Open-source SIEM deployment, tuning and ongoing management. Real-time correlation of alerts across endpoints, firewalls, Microsoft 365* and servers. A searchable record of security events, and evidence of what happened when something goes wrong. The visibility most SMBs don't have, and most need.
The old argument against SIEM for SMBs was straightforward: it was too expensive. Splunk*, QRadar*, ArcSight* and their equivalents were priced for enterprises with security operations centres, not for 50-person professional services firms. The result was a visibility gap. SMBs ran security tooling (antivirus, firewalls, email filters) but had no central view of what any of it was telling them. Attackers used that gap, which is why attackers routinely sit inside compromised networks for weeks or months undetected.
An open-source SIEM changes the calculation. The platform itself is free; what you pay for is the virtual machine it runs on and the engineering labour to deploy, tune, and respond to what it tells you. That brings proper SIEM capability within reach of any SMB that takes security seriously, which in 2026 is essentially all of them.
Sentinel is excellent, Microsoft-native, deeply integrated, mature content library. It's also priced per GB of log ingestion, which gets expensive quickly. A typical SMB environment ingesting 10GB per day can run R30,000+ per month in Sentinel pricing alone. An open-source SIEM has no per-GB pricing; the main cost is the VM running it and the labour to manage it. For enterprises deep in the Microsoft stack with budget to match, Sentinel. For SMBs who need serious SIEM capability without enterprise pricing, an open-source platform.
Splunk* is the gold standard of SIEM, and priced accordingly. R400,000+ per year is a reasonable estimate for even a modest SMB deployment, excluding implementation labour. Few SMBs can justify the TCO even when the capability case is clear. An open-source SIEM covers the capabilities most SMBs actually need, at a fraction of the cost.
The honest comparison for most SMBs. Running endpoint protection, firewall, email filtering and M365 security policies without a SIEM means each tool fires its own alerts into its own console, and nobody correlates them. Our SIEM aggregates everything, correlates patterns, and alerts on things no individual tool would catch, a workstation showing unusual outbound traffic plus a firewall rule change plus an admin login from a new country.
SIEM manager and dashboard installed, usually on an Azure* VM scaled to your log volume (10GB/day for a typical SMB). Agents rolled out to all endpoints and servers via Group Policy* or MDM. Firewall syslog forwarded, Microsoft 365* and Azure* feeds connected. Baseline rules enabled and tuned to your environment to avoid alert fatigue.
Running under real conditions, the deployment generates a lot of noise initially. Normal activity in your environment that looks suspicious to default rules gets allow-listed. Custom detection rules written for your specific threat model, e.g., alerting on access to specific sensitive file shares, or administrative actions outside business hours. By end of phase 2, alerts are meaningful and manageable.
Daily review of alerts, incident response for anything meaningful, monthly reports summarising activity and trends, quarterly tuning sessions. SIEM management is a separately-priced add-on to a managed IT agreement. Standalone SIEM management is also available for clients with internal IT teams who want someone else running it. Detection and alerting run 24/7 automatically; P1 incidents get a response within 15 minutes during business hours.
A SIEM (Security Information and Event Management) platform collects logs and events from your endpoints, servers, firewalls and cloud services, correlates them, and alerts on suspicious activity.
The open-source SIEM we deploy is a mature platform used by thousands of organisations as a credible alternative to proprietary SIEM products like Splunk*, Elastic Security*, or Microsoft Sentinel*.
In 2026, increasingly yes, for three reasons. First, when something goes wrong you need evidence of what happened during the incident: what was accessed, when, and by whom. South Africa's data protection law expects you to understand and report on breaches, and without logging and alerting you can't reconstruct that picture. Second, attackers routinely sit inside compromised networks for weeks or months undetected; without a SIEM, you simply don't see what's happening until the ransomware fires. Third, your cyber insurance renewal is going to ask whether you have "security monitoring and alerting" and the honest answer needs to be yes.
The historical argument against SMB SIEM was cost. An open-source SIEM removes that barrier, and the main investment is now the labour to deploy and tune it properly.
A production SIEM deployment for a typical SA SMB (30-80 endpoints, M365 integration, firewall logs, basic correlation rules) costs between R45,000 and R95,000 as a one-time setup project, plus ongoing management of R6,000 to R18,000 per month depending on alert volume and the scope of monitoring. Detection and alerting run 24/7 automatically; P1 incidents get a response within 15 minutes during business hours (Mon-Fri 09:00-16:00 SAST). The underlying infrastructure (a virtual machine, usually hosted in Azure* for most clients, or on-premise if that fits better) runs between R800 and R3,500 per month depending on log retention and data volume.
Compare to a comparable Splunk* deployment at R400,000+ per year or Microsoft Sentinel* at R30,000-R80,000 per month, and the open-source SIEM economics are compelling for anyone under 500 endpoints.
Microsoft Sentinel* is a cloud-native SIEM/SOAR built on Azure*, deeply integrated with the Microsoft security stack (Defender*, Entra ID*, Microsoft 365*), with excellent out-of-the-box content and a mature SOAR layer for automated response. It's priced per GB of log ingestion, which gets expensive fast.
Our open-source SIEM is self-hosted, with no per-GB pricing. The main cost is the virtual machine running it and the labour to manage it. It integrates with M365 and Azure* well but doesn't have Sentinel's native polish on those feeds, and its SOAR capabilities are more basic. The rough rule: Sentinel for enterprises deep in the Microsoft stack with budget to match; our open-source SIEM for SMBs who need serious capability without enterprise SIEM pricing.
The software, yes, it's open source. The documentation is excellent. In practice, the hard part isn't deployment, it's the ongoing tuning and incident response: writing custom rules for your environment, managing alert fatigue, responding to detections at midnight, keeping the platform updated. Most SMBs who try to self-manage end up with it running but ignored, which is worse than not having it. If you have an internal security team, self-management is viable; if you don't, the economics of managed SIEM usually make sense.
* Products named on this page are examples of the stack we deploy. Actual recommendations depend on your environment, scale, and existing licensing. We have zero commission arrangements with any vendor. Recommendations are made on technical fit alone.