Self-hosted SIEM vs cloud SIEM: what I learned in 2026

Every SIEM renewal, someone forwards me the same spreadsheet. Splunk, Sentinel, QRadar, all the per-GB ingestion rates, and the sales line about how the cloud one "handles everything for you." It always looks reasonable at ten gigs a day. It never looks reasonable by the second renewal, when your log volume has tripled and the invoice has quadrupled.

So here's my honest take on the self-hosted SIEM vs cloud SIEM question in 2026: the features are closer than the marketing wants you to believe, and the real fight is over who owns your log volume and what happens when that volume spikes.

A cloud SIEM bills you on ingestion. Ransomware hits, a box goes sideways, forensic logs flood in — exactly when you're busy, your bill multiplies. I've watched a budget take that hit during a real incident. It's the worst possible moment to discover your meter.

A self-hosted one doesn't care how much you pour into it. I run Wazuh in Docker on my own hardware. Logs land on my disk, not someone's shared pool, and the only limit is the disk I gave it. Same idea runs through the whole stack I use:

wazuh      # SIEM core — detection and file integrity
crowdsec   # threat wall — blocks the bad IPs before they matter
restic     # backup audit — proves the data is actually there

Three Docker stacks instead of three SaaS renewals. Wazuh's the engine, CrowdSec sits in front of anything exposed, and restic quietly backs the rest up. No per-GB meter on any of them.

The honest trade-offs: you maintain it. Wazuh doesn't tune itself, so you'll spend an afternoon taming alert noise. My rule stack started loud and got quieter as I filtered out what didn't matter. There's no phone number to call at 3am — I'm the support desk for my own lab.

But the payoff is real control. My security data stays mine. No retention policy I'm told about after the fact, no export window, no vendor roadmap deciding whether a feature survives. If I want a year of logs, I keep a year of logs.

And I know roughly what it costs. Not zero — I pay for the machine and the power. But versus a cloud SIEM billed on ingestion it's a rounding error, and the cost barely moves whether I log ten events or ten thousand. The spike is the whole game, and self-hosting wins it.

None of this is revolutionary. It's what "own your logs" actually looks like in practice. If you're weighing whether to self-host or keep feeding the meter, stop comparing the sales sheets and start comparing what happens when your volume doubles mid-incident.

I bundled this all into one stack you can spin up yourself — a SIEM core, a threat wall, and a backup layer, each a plain docker-compose file. If that sounds useful, it's over at SMB Security Pack.

FAQ

Do I need a big server for a self-hosted SIEM?
No — Wazuh in Docker runs fine on a mid-range homelab box. Give it a few GB of RAM and disk for retention and you're set.

Does self-hosting mean I lose threat-intel updates?
No. Wazuh ships regular rule updates and CrowdSec pulls live blocklists. You keep the intelligence without the SaaS bill.

Is self-hosting still cheaper if cloud prices keep dropping?
Generally, yes, because cloud SIEM cost scales with your log volume while fixed hardware doesn't move. It only catches up when you outgrow the box.