Best Open Source SIEM Tools in 2026: Top 7 Free Options Compared
Compare 7 free open-source SIEM tools for 2026: Wazuh, Security Onion, Graylog, Elastic and OpenSearch. See licensing, effort and when a managed SIEM fits.
Open source SIEM tools offer a powerful, zero-license-cost way to monitor your infrastructure. However, "free" often comes with the cost of complexity. Here are the best open source SIEM tools to know in 2026, updated from our 2025 edition.
Quick answer — the best open source SIEM in 2026 by situation:
- Best overall: Wazuh — the most complete free SIEM, with endpoint agents and built-in compliance modules.
- Best for network threat hunting: Security Onion.
- Best for pure log volume: Graylog.
- Best if you want to build your own: Elastic Stack or OpenSearch.
- Best for a home lab or a single VM: Wazuh or OSSEC.
Every tool here is free to download and run. Not all of them are open source, and two of the seven carry licence terms that matter a great deal if you plan to resell the result. Start there.
First: which of these are actually open source?
"Open source SIEM" is the phrase everyone searches, but by 2026 it covers at least three different legal situations, and the difference is not academic. We checked each project's own LICENSE file rather than trusting the label on a comparison chart — including our own earlier one, which had two of these wrong.
| Tool | Actual licence | OSI-approved open source? | The clause that catches people |
|---|
| Wazuh | GPLv2 | Yes | None. Copyleft, so derivative work you distribute has to ship its source too. |
| Security Onion | Elastic License 2.0 | No | ELv2 bars providing it to third parties as a hosted or managed service. Fine internally; a problem if you are an MSP planning to sell it. |
| Elastic Stack | Source: ELv2 / SSPL / AGPLv3. Shipped builds: ELv2 | Source yes, download no | Elastic added AGPLv3 in 2024, but its own FAQ is explicit that this affects the source code only and that releases continue under the Elastic License. Build from source and you have an OSI licence; docker pull and you do not. |
| Graylog Open | SSPL | No | Graylog calls it source-available itself. Free to run; not OSI open source. |
| OpenSearch | Apache 2.0 | Yes | None. Linux Foundation governance since 2024. |
| Snort / Suricata | GPLv2 | Yes (engines) | The engines are open. Snort's best rules are not — see below. |
| OSSEC | GPLv2 | Yes | None. |
Two rows there are worth sitting with. Security Onion is the tool most often recommended to Thai SIs and MSPs as the free base to build a service on, and its licence is the one that specifically forbids that. And Elastic is more nuanced than either camp usually admits: the 2024 AGPLv3 addition is real and OSI-approved, but it applies to source code, not to the builds Elastic distributes. If you download Elasticsearch the normal way, you are still on ELv2. That is a narrower change than "Elastic is open source again," and it is worth knowing which one your legal team is being told.
1. Wazuh
The All-Rounder
Wazuh started as an OSSEC fork and became a full platform: an agent on the endpoint, a server that decodes and correlates, and an indexer and dashboard (both OpenSearch forks) behind it. That three-part architecture is the thing to plan capacity around — most people who describe Wazuh as heavy are describing the indexer, not the agent.
What the agent actually does, beyond shipping logs: file integrity monitoring, security configuration assessment against CIS benchmarks, vulnerability detection by matching installed packages against CVE feeds, and active response that can run a script — block an IP, kill a process — without a human in the loop. Agents run on Windows, Linux, macOS, and the older Unixes.
- Pros: the most complete out-of-the-box detection content of anything on this list; genuine GPLv2; compliance mappings (PCI DSS, HIPAA, NIST 800-53) that produce something you can hand an auditor.
- Cons: resource-intensive — the indexer wants RAM and fast disk. Multi-tenancy is not built in, so an MSP running several customers builds that separation themselves.
2. Security Onion
The Network Defender's Choice
A full Linux distribution rather than an application: Suricata for signature detection, Zeek for protocol metadata, full packet capture, and Elastic underneath, wired together and pre-tuned. The analyst-facing parts — Alerts, Hunt, Cases — are the reason people pick it over assembling the same components themselves, and assembling them yourself is genuinely weeks of work.
It also has a mode that gets overlooked: you can import a PCAP or an EVTX file into a standalone install and analyse it offline. For incident response on a one-off capture, that alone justifies keeping an instance around.
- Pros: the best network visibility here by a distance, and the pre-tuning is real — Suricata and Zeek working together on day one instead of month two.
- Cons: steep learning curve, hardware-hungry, and the licence. Security Onion 2 and 3 ship under Elastic License 2.0, which is source-available, not open source, and explicitly restricts offering it as a hosted or managed service. Read it before you build a product on it.
