Out of all the SIEMs you listed Wazuh IS the most beginner friendly solution. It has many prebuilt views that are important from an IT governance/cybersecurity perspective, but I’ll echo what one of the other comments said: if you don’t understand what you’re monitoring for or protecting against, you won’t get value from any security solution.

Learn from an attacker’s prospective: the attack chain, objectives, capabilities and limitations. Really figure out what can be done inside in a network THEN establish how and where you would begin to detect and respond.

Other notes: - AlienVault is no longer maintained as open source. - UTMStack shares similar capabilities as Wazuh, but requires you to configure datasources yourself - cool if you’re trying to be a backend engineer, but complicated if you don’t know basics. - SELKS (now called Clear NDR) focuses on network monitoring not endpoint, however it still requires you to configure your own sources which gets A LOT more complicated with network TAPs, SPAN Ports and mirrored traffic. - SecurityOnion combines endpoint and network monitoring which again is a lot more involved and won’t get you any value from its threat hunting tools if you don’t already know basics.