I keep hearing the same excuse from small businesses: a SIEM is for enterprises. You need a dedicated security team, sixteen gigs of RAM minimum, and a budget line that makes the CFO wince. I believed that too, right up until I ran one myself. In 2026 a genuinely useful open source SIEM runs on the same kind of box you'd give a file server, and the software costs you nothing if you self-host it.
What an open source SIEM actually is
Strip the marketing and a SIEM just collects logs from your machines, runs them against detection rules, and flags the stuff that looks like an attack. Wazuh does that and a bit more — file integrity monitoring, vulnerability detection, compliance checks — all under GPLv2. No agent caps, no log-volume caps, no premium tier hiding behind a feature flag. That's the part vendors never lead with.
The part that scares people is the footprint, and honestly it's deserved. The heavy piece is the indexer, which is OpenSearch under the hood, and it needs one kernel setting or it refuses to start:
sudo sysctl -w vm.max_map_count=262144
Get that right, change the default admin password on first login, and you've done the two things that break most fresh installs.
Why self-hosting kills the "too expensive" excuse
Here's the thing nobody tells you: you don't have to run the enterprise-sized version. A single-node Wazuh stack is three containers — a manager, an indexer, and a dashboard — and docker compose up -d brings the whole thing up. You get the same detection engine and dashboards the big shops use, just without the scaling-to-ten-thousand-agents part that you'll never need.
What you actually pay is mostly time and a spare machine. 4GB of RAM will technically get you up; 8GB is comfortable. If there's an old Dell or a retired dev box sitting under someone's desk, that's your SIEM. The only real monthly cost is electricity, and the only real ongoing job is not ignoring the alerts once you have them.
The catch: out-of-the-box Wazuh rules are noisy. Real-world usage means a couple of weeks of quieting alerts that don't matter so the ones that do stand out. If anything, that's the part that justifies a pre-built stack — someone's already done the tuning for you. Concretely, that's why the setup I run paired Wazuh as the SIEM core with CrowdSec and Grafana for the network layer and restic for verifiable backups, because a SIEM that sees an attack you can't roll back from is only half a story.
FAQ
Do I need a dedicated security team to run an open source SIEM?
No. One person with Docker experience can stand up a single-node Wazuh deployment in an afternoon. The ongoing work is alert triage, not plumbing.
How much RAM does a self-hosted SIEM need?
You can get a single-node stack running on 4GB, but 8GB is the number I'd actually recommend for an indexer that doesn't feel sluggish.
Is Wazuh really free for a business?
Yes. The core platform is GPLv2 open source — no license fee at any scale. The company sells optional cloud hosting and support, but running it yourself in production costs nothing beyond your hardware.
If you'd rather skip the tuning weeks, I packaged the whole thing as three docker-compose stacks — SIEM core, threat wall, and backup audit — for a one-time $15 at https://symshah.gumroad.com/l/smb-security-pack with free updates. The software inside is all open source; you're paying for the setup that's already worked out.
Top comments (0)