When a contractor calls a SIEM “our own product”, it is worth asking what exactly is theirs. In our case the answer is this: ours is the layer on top of an open core, not a rewritten engine. The distinction matters, and there is no reason to blur it.
Why the core is open
The core is Wazuh, with storage on OpenSearch. The choice was deliberate, for two reasons.
The first is the absence of a closed vendor in the most sensitive place in the infrastructure. A SIEM sees everything: system logs, mail, telephony, proxies. Putting a black box there, whose behaviour cannot be read, is odd precisely from a security standpoint.
The second is licensing. Commercial SIEMs traditionally charge for ingested volume, and that creates a harmful reflex: to protect the budget, sources start getting switched off. The saving comes at the expense of the very thing the system was installed for.
What the core gives and what we add
From the core: the stock ruleset (an OSSEC inheritance, roughly three thousand rules), native mapping to the MITRE ATT&CK matrix, and control sets mapped to PCI DSS and ISO 27001. The wording matters here: those are reports for audit and investigation, not certification. A SIEM does not make a company compliant, it produces the evidence base.
Our layer: correlation rules for a specific stack, meaning 3CX, Rocket.Chat, mail and proxy servers, plus integrations and ongoing support. This is where value appears that no product ships with: a generic ruleset does not know what suspicious behaviour looks like inside your telephony or your corporate chat.
On Sigma, plainly: no stock converter from Sigma to Wazuh rules exists. Some rules we convert automatically, others are finished by hand. Promising seamless support here would be untrue.
Collection and storage
- Sources: system journals (syslog, journalctl), applications (NGINX, Docker, 3CX, Rocket.Chat), mail and proxy servers. Delivery over SSH, through agents, or via rsyslog, Logstash and Filebeat.
- Storage: OpenSearch as the primary store, with Loki or S3 for volume and cost cases. Loki and Graylog are collection and storage layers here, not a second SIEM, and confusing them with the correlation core helps nobody.
- Integrity: immutable log storage, with scheduled rotation and archiving. A journal that can be edited is not evidence.
What happens when a rule fires
A rule produces an incident rather than just a line on a dashboard. Then comes notification (email, Telegram, Slack) and, where appropriate, an automatic response such as blocking an address or an account. Correlation runs in real time across several sources at once, because the interesting things are almost never visible in a single log.
Retrospective search exists separately: when a new indicator of compromise becomes known, the accumulated data is checked for earlier occurrences. That is the reason long log retention is worth paying for at all.
Honest limits
- A SIEM does not replace an engineer. It surfaces an anomaly; a person makes the decision. Without someone who triages the alerts, the system quickly becomes a source of noise that nobody reads.
- Rules need maintenance. Infrastructure changes, and a ruleset that was accurate six months ago starts producing false positives. This is continuous work, not a deployment with a sign-off certificate.
- A standards report is not compliance. Control mapping helps an audit, but certification is issued by a certification body, not by a log collection system.
How this perimeter fits into the wider access scheme is described in the piece on Zero Trust in practice.
Frequently Asked Questions
What part is your own? The layer above an open core: correlation rules for a specific stack, integrations and support. The core is Wazuh on OpenSearch.
Why not a commercial SIEM? A closed vendor inside a system that sees every log, and per-volume licensing that pushes teams to switch sources off.
Is Sigma supported? Partially: there is no stock converter to Wazuh rules, so part of the work is manual.
Does it deliver PCI DSS compliance? No, only reports and control mapping for audit. Certification comes from a certification body.
Need a Consultation?
If you are choosing a SIEM, or want to understand why the one you have produces noise instead of incidents, book a free 15-minute call.
