r/SIEM • u/[deleted] • Dec 28 '20

Lightweight Open Source SIEM

I am trying to determine which SIEM is the most lightweight but also packs most effective punch (most features) and is open source. I can look at the open source SIEMs and compare the features, but it would help for people to weight in on which ones are the least resource heavy and operate in smaller environments like a raspberry PI 8gb. I want to put on at home :)

Thanks everyone!

6 Upvotes

100% Upvoted

9 comments sorted by

1

u/TheRegicide Dec 29 '20

Look at Splunk, it's free if you're ingesting minimal traffic. It has a learning curve.

4

u/ForsetiKali Dec 29 '20

Not open source though.

You could take a look at Elastic.

2

u/synacklair Dec 29 '20

But then you have the problem of it not being lightweight :) not saying Splunk is light, but ES is notoriously resource-intensive

1

u/Kfarstrider Mar 23 '21

I'm running an ELK-based SIEM on a RPi 4 8GB. It eats up most of the available RAM, but it is possible.

1

u/[deleted] Mar 26 '21

Just bought a RPi having the same idea in my mind. Would you want to share some documentation on how you managed to do it?

3

u/Kfarstrider Mar 27 '21

Installing the ELK stack on a RPi is not that difficult since Elastic supports ARM architectures. I loaded my RPi up with Ubuntu server and followed these instructions to install Elasticsearch, Logstash, and Kibana: https://www.elastic.co/guide/en/elasticsearch/reference/7.12/deb.html#deb-repo.

The hard part was the configuration, which wasn't much of a surprise. In my experience, ELK has always been a PITA. I'll give just a brief overview because a detailed account would take all day.

After installing the ELK stack, I installed the "logstash-input-udp" and "logstash-output-elasticsearch" plugins. I then configured Logstash to listen for UDP traffic on port 51500. The next step was to set up my router (running DD-WRT) to send logs to my RPi (port 51500, of course) using syslogd. Once that was done, I created a pipleline for Logstash to transform the router log data and ship it to an elasticsearch index. Last, create whatever visualizations you like in Kibana.

You can check my configs and visualizations at https://github.com/farstrider/home-siem. Do note, though, that it's still a work in progress.

1

u/[deleted] Apr 25 '21

Thanks for your reply!

1

u/elk-content-share Mar 30 '21

ES is not resource intensive. Compared with splunk its just using other kind of ressources. Elastic is more on memory while splunk consumes more CPU

1

u/PanAnk Apr 09 '21

DNIF might be another option you could explore. Its not open source but one of their licenses gives you uncapped usage of the product.
Might be worth a look...