazuh-agentIf you are already running an ELK stack for log aggregation, Elastic SIEM is the natural path to AI-assisted detection. It sits on top of Elasticsearch and adds security-specific detection rules, ML anomaly jobs, and UEBA (User and Entity Behavior Analytics) at the paid tiers.
Elastic's ML module runs background jobs that continuously analyze your data streams. The most useful for a SysAdmin environment:
| ML Job | What it detects |
|---|---|
auth_rare_source_ip_for_a_user |
Login from an IP this user has never used — covers the lateral movement and credential theft scenarios from Page 2 |
auth_rare_hour_for_a_user |
Login at an unusual hour for this specific user |
suspicious_login_activity |
Combination of factors: new user agent, new source, unusual time |
high_count_network_denies_source |
Host generating unusual firewall deny volume — scanning behavior |
rare_process_by_host |
Process execution that has never been seen on this host before |
# Via Kibana Dev Tools or API — enable a pre-built ML job
# First ensure data feeds are configured (Filebeat or agent sending to ES)
# PUT request to open the job
curl -X POST "localhost:9200/_ml/anomaly_detectors/auth_rare_source_ip_for_a_user/_open" \
-H "Content-Type: application/json"
# Start the datafeed
curl -X POST "localhost:9200/_ml/datafeeds/datafeed-auth_rare_source_ip_for_a_user/_start"
# Check job status
curl -s "localhost:9200/_ml/anomaly_detectors/auth_rare_source_ip_for_a_user" \
| python3 -m json.tool | grep "state\|processed"Sentinel is Microsoft's cloud-native SIEM. If your environment is Azure-heavy or Microsoft 365-heavy, Sentinel has native connectors that make ingestion nearly effortless. The AI capabilities are genuine and improving rapidly, especially with Copilot for Security integration.
Sentinel charges per GB of data ingested. Microsoft 365 and Azure-native logs ingest free. Everything else costs money. Before you connect your Linux syslog feeds, do the math:
# Estimate your daily log volume before committing
# Run this on your log sources for a week to get a realistic number
journalctl --since "24 hours ago" | wc -c
# Bytes per day from systemd journal
du -sh /var/log/nginx/access.log
# Size of today's web log
# Multiply daily GB by ~$2.46/GB (Sentinel pricing as of 2026)
# 10GB/day = ~$25/day = ~$750/month just for ingestion
# Use commitment tiers if you know your volume — significant discountSentinel's UEBA module builds behavioral profiles automatically once enabled. It correlates identity data from Azure AD with activity across connected sources and produces investigation priority scores per user and entity. The Copilot for Security integration lets you query it in plain English:
Splunk UEBA is the most sophisticated behavioral analytics platform in this list. It uses unsupervised machine learning to build behavioral models across users, devices, and applications, with kill chain detection that correlates activity across multiple stages of an attack. It is also the most expensive option by a significant margin and requires a dedicated Splunk deployment to run on top of.
If your shop does not have a dedicated security operations function, Splunk UEBA is probably not the right fit. It is built for environments where someone is watching the dashboard full-time. The sophistication of the detection is wasted if nobody is actioning the alerts.
Beyond the major platforms, several open-source tools deserve mention for shops that want to build their own stack:
The ancestor of Wazuh. Still maintained, lighter weight, useful for environments where Wazuh's full stack is too heavy. Host-based intrusion detection, file integrity monitoring, log analysis. No ML, but solid rule-based detection.
Network traffic analysis framework. Does not analyze host logs — it analyzes packets. Produces structured logs of network activity that can be fed into any SIEM or analyzed directly. Excellent for detecting lateral movement at the network layer, C2 beaconing, and data exfiltration patterns that host logs miss entirely.
# Zeek produces structured logs per protocol
# conn.log — all network connections with bytes transferred
# dns.log — all DNS queries (exfiltration often uses DNS)
# http.log — all HTTP with user agents, URIs, response codes
# ssh.log — SSH sessions with direction and bytes
# Feed Zeek logs to sgpt for behavioral analysis
tail -200 /var/log/zeek/current/conn.log | \
sgpt "These are network connection logs. Identify any unusual outbound
connections, high data transfer volumes, or connections to unexpected
destinations. Flag anything worth investigating."Network IDS/IPS with rule-based detection plus some behavioral capabilities. Complements host-based tools by watching the wire. Good at detecting known attack tools and C2 frameworks at the network layer. Runs inline (IPS mode) or passively (IDS mode) depending on your preference.
Open-source log management with alerting and some anomaly detection. Not as security-focused as Wazuh or Elastic SIEM, but a solid log aggregation platform that pairs well with AI analysis pipelines. The free tier is genuinely functional for small environments.
| Your situation | Recommended starting point | Why |
|---|---|---|
| Solo sysadmin, limited budget, Linux-only environment | Wazuh | Free, full-featured, manageable by one person who invests in learning it |
| Already running ELK stack | Elastic SIEM (free tier first) | Reuses existing infrastructure and team knowledge |
| Azure-heavy, Microsoft 365 shop | Microsoft Sentinel | Native connectors make ingestion easy; UEBA built in |
| Enterprise with dedicated SOC | Splunk UEBA | Depth of behavioral analytics justifies cost at scale with staff to use it |
| Want network-layer visibility alongside host logs | Add Zeek to any of the above | Host and network logs together catch what either misses alone |
| Not ready for any of the above yet | curl/sgpt pipeline from Page 1 | Start getting value from AI log analysis today with zero new infrastructure |
You have the tool landscape. Page 4 is the one that puts everything in perspective — what all of these tools miss, why the detection asymmetry favors attackers, and the honest accounting of AI security's limits.