AWS Security Hub vs Wazuh comparison

Read 50 Wazuh reviews

35,306 Views
14,829 Comparison Views

81% willing to recommend

AWS Security Hub

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 18, 2024

AWS Security Hub and Wazuh compete in the security solutions category. AWS Security Hub appears to have the upper hand in ease of use and integration, while Wazuh excels in flexibility and cost-effectiveness based on user reviews.

Features: AWS Security Hub offers seamless integration with other AWS services, automated compliance checks, and centralized security alerts. Wazuh provides open-source security monitoring, log management, and intrusion detection options.

Room for Improvement: AWS Security Hub could enhance its third-party integrations, provide more detailed threat intelligence, and improve overall third-party support. Wazuh users recommend improving documentation, simplifying the configuration process, and enhancing usability.

Ease of Deployment and Customer Service: AWS Security Hub is known for its straightforward setup within the AWS ecosystem and highly responsive customer service. Wazuh requires more technical expertise for deployment but benefits from strong community support and active forums.

Pricing and ROI: AWS Security Hub's pricing is higher but justified by its extensive features and integration within the AWS ecosystem, making it a good ROI for larger enterprises. Wazuh, being open-source, offers a more cost-effective solution with high ROI for smaller organizations or those with tight budgets.

To learn more, read our detailed AWS Security Hub vs. Wazuh Report (Updated: October 2024).

AWS Security Hub vs. Wazuh

October 2024

Download the complete report

Helped 881,707 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

AWS Security Hub

Average Rating

7.6

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

Security Orchestration Automation and Response (SOAR) (7th), Cloud Security Posture Management (CSPM) (15th)

Wazuh

Average Rating

7.4

Reviews Sentiment

6.1

Number of Reviews

Ranking in other categories

Log Management (1st), Security Information and Event Management (SIEM) (2nd), Extended Detection and Response (XDR) (5th)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. AWS Security Hub is designed for Cloud Security Posture Management (CSPM) and holds a mindshare of 3.6%, down 4.5% compared to last year.
Wazuh, on the other hand, focuses on Security Information and Event Management (SIEM), holds 6.4% mindshare, down 14.9% since last year.

Cloud Security Posture Management (CSPM) Market Share Distribution
Product	Market Share (%)
AWS Security Hub	3.6%
Wiz	15.2%
Prisma Cloud by Palo Alto Networks	9.6%
Other	71.6%

Cloud Security Posture Management (CSPM)

Security Information and Event Management (SIEM) Market Share Distribution
Product	Market Share (%)
Wazuh	6.4%
Splunk Enterprise Security	7.1%
IBM Security QRadar	5.4%
Other	81.1%

Security Information and Event Management (SIEM)

Featured Reviews

Karthik Ekambaram

Director at Scybers

Has helped identify misconfigurations and prioritize risks but lacks multi-cloud support and deeper integration features

AWS Security Hub cannot scale up to multiple different cloud environments; it only works for AWS. There are other products in the market for CSPM that can give you multi-cloud environment misconfigurations, even Microsoft for that matter. Regarding the integration of AWS Security Hub with third-party tools, I am not certain whether we can integrate them, but there is no need to do so. However, AWS Security Hub cannot integrate with other cloud providers, so it only supports the AWS environment. The compliance checks within AWS Security Hub are good, but we don't use them much. We utilize compliance frameworks such as CIS compliance frameworks and ISO 27017 framework, which are beneficial, but it can improve in other areas too, such as including NIST and other frameworks beyond just ISO and CIS. Improvements can be applicable for scalability, particularly on integration with multi-cloud environments, and compliance frameworks can be added for more variety as well. The unified dashboard in AWS Security Hub is adequate; I cannot say it is exceptional, but the content available in the dashboards is satisfactory for now.

Read full review

Rajin Sandira

Engineer Information Security at N-Able (Pvt) Ltd

Has faced limitations in AI capabilities and pricing flexibility

Pricing-wise, Wazuh stands out, along with deployment flexibility and its documentation which is extremely good in comparison to Forti. The community support is also incredible. They have helped quite a bit because previously, we had a separate tool and management dashboard to do our compliance. With Wazuh, we receive that information without having to do anything extra. We just set up the SIEM and all of that information was automatically populated. The dashboards are very easy to understand and very quick with no lag or delay. I have experienced delays on Forti's dashboards, but not with Wazuh. Wazuh is quite good. In comparison to Forti, they are quite similar. They are very good at detection.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The platform has valuable features for security."

"AWS Security Hub has very good integration features. It allows for AWS native services integration, and it helps us to integrate some of the services outside of AWS. They have partners, such as Amazon Preferred Network Partners (APN). If you have different security tools around APN, we can integrate those findings with AWS Security Hub reducing the need to refer to different portals or different UIs. You can have AWS Security Hub act as a single common go-to dashboard."

"Within AWS Security Hub, there is a feature for aggregating and prioritizing security findings which allows for better risk prioritization based on misconfiguration, as they know AWS thoroughly."

