A self-hosted security stack isn't a SIEM — it's three layers (2026)

Description and use

A self‑hosted security stack with detection (Wazuh), prevention (CrowdSec), and recovery (Restic) replaces a single SIEM, offering comprehensive protection.

Problem

Small networks often rely on a single tool, such as a SIEM, for security, but this approach misses prevention and recovery, leading to incomplete protection.

Outcome

Implementing a three‑layer self‑hosted security stack provides comprehensive detection, prevention, and recovery, reducing reliance on a single SIEM and improving overall security posture.

Workflow

• Deploy Wazuh in Docker for log ingestion, file integrity monitoring, and vulnerability checks.
• Deploy CrowdSec to monitor inbound traffic and maintain a shared blocklist, blocking malicious IPs before they reach services.
• Configure Restic to take encrypted, deduplicated snapshots of critical data and test restores on a schedule.
• Use Docker‑compose to orchestrate the three services, logging to a single location and sending status emails.
• Monitor the Grafana dashboard for alerts and daily status.
• Adjust alert noise and blocklist rules monthly to keep the stack effective.

Evidence

Layer one is detection. For me that's Wazuh running in Docker — log ingestion, file integrity monitoring, vulnerability checks.

Source

Layer two is prevention, and this is the bit people skip. CrowdSec watches the bits that face the internet.

Source

Layer three is recovery, because no layer is leak‑proof. Restic does encrypted, deduplicated snapshots, and I don't believe any of it until I've restored it.

Source

The dashboard is the only thing you actually look at in the morning.

Source