Let's cut through the marketing. When you're a small team, "free" usually means open-source with a steep operational tax, or a vendor's crippled free tier that becomes unusable after 50 events per second. You need something that actually works, meaning it ingests your logs, lets you write detection rules, and doesn't require a full-time admin to keep running.
For a five-engineer team, your best bets are not traditional all-in-one SIEM suites but focused, composable tools you can wire together. Your primary goal is to reduce mean time to detect/resolve, not to deploy a monster. Here's the stack I'd benchmark, in order of operational burden:
**1. Wazuh (Single-Node) + Elastic Stack (Free Tier)**
This is the most "traditional SIEM" path without paying licenses. Wazuh handles host-based detection, file integrity, and compliance. Elastic (the free features) provides the search/visualization layer.
* **Pros:** All-in-one agent (Wazuh), OOTB rules for MITRE ATT&CK, decent log parsing.
* **Cons:** Operational overhead is significant. You manage two complex systems. The free Elastic tier lacks alerting and advanced ML features.
* **Realistic Setup Effort:** 2-3 engineer-weeks to get something meaningful for syslog, OS, and maybe cloud trails.
**2. Grafana Loki (for log aggregation) + Grafana (for visualization) + open-source alerting (e.g., Alertmanager)**
This is a modern, log-centric approach. You're trading complex correlation for simplicity and speed.
* **Pros:** Loki is vastly more resource-efficient than Elastic for storage/query. Grafana dashboards are superior for visualization. You can use Prometheus for metrics alongside logs.
* **Cons:** No built-in correlation or detection engine. You *are* the detection engine, writing all rules as LogQL queries or Prometheus alerts.
* **Example Detection Rule (LogQL):**
```yaml
# Alert for multiple failed SSH logins from a single IP
- alert: SSHBfAttempts
expr: |
rate({job="syslog", facility="authpriv", level="info"}
|= "Failed password" [5m]) > 5
for: 0m
labels:
severity: critical
annotations:
summary: "High rate of SSH failures ({{ $value }})"
```
This puts the burden on you, but it's transparent and flexible.
**3. Security Onion 2.4 (All-in-One Distro)**
It bundles Zeek, Suricata, Wazuh, Elastic, Kibana, and its own management console into a single ISO. Good for a dedicated monitoring VM.
* **Pros:** Incredibly feature-complete for network security monitoring (NSM). Gets you from zero to seeing network flows and IDS alerts in hours.
* **Cons:** It's a monolithic distribution. Upgrades can be painful. Resource-heavy. You inherit its choices—if you hate Elastic, you're out of luck.
**Recommendation:**
If your team has infrastructure chops and wants long-term control, start with **Option 2 (Loki/Grafana)**. It's the most scalable and cost-effective. The "detection engineering" becomes writing and refining your LogQL queries, which is a valuable skill.
If you need OOTB host security and compliance rules immediately and can handle the ops burden, **Option 1 (Wazuh+Elastic)** is your stopgap.
Avoid any "free tier" of a commercial cloud SIEM; they are designed to be painful at scale to force the upsell. You'll hit event-per-second or retention limits just as you start to rely on it.
What's your primary log source? Cloud audit trails, on-prem firewall syslog, or endpoint telemetry? The volume and type will dictate which of these paths is least painful.
Benchmarks or bust