3. Elastic Stack (ELK)
The DIY Powerhouse
Elasticsearch, Logstash and Kibana — the engine underneath several other tools on this page, including Wazuh's indexer and Security Onion's back end. Used directly, Elastic Security gives you a detection engine, a rules repository Elastic publishes openly, and case management, with prebuilt integrations for most of what you would want to collect.
The licence question people remember is half out of date. Elastic moved off Apache 2.0 in 2021, which is why OpenSearch exists; in 2024 it added AGPLv3 — an OSI-approved licence — alongside ELv2 and SSPL. The catch is in Elastic's own FAQ: the change applies to the source code, and releases continue under the Elastic License. So the grounds have shifted, but not as far as the headlines suggested. If your reason for avoiding Elastic was the licence on the thing you actually deploy, that reason still stands.
- Pros: scales further than anything else here, the search is excellent, and the open detection-rules repo means you are not writing every rule from scratch.
- Cons: it is a platform, not a product — turning it into a working SIEM is an engineering project with a headcount attached. The free tier omits several things a SOC eventually wants, and where the line falls has moved more than once.
4. Graylog
Log Management First
While often used just for logs, Graylog's Open version has enough features to function as a SIEM for smaller teams.
- Pros: extremely fast search, and the free tier handles Syslog, CEF, GELF, Beats and Netflow, plus pipelines, dashboards and basic alerting.
- Cons: alerting stops at single conditions, since the correlation engine is Enterprise. There is no archiving and no data tiering either, so everything you keep sits in live search storage.
5. OpenSearch
The Open Fork
The Apache 2.0 fork of Elasticsearch 7.10, under Linux Foundation governance since September 2024. Its SIEM layer is the bundled Security Analytics plugin, a Sigma-rule detection engine.
- Pros: Apache 2.0 across the whole distribution, nothing held back for a paid tier, and 2,200+ detection rules in the box.
- Cons: field mappings cover 16 log types. Anything else means a custom log type and hand-mapping, and threat intel feeds "only work with standard log types".
6. Snort / Suricata
The IDS Legends
Both match packets against signature rulesets and raise alerts. Neither stores, searches or correlates anything; they are sensors that feed a SIEM, the way Security Onion uses Suricata.
- Pros: GPLv2 on both engines, and the Emerging Threats Open ruleset is free to download.
- Cons: Snort's best detection content isn't open source. Talos's rules sit under a non-commercial license, and free users get them 30 days behind paying subscribers, leaving the thin Community ruleset.
7. OSSEC
The Host-Based Veteran
A reliable HIDS for file integrity monitoring and rootkit detection, with active response that blocks an IP before anyone reads the alert. Still actively released.
- Pros: one GPLv2 agent also does registry and policy monitoring; alerts go out as syslog, JSON or email, or straight into MySQL/PostgreSQL.
- Cons: it ships alerts, not logs. Nothing is retained or indexed, so you can't ask it for every failed login from one IP over 90 days.
"Free SIEM tools" and "open source SIEM" are not the same search
They get typed interchangeably, and they lead to different places.
Free but not open source describes Security Onion and Graylog Open — no invoice, source you can read, but licence terms that restrict what you may build on top. For an internal SOC this distinction changes nothing. For an SI packaging a managed service for customers, it decides whether the plan is legal.
Free tier of a commercial product is a third category that shows up in the same search results and belongs in none of the rows above — Splunk Free, Elastic's own free tier, Microsoft Sentinel's trial credit. These have hard ceilings by design: a daily ingest cap, a feature that disappears at renewal, a trial clock. They are fine for evaluation and a poor basis for a compliance obligation that runs for years.
Genuinely open source leaves Wazuh, OpenSearch, Suricata and OSSEC outright, plus Elasticsearch and Kibana if — and only if — you take the AGPLv3 source rather than Elastic's own builds.
If you are searching because a budget line got cut, the honest sequencing is: Wazuh first, because it needs the least assembly for the most coverage; OpenSearch if you already run Elasticsearch and want to leave the licence question behind entirely; Security Onion only if network detection is the actual requirement and you are not reselling it.
