MANAGED WAZUH
SIEM and XDR coverage on one open-source agent — operated by senior engineers.
Wazuh deployed in your cloud or ours, tuned over 60 to 90 days to under 5% false-positive rate, and run 24/7 by a Canadian security team. Same MITRE ATT&CK coverage as Splunk Enterprise Security. Different invoice.
What you get
Six capabilities, one agent, one console.
SIEM + XDR on one agent
Log analytics, file integrity monitoring, vulnerability detection, and active response — same agent, same console. You stop paying for four products.
MITRE ATT&CK out of the box
Detection rules ship pre-tagged with technique IDs. Pivot from alert to ATT&CK navigator without building the mapping yourself.
Vulnerability detection without auth scans
Each agent reports its software inventory. Wazuh correlates against CVE feeds (NVD, RHEL, Canonical, MS) — exploitable software flagged daily.
File integrity + config assessment
FIM and SCA on every endpoint. Real HIDS coverage — not just a log shipper. Catches the change auditors actually ask about.
Compliance dashboards built in
PCI DSS, HIPAA, GDPR, NIST 800-53, TSC, CIS benchmarks ship in the box. We tune them to your auditor's evidence list, not a generic template.
GPLv2. You keep the stack.
If we part ways, your detections, your data, and your dashboards stay yours. No proprietary export format. No hostage logs.
Wazuh vs Splunk ES
Same coverage. Different invoice.
| Capability | Splunk Enterprise Security | Managed Wazuh (ThinSky) |
|---|---|---|
| Pricing model | Per-GB/day ingest or workload (vCPU). List not published[5] | Flat managed fee. No per-GB meter. |
| List rate (per GB/day, per year) | ~$250–$400 at list (1.5–2× base platform)[6] | Bundled. Volume isn't the unit of value. |
| SIEM, XDR, FIM, vuln detection | Core + paid add-ons (ES, SOAR, UEBA)[7] | All in the platform.[1] |
| MITRE ATT&CK mapping | Yes | Yes — rules ship pre-tagged with technique IDs[1] |
| Data ownership if you leave | Proprietary indexes; egress is work | GPLv2 stack, plain index. You keep it.[2] |
| Where Splunk genuinely wins | SPL, Risk-Based Alerting, mature ML Toolkit / UEBA, Splunkbase ecosystem, named tier-1 vendor TAMs.[7][8] | |
How we operate
Four phases. One team.
Assess
Threat-model your environment, map current log sources, baseline noise volume. Two weeks. Written deliverable.
Deploy
Manager cluster, indexer cluster, dashboard. Agents rolled out in waves. Deployed in your cloud or ours — your choice.
Tune
60–90 days of active rule tuning. Sliding-window grouping, decoder work, vendor-specific suppressions. Target: under 5% false-positive rate.
Operate
24/7 SOC. Senior engineers on rotation. Monthly posture report, quarterly strategy call, runbook updates as your stack changes.
Honest math
500 endpoints. ~50 GB/day. Real numbers.
Splunk Enterprise Security
- License (50 GB/day, 12-mo retention)$180,000
- Enterprise Security add-on$50,000
- SOAR add-on$30,000
- Storage (hot tier)$15,000
- Premier support (~20% uplift)$30,000
Managed Wazuh (ThinSky)
- Managed Wazuh service$48,000
- Cloud infrastructure (manager + indexer + dashboard)$12,000
- Add-ons (none — all included)$0
- Storage (hot + warm tier)included
- 24/7 SOC, tuning, runbook ownershipincluded
Methodology, retention assumptions, and conservative ranges for 50, 500, and 5,000 endpoints in the research dossier. Splunk numbers use realistic enterprise-discounted figures, not strict list price (which nobody pays).
Honest answers
The five questions every CISO asks.
Open source means no SLA. Who do we call at 2 a.m.?
You call ThinSky. We carry the operational SLA — Wazuh is GPLv2, but the contract you sign is a commercial one. Senior engineers on rotation, named escalation, runbooks owned by us. If you need the SIEM vendor's logo on your paper SLA for procurement reasons, that's a real difference and we'll tell you up front when it matters.
Splunk has UEBA and ML. Wazuh doesn't. Doesn't that matter?
For most mid-market detection use cases — lateral movement, credential abuse, ransomware staging — well-tuned correlation rules cover the same ground UEBA does. ML on top of Wazuh alerts is achievable as an integration, and academic work has demonstrated 78% false-positive reduction layering ML on Wazuh data.[20] If you run a 200-analyst SOC at a global bank, Splunk's ML Toolkit and RBA add-ons are genuinely better. If you have a 5–15-person security team, the gap is mostly marketing.
Doesn't Wazuh fall over past a few thousand agents?
It can — and the bottleneck is the OpenSearch indexer, not Wazuh itself.[15] The fix is the same fix Elastic operators apply: cluster sizing, shard strategy, ISM policies, hot/warm tiering. We've run mid-market deployments at 2,000–5,000 agents. The architecture has to be right from day one — that's exactly what we sell.
Will my auditor accept Wazuh evidence?
Yes. Wazuh ships compliance dashboards for PCI DSS, HIPAA, GDPR, NIST 800-53, TSC, and CIS benchmarks out of the box, and we customize them for the specific evidence your auditor asks for.[1][2] We have walked Wazuh through SOC 2 Type II and HIPAA audits. If your auditor has a strong Splunk preference, tell us — we plan around it.
Nobody got fired for buying Splunk. How do we explain this to the board?
With the math. We give you a written line-by-line ROI doc — log volume assumptions, retention, GB/day, sources cited — that you can hand the CFO. The board question in 2026 isn't "why open source?" anymore. It's "why are we paying $300K for a SIEM when peers run the same MITRE coverage for $60K?" That's a defensible answer.
See your Wazuh number, not Splunk's.
Send us your endpoint count and a sample of log volume. We'll come back with a written architecture, a 60-day tuning plan, and a real annual number — no NDA required.
Get a Wazuh sizing call →