What SIEM is
SIEM (Security Information and Event Management) is a platform that centralizes, stores, and evaluates security-relevant logs and events from every system in an organization — servers, network devices, firewalls, applications, cloud services, and endpoints. The term was coined in 2005 by analyst firm Gartner as a merger of two previously separate tool categories: SIM (Security Information Management), which handled long-term log storage and reporting, and SEM (Security Event Management), which focused on real-time event monitoring and alert generation. SIEM combined these two functions into a single system.
Unlike EDR and XDR, which we covered in our previous article and which focus primarily on detection and direct response on a specific device or layer, SIEM is first and foremost a central store and analytics layer for logs from everything — not just security tools, but ordinary operational infrastructure too. This breadth of coverage is exactly what makes SIEM almost always necessary for compliance (e.g. PCI DSS requires retaining logs for at least 12 months) and for after-the-fact forensic investigation, when you need to reconstruct what happened across systems weeks or months earlier.
How SIEM works: architecture
Regardless of the specific product, almost all SIEM platforms share the same basic data path:
- Collection — agents installed on servers and endpoints, syslog forwarding from network devices, API integrations with cloud services and security tools (firewalls, EDR, cloud audit logs).
- Normalization and parsing — raw logs come in dozens of different formats (Windows Event Log, syslog, JSON from cloud APIs, CSV exports); SIEM converts them into a unified data schema so they can be compared and correlated with each other.
- Indexing and storage — normalized data gets stored in a search index (typically built on Elasticsearch or OpenSearch), optimized for fast full-text and time-based queries over a huge volume of data.
- Correlation and detection — a detection engine evaluates incoming events against rules (e.g. "5 failed logins from different countries within 10 minutes") or through anomaly detection and UEBA (User and Entity Behavior Analytics).
- Alerting and dashboards — confirmed matches turn into alerts for the SOC team, along with visualizations, compliance reports, and manual search tools for threat hunting.
Key features of a modern SIEM platform
| Feature | What it solves |
|---|---|
| Log aggregation | Central log collection from every system in one place instead of dozens of isolated consoles |
| Real-time correlation | Linking seemingly unrelated events into one meaningful alert |
| Compliance reporting | Automated reports and an audit trail for PCI DSS, GDPR, HIPAA, NIST, and similar frameworks |
| Threat hunting | Tools for manual, ad-hoc searching through historical logs by a security analyst |
| Threat intelligence integration | Enriching alerts with context from external databases of known threats (IOCs, IP reputation) |
| Data retention | Long-term, reliable log storage for after-the-fact forensic analysis and legal requirements |
SIEM vs. XDR vs. SOAR — a quick recap
We covered this distinction in detail in our EDR and XDR article; in short: SIEM is broad but relatively shallow — it collects logs from almost everything, primarily for compliance and long-term retention. XDR is narrower in scope, focused on security telemetry, but brings its own deeper detection logic and native correlation across endpoints, network, email, and cloud. SOAR doesn't collect data or perform detection at all — it automates the response using playbooks based on what SIEM or XDR reports. In practice the lines blur, and many modern platforms (including some of the open source projects below) combine elements of all three categories.
Why companies consider open source SIEM
Commercial SIEM platforms like Splunk, IBM QRadar, or Microsoft Sentinel are among the most expensive line items in a security budget — licensing is usually tied to the volume of data processed per day (e.g. price per GB/day), which leads to sharply rising costs as an organization grows and adds more log sources. Open source SIEM offers an alternative built on a different set of trade-offs:
- Cost — no license fee tied to data volume; you only pay for infrastructure (compute, storage) and your own team's time.
- Control over data — logs stay on your own infrastructure, important for organizations with strict data sovereignty requirements.
- Flexibility and no vendor lock-in — open source code allows modifications, custom integrations, and free migration.
- The trade-off — there's no 24/7 enterprise phone support; tuning detection rules, scaling storage, and maintenance all rest on your own team, which requires real engineering capacity.
Open source SIEM solutions in depth
The following overview maps the most significant open source and free-tier options available in 2026, including their real limitations — not just the marketing claims.
Wazuh — closest to a production-ready free SIEM
Wazuh is a fully open source (GPLv2 licensed) platform that combines SIEM and XDR into a single product. The architecture consists of Wazuh agents installed on monitored devices, a central Wazuh manager that processes and evaluates the data, an indexing layer built on OpenSearch, and a web dashboard. Its key features include:
- File Integrity Monitoring (FIM) — tracking unauthorized changes to critical files and configurations.
- Vulnerability detection — continuously checking installed software against databases of known CVEs.
- Compliance dashboards with native support for PCI DSS, GDPR, HIPAA, and NIST, including automated reports.
- Active response — automated interventions directly on the device, similar to EDR (e.g. blocking an IP address, isolating a process).
- Monitoring of cloud environments, containers, and telemetry collection from third-party APIs.
According to several independent market overviews, Wazuh is the closest thing to a production-deployable free SIEM in 2026 — though it still requires real engineering effort for rule tuning, dashboard building, and managing growing storage.
Security Onion — a network telemetry specialist
Security Onion isn't a single tool but an entire Linux distribution assembled from several open source projects tuned to work together: Suricata (signature-based network IDS), Zeek (rich protocol metadata and file extraction from network traffic), Elasticsearch/Kibana as the indexing and visualization layer, plus osquery and CyberChef for further analysis. Its own interface adds alerts, dashboards, threat hunting, and case management. Its strength is full packet capture — the ability to replay actual network traffic around a suspicious event, something most host-centric SIEM solutions don't offer. Security Onion is therefore an ideal choice where network visibility (network security monitoring, NSM) is the priority over coverage of application and cloud logs.