SIEM Alternatives: Open Source Options Instead of LogRhythm, Exabeam, ArcSight or LogEase
Renewal season always surfaces the same question — if we don't renew, what actually replaces this? One detail catches people out first: LogRhythm and Exabeam are not two vendors any more. The merger closed on 17 July 2024, the combined company kept the Exabeam name, and logrhythm.com/products now redirects to exabeam.com. The product still ships, but the first two rows below point at one company with two product lines, self-hosted and cloud-native.
| Commercial system | The strength you have to concede | Open source stand-in | What you trade away |
|---|
| LogRhythm SIEM | Over 1,100 prebuilt correlation rules, including rules mapped to MITRE ATT&CK, plus packaged ISO 27001 / PCI DSS / HIPAA report modules | Security Onion | No Microsoft dependency underneath at all — no Windows Server, no SQL Server instance to administer — but the detection content and the compliance evidence are yours to build, and ELv2 rules out reselling it as a service |
| Exabeam | UEBA that builds its own behavioural baselines and scores risk by context — a Gartner SIEM Magic Quadrant Leader six times | Security Onion | You get Suricata/Zeek telemetry, a Hunt interface and built-in Cases, but nothing on this list reproduces behavioural risk scoring |
| OpenText ArcSight | Normalizes more than 480 event source types and analyzes 100,000+ events per second, and CEF is a format other vendors ingest | Graylog | Pipeline parsing, alerting and dashboards cover the daily job, but expect limited out-of-the-box integrations, and case management and playbook automation are yours to add |
| LogEase (日志易) | Beaver, a search engine the vendor built itself, and LogEase SPL, its own pipe-based search language | OpenSearch | PPL pipes commands the same way, and Security Analytics ships Sigma rules tagged to MITRE ATT&CK with every distribution — in exchange for running the cluster yourself |
None of the four publishes a price. LogRhythm's own FAQ says to contact your sales representative. Exabeam has no Pricing item in its navigation. ArcSight is licensed by ingestion capacity in EPS, measured as a moving median over a rolling 45-day window, so cost scales with log volume. LogEase's product and documentation pages show no price either, and its manuals sit behind an email-verified download form. Every evaluation starts with a sales cycle instead of a download.
If the real requirement is retaining traffic data for 90 days under the Computer Crime Act, searching it after the fact, and handing an auditor a report, then sitting through a sales cycle to evaluate a full behavioural-analytics platform is buying well past the problem. We went the other way and put the prices on the website so you can compare first — zcrLog Cloud starts at THB 4,000/month (1 GB/day, 90-day retention), and every plan ships the same feature set, differing only in capacity.
At a Glance: Which Tool Fits Your Situation?
| Tool | Best for | Licence | Can an MSP resell it? | Setup difficulty |
|---|
| Wazuh | All-around SIEM + XDR | GPLv2 — open source | Yes (copyleft applies to distributed changes) | Medium |
| Security Onion | Network threat hunting | Elastic License 2.0 — source-available | No, not as a hosted/managed service | High |
| Elastic Stack (ELK) | Custom, search-first stack | Source ELv2/SSPL/AGPLv3; shipped builds ELv2 | Only if you build from the AGPL source | High |
| Graylog Open | Log-management-first teams | SSPL — source-available | Restricted | Medium |
| OpenSearch | Elasticsearch alternative | Apache 2.0 — open source | Yes | High |
| Snort / Suricata | Network IDS/IPS layer | GPLv2 — open source (rules differ) | Yes | Medium |
| OSSEC | Host-based file integrity | GPLv2 — open source | Yes | Low |
The Hidden Cost of "Free"
While these tools have no license fees, the Total Cost of Ownership (TCO) includes:
- Hardware: Storing terabytes of logs requires massive servers.
- Manpower: You need engineers to maintain, patch, and tune these tools constantly.
- Compliance: You have to build your own reports for regulations.
The risk is not a failed deployment. It is a successful one that nobody has time to maintain twelve months later, when the engineer who built it has moved on and the rules have not been tuned since. Budget for the second year, not the first.
Frequently Asked Questions
Which open source SIEM is best for a home lab?
Wazuh or OSSEC are the easiest to run on a single VM with modest resources — Security Onion and the full Elastic Stack need considerably more hardware to be useful.
Is there a lightweight open source SIEM for fast log ingestion?
Graylog is generally the fastest to set up and search against for pure log ingestion. It wasn't built as a full SIEM, but it handles high-volume ingestion well for smaller teams that don't need XDR-level detection.
What's the most cost-effective open source SIEM for a growing SOC team?
None of them are free once you count engineering time. Wazuh tends to scale the most gracefully from a single analyst to a small team, but every tool on this list needs dedicated staff as log volume grows — that's the real cost curve to plan for.
Are open source SIEM tools actually free?
The software itself has no license fee, but total cost of ownership includes hardware to store logs and engineers to maintain, tune, and build compliance reports. For organizations under a compliance deadline, that operational overhead is usually what eventually pushes teams toward a managed option.
