Articles
ESXi Logs to SIEM: How to Forward Them and What to Detect
How to send VMware ESXi logs to a SIEM with esxcli or vSphere, which log files matter, and the detections that catch ransomware and backdoors on the hypervisor.
The UTMStack blog
Practical guides on detection, response, security operations and compliance, written for teams that run them.
Articles
SOC 2 Logging Requirements: What to Log and How Long to Keep It
SOC 2 logging requirements explained: which Trust Services Criteria cover logs, what events to capture, how long to keep them, and the evidence auditors ask for.
Articles
How Much Does a SIEM Cost in 2026? Pricing Models Explained
What a SIEM really costs in 2026: the five pricing models (per GB, per EPS, per device, per user, compute), hidden costs, staffing, and how to compare SIEM quotes.
Articles
SIEM Sizing Calculator: Estimate EPS, Log Volume and Storage
Free SIEM sizing calculator: estimate events per second (EPS), daily log volume in GB and storage for your retention period, with the formulas and typical EPS per device.
Articles
SIEM for Small Business: Affordable Options and How to Start
Does a small business need a SIEM? What to monitor first, the affordable options (free, hosted, managed), what they cost, and a 30-day plan to get started.
Articles
Best SIEM for MSPs and MSSPs: What Multi-Tenant Really Requires
How to choose the best SIEM for an MSP or MSSP: real multi-tenancy, licenses that allow a managed service, per-customer pricing, onboarding, white-label reports and response.
Articles
CMMC SIEM Requirements: Does Level 2 Need a SIEM? (2026 Guide)
Does CMMC require a SIEM? What Level 2's audit logging requirements ask for, how many points they carry, log retention, scoping, and when a cloud SIEM needs FedRAMP.
Articles
Wazuh Alternatives in 2026: 6 Open Source Options Compared
The best Wazuh alternatives in 2026, open source and free: UTMStack, Security Onion, Elastic Security, OpenSearch, Graylog and OSSEC, compared by what each does better.
Articles
Self-Hosted SIEM: When to Run Your Own and the Best Options
Self-hosted and on-premises SIEM explained: when it beats a cloud SIEM, the hardware, storage and people it takes, air-gapped networks, and the best options in 2026.
Articles
PCI DSS 4.0 Logging Requirements: Requirement 10 Explained
PCI DSS 4.0.1 logging requirements in plain language: what Requirement 10 says to log, the fields each record needs, daily automated review, 12-month retention and more.
Articles
Active Directory SIEM Use Cases: 22 Detections and Event IDs
22 Active Directory SIEM use cases with their Windows event IDs: Kerberoasting, golden tickets, DCSync, AdminSDHolder, privileged groups, brute force and more.
Articles
Best SIEM for a Home Lab in 2026: 6 Free Options Compared
The best free SIEM for a home lab in 2026: UTMStack, Wazuh, Security Onion, Elastic, Graylog and Splunk Free compared by hardware and what you learn, plus a starter project.