WAZUH ELK Y WAZUH XDR

[stefanny chavez anto]

Good day
I want to install wazuh in production, but I need to know the difference, its benefits and cons between Wazuh XDR (Wazuh-manager, wazuh-indexer, wazuh dashboard) and Wazuh ELK (elasticsearch, logstash and kibana)

[Christian Borla]

Hi
Stefanny chavez anto
I hope you are well.
I thinks it's depens on your structure and how much time do you want to spend deploying it.

I think it depends on your structure and the time you want to dedicate to it, and maintain it. If we do a quick search on the web we find these differences.

Wazuh:

Components: Wazuh Manager, Wazuh Indexer, Wazuh Dashboard.
Benefits: Integrated solution, simplicity in setup, predefined rules, centralized management.
Drawbacks: Limited customization, scalability challenges for large deployments.

Wazuh ELK:

Components: Elasticsearch, Logstash, Kibana.
Benefits: Flexibility, scalability, community support, versatility.
Drawbacks: Complexity in setup, resource-intensive, maintenance overhead.

Here you can find the wazuh section that talks about the ELK option, I think if we compare at documentation level, there is much more information in the XDR version.  
I hope it helps.
Regards.