G2

Kirpalsinh R.

Cyber Security Intern

Information Technology and Services

Small-Business (50 or fewer emp.)

10/29/2026

"Hands-on SOC log monitoring, agent management, and alert triage"

5/5

What do you like best about Wazuh?

Wazuh provides an incredible learning environment and a practical, hands-on platform for understanding real-world SIEM and XDR operations. The open-source architecture allows interns to explore how endpoint agents capture security telemetry, track File Integrity Monitoring (FIM) events, and monitor system configuration compliance without a steep paywall. Navigating the OpenSearch-powered dashboard makes learning to query log indices, filter security events, and analyze MITRE ATT&CK framework mappings intuitive. Writing basic custom decoders and XML detection rules in a lab setting gives valuable insight into how SOC teams analyze raw log streams and build actionable alerts. Review collected by and hosted on G2.com.

What do you dislike about Wazuh?

Because Wazuh offers deep customizability through XML rulesets and custom regex decoders, troubleshooting syntax errors or unexpected decoder behavior can have a bit of a learning curve for beginners. Configuring rules to prevent false positives when testing custom scripts or local lab tools requires trial and error. Additionally, while the web UI provides detailed event breakdown graphs, having more interactive, built-in tutorial guides or pre-built sandbox walk-throughs inside the console would help junior analysts and interns get up to speed even faster during onboarding. Review collected by and hosted on G2.com.

What problems is Wazuh solving and how is that benefiting you?

Wazuh solves the difficulty of gaining practical, end-to-end experience with enterprise-grade threat detection and log correlation tools. Before working with Wazuh, understanding how security operations centers (SOCs) collect, parse, and analyze event logs across multi-OS endpoints was largely theoretical. Wazuh aggregates telemetry from Windows, Linux, and network devices into a single, unified interface, enabling me to build confidence in incident triage, threat hunting, and security monitoring workflows. Review collected by and hosted on G2.com.