"The advantage is that it is cloud-native, and we do not need to install agents or sensors to find findings."

"The solution shows us our compliance score."

"AWS Security Hub brings many features into one table that is quite useful, and the app team finds it easier to see what is missing."

"I rate Security Hub ten out of ten for stability."

"The best feature of AWS Security Hub is that you can get compliance or your cloud's current security posture."

More AWS Security Hub pros

"The tool is stable."

"When we talk about functionality, the most valuable feature or function I have found in Wazuh is Wazuh EDR agent with EDR capabilities."

"Wazuh automatically scans the host for CIS benchmarks for the latest updates and vulnerabilities and gives a host score. It provides a percentage of perceived risk due to of non patches or any missing patches on that work."

"The product’s interface is intuitive."

"The product is easy to customize."

"It is a stable solution."

"Wazuh's most beneficial features for our security needs are flexibility, built-in rules, integration capabilities, and documentation."

"The deployment is easy and they provide very good documentation."

More Wazuh pros

Cons

"AWS Security Hub should improve the time it takes to update. It takes a long period of time when updating. It can take 24 hours sometimes to update. Additionally, when integrating this solution with more security tools, takes time."

"We need more granular-level customizations to enable or disable the rules in AWS Security Hub."

"Whenever my team gets some alarms from the central team, my team needs to initiate whether it's a real or false trigger. The central team needs to keep adjusting to the parameters or at least the concerned IPs, whether it's really from the company's pool of IPs, so the trigger process can be improved. In the next release of AWS Security Hub, I'd like a better dashboard that could result in better alert visibility."

"Security Hub is currently not worth investing in, as it requires more configurations and integration with other services to work effectively."

"From an improvement perspective, there is a need to add more compliance since, right now, AWS Security Hub only provides four to five compliances to control the tool."

"One aspect that could be improved in the solution is its adaptability to different markets and geopolitical restrictions. In certain regions like Thailand, specific services from certain countries or providers, such as AWS or Azure, might be limited or blocked. It also needs improvement in would require configuring the solution more adaptable to AWS infrastructure and function."

"It is not flexible for multi-cloud environments."

"The telemetry doesn't always go into the control center. When you have multiple instances running in AWS, you need a control tower to take feeds from Security Hub and analyze your results. Sometimes exemptions aren't passed between the control tower and Security Hub. The configuration gets mixed up or you don't get the desired results."

More AWS Security Hub cons

"Log data analysis could be improved. My IT team has been looking for an alternative because they want better log data for malware detection. We are also doing more container implementation also, so we need better container security, log data analysis, auditing and compliance, malware detection, etc."

"The tool does not provide CTI to monitor darknet."

"Wazuh doesn't cover sources of events as well as Splunk. You can integrate Splunk with many sources of events, but it's a painful process to take care of some sources of events with Wazuh."

"One area where Wazuh could use some improvement is in its reporting mechanism, especially for high-level management like CSOs and CEOs."

"An issue I noticed is with tag values in certain rules not functioning properly."

"The deployment is a bit complex."

"The support channel is not optimal, and extensive research is required on our part to implement Wazuh effectively."

"The tool doesn't detect anomalies or new environments."

More Wazuh cons

Pricing and Cost Advice

"There are multiple subscription models, like yearly, monthly, and packaged."

"The cost is based on the number of compliances, core checks, and services required, and for more than 10,000 recommendations, the charge is just one dollar."

"The pricing is fine. It is not an expensive tool."

"AWS Security Hub is not an expensive tool. I would consider it to be a cheap solution. AWS Security Hub follows the PAYG pricing model, meaning you will have to pay for whatever you use."

"Security Hub is not an expensive solution."

"The price of AWS Security Hub is average compared to other solutions."

"AWS Security Hub's pricing is pretty reasonable."

"The price of the solution is not very competitive but it is reasonable."

"The current pricing is open source."

"The solution's cost is above the average."

"It is a free-of-cost solution."

"Wazuh is a cheaply priced product."

"Wazuh is not an expensive solution."

"The solution's pricing is very competitive."

"Wazuh is free and open source."

"We use the free version of Wazuh."

More Wazuh pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Security Posture Management (CSPM) solutions are best for your needs.

See recommendations

881,707 professionals have used our research since 2012.

Comparison Review

it_user186927

Director of Operations at a comms service provider with 10,001+ employees

Feb 16, 2015

Cybereason vs. Interset vs. SQRRL

Capture DB - they all use NoSQL db and hence solve the ad hoc query and 'go back in time' problem with current best of breed SIEM and DLP solutions that rely on real time analysis of incoming logs (and don't store them). This means deeper and quicker iterative threat analysis and assessment…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

11%

Computer Software Company

11%

Manufacturing Company

10%

Government

Computer Software Company

12%

Comms Service Provider

11%

University

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	5
Large Enterprise	12

By reviewers
Company Size	Count
Small Business	27
Midsize Enterprise	15
Large Enterprise	8

Questions from the Community

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will...

