Wazuh

Wazuh is an open-source security platform combining host-based intrusion detection (HIDS), log analysis, and SIEM capabilities. It can be configured to generate incident alerts when anomalies or policy violations occur. A central console aggregates events from endpoints, allowing teams to investigate suspicious activity. While not purely ITSM, Wazuh suits security ops wanting a free solution that triggers security incidents and helps manage them with real-time insights and alerting.