Morning routine, mine: coffee, one browser tab, one Grafana board. Twenty seconds. If nothing is red, I'm done before the kettle boils.
That didn't happen by accident. It happened because for a while I had three separate security tools with three separate logins and I checked exactly none of them regularly. Wazuh had the alerts. CrowdSec had the blocked bots. restic had the backups. All of them were technically working, all of them were invisible to me unless something screamed loudly enough to page me.
Which is a dumb way to run security. A tool you don't look at might as well not exist.
The fix wasn't a fancier SIEM. It was one more panel with all of it on it. Here's the shape of it: Wazuh's alerts feed in, CrowdSec's blocklist count feeds in, and the backup status sits next to them. Three sources, one quiet morning page.
I'm not going to pretend Grafana is zero-effort. You'll spend an afternoon setting up the data sources and wrestling the query syntax. But the payoff is that checking security becomes a glance instead of a chore, and a glance you'll actually do. Habit beats discipline every time, and a single page is the habit.
The other thing it fixed was the reporting problem. My boss didn't want to open three UIs either. A weekly screenshot of the board — SIEM events flat, blocks steady or trending down, backups all green — answers "how are we doing" in one image. That's worth more than any metric you have to dig for.
And because the stacks are all Docker containers, this whole thing lives on hardware I already own. No per-endpoint license, no seat count, no annual renewal call. It's the difference between "do I need to justify this in a budget review" and "this runs on the box in the corner."
The backup audit is the part I'd argue about if someone tried to take it away. I've been burned by backups that looked fine until I actually tried to restore from one. Having restic's status on the same page I already open means I notice the failed snapshot on Tuesday, not at the audit in March.
I put the whole thing together as three reusable stacks — SIEM, threat wall, backup audit — wired so they land on that one board without you inventing the plumbing. If the one-glance-then-goes approach to security ops sounds like where you want to end up, it's at https://symshah.gumroad.com/l/smb-security-pack
It's $15, one time, and you keep the compose files after. Free updates. Not a substitute for a real SOC, but you're probably not running a real SOC — you're running one server and a lot of hope. This is the hope, made visible.
Top comments (0)