bonsaii logoBonsaii

Building a Cost-Effective SOC with Open Source Technologies

In today's threat landscape, having a responsive and adaptive Security Operations Center (SOC) is not a luxury — it's a necessity. While many organizations rely on commercial tools, I've taken a different route: designing a cost-effective and scalable SOC using only open source technologies like:

  • 🔍 OpenSearch for log analytics and anomaly detection
  • 📩 Graylog for log enrichment and alerting
  • 🐝 TheHive for incident response and case management
  • 📊 Grafana for visual dashboards
  • 🔄 FluentBit as a lightweight log shipper
  • 📬 Email alerts for urgent events
  • 🤖 And even plans to incorporate AI/ML-based detection

Here's a high-level look at the architecture:

Why This Architecture?

This setup allows:

  • Log normalization and enrichment using FluentBit + Graylog
  • Real-time detection of threats and system anomalies
  • Visual dashboards to monitor performance and threats at a glance
  • Automated alerting and case creation via TheHive + email
  • AI-ready integration using OpenSearch's anomaly detection capabilities

Whether you're working on a budget or looking for full control of your SOC stack, this architecture gives you modularity, flexibility, and complete transparency.

Want to Build This Yourself?

I've shared a complete installation guide, with:

  • VM setup recommendations
  • Configuration files
  • Integration steps (Wazuh, FluentBit, Graylog, OpenSearch, Grafana, TheHive)
  • How to link alerting logic to email and case management
  • Tips on UEBA and AI anomaly detection tuning
  • This is the link to the documentation step by step
  • https://soc-documentation.vercel.app

Let's Connect

If you're passionate about cybersecurity, threat detection, or open-source solutions — I'd love to connect. You can find more of my work on:

  • LinkedIn: https://linkedin.com/in/soufianeamimi
  • GitHub: https://github.com/Soufiane-coder
  • Portfolio: soufianeamimi.vercel.app

Built with the belief that great cybersecurity doesn't have to be expensive — just smart.

Back to Top