The Night My SIEM Paged Me at 2 AM (And Why I Was Glad It Did)

It was 2:14 AM on a Saturday when my phone buzzed with an alert from our Wazuh dashboard. Not a gentle email notification — a real webhook to Telegram that said:

[CRITICAL] Multiple failed SSH logins detected
Source IP: 185.x.x.x | Target: server-03 | Attempts: 47 in 90 seconds
Action taken by CrowdSec: BANNED for 24h

The next message confirmed that a similar scan from the same subnet hit our web server five minutes later — and was blocked before it could even authenticate.

Here's why I'm writing this: because three weeks ago, I would've had no idea any of this happened until someone noticed their data was missing on Monday morning.

The Before Picture

Before we built our security stack, "monitoring" meant occasionally SSH-ing into a server and checking if it was still running. If something went wrong — and most things at a small business go wrong quietly, not dramatically — nobody knew until a customer complained or a service stopped responding.

We had backups, technically. But we'd never tested them. Nobody ever did.

I'd been putting off building proper security tools because they seemed like enterprise stuff — expensive, complicated, requiring people who actually understand the acronyms. (Spoiler: I don't.)

What We Built Instead

Three Docker stacks on a repurposed server:

• Wazuh as our SIEM and log aggregator
• CrowdSec + Grafana as our automated threat detection wall
• restic for encrypted backups with an audit dashboard so we could actually verify restores work

Total cost? A hard drive and about a weekend to get it all running. No monthly fees, no vendor lock-in, no cloud dependencies.

The 2 AM Incident in Detail

When the alert came through, I knew exactly where to look because everything was centralized:

1. Wazuh had collected the SSH login failures from server-03's authentication logs and correlated them into a single event
2. CrowdSec detected the pattern (47 failed logins in 90 seconds is not normal) and auto-banned the IP at the host firewall level
3. Grafana showed me a visual timeline of the attack with one click, instead of making me grep through server logs at half-past midnight

The best part? The scan hit our web server too, but CrowdSec had already added that subnet to its blocklist based on the SSH attempt alone. Secondary scans were silent.

What I'd Do Differently Now

If this happened again, I'd have better visibility into the attack surface because Wazuh's FIM (file integrity monitoring) would flag any unauthorized changes immediately. Our audit dashboard for backups still needs work — we haven't done a full restore test yet, which is embarrassing and something I plan to fix this weekend.

But honestly? The fact that something caught this at 2 AM while I was asleep is worth more than whatever I'd pay for an enterprise alternative.

Who This Is For

If you're running servers for a small business or team and "security" consists of hoping nobody breaks in, this might help. You don't need a SOC, you don't need Splunk, and you definitely don't need to understand every security acronym on the internet.

You just need something that runs quietly in the background and tells you when things look wrong — before they become problems at 2 AM.

I put together a complete guide covering all three of these stacks as working Docker configurations. Wazuh for SIEM, CrowdSec + Grafana as your threat wall, and restic with an audit dashboard for backups. Everything runs locally on your own hardware, no subscriptions needed.

It's called the SMB Security Pack: https://symshah.gumroad.com/l/smb-security-pack

One-time $15 payment. Free updates forever. No monthly fees. Just containers that run and watch over your infrastructure so you can sleep through the night.