Security Operations And Incident Response — enterprise stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
SIEM Platform
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsElastic Free self-hosted unlimited; Elastic Cloud from $109/mo (8GB) + $0.10/GB ingested. Panther Free 500GB/mo then $0.10/GB after. Splunk $150/GB/mo ($1800/GB/yr) min 100GB. Microsoft Sentinel $2.46/GB ingested, $0.10/GB retention 31-100GB, $0.05/GB >100GB
SOAR / Security Automation & Response
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSplunk SOAR Free 100 actions/day, Enterprise $15k/yr. Shuffle OSS free self-hosted, Cloud 1000 executions free then $0.04/exec, Pro $600/mo. XSOAR $50k/yr starter, Enterprise $120k/yr. Swimlane $40k/yr
SOC Case Management / Ticketing
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsTheHive Free OSS self-hosted unlimited cases. Jira $10/mo up to 10 users, Premium $54/user/mo. ServiceNow SIR $50k/yr min, ~$120/user/mo
Threat Detection EDR/XDR Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh+Osquery Free OSS. SentinelOne $60/device/mo Complete ($35 Core). CrowdStrike Falcon Insight $99/device/mo XDR, Falcon Complete MDR $149/device/mo. Defender for Endpoint P2 $5.20/user/mo
Endpoint Forensics Toolkit
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVolatility/Rekall Free OSS. Magnet AXIOM $2,500/yr/user. FTK $4,000/yr/license + $1,200/yr maintenance. EnCase Forensic $3,594/yr
Log Ingestion & Collection Pipeline
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsFluentd/Vector Free OSS unlimited. Cribl Free up to 1TB/day ingest, Cloud free 10TB/mo. Enterprise $25k/yr starter (2TB/day). Logstash free. AWS Kinesis $0.015/shard/hr + $0.028 per GB ingested
Log Management / Long-term Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsGraylog Open Free up to 5GB/day self-hosted. Datadog Security $0.10/GB ingested + $1.70/1M security events, retention 30d incl. Sumo Logic Free 1GB/day, Pro $1.50/GB/mo + Flex credits $0.30/1000 logs. Splunk Cloud $150/GB/mo
Security Orchestration Runbooks Hosting
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsStackStorm/n8n OSS Free self-hosted unlimited workflows. n8n Cloud Free 5k exec/mo, Starter $24/mo 2.5k workflows, Pro $50/mo. AWS Lambda Free 1M req/mo then $0.20/1M + compute. Tines Free 100 actions/day, Business $5k/mo
PagerDuty / On-Call & Alerting Infrastructure
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsGrafana OnCall Free OSS self-hosted. Opsgenie Free 5 users, Standard $29/user/mo, Enterprise $45/user/mo. PagerDuty Free 5 users, Professional $29/user/mo, Business $41/user/mo, Enterprise custom ($99+/user/mo). Incident management platform included
Secrets Management for SOC Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted. AWS Secrets Manager $0.40/secret/mo + $0.05/10k API calls. Infisical Cloud Free 100 secrets, Pro $29/mo. Vault Enterprise $1.20/hr ($860/mo) + support $15k/yr, Cloud Dedicated from $1.58/hr
Threat Intelligence Platform (TIP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP Free OSS unlimited. OpenCTI Community Free self-hosted, Cloud $1,800/mo. AlienVault OTX Free 100k indicators/day. Anomali Enterprise $60k/yr starter, ThreatConnect $50k/yr min. OTX + MISP feeds free
Network Detection & Response (NDR)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsZeek/Suricata Free OSS unlimited. Corelight Cloud from $3k/mo sensor. Darktrace $40k/yr starter 100 IPs, Enterprise $120k+/yr. ExtraHop $50k/yr min. Vectra AI $60k/yr
Incident Response Collaboration Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMattermost Free OSS unlimited users self-hosted. Rocket.Chat Community Free unlimited. Slack Free 90d history, Pro $8.75/user/mo, Business+ $12.50/user/mo, Enterprise Grid $25/user/mo
Digital Forensics Workstation / Sandboxing Lab
