Build Your Own SIEM: Why These Open-Source Tools Just Work
Most of my content is pretty technical — walkthroughs, configs, detections, integrations. But this post is different. It’s less about how and more about why.
If you’re thinking about building a SIEM stack from open-source tools, you’re probably wondering the same thing I did years ago:
“Can I actually pull this off without a six-figure budget… and will it actually work?”
The answer: yes — if you choose the right tools, in the right way.
This post breaks down the open-source stack we use at SOCFortress and why each tool earned its place. It’s built from real-world lessons, lots of tinkering, and a ton of late nights.
🎯 The Problem With Traditional SIEMs
Let’s be honest. Most commercial SIEM/SOAR platforms are:
- 💸 Expensive — High five- to six-figure licensing models
- 🔒 Closed — You’re locked into their ecosystem
- 🧩 Fragmented — Tools don’t talk to each other
- 🐌 Manual — Automation is gated behind enterprise tiers
- 🚧 Limited — Integrations are slow and vendor-driven
Sound familiar?
I knew we could do better — with open-source. But I didn’t just want to spin up random tools. I needed a cohesive, modular, scalable, and defender-friendly stack.
🧩 The Stack That Just Works
Here’s what we landed on:
1. Wazuh – Endpoint Visibility & Detection
Wazuh is where it all starts. It collects logs from endpoints and monitors file changes, user activity, processes, and more. It’s our detection backbone.
Why we use it:
- Agent-based monitoring across OSes
- Built-in rules and syscheck
- Lightweight and scalable
Its limitations:
- Not ideal for firewall logs
- Weak on log normalization
2. Graylog – Log Ingestion & Enrichment
Graylog became our log brain. It ingests everything Wazuh can’t — firewalls, routers, syslog forwarders — and lets us normalize, enrich, and route logs.
Why we use it:
- Real-time enrichment (VirusTotal, GeoIP, custom APIs)
- Multi-tenant & scalable
- Great log search and pipeline rules
Its limitations:
- Not a detection engine
- Needs something like Wazuh to complement it
3. Grafana – Dashboards That Make Sense
All that data needs to be visible. Grafana gives us fully customized dashboards for alert trends, SOC KPIs, vulnerability summaries, and more.
Why we use it:
- Integrates with Wazuh Indexer (OpenSearch), MySQL, APIs
- Beautiful, customizable dashboards
- Loved by both analysts and clients
4. Velociraptor – Scalable DFIR
When we need to dig deeper, Velociraptor is our go-to. It’s an incident response powerhouse.
Why we use it:
- Remote memory, registry, file, and artifact collection
- Query endpoints in real-time
- Doesn’t interrupt end users
Bonus: Our endpoints run both the Wazuh and Velociraptor agents — detection + IR on tap.
5. Shuffle – SOAR Automation
Shuffle is the glue. It automates workflows between all our tools and external systems like Jira, VirusTotal, and email gateways.
Why we use it:
- Drag-and-drop playbooks
- Connects our stack to the outside world via APIs
- Makes our SOC proactive, not reactive
6. CoPilot – Unified Interface for Analysts
Finally, we built CoPilot — our own open-source platform to tie it all together.
What it does:
- Alert triage & case management
- Launch Velociraptor scans
- Trigger Shuffle playbooks
- Multi-tenant SOC view
- Custom health checks and reporting
Think of it like the cockpit for your SOC.
🔄 How It All Connects
Every piece in this stack solves a specific problem. But the magic is in how they work together:
- Endpoints → Wazuh for monitoring
- Firewalls/3rd parties → Graylog for parsing
- Graylog → Wazuh Indexer for storage
- Grafana → Wazuh Indexer for dashboards
- Velociraptor connects for DFIR
- Shuffle automates everything
- CoPilot gives your team one interface to run the show
Modular. API-driven. Scalable. Open-source.
No vendor lock-in. No bloat.
💡 Want to See the Diagram?
Here’s the full network diagram we use in the video → https://app.eraser.io/workspace/0zwk56XTz2g5Ytk6fbwV?origin=share
🚀 Final Thoughts
This stack was built out of necessity. We didn’t have a huge budget. We had real problems, a growing team, and a mission to deliver world-class detection and response without locking ourselves into a black box.
So we made something better — and we made it ours.
If you’re ready to ditch bloated platforms and build something that works for your team, you’re in the right place.
Let’s connect:
📧 info@socfortress.co
Need Help?
The functionality discussed in this post, and so much more, are available via the SOCFortress platform. Let SOCFortress help you and your team keep your infrastructure secure.
Website: https://www.socfortress.co/
Contact Us: https://www.socfortress.co/contact_form.html
