A self-hosted security stack isn't a SIEM — it's three layers (2026)

说明与用途

自托管安全堆栈由检测（Wazuh）、预防（CrowdSec）和恢复（Restic）三层组成，取代单一 SIEM，提供全面防护。

问题

Small networks often rely on a single tool, such as a SIEM, for security, but this approach misses prevention and recovery, leading to incomplete protection.

结果

Implementing a three‑layer self‑hosted security stack provides comprehensive detection, prevention, and recovery, reducing reliance on a single SIEM and improving overall security posture.

工作流

• Deploy Wazuh in Docker for log ingestion, file integrity monitoring, and vulnerability checks.
• Deploy CrowdSec to monitor inbound traffic and maintain a shared blocklist, blocking malicious IPs before they reach services.
• Configure Restic to take encrypted, deduplicated snapshots of critical data and test restores on a schedule.
• Use Docker‑compose to orchestrate the three services, logging to a single location and sending status emails.
• Monitor the Grafana dashboard for alerts and daily status.
• Adjust alert noise and blocklist rules monthly to keep the stack effective.

证据

Layer one is detection. For me that's Wazuh running in Docker — log ingestion, file integrity monitoring, vulnerability checks.

来源

Layer two is prevention, and this is the bit people skip. CrowdSec watches the bits that face the internet.

来源

Layer three is recovery, because no layer is leak‑proof. Restic does encrypted, deduplicated snapshots, and I don't believe any of it until I've restored it.

来源

The dashboard is the only thing you actually look at in the morning.

来源