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSIFT/REMnux/FLARE VM Free OSS. Any.run Community Free 5 tasks/day unlimited, Pro $60/mo, Enterprise $299/mo. Joe Sandbox Community Free 100 analyses/mo, Cloud Pro $600/mo
Vulnerability Management Platform
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free OSS unlimited IPs. Nessus Essentials Free 16 IPs. Tenable.io $3,600/yr 128 assets (~$28/asset/yr), Qualys $1,995/yr 256 IPs. Rapid7 InsightVM $25/asset/yr
Compliance & Audit Logging (WORM / Immutable)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsimmudb Free OSS 5GB. AWS S3 Object Lock Free (S3 costs $0.023/GB/mo + API), CloudTrail $2.00/100k management events free first copy. Veeam Immutable Backup $36/workload/yr. Glacier Vault Lock $0.004/GB/mo
Security Data Lake / SIEM Backend Storage
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsElasticsearch+MinIO Free OSS self-hosted. AWS S3 $0.023/GB/mo, Athena $5/TB scanned, Security Lake Free ingest. Snowflake Standard $2/credit (~$2-4/hr compute), storage $23/TB/mo. Panther Data Lake in S3 cost-covered
Identity Threat Detection & Response (ITDR)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWazuh+Keycloak Free OSS. Microsoft Defender for Identity $5.20/user/mo bundled in M365 A5/E5, standalone $5/mo. CrowdStrike Identity $25/device/mo. CyberArk $80/user/yr min. Okta Workforce Identity $2/user/mo + Advanced $4/user/mo
Threat Hunting Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVelociraptor/Sigma Free OSS unlimited hunting. Censys Free 250 queries/mo, Team $1,500/mo. Elastic Security Hunting Free tier. CrowdStrike Falcon OverWatch $35/device/mo add-on, Managed Hunting $75k/yr min
Malware Analysis Sandbox (Detonation)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCuckoo/Capev2 Free OSS. Any.run Pro $60/mo 100 tasks/mo, Team $299/mo. Joe Sandbox Cloud Basic $300/mo 350 analyses, Unlimited $1,200/mo. VMRay $50k/yr. Hybrid Analysis Free 100/day
Security Automation Infrastructure (Workers/Functions)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTemporal OSS Free self-hosted. AWS Lambda Free 1M req/mo then $0.20/1M + $0.00001667/GB-s, Step Functions $0.025/1k state transitions. Temporal Cloud Free 10k actions/mo then $0.20/1k actions, Pro $500/mo min
Evidence Collection & Chain-of-Custody Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsVelociraptor/GRR Free OSS. S3 Standard $0.023/GB/mo, Glacier Instant $0.004/GB/mo + $0.03/1k requests, Glacier Deep Archive $0.00099/GB/mo, Vault Lock compliance free. FTK Central Case Storage $4k/yr
Packet Capture & Traffic Analysis Infra
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsArkime/Moloch Free OSS unlimited PCAP. CloudShark Free Community 2GB, Pro $199/mo 100GB. ntopng Community Free, Enterprise $3,999/yr. NetWitness $75k/yr appliance + storage. Core hardware: 10TB NVMe ~$1,200 one-time
Security Metrics & SOC Dashboarding
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsGrafana OSS Free unlimited dashboards. Datadog Free dashboards included with log ingest $0.10/GB. Grafana Cloud Free 10k metrics/50GB logs, Pro $8/user/mo, Enterprise $15k/yr. Splunk Dashboard included in $150/GB/mo
Deception Technology Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenCanary/Canarytokens Free OSS unlimited tokens. Thinkst Canary Free 10 canarytokens, Canary device $3,500/yr (5 pack), Enterprise $15k/yr 50 canaries. Attivo (SentinelOne) $30k/yr
Threat Intel Feed Aggregation (Commercial Feeds)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOTX/Abuse.ch/Feodo Free 100k IOCs/day. Shodan API Free 100 queries/mo, Membership $49 one-time + $59/mo developer. Censys Free 250/mo. Recorded Future $120k/yr min, CrowdStrike Intel $60k/yr add-on. Anomali feeds $36k/yr
Incident Containment Orchestration (Isolation/Quarantine)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh Active Response Free OSS. Microsoft Defender for Endpoint auto-isolation included in P2 $5.20/user/mo. CrowdStrike Falcon containment included in $99/device/mo Insight. XSOAR containment playbooks $50k/yr + integration $5k
