Open source SIEM in 2026 is cheaper than you think

Description and use

Small businesses can deploy a free, low‑cost SIEM on a modest machine using Docker Compose and Wazuh, eliminating licensing fees and reducing operational overhead.

Problem

Small businesses believe SIEMs are too expensive and require large resources, deterring adoption.

Outcome

A small business can deploy a fully functional SIEM for free (hardware only), with minimal setup time and ongoing maintenance focused on alert triage.

Workflow

• 1. Prepare a spare machine with 4–8 GB RAM.
• 2. Install Docker and Docker Compose.
• 3. Run sudo sysctl -w vm.max_map_count=262144 to satisfy OpenSearch.
• 4. Pull the Wazuh Docker images and execute docker compose up -d to start manager, indexer, and dashboard containers.
• 5. Secure the installation by changing the default admin password on first login.
• 6. Tune detection rules to reduce noise over a few weeks.
• 7. Optionally integrate CrowdSec, Grafana, and restic for threat wall, visualization, and backups.

Evidence

A single-node Wazuh stack is three containers — a manager, an indexer, and a dashboard — and docker compose up -d brings the whole thing up.

Source

4GB of RAM will technically get you up; 8GB is comfortable.

Source