The (definitive) list of open source SIEM platforms worth evaluating

Security teams evaluating a SIEM in 2026 face a crowded field of open source options, each with its own strengths, deployment model and licensing terms. This guide breaks down the open source SIEM platforms worth your attention, the criteria that actually matter when comparing them, and why a SIEM itself is only part of the answer: without a structured threat intelligence layer feeding it, even the best detection engine is working with incomplete context.

Reviewed and maintained by Filigran’s product and content team.

TL;DR

Open source SIEMs range from lightweight host-based tools (OSSEC) to full detection platforms (Wazuh, Elastic Security) to purpose-built network monitoring distributions (Security Onion).
Evaluate on log source coverage, detection rule quality, scalability, integration ecosystem, community health and compliance coverage - not just feature lists.
Wazuh currently offers the most complete out-of-the-box experience; Elastic Security offers the most flexibility for teams with the engineering capacity to tune it.
A SIEM alone only tells you what happened. Pairing it with a threat intelligence platform (TIP) like OpenCTI adds the context of who is behind an attack and what to do about it.
Threat intelligence tells you what to detect; breach and attack simulation (BAS/AEV) tools like OpenAEV tell you whether your SIEM actually catches it, closing the loop between intelligence and validated detection.
Filigran’s XTM Platform natively connects OpenCTI and OpenAEV, removing the custom integration work needed to run intelligence and validation as one stack.
Not everything marketed as a "free SIEM" is actually open source - Splunk Free is a notable example worth understanding before you evaluate it.

What to look for in an open source SIEM

Choosing an open source SIEM is not just about feature lists. These are the criteria that actually matter for practitioners.

Log source coverage

Endpoints, cloud workloads (AWS, Azure, GCP), network devices and SaaS applications all generate relevant telemetry. Check what is natively supported versus what requires custom parsing.

Detection rule quality

A SIEM is only as good as its detection logic. Look for active rule communities (SIGMA compatibility is a strong signal), frequent updates and clear documentation for custom rules.

Scalability and deployment

Some tools run comfortably on a single node; others require distributed architectures for enterprise-scale ingestion. Know your events-per-second requirements before you commit.

Integration ecosystem

Your SIEM needs to connect to EDRs, ticketing systems, SOAR platforms and, critically, threat intelligence sources. Native TAXII 2.1 support or available TIP connectors are key criteria.

Maintenance and community health

Check GitHub commit frequency, issue response times and community forums. An effectively abandoned project leaves you holding the maintenance burden alone.

Compliance coverage

Operating under PCI DSS, HIPAA, SOC 2 or GDPR? Verify the tool ships relevant compliance dashboards and reporting out of the box - or that the community has built them.

Our shortlist of open source SIEM tools for 2026

#1 - Wazuh

What it is: the most widely deployed open source SIEM/XDR platform. It started as a fork of OSSEC and has grown into a full security operations platform covering log analysis, intrusion detection, vulnerability detection, file integrity monitoring and compliance reporting.

Best for: teams that want a single open source platform covering SIEM, host-based IDS and XDR capabilities without stitching together multiple tools.

Unified agent covers endpoint telemetry, log forwarding and active response.
Strong out-of-the-box compliance content (PCI DSS, HIPAA, NIST, CIS).
Threat intel from OpenCTI can be pulled in via TAXII 2.1 or CSV feed for indicator enrichment.

Where it falls short: the Wazuh indexer (based on OpenSearch) can become resource-intensive at scale, and UI customization is limited compared to ELK-based alternatives. License / deployment: GPLv2, self-hosted; a cloud-hosted option is available.

#2 - Elastic Security (ELK Stack)

What it is: a SIEM built on the Elasticsearch, Logstash and Kibana stack, with a detection engine, timeline investigation views and machine learning-based anomaly detection. The developer-favorite option for teams that want maximum flexibility.

Best for: engineering-heavy teams comfortable tuning their own stack and writing custom detection logic.

Extremely powerful query languages (KQL, EQL) for threat hunting.
SIGMA rule conversion support via community tooling; scales horizontally for high-volume environments.
One of OpenCTI’s officially supported native connectors: the Elastic Security Intel stream connector pushes threat intelligence directly into Elasticsearch indices for indicator matching.

Where it falls short: the free Basic tier has meaningful feature restrictions - some detection and ML capabilities require a paid subscription - and deployment complexity is high. License / deployment: Elastic License 2.0 by default (source-available); since 2024 the same code is also offered under the OSI-approved AGPLv3. Self-hosted or Elastic Cloud.

#3 - Security Onion

What it is: a Linux distribution purpose-built for threat hunting, network security monitoring and log management. It bundles Suricata (IDS), Zeek (network analysis), the Elastic Stack and a custom analyst console into a pre-configured detection platform.