What do you like most about AWS Security Hub?

The most valuable features of the solution are the scanning of all the cloud environments and most of the compliances available in the cloud.

What needs improvement with AWS Security Hub?

What do you like most about Wazuh?

Wazuh is its flexibility and open-source nature, which allows us to tailor threat detection and response across diverse client environments. Its integration capabilities with SOAR, cloud platforms,...

What needs improvement with Wazuh?

Regarding compliance, I find it not stable. I do not recommend it for that purpose. It can comply with Wazuh NCA, which we have here in Saudi Arabia. Wazuh NCA has many frameworks starting with ECC...

What is your primary use case for Wazuh?

I have been working with Wazuh for two years, and I can explain how I use Wazuh. I did not use Wazuh as a SIEM solution. I use Wazuh as a tool for services we provide. This service is called compro...

Microsoft Sentinel vs AWS Security Hub

Comparisons

Compared 36% of the time

Prisma Cloud by Palo Alto Networks vs AWS Security Hub

Compared 8% of the time

Wiz vs AWS Security Hub

Compared 7% of the time

Microsoft Defender for Cloud vs AWS Security Hub

Compared 5% of the time

CrowdStrike Falcon Cloud Security vs AWS Security Hub

Compared 3% of the time

More AWS Security Hub Competitors

Security Onion vs Wazuh

Compared 10% of the time

Elastic Stack vs Wazuh

Compared 9% of the time

Splunk Enterprise Security vs Wazuh

Compared 5% of the time

Graylog Enterprise vs Wazuh

Compared 5% of the time

Elastic Security vs Wazuh

Compared 4% of the time

More Wazuh Competitors

Product Reports

Download AWS Security Hub product report

AWS Security Hub

February 2026

Download Wazuh product report

January 2026

Also Known As

SQRRL

Wazuh All-In-One Deployment

Overview

AWS Security Hub is a comprehensive security service that provides a centralized view of security alerts and compliance status across an AWS environment. It collects data from various AWS services, partner solutions, and AWS Marketplace products to provide a holistic view of security posture. With Security Hub, users can quickly identify and prioritize security issues, automate compliance checks, and streamline remediation efforts.

The service offers a range of features including continuous monitoring, threat intelligence integration, and customizable dashboards. It also provides automated insights and recommendations to help users improve their security posture. Security Hub integrates with other AWS services like Amazon GuardDuty, AWS Config, and AWS Macie to provide a unified security experience. Additionally, it supports integration with third-party security tools through its API, allowing users to leverage their existing security investments.

With its user-friendly interface and powerful capabilities, AWS Security Hub is a valuable tool for organizations looking to enhance their security and compliance posture in the cloud.

Amazon Web Services (AWS)

Wazuh offers an open-source platform designed for seamless integration into diverse environments, making it ideal for enhancing security infrastructure. Its features include log monitoring, compliance support, and real-time threat detection, providing effective cybersecurity management.

Wazuh stands out for its ability to integrate easily with Kubernetes, cloud-native infrastructures, and various SIEM platforms like ELK. It features robust MITRE ATT&CK correlation, comprehensive log monitoring capabilities, and detailed reporting dashboards. Users benefit from its file integrity monitoring and endpoint detection and response (EDR) capabilities, which streamline compliance and vulnerability assessments. While appreciated for its customization and easy deployment, room for improvement exists in scalability, particularly in the free version, and in areas such as threat intelligence integration, cloud integration, and container security. The platform is acknowledged for its strong documentation and technical support.

What are the key features of Wazuh?

MITRE ATT&CK Correlation: Streamlines threat analysis by correlating security data with known attack patterns.
Log Monitoring: Provides continuous oversight of log data to enhance security insights.
SIEM and ELK Integration: Simplifies centralization of security events and analytics.
Kubernetes Support: Ensures security measures align with containerized environments.
File Integrity Monitoring: Alerts on unauthorized changes to critical files.
Endpoint Detection and Response: Identifies and mitigates endpoint threats efficiently.
Compliance and Benchmarking: Built-in rules assist in meeting regulatory standards.

What benefits and ROI should users look for?

Cost-Effectiveness: Offers an affordable open-source security solution tailored for extensive customization.
Customization: Users can adjust features to fit unique security requirements.
Scalability: Facilitates growth by adapting to expanding security needs.
Comprehensive Support: Backed by detailed documentation and technical expertise.
Regulatory Compliance: Helps maintain adherence to industry-specific regulations.

In industries like finance, healthcare, and technology, Wazuh is utilized for its capabilities in log aggregation, threat detection, and vulnerability management. Companies often implement its features to ensure compliance with stringent regulations and to enhance security practices across cloud environments. By leveraging its integration capabilities, organizations can achieve unified security management, ensuring comprehensive protection of their digital assets.

Sample Customers

Edmunds, Frame.io, GoDaddy, Realtor.com

Information Not Available