EN
ENNA

TheHive vs Wazuh

GitHub Stats

3.9k
Stars
15.2k
683
Forks
2.2k
834
Issues
2821
8mo ago
Updated
3d ago
AGPL-3.0
License
-
Scala/JavaScript
Language
C/Python

About TheHive

TheHive is a scalable, open-source Security Incident Response Platform (SIRP) designed to make life easier for SOCs, CSIRTs, and CERTs dealing with security incidents that need to be investigated and acted upon. It provides collaborative case management where multiple analysts can work on the same case simultaneously, with full audit trails and task assignment. TheHive integrates tightly with Cortex for automated observable analysis (IP lookups, hash checks, domain reputation) and with MISP for threat intelligence sharing. Cases can be created from email alerts, SIEM events, or manually, and each case supports tasks, observables, and evidence attachments. Its template system and custom fields make it adaptable to any organization's incident response workflow.

About Wazuh

Wazuh is a free, open-source security platform that provides unified XDR (Extended Detection and Response) and SIEM (Security Information and Event Management) capabilities. It consists of an agent deployed on endpoints and a central server that collects, analyzes, and correlates security data. Wazuh performs real-time log analysis, file integrity monitoring, rootkit detection, vulnerability assessment, configuration compliance checking (CIS, PCI DSS, HIPAA, NIST), and active response. It detects threats using rules that correlate events from multiple sources, including endpoint logs, cloud services (AWS, Azure, GCP), containers, and network devices. Wazuh integrates with Elasticsearch and OpenSearch for log storage and visualization, and includes a custom dashboard for security operations. Its open-source nature and comprehensive feature set make it a popular alternative to commercial SIEM solutions.

Platform Support

๐Ÿงlinux
๐Ÿงlinux๐ŸŽmacos๐ŸชŸwindows

Tags

TheHive only

incident-responsecase-managementsoccsirtcollaborationmisp

Wazuh only

siemxdrendpoint-detectionlog-analysiscompliancevulnerability-scanning