OSI-licensed open source
A SIEM collects logs and events from servers, networks and cloud services, correlates them against detection rules and raises alerts for analysts. Open-source options let security teams run that pipeline on their own infrastructure without per-GB ingest licensing, at the cost of running and tuning it themselves.
Few projects are a complete SIEM on their own. Wazuh and OpenSearch Security Analytics cover collection, storage and alerting; Suricata, Zeek, Falco, OSSEC and Velociraptor supply network, host and forensic telemetry that feeds one. Every project here was checked for an OSI-approved license. Some well-known names are excluded: Security Onion now ships under the Elastic License 2.0 and Graylog under SSPL, neither OSI open source.
Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.
| Tool | Best for | Pricing | Licence |
|---|---|---|---|
| Wazuh | Teams wanting an agent-based SIEM and XDR in one stack | Free, open source (self-hosted) | GPL-2.0 |
| OpenSearch Security Analytics | Teams already running OpenSearch for logs | Free, open source (self-hosted) | Apache-2.0 |
| Suricata | Network detection feeding a SIEM | Free, open source (self-hosted) | GPL-2.0 |
| Zeek | Network visibility and threat hunting logs | Free, open source (self-hosted) | BSD-3-Clause |
| Falco | Runtime threat detection for containers and Kubernetes | Free, open source (self-hosted) | Apache-2.0 |
| OSSEC | Lightweight host-based detection | Free, open source (self-hosted) | GPL-2.0 |
| Velociraptor | Forensics and incident response on endpoints | Free, open source (self-hosted) | AGPL-3.0 |
Best for: Teams wanting an agent-based SIEM and XDR in one stack · Free, open source (self-hosted)
Wazuh describes itself as the open source security platform for unified XDR and SIEM across endpoints and cloud workloads. The repository states most code is GPLv2, with the engine directory under AGPL-3.0-or-later.
Best for: Teams already running OpenSearch for logs · Free, open source (self-hosted)
OpenSearch Security Analytics is a framework for detecting security threats in event log data, with pre-packaged detection rules you can customize. It runs as a plugin on the OpenSearch stack.
Best for: Network detection feeding a SIEM · Free, open source (self-hosted)
Suricata is an open-source engine for network intrusion detection, intrusion prevention and network security monitoring, developed by the OISF community.
Best for: Network visibility and threat hunting logs · Free, open source (self-hosted)
Zeek is a network analysis framework that produces rich logs of network activity rather than a signature-only IDS. Its repository ships under a BSD license.
Best for: Runtime threat detection for containers and Kubernetes · Free, open source (self-hosted)
Falco is a cloud-native runtime security tool for Linux that detects and alerts on abnormal behavior in real time. It is used on containers and Kubernetes hosts.
Best for: Lightweight host-based detection · Free, open source (self-hosted)
OSSEC is a host-based intrusion detection system covering log analysis, file integrity checking, policy monitoring, rootkit detection and active response.
Best for: Forensics and incident response on endpoints · Free, open source (self-hosted)
Velociraptor collects host-based state information and runs VQL queries at scale for endpoint monitoring and digital forensics and incident response.
One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| One stack with agents, rules and dashboards | Wazuh |
| Add detections to an existing OpenSearch deployment | OpenSearch Security Analytics |
| Network intrusion detection | Suricata, Zeek |
| Container and Kubernetes runtime alerts | Falco |
| Host intrusion detection and file integrity | OSSEC, Wazuh |
| Incident response and forensics | Velociraptor |
Quick answers to common questions
Wazuh is the closest to a complete open-source SIEM and XDR stack, with agents, a manager and a dashboard. Most others are components you combine.
Recent Graylog versions are licensed under SSPL, which is not OSI open source, so it is not listed here. Check the current Graylog license before deciding.
Its repository now uses the Elastic License 2.0, which is source-available, not OSI open source, so we left it out.
The software is free, but you pay for infrastructure and staff time. Wazuh and others also sell paid cloud or support offerings.
List it on TechLogHub and we'll review it for this guide.
