Open Source Tools · Alternatives
Splunk Enterprise Security is a commercial SIEM built on the Splunk data platform. Open-source teams often start from Wazuh for log collection, endpoint telemetry and detection rules; source-available platforms such as Graylog and Security Onion are also used.
Splunk Enterprise Security is a commercial product by Cisco (Splunk) (official site). Category: SIEM, XDR and log management.
| Tool | Licence | Stars | Last commit | Best for |
|---|---|---|---|---|
 Wazuh | GPL-2.0-only AND AGPL-3.0-or-laterOpen source | 17k | today | Open-source XDR and SIEM platform |
 Graylog | SSPL-1.0Source-available | 8.2k | today | Centralised log management |
 Security Onion | Elastic-2.0Source-available | 4.9k | 1 month ago | Platform for threat hunting and security monitoring |
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
The code is public, but the licence is not approved by the Open Source Initiative. Read the licence before using these commercially.
Centralised log management
Log management server that collects, parses, stores and searches logs, with streams, pipelines, dashboards and alerts.
Platform for threat hunting and security monitoring
Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.
Product names are trademarks of their owners. ThreatWire is not affiliated with Cisco (Splunk). The comparison covers what each tool is designed to do, not a feature-by-feature equivalence.
