WAZUH · Open-source SIEM / XDR · Log management
Kinetik Bilişim deploys the Wazuh server, indexer and dashboard, rolls out agents and turns logs into alerts people actually look at — and takes over Wazuh installations you built yourself.
Wazuh is an open-source security monitoring platform that combines log collection and correlation (SIEM), file integrity monitoring, vulnerability detection, configuration assessment and endpoint threat detection (XDR) under one roof. It grew out of the OSSEC project and has no licence fee.
The architecture has four components: the Wazuh agent installed on monitored systems, the Wazuh server that analyses events, the indexer that stores the data and the dashboard that serves as the interface.
| At a glance | Wazuh |
|---|---|
| Developer | Wazuh, Inc. |
| Headquarters | US · California |
| Licence | Open source (GPLv2) |
| Components | Agent · Server · Indexer · Dashboard |
| Installation options | All-in-one · Docker · Kubernetes · OVA |
| Compliance templates | PCI DSS · GDPR · HIPAA · NIST 800-53 |
| With Kinetik | Deployment, agent rollout, rule tuning, reporting |
Kinetik Bilişim and Wazuh
Collecting logs is easy; the hard part is surfacing the three events out of thousands that really need attention. That is why our Wazuh deployments focus on rule tuning: we don't leave the default rule set as is, we weed out false positives against the organisation's normal behaviour.
We feed Wazuh with FortiGate syslog, Windows Server and Active Directory events (including Sysmon), and Proxmox and JumpServer records, so network, identity and privileged access appear on the same timeline.
In Türkiye, interest in Wazuh is largely do-it-yourself: the most searched topics are agent installation, Docker deployments and dashboard errors. If you built Wazuh yourself and the alert count has become unmanageable, we take it over without wiping it and sort out the rules, indices and capacity.
Product family
- Wazuh SIEM — log collection, correlation, alerting and compliance reports.
- Wazuh XDR — endpoint threat detection, file integrity and vulnerability detection.
- Wazuh Cloud — the vendor-hosted edition, for teams that don't want to run the infrastructure.
Which problems do we solve?
- ISO 27001 logging and monitoring controls. Central logging, retention and evidence of regular review.
- SMBs without a SOC budget. No licence fee, with a weekly summary through our managed service.
- Operational problems in a self-built Wazuh. Indexer capacity planning and maintenance for full disks, dashboards that won't load and version upgrades.
- Unnoticed configuration changes on servers. File integrity monitoring and configuration assessment.
A SIEM nobody reads is the most expensive log archive there is. In Wazuh projects our first goal is a report simple enough to be read once a week.
— Field note, Kinetik Bilişim
How we work
- Discovery. Log sources, retention needs and compliance target; review of any existing Wazuh installation.
- Design and PoC. Pilot on critical servers; measuring the false-positive rate.
- Deployment and migration. Agent rollout, syslog integrations and rule tuning.
- Operations. Weekly reporting and alert follow-up — Managed Services.
Related pages and reading
- Monitoring solutions
- Open-source solutions
- ISO Certification: logging and monitoring controls
- KVKK & GDPR Compliance
- JumpServer: forward privileged sessions to Wazuh
Frequently asked questions
Is Wazuh free?
Yes, it is open source with no licence fee. The cost lies in server resources, storage, and deployment and operations effort.
Which systems does the Wazuh agent run on?
Windows, Linux and macOS servers and clients. Firewalls, switches and applications that can't take an agent connect via syslog; agents are grouped and configured centrally.
How does Wazuh differ from Graylog, Splunk and Zabbix?
Zabbix monitors performance and availability; it does not correlate security events. Graylog is a strong log management tool but needs extra work for security rules and endpoint detection. Splunk is feature-rich and licensed by data volume. Wazuh delivers SIEM, endpoint detection and compliance reporting in one package with no licence fee.
We built Wazuh ourselves — can you take it over?
Yes. We start with a version, capacity and rule review without wiping existing indices or agents. Wazuh doesn't replace a SOC, so we also set up who looks at the alerts and how often.
What are your logs telling you?
Let's plan a Wazuh pilot on your critical servers, or a health check of your existing installation. Book an introductory meeting →
Last updated: October 2026
