There is a persistent myth that open-source security operations means downloading a tool, pointing it at your logs, and hoping. Running a real security operations centre on Wazuh and OpenSearch is nothing like that — and the gap between “installed” and “operational” is exactly the work worth paying for.
What the stack gives you
Start with what the stack gives you. Wazuh provides the agent-based collection, file-integrity monitoring, log analysis, and a detection engine whose rules you can read and modify. OpenSearch provides the scalable storage and search underneath. Together they are a genuinely capable foundation — and, critically, an inspectable one.
Every detection is a rule you can point at, challenge, and own. Compare that to a commercial platform that scores events with logic you are not permitted to see.
The work is everything around it
Collection has to be complete and reliable: agents deployed across a heterogeneous estate, log sources normalised, gaps identified before an incident finds them for you.
Detection engineering is continuous: out-of-the-box rules are a starting point, and the value comes from tuning them to the client's environment, writing new rules for the threats that actually matter to them, and killing the false positives that otherwise train analysts to ignore alerts.
Triage and response need people — a UK-based, cleared team on rotation, with runbooks, escalation paths, and the discipline to treat a 3 a.m. alert with the same rigour as a 3 p.m. one.
The part nobody advertises
Then there is the part nobody advertises: operating the platform itself. OpenSearch clusters need capacity planning, index lifecycle management, and tuning as data grows. Wazuh needs upgrades, rule-set hygiene, and integration with the rest of the security estate.
This is real engineering, and doing it as code — with configuration in version control — is what keeps it consistent and auditable rather than a pile of undocumented tweaks.
Why it is worth it
Done properly, the result is a SOC with a property most commercial offerings cannot match: explainability. When a client asks why an alert fired, we show them the rule and the evidence. When their auditor asks how detection works, they can read it. A detection you cannot explain is a detection you cannot fully trust — and for the organisations we work with, “trust us” was never going to be good enough.
So: what does it take? Proven open foundations, yes. But mostly it takes disciplined engineering, continuous detection work, and cleared people who care. The tools are open. The competence is the service.