Open-source Rapid7 alternatives

Wazuh is a free and open-source platform for threat prevention, detection and response. It protects workloads across on-premises, virtualized, containerized and cloud environments and combines XDR and SIEM functions in one product. The code is written mainly in C++.

The solution consists of an endpoint security agent installed on monitored systems and a management server that collects and analyzes the agents' data. It is integrated with the Wazuh Indexer, which offers a search engine and visualization for navigating security alerts. Agents scan for malware, rootkits and suspicious anomalies, read system and application logs, and monitor files for changes to content, permissions, ownership and attributes.

Rule-based analysis of collected logs, including data received from network devices through syslog, helps surface misconfigurations, policy violations and attempted or successful attacks. Repository topics also cover vulnerability detection, configuration assessment, incident response and compliance such as PCI DSS. The repository lists its license as 'Other', so review the license files for the exact terms.

Graylog is a log management server written in Java and described by its maintainers as free and open. It centralizes log data from many systems so teams can search, view and analyze events in one place instead of connecting to each machine individually.

The repository topics point to support for common log formats and transports, including GELF and syslog, along with Kafka and AMQP inputs. Topics also place the project in log analysis, log collection, secure logging and SIEM territory, which reflects its use for monitoring and security work. Specific features were not available when this entry was written, because the vendor website could not be read.

DefectDojo is a DevSecOps, application security posture management and vulnerability management tool. It orchestrates end-to-end security testing, tracks vulnerabilities, removes duplicate findings, supports remediation work and produces reports, giving security teams one place to see what scanners across the pipeline have found.

A simple way to try it is uploading sample scan reports, and the project provides Docker Compose instructions for a quick start plus public demo environments for both the commercial Pro edition and the OWASP Community Edition, which reset daily and should not hold sensitive data. Repository topics include vulnerability correlation, security automation and orchestration. It is built with Python and Django and can be deployed on Kubernetes.

The community edition is licensed under BSD-3-Clause and is run on your own infrastructure, while the vendor sells a Pro edition with additional features. It suits AppSec and product security teams consolidating results from many scanners.

OpenVAS Scanner is the scanning engine of the Greenbone Community Edition and is also used in Greenbone Enterprise appliances. It performs vulnerability scans by running a set of Vulnerability Tests (VTs) that is updated and extended continuously through a feed.

The module is configured, built and installed with CMake and make, and the INSTALL.md file explains how to set up openvas and expose the scanner to other GVM modules. Release files are signed with the Greenbone Community Feed integrity key. Docker images are published to the Greenbone registry, and a fully containerized setup for the Community Edition is also provided.

The repository also contains a Rust project that aims to replace the existing scanner stack made up of openvas-scanner, ospd-openvas and notus-scanner, simplifying scanning by centralizing everything in one place; for now it uses openvas-scanner as the scan engine. The code is licensed under GPL-2.0. Anyone not comfortable building from source is pointed to the Greenbone Enterprise TRIAL virtual machine.

Security Onion is a no-cost, open Linux distribution built for threat hunting, security monitoring across an enterprise, and log management. It bundles a suite of tools designed to work together so defenders get visibility into both network and host activity from a single platform.

The Security Onion Console is a unified web interface for analyzing events and managing the deployment, with its own tools for alerting, dashboards, hunting, packet capture, detections and case management. Underneath it uses the Elastic Stack for search, Suricata for network intrusion detection, Elastic Fleet for host monitoring, Zeek for network metadata and other tools such as osquery and CyberChef. The installer and configuration are largely shell scripts.

The repository license appears as 'Other' on GitHub. Security Onion is deployed on your own hardware or virtual machines, either standalone or as a distributed grid. It suits security operations centers, incident responders and blue teams that want an integrated, open alternative to commercial monitoring platforms.