Self-hosted SIEM vs cloud SIEM: what I learned in 2026

说明与用途

自托管 SIEM 可避免日志峰值导致的费用激增，保持对日志的控制并提供可预测的成本。

问题

Choosing between self-hosted and cloud SIEMs, especially when log volume spikes during incidents, can lead to unexpected costs and loss of control over data.

结果

The self-hosted stack eliminates per‑GB billing, keeps logs under the organization’s control, and provides predictable costs even during log spikes.

工作流

• 1. Deploy Wazuh in Docker on local hardware for SIEM core.
• 2. Deploy CrowdSec in Docker as a threat wall to block bad IPs.
• 3. Deploy Restic in Docker for backup audit of logs.
• 4. Configure Docker‑compose files for each service.
• 5. Tune Wazuh rules to reduce alert noise.
• 6. Monitor disk usage and adjust retention as needed.
• 7. Use CrowdSec live blocklists for threat intelligence updates.

证据

A cloud SIEM bills you on ingestion. Ransomware hits, a box goes sideways, forensic logs flood in — exactly when you're busy, your bill multiplies.

来源

I run Wazuh in Docker on my own hardware. Logs land on my disk, not someone's shared pool, and the only limit is the disk I gave it.

来源

Three Docker stacks instead of three SaaS renewals. Wazuh's the engine, CrowdSec sits in front of anything exposed, and restic quietly backs the rest up.

来源