Backup & Recovery Orchestration for IR
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsRestic/Velero Free OSS. AWS Backup Free tier: $0.05/GB-mo backup storage + $0.02/10k restore. Veeam Community Free 10 workloads, Veeam Universal $18/workload/mo ($36 immutable), Enterprise $1,200/socket/yr. Rubrik $40k/yr min + storage $0.05/GB
Security Training / Tabletop Exercise Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAtomic Red Team + Caldera Free OSS. TryHackMe $18/user/mo Business, HackTheBox $30/user/mo. RangeForce $500/user/yr, Immersive Labs $650/user/yr, AttackIQ $75k/yr min platform
Privileged Access Monitoring for IR
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsTeleport Community Free self-hosted 15 nodes. Teleport Cloud Free 15 nodes + $10/node after, Team $18/node/mo, Enterprise $36/node/mo. CyberArk $120/user/yr min $45k/yr. AWS Session Manager free (EC2/S3 costs)
Full SOC-as-a-Service Platform Manager
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh Cloud SOC Free tier 5GB/day self-hosted. Arctic Wolf $50k/yr starter 250 users, ~$200/user/yr. Expel $100k/yr starter up to 500 endpoints (~$200/endpoint/yr), Enterprise $250k+/yr. Unit 42 MDR $180k/yr min
Extended Detection Telemetry (Cloud Workload Protection / CWP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsProwler/ScoutSuite Free OSS. Wiz Free 100 workloads, Standard from $30k/yr 1000 workloads ($2.50/workload/mo), Enterprise $120k/yr. Lacework Free 10 workloads, Pro $50k/yr. Orca $75k/yr
AI-Driven SOC Analytics / UEBA
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsApache Spot Free OSS. Microsoft Sentinel UEBA Free included in $2.46/GB. Elastic ML jobs Free tier 2 jobs. Exabeam Fusion $120k/yr starter 500 users (~$20/user/mo), Enterprise $250k+/yr. Splunk UBA $25k/yr add-on + Splunk Enterprise licensing $150/GB/mo
Global Log Replication & DR for SOC
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsKafka OSS Free self-hosted (EC2 cost $100/mo per broker). AWS Kinesis $0.015/shard/hr + $0.028/GB, S3 CRR $0.02/GB + storage. Confluent Cloud Basic $0.10/GB ingest + $0.15/GB egress, Enterprise $450/mo min + $1.5k/mo HA. Cribl HA $45k/yr
Attack Surface Management Integration
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAmass/subfinder/nuclei Free OSS. Shodan Monitor Free 16 IPs, Small Business $399/mo 20k IPs, Enterprise $899/mo. Censys ASM Free 250 assets, Team $1,500/mo 1000 assets, Enterprise $12k/mo. Xpanse $80k/yr starter
Breach & Attack Simulation Infrastructure
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCaldera+Atomic Red Team Free OSS unlimited simulations. AttackIQ Flex Free 5 simulations/mo, Professional $5k/mo, Enterprise $75k/yr. SafeBreach $90k/yr starter, Enterprise $180k/yr. Cymulate $70k/yr starter
Security Orchestration High-Availability Cluster
Scheduling, availability, and booking logic. Core to any appointment or reservation product.Pricing & free-tier limitsK3s+Consul OSS Free self-hosted (EC2 $60/mo). AWS EKS $0.10/hr ($73/mo) + nodes $60-200/mo, RDS Multi-AZ db.t3.micro $25/mo + $15/mo standby. OpenShift $50k/yr 50 cores. Consul Enterprise $1.50/hr + support $20k/yr. Temporal Cloud HA $1k/mo
DFIR Reporting & Legal Hold Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTheHive Reporting + Timesketch Free OSS. Autopsy Free OSS. Magnet Review Free Viewer, Enterprise $5k/yr/user + Axiom $2,500/yr. FTK Central Reporting $6k/yr + FTK $4k/yr. Exterro Legal Hold $60k/yr Enterprise min + $25/user/mo. Relativity $70k/yr
How this enterprise security operations and incident response checklist works.
Each requirement below is something a enterprise security operations and incident response build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.