Open Source Tools · Alternatives
Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR service on Azure. Self-hosted alternatives trade the managed service for full control of the data: Wazuh is the most common open-source starting point.
Microsoft Sentinel is a commercial product by Microsoft (official site). Category: SIEM, XDR and log management.
| Tool | Licence | Stars | Last commit | Best for |
|---|---|---|---|---|
 Wazuh | GPL-2.0-only AND AGPL-3.0-or-laterOpen source | 17k | today | Open-source XDR and SIEM platform |
 Security Onion | Elastic-2.0Source-available | 4.9k | 1 month ago | Platform for threat hunting and security monitoring |
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
The code is public, but the licence is not approved by the Open Source Initiative. Read the licence before using these commercially.
Platform for threat hunting and security monitoring
Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.
Product names are trademarks of their owners. ThreatWire is not affiliated with Microsoft. The comparison covers what each tool is designed to do, not a feature-by-feature equivalence.
