Open-source security monitoring and threat hunting tools for businesses

Security monitoring means collecting what your servers, computers and network record, and having something watch it for signs of an attack. Threat hunting means searching that record on purpose, for an attacker who slipped past the alarms. Mature open-source tools exist for every part of the job: Wazuh for watching servers and laptops, Suricata and Zeek for the network, osquery and Velociraptor for searching across machines, CrowdSec for blocking attackers, and Sigma and MITRE ATT&CK for shared detection rules and vocabulary. The tools are free; the time to read their alerts is not.

Why detection matters

Prevention fails sometimes, however good it is. The US National Institute of Standards and Technology's Cybersecurity Framework 2.0 makes "Detect" one of its core functions: finding and analysing possible attacks and compromises, through continuous monitoring, for organisations of every size. An intrusion found in hours costs far less than one found months later by a customer.

Watching servers and laptops: Wazuh and OSSEC

Wazuh is a free, open-source security platform (GPLv2) that combines log analysis with endpoint monitoring. Agents on Linux, Windows and macOS machines report to a central Wazuh server, which provides:

• file integrity monitoring, which alerts when important files change
• vulnerability detection against installed software
• log analysis and alerting
• configuration checks against security baselines
• automatic responses, such as blocking an address

Wazuh's quick-start guide says one server with 8 GiB of memory can monitor up to about 100 endpoints, which puts it within reach of a small business.

OSSEC, Wazuh's older and lighter ancestor (GPLv2), still suits a handful of servers.

Watching the network: Suricata, Zeek and Security Onion

• Suricata (GPLv2, from the non-profit Open Information Security Foundation) inspects network traffic for known attacks and can block them.
• Zeek (BSD licence) passively records what happens on the network, connections, DNS lookups, certificates and files, as detailed logs for later searching.
• Security Onion bundles Suricata, Zeek, the Elastic stack and packet capture into one distribution. Its licence file is the Elastic License 2.0, which is not an open-source licence in the usual sense and forbids offering the software to others as a hosted service. It also needs substantial hardware.

Searching across machines: osquery and Velociraptor

• osquery (Apache 2.0 or GPLv2, now under the Linux Foundation) lets you query computers as if they were a database: which programs are running, which users exist, which ports are open.
• Velociraptor (AGPLv3, part of Rapid7 since April 2021) is built for hunting and investigating across many endpoints at once, collecting evidence during an incident.

Blocking and sharing: CrowdSec, fail2ban, MISP and OpenCTI

• fail2ban reads logs on one server and bans addresses after repeated failed logins.
• CrowdSec (MIT licence) does the same from behaviour patterns in logs and web requests, and shares what it sees through a community blocklist, so an attacker seen elsewhere can be blocked before reaching you.
• MISP (AGPLv3, from Luxembourg's CIRCL) and OpenCTI (Community Edition under Apache 2.0) are platforms for collecting and sharing threat intelligence. They suit organisations with someone whose job includes reading it.

Shared rules and a shared vocabulary: Sigma and MITRE ATT&CK

• Sigma is a common format for writing log detections once and converting them for many tools. Its public rule set uses the Detection Rule License, which requires keeping the authors' attribution.
• MITRE ATT&CK is a free knowledge base of attacker tactics and techniques drawn from real attacks. It gives defenders a common name for what they are looking for, and most of the tools above tag their alerts with it.

Licences worth checking

Not every security tool that publishes its code is open source in the usual sense. Read the licence before you build on one:

What a small business can realistically run

Noiz's view, based on the tools' own guidance:

1. Wazuh agents on servers and laptops, reporting to one Wazuh server, for file changes, vulnerabilities and log alerts.
2. fail2ban or CrowdSec on every server that faces the internet.
3. Suricata at the office network edge if you have one, with Zeek logs if you want to investigate later.
4. Sigma and YARA rules from trusted sources, and ATT&CK names in your notes.

Leave threat-intelligence platforms and full case management until you have someone to run them.

The limit is people, not software. The UK National Cyber Security Centre says that searching logs proactively needs further investment in people, skills and business processes. In May 2026 the US Cybersecurity and Infrastructure Security Agency retired Logging Made Easy, its own free logging package for small organisations, a reminder that free tools still need someone to maintain them. Start small, tune the alerts until they are worth reading, and decide who reads them.

For the scanners that sit alongside these tools, see open-source antivirus and anti-malware for business computers and servers.

Where Noiz fits

A Noiz Cloud server is a straightforward home for a Wazuh server or a CrowdSec set-up, with full root and a dedicated address. Noiz can install, tune and maintain these tools under a quoted Linux administration service, by the hour, once off or maintained monthly.

If you want monitoring on your servers without becoming a full-time analyst, ask Noiz for a Linux administration quote.

Sources

• Wazuh, getting started: https://documentation.wazuh.com/current/getting-started/index.html
• Wazuh, quick start: https://documentation.wazuh.com/current/quickstart.html
• Wazuh, licence: https://github.com/wazuh/wazuh/blob/main/LICENSE
• OSSEC: https://www.ossec.net/
• Zeek: https://zeek.org/ and licence https://github.com/zeek/zeek/blob/master/COPYING
• Suricata, what is Suricata: https://docs.suricata.io/en/latest/what-is-suricata.html
• Security Onion, licence: https://docs.securityonion.net/en/3/main/license
• Security Onion, hardware: https://docs.securityonion.net/en/3/main/hardware
• osquery: https://github.com/osquery/osquery
• Velociraptor, overview: https://docs.velociraptor.app/docs/overview/
• Rapid7 acquires Velociraptor (21 April 2021): https://www.rapid7.com/about/press-releases/rapid7-acquires-digital-forensics-and-incident-response-open-source-project-velociraptor/
• CrowdSec documentation: https://docs.crowdsec.net/docs/intro
• fail2ban: https://github.com/fail2ban/fail2ban
• MISP: https://www.misp-project.org/
• OpenCTI: https://github.com/OpenCTI-Platform/opencti
• Sigma: https://github.com/SigmaHQ/sigma and Detection Rule License https://github.com/SigmaHQ/Detection-Rule-License
• TheHive licences: https://docs.strangebee.com/thehive/installation/licenses/about-licenses/
• Graylog licence: https://github.com/Graylog2/graylog2-server/blob/master/LICENSE
• OpenSearch: https://opensearch.org/
• MITRE ATT&CK: https://attack.mitre.org/
• NIST Cybersecurity Framework 2.0 (26 February 2024): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• CISA, Logging Made Easy: https://www.cisa.gov/resources-tools/services/logging-made-easy
• CISA, no-cost cybersecurity services and tools: https://www.cisa.gov/resources-tools/resources/free-cybersecurity-services-and-tools
• NCSC, introduction to logging for security purposes: https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.