Datadog, New Relic, Sentry and Splunk rent the graph and the retention. Prometheus is Apache-2.0. Grafana is AGPL-3.0. Together they cover metrics and the boards on top of them. Wazuh's engine is licensed under AGPL-3.0, and its shared libraries are dual-licensed GPL-2.0 or AGPL, which is a host-level detection tool. osquery is dual-licensed Apache-2.0 and GPL-2.0. Sentry's current offering is not what we deploy as the owned error tracker.
What is not replaced?
CrowdStrike is not replaced by Wazuh. A managed detection vendor sells people and threat intelligence, not only an agent. Splunk's retention-and-search product is not replaced by a default Prometheus install. If the contract requires a named SOC, the contract still requires a named SOC.
What do you operate?
The collectors, the disk, and the alert that has to reach a human. A dashboard nobody watches is not observability. Security assessment and hardening is how we decide which signals are worth paging on.
When should monitoring stay rented?
When the estate is small, the vendor's agent is already deployed, and the bill is not the incident. Own it when the telemetry itself is sensitive, or when the per-host fee has become the monitoring strategy.
What do we hand over?
We select the system, deploy it on infrastructure you control, connect it to the tools you keep, and write the runbook so your own team can operate it. Support after handover is optional. The rest of the map is in software you can stop renting; the engagement behind it is open-source business systems.
Name one process that still needs a person. We will tell you what a one-time build takes.
Contact us today