Small and midsize businesses do not need to accept the cost and lock-in of commercial SIEMs to get meaningful detection and response. By combining a few well maintained open-source projects you can build a capable, affordable security monitoring stack that fits SMB constraints: limited budget, small ops team, and mixed cloud/on-prem estates. Below I outline practical alternatives, when to pick each, and concrete starting recipes you can deploy within days.

What to expect from an open-source SIEM approach

Open-source SIEM solutions are not magic plug-and-play replacements for large commercial platforms. They trade license fees for integration and operational work. In practice that means you will get strong visibility and detection capability, but you must plan for collection, storage sizing, rule tuning, and maintenance. For many SMBs that tradeoff is acceptable because the software cost savings let you hire a contractor or invest in a small managed service instead of a large annual license.

Candidate projects and how they fit together

Wazuh - endpoint-focused SIEM and XDR Wazuh provides unified endpoint monitoring, log collection, file integrity monitoring, vulnerability detection, and a ruleset for alerting. It is distributed as open-source and documents a server, indexer, and dashboard architecture you can run on VMs or cloud instances. Wazuh is a solid pick when you need host telemetry plus central correlation and want an actively maintained open platform.

Security Onion - network visibility plus log management If your primary need is network-level detection and packet capture, Security Onion bundles Zeek, Suricata, full packet capture, Elasticsearch/OpenSearch backends, and its own user interfaces for alerts and investigation. Security Onion is great for SMBs that can dedicate a small appliance or VM to network monitoring and want an integrated sensor-to-SOC workflow. Note that older Security Onion 2.3 reached end-of-life in April 2024 so you should deploy or upgrade to the supported 2.4 track.

Graylog - centralized log management and lightweight SIEM features Graylog Open (the free edition) is a focused log manager with search, dashboards, and alerting that fits small teams who need powerful log search without heavy deployment overhead. Graylog also offers paid tiers for correlation and packaged security features, so you can start small and scale. Be aware of Graylog’s licensing changes in earlier releases which moved the project to SSPL for core distributions; confirm licensing for your deployment model if vendor lock-in or cloud resale is a concern.

OpenSearch / OpenSearch Service - search and detection engine OpenSearch and AWS OpenSearch Service provide an Apache-licensed search engine and dashboards that many open-source stacks use for indexing and analytics. OpenSearch also introduced security analytics features and prepackaged detectors to simplify creating correlation rules and findings. It is a strong backend choice if you prefer an open search layer with managed options on AWS.

Zeek and Suricata - network telemetry engines Zeek (formerly Bro) and Suricata are complementary network monitoring tools. Zeek produces high fidelity flow and protocol logs ideal for threat hunting and enrichment. Suricata provides signature-based IDS alerts and file extraction. Both feed easily into SIEMs like Wazuh, Security Onion, or Graylog for richer detection.

Packaged open-source SIEMs

SIEMonster packages multiple open-source projects into a consolidated distribution with a free community edition and paid support tiers. For SMBs who want a near-turnkey experience without commercial SIEM costs, SIEMonster can reduce integration work while still leveraging open tools under the hood.

Choosing for SMB use cases - short guidance

  • Simple host + logs monitoring: Start with Wazuh agents on endpoints, a single Wazuh manager/indexer node, and the Wazuh dashboard. This gives fast ROI on host detections and compliance rules.
  • Network-centric visibility: Deploy a small Security Onion sensor at your network edge or core switch span port; pair it with Zeek and Suricata for deep network telemetry. Make sure you run a supported Security Onion version.
  • Lightweight centralized logging: Use Graylog Open as your log collector and search layer if you want a simpler UI and lower initial operational burden; add correlation rules or upgrade to paid tiers when needed.
  • Fast packaged deploy: If you prefer less DIY, try SIEMonster Community to get a pre-integrated set of tools and then customize slowly.

Practical starting recipes

1) Minimal Wazuh starter (small office, 10-100 hosts)

  • Install a single Wazuh manager+indexer+dashboard on a cloud VM sized to your retention needs. Use Wazuh agents for Windows and Linux endpoints. Start with default rules and enable file integrity monitoring and basic compliance templates. Monitor disk and index growth and add a second indexer node if ingestion grows. Refer to the Wazuh quickstart and hardware guidance when sizing.

2) Network + host visibility (retail site or small office with critical services)

  • Deploy one Security Onion sensor for network traffic capture and Zeek logs. Run Wazuh agents on servers and key workstations and forward logs to a centralized Graylog or OpenSearch backend for unified searching. Use Suricata for signatures and Zeek for protocol metadata and threat hunting. This hybrid yields both host detection and network context for alerts.

3) Managed shortcut

  • If you lack operations bandwidth, evaluate Wazuh Cloud, Graylog Cloud, or AWS OpenSearch Service with security analytics. Managed offerings reduce maintenance work and let small teams focus on tuning detections and responding to incidents. Confirm pricing and data egress costs before committing.

Operational tips and caveats

  • Plan for storage and retention. Index size drives cost and performance. Implement tiered retention and archive older logs to cheaper storage when possible.
  • Start with a small set of high-value logs: Windows Security, authentication, DNS, perimeter firewall, and critical server logs. Expand incrementally to avoid alert overload.
  • Invest in playbooks and simple automation. Even a small team should automate triage steps such as basic enrichment, IP reputation checks, and initial containment actions.
  • Watch licensing and EOL. Some projects change licenses or deprecate older releases. Always cross-check the project documentation and run supported versions. For example Security Onion 2.3 reached end-of-life in April 2024, so run supported releases.
  • Community and paid support options exist. If your team cannot sustain DIY, a paid managed option or vendor support for open-source stacks is often cheaper than a full commercial SIEM license.

Closing - a practical path forward

For most SMBs the best path is iterative. Start with a focused, open-source stack that solves your biggest blind spot. Add network sensors and richer correlation once you have stable collection and a repeatable triage workflow. Open-source stacks require people and process, but they let you buy skill and service rather than expensive licenses. If you are short on staff, evaluate managed open-source offerings so you keep visibility without overwhelming your ops team.

If you want, I can map one of these starter recipes to your exact environment and produce a short bill of materials and an estimated monthly cost for cloud-hosted vs on-prem deployment.