Building an Open-Source Security Monitoring Stack
You don't need a six-figure SIEM to have real visibility. A capable open-source monitoring stack — network detection, host detection, traffic analytics, and a place to correlate it all — runs on modest hardware and teaches you more about your environment than any appliance. The trick is understanding what each tool sees, because they watch different things and the value is in combining them.
Two vantage points: network and host
Detection happens at two levels, and you want both:
- Network (NIDS) — watches traffic on the wire. Sees scans, exploit attempts, C2 beacons, and lateral movement between hosts. Blind to anything encrypted or anything that never touches the monitored segment.
- Host (HIDS) — watches what happens on a machine: file changes, log events, new processes, privilege use. Sees what the network can't, but only on hosts running the agent.
The components
Suricata — network detection and traffic analysis
Suricata is the modern NIDS/IPS: multi-threaded, rule-driven (compatible with the widely used ET/Snort rule ecosystems), and — underrated — a superb passive traffic logger, emitting structured JSON (EVE) for flows, DNS, TLS, and HTTP. Even before a single alert fires, that metadata is gold for hunting.
# Run Suricata on a mirror/SPAN port or tap; emit JSON for everything
suricata -i eth1 -c /etc/suricata/suricata.yaml
# Rules auto-updated via suricata-update; ET Open is free and strong
suricata-update && systemctl restart suricata
# eve.json now streams flow/dns/tls/http/alert records -> ship to your log storeWazuh — host detection, the maintained OSSEC successor
OSSEC pioneered open-source HIDS — file integrity monitoring, log analysis, rootkit checks. Its actively developed successor, Wazuh, is what to deploy today: agents on every host feed a central manager doing file-integrity monitoring, log analysis, vulnerability detection, and compliance checks, with its own dashboard. Where the network stack sees the exploit attempt, Wazuh sees whether it landed.
ntopng — real-time traffic visibility
Suricata tells you about bad traffic; ntopng shows you all traffic — top talkers, per-host bandwidth, application breakdown, and historical flows. It's how you answer "what is this host suddenly sending 40 GB to?" and how you learn the baseline that makes anomalies visible.
# brew install ntopng (or apt); point it at the same tap/SPAN
ntopng -i eth1 -w 3000 # web UI on :3000, drill into any host/flowA place to correlate: the log layer
Detection tools are only as good as your ability to search and correlate across them. Ship Suricata's EVE JSON and Wazuh alerts into a log platform — the classic open choice is an Elasticsearch/OpenSearch + dashboards stack (Graylog is a lighter, friendlier alternative). Now a single timeline shows the network alert, the host that received it, and the traffic that followed.
How the pieces reinforce each other
The stack's power is correlation. A realistic detection chain:
- Suricata alerts on an exploit attempt against a web server from an external IP.
- Wazuh on that server shows a new process spawned and a modified binary seconds later — the exploit landed.
- ntopng reveals the server now beaconing to an unfamiliar host on a regular interval — C2.
- Your log platform ties the three events into one incident timeline for response.
No single tool tells that story; together they do.
Deployment notes
- Get the traffic. NIDS needs a SPAN/mirror port or a network tap at a chokepoint (internet edge, inter-VLAN). You can't detect what you can't see.
- Start in detection, not prevention. Run Suricata as IDS first; only move to inline IPS once you trust the rules and won't block legitimate traffic.
- Tune relentlessly. An untuned stack drowns you in false positives (see the base-rate problem in security analytics). Suppress noise, keep signal.
- Protect the monitoring plane. Your SIEM holds the evidence; segment and harden it — it's a prime target.
Real visibility comes from combining vantage points: Suricata on the wire, Wazuh on the host, ntopng for the baseline, and a log layer to correlate. Each is blind alone; together they tell the whole story of an intrusion.