The $20k/year logging tool I replaced with Docker containers (and saved our small business)

The $20k/year logging tool I replaced with Docker containers (and saved our small business)\n\nA few years ago, our office of about 30 people got hit with a PCI DSS audit. Fair enough - we process card payments. The auditor asked for centralized log collection, retention for a year, intrusion detection on every server, and backup verification. Every single requirement.\n\nThen the sales rep from that popular enterprise SIEM walked me through pricing. About $20k a year minimum. For 30 endpoints. I stared at him for a long time before asking if he meant per month.\n\nI went home, fired up some Docker containers, and by midnight had something that covered about 80% of what the auditor wanted - without sending any data to someone else's cloud.\n\n## The setup (three stacks, one box)\n\n*Wazuh* handles the SIEM piece. It collects logs from every machine on our network, correlates events, and flags suspicious behavior. We deployed agents on all servers and workstations in about an afternoon. Its built-in compliance dashboard even has a PCI DSS mapping that made the auditor happy.\n\nFor threat detection I installed CrowdSec behind our firewall, paired with a Grafana dashboard so we could actually read what was happening instead of parsing YAML files at 2am. CrowdSec blocks IPs at the system level and integrates nicely with fail2ban-style rules. The Grafana panel shows blocked requests over time, geolocation of attacks, and which rules fired most often.\n\nFor backups I set up restic repositories on an external drive with encrypted snapshots. It's fast, deduplicated by default, and the fact that it supports incremental backups means we can run it daily without filling the disk.\n\n## The cost breakdown\n\n| | Enterprise SIEM | What we built |\n|---|---|---|\n| Annual license | ~$20k | $0 (open source) |\n| Hardware | Dedicated cluster | One used mini PC (~$350 one-time) |\n| Support contracts | $5k+/year | Community docs + StackOverflow |\n| Data residency risk | Your data in their cloud | Everything stays local |\n\nThat said, it's not all free. The real cost was the afternoon I spent wrestling with Wazuh's agent configuration on a mixed Linux/Windows environment and building that first Grafana dashboard from scratch.\n\nBut here's the thing - once it was running, maintenance was basically \"check the dashboard every morning.\" It takes maybe five minutes. Sometimes less.\n\n## Where this gets tricky\n\nThe biggest gap between what we built and the enterprise alternative is alert fatigue. Wazuh generates a lot of noise at first. You spend weeks tuning rules to filter out the false positives that drive your team crazy. The enterprise tools don't have this problem because their defaults are more conservative - they also miss things.\n\nAnother tradeoff: you're responsible for updates and maintenance. There's no vendor calling to tell you there's a critical CVE in your SIEM stack.\n\n## If you want to try it yourself\n\nI actually packaged all three stacks into ready-to-run Docker Compose files with sensible defaults pre-configured. It's called the SMB Security Pack - Wazuh for logging, CrowdSec plus Grafana for threat detection, and restic backups all in one bundle.\n\nOne-time purchase of $15 instead of a twenty-kay annual subscription. Updates are free. No recurring costs, no vendor lock-in.\nYou can grab it here: https://symshah.gumroad.com/l/smb-security-pack\n\nIt won't replace an enterprise SIEM for a Fortune 500 company. But for a small business or homelab that needs to check compliance boxes without emptying the bank account? It does the job.\n