Setting up a SIEM is genuinely easy. I stood up Wazuh in an afternoon, pointed a couple of agents at my boxes, and went to bed feeling virtuous.
The next morning I had forty emails. A third of them were the same port scan from the same bot, logged by every host that saw it. A few were real. Most were the SIEM doing exactly what I asked it to do, and me getting exactly what I deserved for not asking better questions.
The problem was never the tool. It was that I built a fire alarm with one setting: loud. And loud, it turns out, is mostly noise.
So I spent a weekend tuning it, and it changed how I think about security monitoring. Here's what actually moved the needle.
Start with what you'd notice anyway. Before tuning a single rule, I wrote down what genuinely scares me: someone logging into a machine we didn't touch, a service pointing outbound when it shouldn't, a password spray against our VPN. Everything else was a lead to triage, not an alert to fire.
Aggress the noise at the source. That recurring port scan was hitting my whole subnet, and Wazuh's default had each host report it. One rule, scoped once, collapsed forty emails into one.
Let the blocklist do the boring job. The CrowdSec side of my stack eats most of the automated garbage before it ever becomes an alert. When the thing banging on the door is already on a shared blocklist, the SIEM doesn't even need to know about it. That alone cut my alert volume by more than half.
Tune in rounds, not all at once. I'd change three rules, let it sit for a week, and look at what still fired. Rinse and repeat. Every round was the same shape: the noise gets quiet, and the alerts that remain start to look important again, because they actually are.
Keep the receipts. The other half of this story is that tuning rules isn't worth a thing if you can't show the auditor that you did it. So my backup stack snapshots the configs, the rulesets, the dashboards, and the logs that show the alerts we chose to mute and why. When someone asks where your evidence is, I point at a file, not a shrug.
A month in, my inbox gets one SIEM email a week. Sometimes it's a false positive. Usually it's real. I read it now, and that's the whole point: an alert you read is worth more than ten you archive without opening.
If you want the same setup without rebuilding it rule by rule, I packaged the whole thing. Wazuh for detection, CrowdSec with Grafana for visibility, and restic that actually logs what a backup audit is supposed to log, as three Docker stacks you can run yourself. One-time fifteen bucks, updates included, and it lives entirely on your own hardware: https://symshah.gumroad.com/l/smb-security-pack
That's the expensive part done. Tuning is still your job, and honestly, that's the part worth doing yourself.
