Cloud SIEMs get most of the attention, but a large share of organizations still run their SIEM on their own servers, and for good reasons: their logs may not be allowed to leave, their network may have no internet connection at all, or their log volume would make a per-gigabyte cloud bill painful. “Self-hosted SIEM” is also one of the most common searches from people building their first security monitoring, because the best free SIEMs are self-hosted.
This guide covers when self-hosting is the right call, what it really takes to run one well, how air-gapped networks change the picture, and the main options. We build UTMStack, which runs both self-hosted and in the cloud, so weigh our view with that in mind.
The short answer: self-host your SIEM when your data must stay under your control (controlled unclassified information, data residency, air-gapped or classified networks, strict contracts), when your log volume makes volume-based cloud pricing expensive, or when you want to own the platform. Plan for a server sized to your events per second and retention, fast disks for recent data, backups, regular updates, and a few hours of skilled time every week.
Self-hosted vs cloud SIEM
| Self-hosted | Cloud SIEM | |
|---|---|---|
| Where logs live | Your servers, your data center or private cloud | The vendor’s cloud, in a region you choose |
| Who runs the platform | You (or a partner) | The vendor |
| Cost model | License (or free) plus hardware, storage and time | Subscription, often by data volume |
| Works without internet | Yes, if the product supports it | No |
| Scaling | You add hardware | The vendor scales it |
| Updates | You schedule and apply them | Automatic |
| Compliance scope | Entirely inside your boundary | Includes the provider and its documentation |
There is also a middle ground: a dedicated hosted instance, run by the vendor for you alone, rather than a shared multi-customer cloud. It removes the maintenance work while keeping your data on its own server in the region you choose.
Self-hosted or hosted?
Two questions settle it for most organizations
When self-hosting makes sense
- Your logs may contain regulated data. Logs pick up file names, email subjects, user names and database queries. For a defense contractor, that can make the SIEM a system that holds controlled unclassified information. Keeping it inside your own enclave avoids the question. See CMMC SIEM requirements.
- Data residency. Some governments, banks and healthcare organizations must keep data in one country, or in their own facilities.
- No internet connection. Industrial networks, classified networks and some critical infrastructure are air-gapped by design. A cloud SIEM is not an option.
- High log volume. If you produce hundreds of gigabytes a day, volume-based cloud pricing can cost more than the servers to store it yourself.
- Control and customization. You choose when to upgrade, how long to keep data and what runs next to it.
- Budget. A free open source SIEM on existing hardware is the lowest-cost way to start.
When it does not
- Nobody can maintain it. A SIEM that misses updates or runs out of disk is worse than none, because it gives false confidence.
- Your environment is mostly cloud and SaaS. If your logs start in Microsoft 365, AWS or Azure, a cloud or hosted SIEM is closer to the data.
- You need it running this week. A hosted instance gets you to first alerts faster.
What it takes to run a SIEM yourself
Hardware sized to your volume
Two numbers decide the server: events per second (for CPU and memory) and gigabytes per day times retention (for disk). Our SIEM sizing calculator estimates both. As a reference, these are UTMStack’s single-server sizes, planned for one month of hot storage:
| Size | Data sources | Data per month | CPU | Memory | Disk |
|---|---|---|---|---|---|
| Small | 50 | 120 GB | 4 cores | 16 GB | 150 GB |
| Medium | 120 | 250 GB | 8 cores | 16 GB | 250 GB |
| Large | 240 | 500 GB | 16 cores | 32 GB | 500 GB |
| Enterprise | 500 | 1 TB | 32 cores | 64 GB | 1 TB |
Plan network bandwidth too: about 100 Mbps for small installs, 1 Gbps for medium and large, and 10 Gbps above 500 sources.
Storage in two tiers
Keep recent data, where correlation and most searches run, on SSD or NVMe disks. Move older data to cheaper storage. Check that the product can still search the older tier directly; restoring archives before every audit question gets old fast.
Backups and recovery
Back up configuration, rules and the log store, and test a restore. Decide whether you need high availability: for many organizations a few hours of SIEM downtime is acceptable if agents buffer logs until it returns.
Updates
SIEMs get new detection rules, parsers and security fixes regularly. Schedule a monthly maintenance window, and subscribe to the project’s release notes.
Securing the SIEM itself
A SIEM holds a map of your network and every login in it, which makes it a target. Put it on a management network, require multi-factor sign-in, give few people administrator rights, and send its own audit logs somewhere it cannot erase them.
