Open source SIEM in 2026 is cheaper than you think

说明与用途

小型企业可以使用 Docker Compose 和 Wazuh 在 4–8 GB RAM 的低成本机器上部署免费 SIEM，消除许可费用并降低运营成本。

问题

Small businesses believe SIEMs are too expensive and require large resources, deterring adoption.

结果

A small business can deploy a fully functional SIEM for free (hardware only), with minimal setup time and ongoing maintenance focused on alert triage.

工作流

• 1. Prepare a spare machine with 4–8 GB RAM.
• 2. Install Docker and Docker Compose.
• 3. Run sudo sysctl -w vm.max_map_count=262144 to satisfy OpenSearch.
• 4. Pull the Wazuh Docker images and execute docker compose up -d to start manager, indexer, and dashboard containers.
• 5. Secure the installation by changing the default admin password on first login.
• 6. Tune detection rules to reduce noise over a few weeks.
• 7. Optionally integrate CrowdSec, Grafana, and restic for threat wall, visualization, and backups.

证据

A single-node Wazuh stack is three containers — a manager, an indexer, and a dashboard — and docker compose up -d brings the whole thing up.

来源

4GB of RAM will technically get you up; 8GB is comfortable.

来源