Graylog Open — strong at log management, not at correlation
Graylog Open is a 100% permanently free edition focused primarily on log management at high volume — it can ingest data from almost anywhere (syslog, GELF, Beats, REST API, Kafka), offers fast full-text search over Elasticsearch or OpenSearch, and provides a clear pipeline model for processing data. An important limitation to know before deploying: the free edition doesn't include a built-in alerting and correlation engine or scheduled reports — these features (along with archiving and the so-called Illuminate content) are reserved for the paid Graylog Enterprise license. Graylog Open is therefore best suited to teams that primarily need reliable central log management, with the option of moving to the paid tier later as automated-detection needs grow.
OpenSearch + Security Analytics — a foundation, not a finished SIEM
OpenSearch is an Apache 2.0 licensed fork of Elasticsearch and Kibana (created after Elastic's 2021 license change) and isn't a SIEM by itself — it's a search and analytics engine that a SIEM can be built on top of. The Security Analytics plugin partly fills that gap: it adds support for SIGMA-compatible detection rules (an open, community-maintained rule format portable across different SIEM platforms), threat intelligence integration, and anomaly detection. It's a younger and less mature tool than Elastic Security, though — a choice for teams that want maximum control and are willing to invest their own engineering time building a complete pipeline around this foundation.
Elastic Security (Basic tier) — a strong free foundation with clear limits
Elastic went through an interesting licensing journey: originally Apache 2.0, in 2021 it moved to SSPL/Elastic License (which took it off the list of formally "open source" licenses), and in August 2024 it added AGPLv3 as an additional option — an OSI-approved open source license that formally put Elasticsearch and Kibana back on the open source list. The free Basic tier of Elastic Security includes the core Elastic stack (Elasticsearch, Kibana, Logstash), more than 1,300 publicly available detection rules published on GitHub (freely auditable and editable), the Elastic Common Schema for data normalization, and a timeline-based investigation tool. The paid tier is needed for ML-based anomaly detection, managing an Elastic Agent fleet at large scale, and advanced response automation — but for smaller deployments, the free Basic tier is a surprisingly capable foundation.
TheHive + Cortex + MISP — a complement, not a SIEM replacement
This trio isn't a SIEM by itself, but it's extremely commonly paired with open source SIEM deployments. TheHive is a case management platform for SOC analysts — it receives alerts (e.g. from Wazuh or Security Onion) and turns them into structured investigations with tasks, a timeline, and team collaboration. Cortex is an engine for automated indicator analysis (e.g. automatically checking a file hash or IP address against dozens of external sources) — it works standalone or paired with TheHive. MISP is a platform for sharing threat intelligence between organizations and communities. Starting with version 5, TheHive (developed by StrangeBee) introduced a tiered licensing model — the free Community license covers most everyday needs but requires registration, while more advanced features and higher availability are reserved for the paid Gold and Platinum tiers. Cortex and MISP remain fully open source.
The open source SIEM ecosystem has its dead ends too. AlienVault OSSIM — historically one of the first genuinely open source SIEM tools — is still freely downloadable after its acquisition by AT&T Cybersecurity (now LevelBlue), but without active development; the vendor's attention has shifted to the commercial USM Anywhere platform. Apache Metron met a similar fate, having been moved to the Apache Attic (the archive for inactive projects). Before deploying any open source tool, always check its activity on GitHub — the date of the last commit and the state of open issues are a better signal of a project's health than its marketing page.
A typical hybrid stack: SIEM/NSM + SOAR + threat intel
In practice, teams rarely deploy just one tool — a common combination is a detection layer (Wazuh or Security Onion) generating alerts, connected to TheHive for case management, Cortex for automated analysis, and MISP as both a source and a destination for shared threat intelligence:
Comparison at a glance
| Tool | License | Main focus | Key limitation |
|---|---|---|---|
| Wazuh | GPLv2 (fully open source) | Unified SIEM + XDR | Requires engineering effort for tuning and scaling |
| Security Onion | Freely available distribution | Network security monitoring | Less coverage beyond network telemetry |
| Graylog Open | 100% free | Log management at high volume | No built-in alerting/correlation |
| OpenSearch + Security Analytics | Apache 2.0 | DIY foundation for a custom SIEM | Not a finished SIEM out of the box |
| Elastic Security (Basic) | AGPLv3 / Elastic Basic (free) | SIEM built on the Elastic stack | ML detection and fleet management require the paid tier |
| TheHive + Cortex + MISP | Community / fully open | Case management, SOAR, threat intel | Not a SIEM — needs a source of alerts |
What to look for when choosing
- Log volume growth over time — SIEM storage grows faster than most teams estimate at the start; plan capacity with a significant margin.
- Project activity — the date of the last commit, the state of open and closed issues, and the size of the community are a better trust signal than a project's website copy.
- Real engineering capacity of the team — open source SIEM trades license costs for your own team's time; without someone continuously tuning rules, the system quickly gets flooded with false positive alerts.
- A path to commercial support — several of the tools above (Wazuh, Graylog, Elastic, TheHive) offer paid support or an enterprise tier that can be added later without needing to migrate to a different tool.
Summary
SIEM solves a different problem than EDR and XDR — instead of fast detection and direct response on a single device, it's an organization's central memory: where logs from everything get stored, how they're correlated, and how you pull an answer out of them quickly during an audit or investigation. The open source ecosystem today offers real, production-usable alternatives to commercial platforms — Wazuh as the closest thing to a finished SIEM+XDR solution, Security Onion for network-oriented deployments, Graylog for log management at scale, OpenSearch and Elastic Security Basic as flexible but more integration-heavy foundations, and TheHive with Cortex and MISP as a complementary layer for case management and threat intelligence sharing. Choosing the right combination depends less on which tool has the longest feature list, and more on how much of your own engineering time your team is realistically willing to invest in running it.