Wazuh or Osquery

[wildlyunder]

Hi All,

We need to ship logs from Linux and Windows Machines on Prem and in the cloud and not sure which agent to go for.

What agent do you prefer and why?

Any pro's and cons?

[dougburks]

Since Wazuh, osquery, and Elastic Beats are all free, we recommend that you try each of them in your environment to see which works best for you and your goals.

[0nnyx]

Recommend you use Beats for log shipping only : it has the least overhead and is the most reliable
Add Wazuh for incident response or compliance audit if needed (don't think the IR part works yet)
Add Osquery for specific OS info like current users, running processes etc if needed
Wazuh will throw plenty of alerts by default unless you disable the audit config part.
Osquery will pollute your logs with its own app logging and is not 100% reliable : had several computers stopping sending logs for weeks after an autoupdate