Which of these tools still has a genuinely open source license?
Wazuh (GPLv2), OpenSearch (Apache 2.0), Snort and Suricata (GPLv2) and OSSEC (GPLv2) are open source today. Elasticsearch and Kibana are a special case: since 2024 their source code carries AGPLv3 as an option, but Elastic's FAQ states the releases themselves continue under the Elastic License, so the build you download is not OSI open source. Two others are not open source at all: Graylog's open edition moved to the Server Side Public License at version 4.0, which Graylog itself calls source-available, and Security Onion ships under Elastic License 2.0. Both are free to run; neither is OSI-approved open source.
Can an MSP build a managed service on these?
On Wazuh, OpenSearch, Suricata and OSSEC, yes. On Security Onion, no — Elastic License 2.0 specifically restricts providing the software to third parties as a hosted or managed service. Graylog's SSPL has its own service restriction. This is the single most expensive detail to discover late, because it surfaces after the platform is built, not before.
zcr in two products: zcrLog for log retention, zcrSIEM for SOC operations
We split the job these tools bundle together, because the two halves have different buyers.
zcrLog handles collection and retention. Its Log Viewer separates System Logs, EDR Logs and Microsoft Entra ID; ingestion takes syslog straight off FortiGate and Palo Alto and auto-detects the device type, and pulls Microsoft 365 audit logs from Exchange, SharePoint and Teams through the Office 365 Management API; the Usage & Billing screen shows the daily GB quota, EPS limit and overage rate. If the requirement is 90 days of retention under the Computer Crime Act and the ability to search it later, zcrLog on its own is the answer — Cloud, virtual appliance, or a hardware appliance in your rack.
zcrSIEM is the product that starts to matter once somebody is actually working alerts. It measures mean time to acknowledge, mean time to resolve, SLA compliance and detection latency, and counts incidents by Critical, High and Medium. Threat Hunting turns a plain-English description into a query, then makes you read and edit it before it runs. Detection Rules shows which log sources activate which rules and how much of MITRE ATT&CK is covered — the same question you'd otherwise answer by hand, and part of the build work that running Wazuh yourself takes. It ingests its own sources, and its plans carry their own capacity and retention, so a team that already collects logs elsewhere can start with zcrSIEM alone. The console is multi-tenant, which is the piece Wazuh and Security Onion leave you to build.
Request a Demo Today
If you'd rather talk through your own environment, here's how to reach us.
Sources
- Security Onion — License — confirms Security Onion runs under Elastic License 2.0, which restricts offering it to third parties as a hosted or managed service
- Elastic — Licensing FAQ — confirms the AGPLv3 option added in 2024 applies to the source code only, while distributed releases continue under the Elastic License
- Linux Foundation — OpenSearch Software Foundation — confirms OpenSearch's governance transferred to the Linux Foundation in September 2024
- BusinessWire — Exabeam and LogRhythm Complete Merger — confirms the merger's completion date (July 17, 2024) and the surviving company name
- Exabeam — LogRhythm SIEM — over 1,100 prebuilt correlation rules, the compliance frameworks listed (ISO 27001, PCI DSS and HIPAA among them), and an FAQ that sends pricing questions to a sales representative
- Exabeam — named a Leader for the sixth time in the 2025 Gartner Magic Quadrant for SIEM — the six Leader years: 2018, 2020, 2021, 2022, 2024, 2025
- OpenText — ArcSight Enterprise Security Manager — more than 480 event source types and 100,000+ events per second
- Micro Focus — How Data Ingestion Affects Your License (ArcSight Platform 22.1) — the licence is set in EPS and measured as a moving median over 45 days
- LogEase — SIEM Platform and documentation page — the proprietary Beaver search engine, the Search Processing Language, and manuals offered through an email-verified download form
- OpenSearch — Building custom threat detection rules with Security Analytics (blog, 18 June 2025) — more than 2,200 prepackaged Sigma rules
- OpenSearch docs — Supported log types — the 16 standard log types
- OpenSearch docs — Creating detectors — "Threat intelligence feeds only work with standard log types"
- Graylog — Feature List, December 2025 (PDF) — Graylog Open takes Syslog, CEF, GELF, Beats and NetFlow inputs and includes pipelines; the correlation engine and hot/warm/archive data tiering are Enterprise and Security features
- Graylog — Graylog Open — free to use under the Server Side Public License
- Snort — license and products — the Snort rules carry a Non-Commercial Use License, and paid subscribers receive rulesets 30 days before registered users
- Proofpoint — Emerging Threats Open rules — the public download directory for the Open ruleset