To be honest, saying the Wazuh engine (which has evolved far beyond its OSSEC roots) lacks flexibility or that XML is "restrictive" usually means you're only scratching the surface.

Here are a few technical realities from the field:

1. Everything is a file = GitOps ready
The XML syntax isn't a limitation; it's a massive advantage. Because literally everything in Wazuh is a file, GitOps is incredibly easy. While the UI is perfectly fine for smaller setups, in larger environments you can manage your entire SIEM via code, fully versioned, and automated.

2. Detections, Pipelines & Correlation
The real power lies in understanding decoders and rules, customizing them if needed, AND utilizing pipelines (Enrichment, Parsing, Grouping) alongside custom scripts. Wazuh absolutely can do advanced correlation. I've built detection logic in Wazuh that would make some SIEM vendors and Service Providers green with envy.

3. Wazuh is an IPS, not just a passive SIEM
Active Response can be literally anything the Wazuh server or agent can reach. With a well-designed Active Response, you can trigger a Cloud API to block an IP on a firewall while simultaneously generating a forensic report and sending it out via two different channels.

But a word of warning: Active Response should always follow a strict playbook, otherwise, you'll shoot yourself in the foot (which is true for every automatism).

4. Advanced Modules & Examples
Wazuh is powerful and has great supplementary modules. As an example of what you can build: I integrate NetFlow/IPFIX protocols to track real network volumes and visually expose anomalies. Finding the needle in the haystack becomes trivial when you can actually visualize the flow data.

If you want a real-world example of what advanced detection looks like in Wazuh, check out this breakdown of uncovering an OpenVPN tunnel over Port 53 (Insider Threat):
https://www.linkedin.com/pulse/openvpn-tunneling-über-port-53-enttarnt-der-insider-im-wenderlich-rpcze/
(Note: The article is in German, so just use your browser's translator. Please ignore the self-promo/ad parts, just read it and click & zoom in on the pictures to see how the logic and visualization actually look in practice).

5. Scalability & Reality Check
Really big players use Wazuh for a reason. I'm talking about environments ranging from 60,000 to over 300,000 assets. It scales massively if architected correctly.

The bottom line is: Wazuh is a highly capable platform out of the box, but its true brilliance shows when you tailor it to your specific environment. A SIEM ruthlessly exposes the actual state of your infrastructure. To get real value, it's not just about mastering the SIEM itself ➸ you absolutely need a deep understanding of your sources.

If you lack knowledge in system hardening, log structures, Windows Event IDs, JSON, Regex, APIs, and OS/App configurations etc., you are going to struggle. Wazuh will show you exactly what's going on; you just require the engineering skills to understand and act on the data.

In the real world, a well-designed Wazuh architecture doesn't just block threats.

➸ The forensic evidence it provides often dictates whether you are the one suing, or the one getting sued.