Wazuh Extended Detection and Response (XDR) is an open source security platform that provides threat detection, analysis, and response capabilities across multiple IT infrastructure layers. The platform collects telemetry from endpoints, network devices, cloud workloads, third-party APIs, and other sources for unified security monitoring. The platform includes a universal agent that runs on common operating systems to perform malware detection, file integrity monitoring, vulnerability assessment, system configuration scanning, and automated threat response. Wazuh maps detected events to adversary tactics and techniques, ingests third-party threat intelligence data, and supports custom queries for threat hunting. Wazuh provides behavioral analysis capabilities that monitor file integrity, network traffic, user behavior, and system performance metrics to identify deviations from normal patterns. The active response module automatically executes built-in or custom response actions to mitigate threats according to incident response plans. The platform includes cloud workload protection with built-in integrations for cloud services, supporting native and hybrid cloud environments including container infrastructure. It performs regulatory compliance checks against standards such as PCI-DSS, HIPAA, and GDPR, and generates compliance reports. Wazuh ingests telemetry via syslog or APIs from third-party applications, devices, and workloads including cloud providers and SaaS vendors. The platform is customizable and maintained by a community of users and developers.