Open-source Microsoft Defender alternatives

Wazuh is a free and open-source platform for threat prevention, detection and response. It protects workloads across on-premises, virtualized, containerized and cloud environments and combines XDR and SIEM functions in one product. The code is written mainly in C++.

The solution consists of an endpoint security agent installed on monitored systems and a management server that collects and analyzes the agents' data. It is integrated with the Wazuh Indexer, which offers a search engine and visualization for navigating security alerts. Agents scan for malware, rootkits and suspicious anomalies, read system and application logs, and monitor files for changes to content, permissions, ownership and attributes.

Rule-based analysis of collected logs, including data received from network devices through syslog, helps surface misconfigurations, policy violations and attempted or successful attacks. Repository topics also cover vulnerability detection, configuration assessment, incident response and compliance such as PCI DSS. The repository lists its license as 'Other', so review the license files for the exact terms.

CrowdSec is an open-source and participative security solution that detects and blocks malicious behavior on servers. Its Security Engine acts as an all-in-one intrusion detection and prevention system and web application firewall, analyzing log sources and HTTP requests and enforcing decisions through separate remediation components. It runs on Linux, Windows, Docker and Kubernetes.

A Community Blocklist of IP addresses identified as malicious is shared among users, so an address that attacks one participant can be blocked for others before it arrives. Detection and remediation are decoupled, which means logs can be parsed on one machine while blocking happens at a firewall, reverse proxy or CDN elsewhere. A web console supports monitoring and automation.

The README compares it with fail2ban, which reads similar logs, and with ModSecurity, Coraza and naxsi, since the AppSec component is a WAF built on Coraza that loads SecLang rules and the OWASP Core Rule Set. It can also answer suspicious requests with a JavaScript proof-of-work challenge to stop headless scrapers. CrowdSec is written in Go and licensed under MIT.

OSSEC is a host-based intrusion detection system (HIDS) that watches individual servers and endpoints for signs of compromise. Its README describes it as a platform that brings together HIDS, log monitoring and SIM/SIEM capabilities in one open-source package.

The project's description lists log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. Those capabilities support compliance work as well as detection, and the repository's topics refer to PCI DSS and NIST 800-53. Stable releases and documentation are published on ossec.net, with community help on Slack and Discord.

OSSEC is written in C and licensed under GPL-2.0. It bundles a modified zlib and a small part of OpenSSL, along with the cJSON library. Atomicorp hosts the annual OSSEC conference, and the development version is available through a simple git clone.

Security Onion is a no-cost, open Linux distribution built for threat hunting, security monitoring across an enterprise, and log management. It bundles a suite of tools designed to work together so defenders get visibility into both network and host activity from a single platform.

The Security Onion Console is a unified web interface for analyzing events and managing the deployment, with its own tools for alerting, dashboards, hunting, packet capture, detections and case management. Underneath it uses the Elastic Stack for search, Suricata for network intrusion detection, Elastic Fleet for host monitoring, Zeek for network metadata and other tools such as osquery and CyberChef. The installer and configuration are largely shell scripts.

The repository license appears as 'Other' on GitHub. Security Onion is deployed on your own hardware or virtual machines, either standalone or as a distributed grid. It suits security operations centers, incident responders and blue teams that want an integrated, open alternative to commercial monitoring platforms.

ClamAV is an open-source antivirus engine that detects trojans, viruses, malware and other malicious threats. It is written in C, released under GPL-2.0 and developed by Cisco Talos. It is used as an engine that other tools and servers can build on, for example scanning files or mail attachments, rather than as a polished desktop product.

Documentation and an FAQ are hosted at docs.clamav.net, and each release archive includes an offline copy. The project explains how to read and write ClamAV signatures through a signature writing manual, so anyone can create detection rules. News, release notes and a blog track new features, and documentation contributions go through a separate repository.

Installation options include official Docker images, distribution package managers, and downloadable installers: Debian and RPM packages for Linux, a universal PKG for macOS and MSI or portable ZIP packages for Windows. It can also be built from source for Unix, Linux, Mac and Windows. Upgrade notes describe moving from earlier versions.