Small businesses get attacked for the same reasons large ones do, with fewer people watching. The usual story is not a sophisticated hacker: it is a stolen Microsoft 365 password, a new inbox rule that hides the attacker’s emails, a VPN account guessed over a weekend, or antivirus switched off on one server the night before ransomware runs. Each of those leaves a trace in a log. A SIEM is the tool that reads those logs and tells you.
The problem is that SIEMs were built for large companies with security teams, and many are priced and designed that way. This guide covers whether a small business needs one, what to monitor first, the affordable ways to get one, and a 30-day plan to start. We build UTMStack, so weigh our view accordingly.
The short answer: most small businesses that handle customer data, payments, health information or defense work need what a SIEM does: one place for security logs, alerts on account takeover and ransomware warning signs, and evidence for auditors and insurers. They do not need an enterprise SIEM. The affordable routes are a free open source SIEM if you have IT staff, a hosted SIEM priced per device if you do not want servers, or a managed service if nobody can watch the alerts.
Does a small business need a SIEM?
You probably do if any of these apply:
- A regulation or contract asks for log monitoring. PCI DSS requires automated daily log review for anyone who takes cards, HIPAA requires audit controls for health information, and CMMC Level 2 requires log correlation for defense suppliers.
- Your cyber insurance or a big customer sends security questionnaires. They commonly ask whether you collect and monitor security logs centrally, and how long you keep them.
- You run on cloud apps and remote work. If your business lives in Microsoft 365 or Google Workspace, sign-ins from new countries and changes to mailbox rules are your biggest risk, and nobody sees them unless something is watching.
- You have a server or a domain controller. That is where ransomware operators go first.
You probably do not need one yet if you are a handful of people with no servers, no regulated data and a managed endpoint security product with someone watching it. Even then, turn on the audit logs your cloud apps already offer.
What small businesses actually need from a SIEM
The feature list that matters is short:
- Ready integrations for Microsoft 365 or Google Workspace, your firewall, your endpoint security console and Windows servers, without writing parsers.
- Detections that work on day one, with few false alarms.
- Automated response, so a brute-force source is blocked or a compromised account disabled even at 3 a.m.
- Reports a non-specialist can read, for the owner, the auditor and the insurer.
- A predictable price that does not jump when log volume does.
- Someone to call when an alert needs a second opinion.
The threats a small business SIEM should catch
| Threat | What the SIEM sees |
|---|---|
| Business email compromise | Sign-ins from unusual places, multi-factor push spam, new inbox rules that forward or hide email |
| Password guessing on VPN or remote desktop | Many failed logons from one address, then a success |
| Ransomware preparation | Antivirus disabled, shadow copies deleted, mass file renames, ransom notes created |
| A new administrator nobody approved | Accounts created or added to admin groups |
| Data theft | Large downloads from SharePoint or OneDrive, mail exported to PST files |
| A blind spot | A server or firewall that stops sending logs |
The affordable options
| Option | Upfront cost | You need | Best for |
|---|---|---|---|
| Free open source SIEM on your own server | Hardware only | Someone with Linux and security skills, a few hours a week | Businesses with an IT person or a technical owner |
| Hosted SIEM priced per device | Monthly subscription | Someone to read alerts, with automation doing the routine work | Businesses that do not want to run servers |
| Managed SIEM or MDR service | Monthly per device or per user | Very little | Businesses with nobody to watch alerts |
| Only the logs built into your tools | Nothing | Time to check several consoles, often with short retention | Very small businesses starting out |
Which option fits your business?
Start from who can look at alerts
Two things to check with any option. First, what happens at night and on weekends, when most attacks start: either automated response or a person must act. Second, how long logs are kept: many built-in consoles keep logs for months, while audits and investigations often need a year.
What it costs
A small business SIEM costs anything from nothing (open source on hardware you have) to a monthly fee per device, user or gigabyte. The pricing model matters more than the starting price: per-gigabyte plans grow with every log you add, while per-device plans only grow when you add devices. The people cost matters too. If nobody on staff can review alerts, compare the price of a managed service with that of hiring, not with the license alone. Our guide to SIEM cost breaks down every model, and the SIEM sizing calculator estimates your log volume.
