SIEM
Security Information and Event Management: collect security logs in one place, search them, keep them, and alert on what matters.
#What it is
A SIEM is the system a security team lives in. It does four jobs:
- Collect logs from everywhere: firewalls, servers, DNS, endpoints, cloud.
- Store them for a set retention period, searchable.
- Search and correlate, so an analyst can follow one IP across every source.
- Alert when a rule matches.
Commercial examples include Splunk and Microsoft Sentinel; open-source options include Wazuh and the Elastic stack.
#My home version
A full SIEM is far too heavy for a Raspberry Pi, but the core of it isn't:
| Job | Enterprise (Splunk) | My Pi |
|---|---|---|
| Collect | Universal Forwarder | Alloy |
| Store | Indexer | Loki (30 days) |
| Search | Search Head | Grafana + LogQL |
| Alert | Alert actions | Grafana alerting to Telegram |
The data sources are DNS queries from Pi-hole and honeypot events from OpenCanary. Together they answer the two questions that matter at home: what is everything talking to? and is anything poking around that shouldn't be?
#What it's missing
Being honest about the "lite": no correlation engine, no threat-intel enrichment, no case management, no endpoint telemetry, and a single box that is also one of the things being watched. It's not a SOC. It is real practice on real data, with the same query-hunt-alert loop.