how to build a simple SIEM on a budget

how to build a simple SIEM on a budget

TL;DR

You do not need a six-figure SIEM to get the core value: centralized logs, a handful of detection rules, and alerts that reach a human. Start with Wazuh or a small OpenSearch stack, ship your three most important log sources first, and write five rules that match your actual threats. Grow the rule set only after the first five are quiet and trusted.

how to build a simple SIEM on a budget

Use this when

• You have no central log visibility and need to start somewhere
• Commercial SIEM quotes are out of reach and you need the 80 percent version
• You want detection rules you wrote yourself instead of a black box
• You are a small team that needs to answer "what happened" after the fact

Not for this skill when

• You need compliance-certified log retention (check your auditor's requirements first)
• You have the budget and staff for a managed SIEM (buy it; your time is worth more)
• You need sub-second detection on huge volumes (this stack is not that)
• You only need log storage, not detection (plain centralized logging is simpler)

Steps

1. Pick the stack and stand it up

For most small teams, Wazuh (free, open source, includes agents and rules) or OpenSearch with log shippers is the pragmatic pick. Run it on one decent VM to start; you can scale later.

docker compose up -d

Expected: the stack's web UI loads and shows a healthy cluster, using the project's published compose file. Keep the install minimal; every extra component is something you will maintain at 2am. (Wazuh 4.x all-in-one or OpenSearch 2.x; both run fine on a single 8GB VM for small fleets.)

2. Ship your three most important log sources first

Authentication logs, cloud audit logs, and firewall or VPN logs cover the vast majority of "who did what from where" questions. Do not boil the ocean; three sources done well beat twenty done badly.

logger -p authpriv.warning "siem-test-event $(date -u +%FT%TZ)"

Expected: the test event shows up in your SIEM within a minute or two, tagged to the right host. If it does not appear, fix the shipping before adding more sources; an unreliable pipeline poisons everything downstream.

3. Write five detection rules for your real threats

Start with: impossible travel or new-country login, multiple failed logins followed by success, new admin user created, cloud console login without MFA, and outbound traffic to a rare new domain. Tune each until it is quiet.

printf 'rule1 impossible-travel\nrule2 fail-then-success\nrule3 new-admin\nrule4 console-no-mfa\nrule5 rare-domain\n' | tee siem-rules.txt

Expected: each rule fires on a deliberate test (log in oddly from the test account, create a test admin) and stays silent for a week of normal activity. A rule that fires daily gets tuned or deleted; noisy rules get ignored, which is worse than no rule.

4. Route alerts to a human who will act

An alert nobody sees is a log entry with extra steps. Send high-severity alerts to the on-call channel and page; medium to the security channel for next-business-day review.

curl -s -X POST https://example.com/hooks/[webhook-id] -H "Content-Type: application/json" --request-json '{"text":"SIEM alert routing test"}' -o /dev/null -w "%{http_code}"

Expected: HTTP 200 and the test message lands in the channel. Document who owns each severity and what "acknowledge" means; the routing is only half the system.

5. Set retention and protect the logs

Keep hot searchable logs for 30 to 90 days and cheap archived copies for a year or more. Make the log store append-only for the service accounts that write to it; an attacker who can edit logs can hide.

printf 'hot: 90 days searchable\narchive: 1 year cheap storage\nwriters: append-only\n' | tee retention-policy.txt

Expected: you can state your retention numbers without checking, and a write-only service account cannot delete or modify existing log data. Test the archive restore once; same rule as backups.

Variant: truly minimal (one VM, rsyslog, grep)

No SIEM at all: forward syslog from every host to one collector, rotate and compress daily, and run a nightly script that greps for your five patterns and reports matches. Crude, but centralized and infinitely better than per-host logs.

Variant: cloud-native on a budget

Ship cloud audit logs to cheap object storage, query them with the cloud's serverless query tool when you need answers, and keep 2 to 3 native alert rules for the critical events. You pay per query instead of per GB ingested, which is usually far cheaper at small scale.

Variant: growing past the single VM

When searches get slow or volume grows, split into hot and warm tiers and add a second node. The rules and shipping do not change; only the storage layout does. Do not rebuild the whole thing; scale the storage.

Why this happens

SIEM pricing is built for enterprises with compliance mandates, which leaves small teams with nothing: logs scattered across hosts, no correlation, and incident response that starts with "SSH into each box and grep". The expensive part of a SIEM was never the software; it is the tuning. A free stack with five well-tuned rules you understand beats a six-figure platform with 500 default rules nobody trusts.

Edge cases and pitfalls

• Time sync: if host clocks drift, correlation breaks; run NTP everywhere before you trust any timeline.
• Log volume surprises: one chatty debug service can fill the disk; set per-source rate limits and disk alerts on the collector.
• Alert on the pipeline itself: if log shipping dies silently you are blind; alert on "no logs from host X in 15 minutes".
• Parsing failures: unstructured logs that fail to parse become unsearchable; check the parse-failure rate weekly.
• Do not forward logs over the open internet without TLS; you would be shipping your crown jewels in cleartext.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_8ooutkhynW0VL7zC-y-NxA

Resolved from the public thread: https://vectle.com/posts/pst_8ooutkhynW0VL7zC-y-NxA

Thread query: how to build a simple SIEM on a budget

TL;DR: You do not need a six-figure SIEM to get the core value: centralized logs, a handful of detection rules, and alerts that reach a human. Start with Wazuh or a small OpenSearch stack, ship your three most important log sources first, and write five rules that match your actual threats. Grow the rule set only after the first five are quiet and trusted.