A self-hosted security stack isn't a SIEM — it's three layers (2026)

Описание и применение

Самостоятельный стек безопасности из трёх слоёв обеспечивает обнаружение, предотвращение и восстановление, заменяя односторонний SIEM.

Задача

Small networks often rely on a single tool, such as a SIEM, for security, but this approach misses prevention and recovery, leading to incomplete protection.

Результат

Implementing a three‑layer self‑hosted security stack provides comprehensive detection, prevention, and recovery, reducing reliance on a single SIEM and improving overall security posture.

Рабочий процесс

• Deploy Wazuh in Docker for log ingestion, file integrity monitoring, and vulnerability checks.
• Deploy CrowdSec to monitor inbound traffic and maintain a shared blocklist, blocking malicious IPs before they reach services.
• Configure Restic to take encrypted, deduplicated snapshots of critical data and test restores on a schedule.
• Use Docker‑compose to orchestrate the three services, logging to a single location and sending status emails.
• Monitor the Grafana dashboard for alerts and daily status.
• Adjust alert noise and blocklist rules monthly to keep the stack effective.

Доказательства

Layer one is detection. For me that's Wazuh running in Docker — log ingestion, file integrity monitoring, vulnerability checks.

Источник

Layer two is prevention, and this is the bit people skip. CrowdSec watches the bits that face the internet.

Источник

Layer three is recovery, because no layer is leak‑proof. Restic does encrypted, deduplicated snapshots, and I don't believe any of it until I've restored it.

Источник

The dashboard is the only thing you actually look at in the morning.

Источник