Host-Based Detection Part 2: From OSSEC to Wazuh, and What Actually Changed
Wazuh didn’t start as Wazuh. Understanding why it exists, and why an older, less commercially confident project shares almost its entire technical vocabulary with it (syscheck, rootcheck, decoders, the same rule-level scale), makes a lot of the rest of this series easier to follow.
OSSEC: 2004 to now
OSSEC was created by Daniel B. Cid, starting around 2004, as an open-source host intrusion detection system: real-time log analysis, file integrity monitoring, Windows registry monitoring, rootkit detection, and active response, the same feature list Wazuh still advertises today because it’s the same feature list it inherited. Third Brigade acquired the project and Cid’s copyrights in June 2008. Trend Micro acquired Third Brigade in 2009 and, notably, committed publicly to keeping OSSEC open source rather than folding it into a paid product outright.
Why Wazuh forked in 2015
Santiago Bassett and a team around him forked OSSEC into Wazuh in 2015. The stated motivation, consistently across sources covering it, wasn’t a dispute over licensing or a sudden closure: OSSEC under Trend Micro’s stewardship had fallen behind on a modern web UI, hadn’t scaled cleanly for enterprise deployments, and integrated poorly with the rest of a typical security stack of the time. Wazuh’s early differentiators were exactly those three gaps: a proper web interface, a RESTful API, and native integration with the Elastic Stack, later its own OpenSearch-based indexer and dashboard once Elastic’s licensing changed. Trend Micro released control of OSSEC itself to the OSSEC Foundation in 2018, with Atomicorp stewarding the free and open-source line alongside a commercial version.
A finding worth correcting before it gets repeated
It’s tempting, and this site’s own earlier scoping notes made exactly this assumption, to describe OSSEC as the stagnant legacy fork and Wazuh as the only one still actively developed. Checking that directly against OSSEC’s own published timeline doesn’t support it: OSSEC 3.8.0 shipped in January 2025, and OSSEC 4.3.0 shipped in August 2026, a month before this post. Atomicorp has kept releasing it. The honest comparison isn’t alive versus dead, it’s a smaller, more conservative project focused on its original HIDS scope, against a fork that expanded aggressively into the SIEM and XDR space, added a full indexer and dashboard, and now maintains a genuinely large ruleset and integration ecosystem OSSEC never tried to match. Both claims, that OSSEC is still maintained and that Wazuh has grown into something substantially larger, are true at once.
The wider landscape, briefly
OSSEC and Wazuh aren’t the only ways to get host-level visibility, and the rest of this series will keep coming back to how Wazuh’s approach differs from these, in more depth in Part 9.
Sysmon, Microsoft’s Sysinternals tool, is Windows-only: a kernel driver plus an XML configuration file that logs process creation, network connections, driver and image loads, and a good deal more, in far more structured detail than the Windows Event Log gives by default. It has no analysis engine of its own. Something else, Wazuh, Splunk, Sentinel, has to consume and alert on what it produces.
auditd is the Linux kernel’s own audit subsystem: syscall-level auditing, configured with rules via auditctl, capable of recording exactly which process touched exactly which file or made exactly which syscall, regardless of whether the responsible program logs anything itself. It’s lower-level and higher-fidelity than anything Wazuh’s own FIM or rootcheck modules do, and also, on its own, just a firehose with no alerting layer either.
osquery treats a running system’s state as a SQL-queryable database: process lists, open sockets, installed packages, and dozens of other tables, queried on demand or on a schedule rather than watched continuously for events. It’s a genuinely different paradigm, asking a question of every host in a fleet at once rather than waiting for something to trip a rule, and it complements a rule-based tool like Wazuh rather than replacing it. Wazuh even ships its own osquery integration wodle.
Falco, a CNCF project, watches syscalls via eBPF specifically for container and cloud-native runtime behaviour: a shell spawned inside a container that never spawns one normally, an unexpected outbound connection from a workload that shouldn’t make one. It’s the tool for a gap this site’s own Container Networking Deep Dive and CNI coverage never touched: what happens inside a running container, not just what happens on its network path.
Wazuh sits in the middle of this landscape: broader than OSSEC’s original scope, narrower than a full commercial EDR, and, unlike Sysmon or auditd on their own, a complete pipeline from raw log to alert. Part 3 covers how that pipeline is actually built, and what’s changing in the version still in beta as this gets written.
Sources: