Take Control of Your Security: Free, Self-Hosted SIEM & Logs with Graylog, Wazuh, & Security Onion

[@Zaim-S]

Thanks for this that you heard out the comments from the last video and created a deeper one with other tools in compression

[@waretechnologies6845]

Security Onion with some good network taps is a potent combo. I love it on my home network.

[@security-onion]

Thanks, glad you like it!

[@Calvin420GetRektM8]

I think, graylog would be a great addition to my stack, since at work we use Splunk (which is very expensive). Graylog seems somewhat similar to splunk.

[@sphui]

If your company is utilizing Splunk, you may indeed be eligible for a Personalized Dev/Test License.

[@maxmustermann194]

Excellent insights, appreciated!

[@LAWRENCESYSTEMS]

Glad it was helpful!

[@maxmustermann194]

@@LAWRENCESYSTEMS oh yeah, we're evaluating Wazuh in conjunction with OpenSearch as a logging solution for a client and the pcap limitation is an interesting point.

[@DoughBoy2024]

Hey Tom, how about doing an updated video to some of the other tools you guys use i.e., ninjaone, sentinelone, etc

[@LAWRENCESYSTEMS]

forums.lawrencesystems.com/t/client-defense-matrix-the-msp-stack-we-use-to-defend-our-clients/18805

[@yugandharm.3810]

Thanks for the video. Can we build Wazuh on latest Graylog Open version (replacing filebeat) with Grafana?

[@LAWRENCESYSTEMS]

I have no idea.

[@yasser-cifer8175]

am struggling a looot with writing my own syslog decoders in ,i wonder if adding graylog could help !

[@Anto-oi9yf]

you will need to writing your own parser on graylog too, its not built in

[@chaosfenix]

You definitely saw my comment on your security onion video. Thanks for this comparison. There are a lot of tools out there but knowing which ones to use depending on your situation can be difficult. This was really helpful though.

[@LAWRENCESYSTEMS]

Thanks!

[@bak1necWWE]

I hate wazuh and ran from anything that runs on opensearch. You add some opensearch dashboard and use it, and then when you update your wazuh, it wont start back saying that some dashboards from opensearch are no longer supported.... and then you have a bug, lets say your wazuh version is 4.6.0, and you update your endpoint wazuh agent from 4.6.1 but dont update ur server bcuz you dont want the problem with it not starting after updating, but your wazuh gonna alert that your agent OUTDATED bcuz 4.6.1 not equal to 4.6.0. I know its free but one of the worst open source product that ive used

[@jeankgabriel]

Thank you

[@HerbieBancock]

Nobody wants to steal anything on your "homelab."

[@LAWRENCESYSTEMS]

Maybe no one wants to steal your Homelab but I don't that's true of all homelabs.