Best for: SOC teams that want a ready-to-deploy network security monitoring platform without weeks of integration work.

Pre-integrated detection stack out of the box - no assembly required.
Strong network visibility via Zeek and Suricata alongside host-based telemetry.
Active community with regular rule and content updates, designed for analyst workflows.

Where it falls short: the opinionated architecture constrains custom deployments, and scaling beyond a single sensor requires planning. Threat intel integration runs through TAXII 2.1 or CSV feeds. License / deployment: GPL, self-hosted, designed for on-premises deployment.

#4 - OpenSearch Security Analytics

What it is: the SIEM component of the OpenSearch project, the AWS-backed open source fork of Elasticsearch, providing log ingestion, SIGMA-compatible detection rules and threat intelligence integration within the OpenSearch ecosystem.

Best for: teams already running OpenSearch infrastructure, or AWS-native environments.

Native SIGMA rule support - import community rules without conversion tooling.
Actively maintained by AWS and the OpenSearch community; integrates naturally with CloudTrail, GuardDuty and VPC Flow Logs.
Fully OSI-approved open source license (Apache 2.0).

Where it falls short: a younger project than Elastic Security - the detection content library and community ecosystem are less mature, and threat intelligence integration requires more manual configuration. License / deployment: Apache 2.0, self-hosted or AWS OpenSearch Service.

#5 - Graylog Open

What it is: a log management platform with SIEM capabilities. The open edition focuses on centralized log collection, search and alerting; commercial tiers add security-specific content and compliance features.

Best for: teams that prioritize log management and search over detection engineering, particularly with high-volume application and infrastructure logs alongside security events.

Excellent search performance on large log volumes.
Flexible pipeline processing for log normalization and a strong alerting system.
Lower operational overhead than full ELK deployments for log-centric use cases.

Where it falls short: limited built-in security detection content compared to Wazuh or Elastic Security - it is a log management tool first, SIEM second. License / deployment: SSPL (not OSI-approved), self-hosted.

#6 - OSSEC

What it is: one of the oldest open source host-based intrusion detection systems (HIDS): log analysis, file integrity monitoring, rootkit detection and active response.

Best for: lightweight host-based monitoring where deploying a full SIEM agent is not practical, and legacy environments where OSSEC is already in place.

Extremely lightweight agent footprint with wide platform support (Linux, Windows, macOS, Solaris, AIX).
Large community rule library built over two decades.
Wazuh is the modern successor and is backwards-compatible with OSSEC configurations.

Where it falls short: core development has slowed significantly, the UI is minimal, and it is not suitable as a primary SIEM for modern SOC workflows. License / deployment: GPLv2, self-hosted.

#7 - AlienVault OSSIM (retired - included for reference)

What it is: AT&T Cybersecurity’s open source SIEM, combining asset discovery, vulnerability assessment, intrusion detection and SIEM correlation in a single platform. Development has effectively stopped: the last release dates to May 2022 and its retirement has been confirmed.

Best for: legacy context only - teams already running OSSIM who need to plan a migration path, typically toward Wazuh or another actively maintained tool. Notably, OTX (Open Threat Exchange) remains one of OpenCTI’s native connectors, independent of OSSIM’s retirement.

Where it falls short: no active development, heavy hardware requirements and a dated UI - it should not be evaluated for new deployments. License / deployment: GPLv2, self-hosted appliance or VM.

#8 - UTMStack

What it is: a newer open source SIEM + SOAR platform combining log management, threat detection, incident response and compliance reporting in a single stack, targeting mid-market organizations.

Best for: teams that want SIEM and basic SOAR capabilities without deploying separate platforms.

Integrated SOAR playbooks alongside SIEM correlation.
Compliance modules for PCI DSS, HIPAA and ISO 27001.
Lower deployment complexity than ELK-based alternatives, with active development.

Where it falls short: a smaller community and ecosystem than Wazuh or Elastic Security, and less battle-tested at enterprise scale. License / deployment: AGPLv3 (copyleft - modifications distributed as part of a hosted deployment must also be published), self-hosted.

A note on Splunk Free (not open source)

Splunk’s free tier is technically not open source - the source code is not available. It comes up frequently in open source SIEM evaluations, so the constraints matter: the most powerful search and analytics engine in the category and a massive app ecosystem, but a 500 MB/day ingest cap that makes the free tier impractical for production SOC use. Treat it as a "try before you buy" tier, not a free production option.

The architecture most teams are missing

A SIEM processes logs and generates alerts - it tells you that something happened. It does not tell you who is behind the activity, what campaign it belongs to, or which other assets are at risk. That context comes from threat intelligence, structured and automatically fed into your detection stack.

SIEM

Log collection, correlation, alerting. Example tools: Wazuh, Elastic Security, Security Onion.

Threat Intelligence Platform (TIP)

Structured CTI storage, enrichment and indicator management. Example tool: OpenCTI.

