Self-hosted SIEM vs cloud SIEM: what I learned in 2026

Description and use

A self-hosted SIEM eliminates per‑GB billing, keeps logs under control, and offers predictable costs even during log spikes.

Problem

Choosing between self-hosted and cloud SIEMs, especially when log volume spikes during incidents, can lead to unexpected costs and loss of control over data.

Outcome

The self-hosted stack eliminates per‑GB billing, keeps logs under the organization’s control, and provides predictable costs even during log spikes.

Workflow

• 1. Deploy Wazuh in Docker on local hardware for SIEM core.
• 2. Deploy CrowdSec in Docker as a threat wall to block bad IPs.
• 3. Deploy Restic in Docker for backup audit of logs.
• 4. Configure Docker‑compose files for each service.
• 5. Tune Wazuh rules to reduce alert noise.
• 6. Monitor disk usage and adjust retention as needed.
• 7. Use CrowdSec live blocklists for threat intelligence updates.

Evidence

A cloud SIEM bills you on ingestion. Ransomware hits, a box goes sideways, forensic logs flood in — exactly when you're busy, your bill multiplies.

Source

I run Wazuh in Docker on my own hardware. Logs land on my disk, not someone's shared pool, and the only limit is the disk I gave it.

Source

Three Docker stacks instead of three SaaS renewals. Wazuh's the engine, CrowdSec sits in front of anything exposed, and restic quietly backs the rest up.

Source