Monitoring the monitor
Alert when the SIEM’s disk passes 80 percent, when its services restart, and when any log source goes quiet. A silent source is either a broken agent or an attacker.
People time
Budget a few hours a week for alert review, tuning and maintenance in a small environment, and a person or more full time as you grow. This is the same work a cloud SIEM needs, minus the platform maintenance.
A self-hosted SIEM, end to end
What runs where when the SIEM lives on your own servers
Air-gapped SIEM: what changes
An air-gapped network has no path to the internet, so everything a SIEM normally downloads must come in by hand:
- Installation and updates come from offline packages or container images copied in on approved media.
- Threat intelligence (known bad addresses, domains and file hashes) must be imported on a schedule, or the SIEM works on rules and behavior alone.
- Cloud integrations do not apply; everything arrives over agents and syslog inside the network.
- Time comes from an internal time source, which every system must use so timelines line up.
- Support happens over exported diagnostics rather than remote sessions.
Ask any vendor exactly which features stop working without internet before you commit.
The main self-hosted SIEM options
| Tool | License | What it is | Hardware to plan for | Notes |
|---|---|---|---|---|
| UTMStack | AGPL-3.0 (Community), commercial (Enterprise) | Complete SIEM: correlation, response, incidents, compliance | 4 cores, 16 GB, 150 GB for about 50 sources | One installer; air-gapped installation mode; can move to or from the hosted version |
| Wazuh | GPLv2 | Endpoint-focused security platform | 4 vCPU, 8 GB, 50 GB for up to 25 agents | Strong host checks; response and cases via integrations |
| Security Onion | Elastic License 2.0 | Network security monitoring distribution | 4 cores, 24 GB or more, 200 GB standalone | Forbids offering it as a managed service |
| Elastic Security | Elastic License 2.0 (source also AGPL) | Search platform with security features | Depends on cluster design | Free Basic tier includes detection rules and cases |
| OpenSearch Security Analytics | Apache 2.0 | Search platform with Sigma rules | Depends on cluster design | You add collection, response and reporting |
| Graylog Open | SSPL | Log management | Moderate | Correlation and Sigma rules are paid |
Most large commercial SIEM vendors also still sell a self-managed edition, usually priced by data volume or events per second. If you consider one, ask about the roadmap: several vendors now put most of their new development into their cloud products.
How UTMStack runs self-hosted
UTMStack installs on one Linux server, physical or virtual, running Ubuntu 24.04 LTS or a Red Hat compatible system, in 15 to 30 minutes, or as a virtual appliance image for VMware, Hyper-V and Proxmox. It checks every event against 600+ detection rules as it arrives, before storage, and keeps logs in compressed column storage with a hot tier and a cold tier that both answer the same searches. Retention is yours to set, up to five years. Large deployments scale out across nodes.
For networks without internet access, the installer has an air-gapped mode that installs from preloaded container images; features that need an internet connection are limited, so plan those with us. And because the self-hosted and hosted versions are the same platform, you can start in UTMStack Cloud, on a dedicated instance in the United States, Canada, the United Kingdom, France or Poland, and move in-house later, or the other way around.
Install the free edition, see the system requirements, or talk to an engineer about an Enterprise license on your own servers.
Frequently asked questions
What is a self-hosted SIEM? A SIEM you install and run on your own servers, in your data center or private cloud, instead of using the vendor’s cloud service. You control where the logs live and when the software changes.
What is the best self-hosted SIEM? For a complete SIEM with response and compliance reports in one install, UTMStack. For endpoint-focused monitoring on little hardware, Wazuh. For network monitoring, Security Onion. For building your own on a search platform, OpenSearch or Elastic.
Is there a free self-hosted SIEM? Yes. UTMStack Community, Wazuh and OpenSearch are free and open source; Security Onion, Graylog Open and Elastic’s Basic tier are free but source-available, with limits on offering them as a service.
Can a SIEM run in an air-gapped network? Yes, if it supports offline installation and updates. Expect to import threat intelligence and updates by hand, and to lose cloud integrations. UTMStack’s installer has an air-gapped mode.
Is on-premises SIEM cheaper than cloud? At high log volumes it often is, because you pay for storage rather than for every gigabyte ingested. At small volumes, the time to run it can outweigh the savings. Compare three-year totals, including people.
How much hardware does a self-hosted SIEM need? For UTMStack, 4 cores, 16 GB of memory and 150 GB of disk covers about 50 data sources with a month of hot storage. Use the SIEM sizing calculator for your numbers.
