A SIEM for Teams Who Cannot Afford a SOC
Log collection you never read is theatre. Three alerts you actually respond to is a security programme.
Most small companies have no security monitoring at all, and the ones that do usually have something worse: a log pipeline nobody reads, which provides the feeling of monitoring without any of the function.
Collecting logs is not detection. Detection is someone finding out that something happened, in time to act.
What Wazuh gives a small team
An open-source platform combining host agents, log analysis, file integrity monitoring, vulnerability detection and alerting. For a business that cannot fund a security operations centre, it is a realistic way to have the basics.
Agents on servers report to a manager that correlates events against rules and raises alerts.
Start with five alerts, not five hundred
This is the advice that decides whether it works. The default ruleset produces enormous volume, and a team that receives four hundred alerts a day responds to none of them.
Pick a handful that map to what would actually hurt this business:
- Successful login from a country where nobody works
- New user created or privileges granted outside a change window
- Modification to files in the web root of a production site
- The application service restarting unexpectedly
- Disk filling on the database server
Five alerts that a human reads and acts on beat a dashboard nobody opens. Add more only when the current set is being handled reliably.
Decide who responds, before you deploy
An alert with no owner is a notification. Write down, in one page: who receives it, what they check first, who they escalate to, and what "resolved" means.
For a five-person company that page might name one person and their phone number. That is fine — what matters is that it exists and that the person knows.
Resourcing it honestly
The manager needs real disk and memory, and log volume grows faster than anyone estimates. Set retention deliberately: enough to investigate an incident discovered weeks later, not so much that storage becomes the reason the project is cancelled.
Ninety days is a reasonable default for a small business.
The value nobody expects
The first genuine benefit is usually not catching an attacker. It is discovering what your infrastructure has been doing all along — the service restarting nightly, the forgotten cron job, the developer laptop still connecting to production.
That inventory of reality is worth the deployment on its own.
Resources
- Repo: wazuh/wazuh
- Docs: documentation.wazuh.com
- Video walkthroughs: YouTube: Wazuh setup tutorial
- Write portable rules with Sigma
Need this built properly?
I build secure, fast, bilingual platforms for clients across Egypt, Saudi Arabia, the UAE and Kuwait.
