We replayed 24 ATT&CK techniques against a default Wazuh install. Three raised an alert.

Not three percent. Three techniques. The four chains you would most want to catch — discovery, collection, exfiltration, C2 — produced zero alerts between them. I want to be precise about what that number is and is not, because the number is easy to misread in both directions. What it is A default install. Stock rules, no Sysmon, no ScriptBlock logging, no tuning. We replayed 24 techniques and counted how many produced an alert a human would see. Denominator: 24. Numerator: 3. What it is not It is not a claim that Wazuh is a bad SIEM. It is a claim that a default SIEM is close to blind, and that most of the detection you think you bought is configuration you have not done yet. The same technique, three SIEMs T1110.001 (brute force) is the one technique we have run end-to-end on all three platforms. SIEM Setup Result MTTD Wazuh 4.14.2 SSH brute force, 20+ failed logins, custom rule 100113 ALERTED ×2, coverage 100% 25s / 45s IBM QRadar CE 7.3.3 hydra, 50 SSH login attempts against a live victim host ALERTED ~4s Splunk Enterprise winsrv01 , 12× EventCode 4625 — events replayed into Splunk, not generated by a live attack ALERTED 0s Read the third row differently from the first two. Wazuh and QRadar were measured against a real attack on a real host: hydra and a live SSH brute force, with the alert coming back out of the platform. The Splunk row is a real Splunk Enterprise, a real detection-as-code rule, and a real query — but the 4625 events were replayed in rather than produced by an attack we ran. That makes it a valid test of the connector and the rule. It is not a test of Splunk's ingest path, and we are not going to let it read as one. 🔴 Do not read this table as a race either. The three numbers are not comparable and we are not going to pretend they are. Splunk's 0s is not Splunk being six times faster than QRadar — it is Windows 4625 events already sitting in the index before the clock started, while the Wazuh figure includes agent-to-manager-to-indexer propagati