We got dinged on a compliance audit for a control we actually had in place. That was the frustrating part. Not that we were failing to lock something down. We had the tooling. But when the auditor asked for evidence, we had nothing but a person saying "yeah, I think that's turned on."
That's not evidence. That's a vibe.
If you've ever been through this you know exactly how it goes. The auditor wants logs. They want to see that change detection fired when a file got modified. They want proof the backup you claim to take is actually running and restorable. They want the firewall to show it's been blocking stuff, not just sitting there collecting dust.
Turns out most of that evidence already lives in three tools small shops already run. I just never wired it into one place you could point at and say "here."
First, the SIEM. I run Wazuh, and honestly the file integrity monitoring does half the work on its own. Every time a config file or a binary changes on a host, there's an alert with a timestamp. That's a dated, tamper-fingerprinted record of "nobody messed with this box." Auditors love that. It's the difference between claiming you patch things and showing a server that flips an alert the moment something unexpected lands on disk.
Second, the edge. CrowdSec watches the firewall's connection attempts and hands me a rolling list of who's been trying to get in and which of them got blocked. Bots, scanners, the usual background radiation. A few screenshots of that, sorted by source, and you've basically handed the auditor a signed statement from the internet itself saying "your exposure is being actively filtered."
Third, and this is the one people forget: the backups. Everyone runs restic. Almost nobody can prove a restore works until they need it at 2 AM on a Sunday. I added a tiny audit dashboard on top that checks the backup jobs and flags the ones that silently stopped or that would fail a test restore. So when the auditor asks "do your backups work?", I'm not shrugging. I'm scrolling to the run history and showing them actual snapshots succeeding on schedule.
None of this is exotic. It's three self-hosted stacks, all free and open source, all running in Docker on a machine I already owned. An afternoon to stand up, a weekend to tune.
Anyway. We passed the re-audit. Nobody asked me for a person's word that time.
If you want the exact three stacks I used, I bundled them into something small businesses can just clone and run: the SMB Security Pack. Fifteen bucks, one-time, free updates. It's the same Wazuh/CrowdSec/restic setup, pre-wired so the evidence is in one dashboard instead of three tabs and a prayer.
Top comments (0)