Tools/Wazuh
Wazuh
Open-source SIEM/XDR platform — log analysis, host-based intrusion detection, file integrity monitoring, and vulnerability detection via agents deployed across cloud and on-prem hosts. Closest open-source equivalent to Amazon_GuardDuty's continuous threat monitoring, with the tradeoff that you run and tune the detection rules and infrastructure yourself rather than consuming a managed AWS service. Elastic Security (open version) covers similar ground built on the ELK stack; Falco is a narrower, container/runtime-focused alternative. Ships a built-in AWS_CloudTrail integration module for ingesting and analyzing AWS audit logs, and can consume auditd host logs for centralized on-prem analysis.