BAS / AEV

Continuously test whether your SIEM detections actually fire against real adversary techniques. Example tool: OpenAEV.

Case management / SOAR

Incident response and playbook execution. Example tools: TheHive, Shuffle.

How OpenCTI connects to your SIEM

OpenCTI is a threat intelligence platform built around the STIX 2.1 data model. It stores structured CTI objects - indicators, TTPs, threat actors, campaigns, malware, vulnerabilities - and makes them available to downstream systems:

TAXII 2.1 collections: filterable collections your SIEM polls on a schedule - the recommended path for SIEMs without a dedicated connector, including Wazuh and Security Onion.
Native stream connectors: real-time STIX event push to Elastic Security Intel, AlienVault OTX and Splunk SOAR.
CSV feeds: simple HTTP-accessible feeds of any entity type.

When your SIEM alerts on a suspicious IP or file hash, the analyst immediately sees threat actor attribution, associated campaigns and MITRE ATT&CK technique mapping - without leaving their workflow.

Explore OpenCTI

OpenCTI bi-directional integrations with SIEM, EDR and enrichment tools

OpenCTI’s native SIEM/SOAR integrations at a glance

The three integrations to evaluate first if native, real-time sync is a requirement - plus TAXII 2.1 and CSV feeds for every other platform.

Elastic Security Intel

Real-time stream connector pushing STIX indicators directly into Elasticsearch for detection-rule matching.

View on XTM Hub

AlienVault OTX

Community threat-feed connector ingesting pulses and indicators from Open Threat Exchange into OpenCTI.

View on XTM Hub

Splunk SOAR

Integrates OpenCTI intelligence into Splunk’s SOAR case-management and playbook workflows.

View on XTM Hub

Choosing the right open source SIEM for your stack

There is no universal answer, but there are clear patterns:

If you want the most complete out-of-the-box experience: start with Wazuh. It covers the most ground with the least assembly required and has the most active community.
If you have strong engineering capacity and need maximum flexibility: Elastic Security gives you the most powerful query and analytics capabilities, plus a native OpenCTI connector - but requires significant tuning investment.
If network visibility is your priority: Security Onion bundles Zeek and Suricata alongside SIEM capabilities and is purpose-built for network security monitoring.
If you are AWS-native: OpenSearch Security Analytics is the natural fit, with native SIGMA support and clean integration with AWS services.

Whatever you choose: plan for the intelligence layer from the start. Retrofitting a TIP integration into a mature SIEM deployment is harder than designing for it upfront.

Frequently asked questions

What is the best open source SIEM in 2026?

There is no single "best" - it depends on your priorities. Wazuh offers the most complete out-of-the-box experience with the least assembly required. Elastic Security offers the most flexibility for teams with engineering capacity to tune it. Security Onion is purpose-built for network security monitoring, and OpenSearch Security Analytics is the natural fit for AWS-native environments.

Is Elastic Security actually open source?

It is complicated. Elastic Security ships under the Elastic License 2.0 by default, which is source-available but not OSI-approved as open source. Since 2024, Elastic also offers the same code under AGPLv3, which is OSI-approved. Confirm which license applies to the specific version and distribution you deploy.

Does OpenCTI integrate with Wazuh?

Not via a dedicated native stream connector today. OpenCTI’s officially maintained native connectors are for Elastic Security Intel, AlienVault OTX and Splunk SOAR. Wazuh and Security Onion users can still integrate threat intelligence via OpenCTI’s TAXII 2.1 collections or CSV feeds, which most modern SIEMs support natively.

What is the difference between a SIEM and a threat intelligence platform (TIP)?

A SIEM collects, correlates and alerts on logs - it tells you something happened. A TIP like OpenCTI stores structured, contextualized threat data (indicators, TTPs, threat actors, campaigns) and enriches those alerts with who is likely behind the activity and what to do about it. The two are complementary layers, not substitutes for each other.

What is BAS/AEV and how does it relate to my SIEM?

Breach and attack simulation / adversarial exposure validation (BAS/AEV) tools, like OpenAEV, run real adversary techniques against your environment to test whether your SIEM’s detection rules actually fire. It closes the loop between "we wrote a detection rule" and "we verified that rule works", and results can feed back into tuning your SIEM’s rule set.

Is Splunk Free actually open source?

No. Splunk’s free tier is proprietary software with a free usage tier capped at 500 MB/day of ingest - the source code is not published. It is useful for evaluation, development or very small deployments, but it is not an open source SIEM and is not viable for production SOC use at scale.

Make your SIEM threat-informed.

Browse 390+ connectors, feeds and integrations for OpenCTI - including native connectors for Elastic Security Intel, AlienVault OTX and Splunk SOAR - on the XTM Hub.

Explore the XTM Hub Book a demo