A 30-day plan to get started
The first 30 days
Start where small businesses are attacked most
- Week 1Cloud and edgeMicrosoft 365 or Google Workspace, firewall, VPN
- Week 2Endpoints and serversAgents on servers and laptops; antivirus console
- Week 3Tune and automateExceptions for known-good activity; automatic blocking
- Week 4Report and documentFirst report and a one-page runbook
Week 1: connect the cloud and the edge. Inventory your log sources. Connect Microsoft 365 or Google Workspace, your firewall and your VPN. These catch the most common small business attacks.
Week 2: add endpoints and servers. Install the agent on servers and the domain controller, then on laptops. Connect your antivirus or endpoint detection console.
Week 3: tune and automate. Review every alert from the first two weeks. Add exceptions for known-good activity, and turn on automated responses for clear-cut cases such as brute-force sources.
Week 4: report and document. Run your first compliance or security report. Write a one-page runbook: who gets alerts, who decides on serious ones, and who to call for help.
Questions to ask before you buy
- Does it connect to Microsoft 365 or Google Workspace, our firewall and our antivirus out of the box?
- What does it do automatically when it sees an attack at night?
- How many alerts a week should we expect after tuning?
- How long are logs kept, and can we search old ones without extra fees?
- What will the price be if our log volume doubles?
- Who helps us when an alert is unclear, and how fast?
- Can our IT provider or MSP manage it for us?
How UTMStack fits a small business
UTMStack puts log management, real-time detection, automated response, incident tracking and compliance reports in one product, so a small team does not have to connect separate tools. It has ready integrations for Microsoft 365, Google Cloud, AWS and Azure, the common firewalls (Fortinet, Sophos, SonicWall, Cisco, Palo Alto Networks, pfSense and others) and endpoint tools such as CrowdStrike, SentinelOne, Sophos, Bitdefender, ESET and Kaspersky. Its rules cover the threats above, from suspicious inbox rules and multi-factor push spam to shadow copy deletion and ransom notes, and response flows can block an address, disable an account or isolate a machine automatically.
- Free: the open source Community edition installs on one Ubuntu server in 15 to 30 minutes.
- Hosted: UTMStack Cloud gives you a dedicated instance with plans from 25 devices, including the SOC-AI assistant, compliance reports and support by ticket and chat.
- Managed for you: many UTMStack partners are IT providers and MSPs who can run it for you. Ask us for one near you.
Every paid option is priced per device, never by log volume. Try the console on sample data in the live demo, or talk to us about your setup.
Frequently asked questions
Do small businesses need a SIEM? If you handle payment cards, health information, defense contracts or other regulated data, or your insurer asks about log monitoring, yes in practice. Very small businesses without servers or regulated data can start with the audit logs built into their cloud apps and endpoint security.
What is the best SIEM for a small business? One that connects to your cloud apps, firewall and antivirus without custom work, responds automatically when nobody is watching, and has a predictable price. A complete platform such as UTMStack, hosted or self-hosted, fits teams that want to run it themselves; a managed service fits teams that cannot watch alerts.
What is the cheapest SIEM? A free open source SIEM on hardware you already own costs only your time. Over a few years, the cheapest option is the one whose price does not grow with your log volume and that includes the features you need.
Is a free SIEM good enough for a small business? It can be, if someone on staff can install, update and tune it. UTMStack’s free Community edition includes real-time detection, automated response and CMMC and GDPR compliance reports.
SIEM or managed detection and response for a small business? A SIEM collects and analyzes logs from everything; managed detection and response adds people who watch and respond, often focused on endpoints. If you have nobody to watch alerts, a managed service, or a SIEM run by your IT provider, is the safer choice.
How many devices does a small business SIEM need to cover? Every server, laptop and firewall, plus each cloud account. A 50-person office typically has 60 to 100 log sources once all of those are counted.
