A free SIEM costs nothing to download and quite a lot to run. We compared Wazuh, Elastic Security on its free Basic tier, and Security Onion’s community edition using their own documentation and licences, checked on 22 October 2026, with one question in mind: when something goes wrong at 3am, which of them will tell you?
How we compared them
This is a documentation review, not a lab test. We read each project’s installation guides, hardware requirements, licence texts and feature matrices, and we checked the current release. We have not scored them, because a score would suggest a precision that reading documentation cannot give. What the documents can show is what each tool says it does for free, what it asks of your hardware, and where the paid tier begins.
| Wazuh | Elastic Security (Basic) | Security Onion (community) | |
|---|---|---|---|
| Current release | 4.14.9, 15 October 2026 | 9.5.5, 6 October 2026 | 3.3.0-20260911, 11 September 2026 |
| Licence | GPLv2 and Apache 2.0 | Elastic License 2.0 for security features; core under AGPLv3, SSPL or ELv2 | Elastic License 2.0 |
| Small-site hardware | 4 vCPU, 8 GiB RAM, 50 GB for up to 25 agents | Depends on your deployment | 4 cores, 24 GB RAM, 200 GB, 2 NICs (standalone) |
| Free outbound alerts | Yes, email alerting | Server Log and Index connectors only | None by default |
| Main strength | Endpoint agent, compliance, all in one | Detection engine and search | Network visibility plus logs |
Wazuh: the one that emails you
Wazuh’s quickstart states: “Wazuh is free and open source. Its components abide by the GNU General Public License, version 2, and the Apache License, Version 2.0 (ALv2).” The all-in-one installation, it says, “is usually enough for monitoring up to 100 endpoints and for 90 days of queryable/indexed alert data.” The suggested hardware is modest: 4 vCPU, 8 GiB RAM and 50 GB of storage for 1 to 25 agents, rising to 8 vCPU and 200 GB for 51 to 100.
For our 3am question, Wazuh is the only one of the three whose free edition includes email alerting configured in the manager itself. That matters more to a team of two than any detection feature.
Two practical notes. The quickstart recommends disabling the Wazuh package repository after installation “to prevent accidental upgrades that could break the environment”, which tells you something about how upgrades should be handled. And the licence is changing on the development branch: a commit on 15 October 2026 moved the Wazuh engine under the GNU Affero General Public License, version 3 or later. The 4.14.9 release is not affected. For most internal users the AGPL changes little; for anyone offering Wazuh as a hosted service, it is worth reading before the next major version.
Elastic Security on Basic: powerful, but quiet
Elastic is the most capable search and detection platform of the three, and the free Basic tier is more generous than many assume. According to Elastic’s subscription matrix, Basic includes the detection engine, prebuilt rules, Timeline, Cases, malware prevention on the endpoint and Osquery Manager.
The gaps are telling. Machine learning anomaly detection, ransomware prevention, malicious behaviour protection, host isolation, the response console, tamper protection, device control, Attack Discovery, the AI Assistant, Entity Analytics and single sign-on are all paid. So are the alerting connectors that would send an email, a Slack message or a PagerDuty page. On Basic, the matrix lists only the Server Log and Index connectors. Your rules will fire; they will just fire into Elastic itself. Somebody has to be looking.
On paid tiers, the matrix lists Gold as discontinued and Platinum as available to existing customers only, so a small team that outgrows Basic is looking at the Enterprise tier or Elastic Cloud. The source is offered under a choice of AGPLv3, SSPL or the Elastic License 2.0, though the commercial features are under the Elastic License only, according to the repository licence file.
Security Onion: the network specialist
Security Onion bundles network monitoring with log management, case handling and detection, and builds on Elastic underneath. It is the only one of the three designed around watching packets as well as logs.
It is also the hungriest. Its hardware guide lists a standalone minimum of 4 cores, 24 GB RAM, 200 GB of storage and two network interfaces, and adds: “Consider 32GB of RAM or more if you plan on monitoring even a small amount of network traffic.” It supports only x86-64 processors, and the 11 September release added an x86-64-v3 CPU pre-flight check to soup, its update tool, so older hardware may be turned away at the next upgrade.
On alerting, the documentation is plain: “By default, no outbound notifications are enabled in a Security Onion installation.” According to its notifications page, outbound notifications need the Pro licence. Security Onion Pro also adds OIDC single sign-on, FIPS and disk encryption options and STIG hardening among other features. The standard Pro licence covers “up to ten” nodes; if it lapses, Security Onion “will revert to community Security Onion”. Asked whether Pro includes higher tier licensing for Elastic, the vendor answers: “At this time, no other paid licenses are included with Security Onion Pro.”
Which one, for whom
- A small IT team with mostly Windows and Linux endpoints: Wazuh. Its hardware needs are low, compliance reporting is built in, and it will email you.
- A team with search skills that already runs Elastic: Elastic Security on Basic, with a clear plan for who watches the alerts, or a budget for a paid tier.
- A team that needs to see network traffic: Security Onion, on dedicated hardware, with the understanding that alerts stay on the console unless you pay for Pro.
Whichever you pick, the expensive part is not the software. It is the person who reads what it says. A free SIEM that nobody checks is a well-indexed record of what happened to you.
Once one of these is running, try a real hunt in it: Plex2Shell implants in the Plex Codecs folder. More comparisons are in Product Reviews.
Sources
- Wazuh documentation: Quickstart
- Wazuh documentation: Alert management
- Wazuh v4.14.9 release
- Wazuh commit changing engine licence, 15 October 2026
- Elastic: Subscriptions and feature matrix
- Elasticsearch v9.5.5 release
- Elasticsearch licence file
- Elastic License 2.0
- Security Onion documentation: Hardware requirements
- Security Onion documentation: Notifications
- Security Onion Pro
- Security Onion releases
- Security Onion licence