Why SMBs Need a SOC in 2025
SMBs account for 43% of cyberattack targets according to ANSSI's 2024 report, yet fewer than 5% have a Security Operations Center (SOC). The excuse is always the same: "It's too expensive, it's for large enterprises."
Wrong. In 2025, it's entirely possible to set up a minimalist but functional SOC for a business with 20 to 200 employees, using open source tools, some automation, and an architecture designed for cost-effectiveness.
This guide shows you exactly how.
Target Architecture: The 4 Layers of a Minimalist SOC
An enterprise SOC typically relies on dozens of components. For an SMB, we focus on 4 essential layers:
- Log collection — centralize logs from all equipment
- Detection & correlation (SIEM) — identify abnormal behavior
- Alerting & response — notify the right people and trigger actions
- Dashboard & reporting — visualize security posture
Step 1: Centralize Logs with Wazuh
Wazuh is the central building block of our minimalist SOC. It's an open source SIEM/XDR that combines log collection, host-based intrusion detection (HIDS), and regulatory compliance.
Recommended Installation
# On an Ubuntu 22.04 VPS (4 vCPU, 8 GB RAM, 100 GB SSD)
curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
sudo bash wazuh-install.sh -a
This single command installs Wazuh Manager + Wazuh Indexer + Wazuh Dashboard.
Priority Log Sources to Connect
| Source | Collection Method | Priority |
|---|---|---|
| Windows workstations | Wazuh Agent | 🔴 Critical |
| Linux servers | Wazuh Agent + Syslog | 🔴 Critical |
| Firewall (pfSense, Fortinet) | Syslog to Wazuh | 🔴 Critical |
| Microsoft 365 / Google Workspace | Wazuh API Module | 🟠 High |
| Business apps (Supabase, Vercel) | Webhook → Syslog | 🟡 Medium |
Practical tip: start with Windows workstations and the firewall. Within 48 hours, you'll cover 80% of a typical SMB's attack surface.
Step 2: Configure Detection Rules
Wazuh ships with over 3,000 detection rules out of the box (MITRE ATT&CK mapped). But for an SMB, the key challenge is avoiding alert fatigue.
10 Critical Rules to Enable Immediately
- SSH/RDP brute force (rule 5710, 60122)
- Admin account creation (rule 5902)
- GPO modification (rule 60144)
- Suspicious PowerShell execution (rule 91801)
- Login from unusual country (custom rule + GeoIP)
- Antivirus disabled (rule 91530)
- Large file transfers (custom rule)
- Mass M365 authentication failures (Office 365 module)
- Firewall rule changes (custom syslog)
- Root/sudo access outside business hours (custom rule + timestamp)
Custom Rule Example
<rule id="100010" level="12">
<if_sid>5501</if_sid>
<time>8pm - 6am</time>
<description>Sudo access outside business hours</description>
<group>pci_dss_10.2.5,</group>
</rule>
Step 3: Automate Alerts with n8n
A SIEM that generates alerts in a dashboard no one checks is useless. Automation is the force multiplier of a minimalist SOC.
n8n (self-hosted) connects Wazuh to the rest of your stack:
Typical Workflow: Critical Alert → Action
Wazuh Webhook → n8n → Filter (level ≥ 12)
├── Slack/Teams: notification with context
├── Supabase: log to `security_incidents` table
├── Claude AI (API): analysis and remediation suggestions
└── OPNsense API: automatic IP blocking
Why Claude AI? For every level 12+ alert, we send the raw JSON to the Claude API with this prompt: "Analyze this Wazuh security alert, assess the real severity, and propose 3 concrete remediation actions for an SMB." The result is injected into the Slack notification.
Result: your IT team receives not a raw alert, but an actionable brief.
Step 4: Dashboard and Reporting
The native Wazuh dashboard is powerful but technical. For executive reporting, we use Grafana connected to the Wazuh indexer (OpenSearch compatible).
Weekly KPIs to Track
- Number of critical alerts (level ≥ 10) and trend
- Mean time to detection (MTTD)
- Top 5 most targeted machines
- CIS compliance rate (Wazuh SCA score)
- Open vs. resolved incident count
Realistic Budget: Monthly Cost
| Component | Solution | Monthly Cost |
|---|---|---|
| Wazuh server | Hetzner VPS (4vCPU/8GB) | €15 |
| Self-hosted n8n | Same VPS or dedicated | €0–10 |
| Log storage (90 days) | 200 GB SSD volume | €10 |
| Claude AI API | ~500 calls/month | €15 |
| Grafana Cloud (free tier) | Dashboards | €0 |
| Human time | 8h/month supervision | Variable |
| Total infrastructure | ~€50/month |
Compare that to the €2,000–5,000/month for a commercial managed SOC. The ratio is unbeatable for an SMB.
Common Pitfalls to Avoid
- ❌ Collecting everything from day one: start with 3 critical sources, expand gradually
- ❌ Ignoring sizing: Wazuh Indexer is RAM-hungry — plan for 8 GB minimum
- ❌ Not documenting runbooks: every alert type must have a written response procedure
- ❌ Forgetting legal retention: in France, CNIL enforces rules on log retention (6 months recommended, 1 year max for most cases)
- ❌ Neglecting updates: Wazuh publishes frequent security patches — automate with a cron job
5-Day Action Plan
| Day | Action |
|---|---|
| D1 | Provision VPS, install Wazuh all-in-one |
| D2 | Deploy agents on Windows workstations and Linux servers |
| D3 | Connect firewall via syslog, enable the 10 critical rules |
| D4 | Set up n8n + Slack alert workflow + Claude AI |
| D5 | Build Grafana dashboard, document basic runbooks |
Conclusion: Security Is Not a Luxury
A minimalist SOC will never replace a 24/7 SOC with a 10-analyst team. But for an SMB, it's the difference between seeing attacks coming and discovering them in the news.
With Wazuh, n8n, and Claude AI, you get an operational SOC SIEM for the price of a software subscription. At Otomy, we help SMBs across France and Algeria deploy this stack in under a week. Contact us for an attack surface audit.