Security Operations And Incident Response — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
SIEM Platform
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsElastic Free self-hosted unlimited; Elastic Cloud from $109/mo (8GB) + $0.10/GB ingested. Panther Free 500GB/mo then $0.10/GB after. Splunk $150/GB/mo ($1800/GB/yr) min 100GB. Microsoft Sentinel $2.46/GB ingested, $0.10/GB retention 31-100GB, $0.05/GB >100GB
SOAR / Security Automation & Response
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSplunk SOAR Free 100 actions/day, Enterprise $15k/yr. Shuffle OSS free self-hosted, Cloud 1000 executions free then $0.04/exec, Pro $600/mo. XSOAR $50k/yr starter, Enterprise $120k/yr. Swimlane $40k/yr
SOC Case Management / Ticketing
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsTheHive Free OSS self-hosted unlimited cases. Jira $10/mo up to 10 users, Premium $54/user/mo. ServiceNow SIR $50k/yr min, ~$120/user/mo
Threat Detection EDR/XDR Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh+Osquery Free OSS. SentinelOne $60/device/mo Complete ($35 Core). CrowdStrike Falcon Insight $99/device/mo XDR, Falcon Complete MDR $149/device/mo. Defender for Endpoint P2 $5.20/user/mo
Endpoint Forensics Toolkit
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVolatility/Rekall Free OSS. Magnet AXIOM $2,500/yr/user. FTK $4,000/yr/license + $1,200/yr maintenance. EnCase Forensic $3,594/yr
Log Ingestion & Collection Pipeline
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsFluentd/Vector Free OSS unlimited. Cribl Free up to 1TB/day ingest, Cloud free 10TB/mo. Enterprise $25k/yr starter (2TB/day). Logstash free. AWS Kinesis $0.015/shard/hr + $0.028 per GB ingested
Log Management / Long-term Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsGraylog Open Free up to 5GB/day self-hosted. Datadog Security $0.10/GB ingested + $1.70/1M security events, retention 30d incl. Sumo Logic Free 1GB/day, Pro $1.50/GB/mo + Flex credits $0.30/1000 logs. Splunk Cloud $150/GB/mo
Security Orchestration Runbooks Hosting
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsStackStorm/n8n OSS Free self-hosted unlimited workflows. n8n Cloud Free 5k exec/mo, Starter $24/mo 2.5k workflows, Pro $50/mo. AWS Lambda Free 1M req/mo then $0.20/1M + compute. Tines Free 100 actions/day, Business $5k/mo
PagerDuty / On-Call & Alerting Infrastructure
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsGrafana OnCall Free OSS self-hosted. Opsgenie Free 5 users, Standard $29/user/mo, Enterprise $45/user/mo. PagerDuty Free 5 users, Professional $29/user/mo, Business $41/user/mo, Enterprise custom ($99+/user/mo). Incident management platform included
Secrets Management for SOC Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted. AWS Secrets Manager $0.40/secret/mo + $0.05/10k API calls. Infisical Cloud Free 100 secrets, Pro $29/mo. Vault Enterprise $1.20/hr ($860/mo) + support $15k/yr, Cloud Dedicated from $1.58/hr
Threat Intelligence Platform (TIP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP Free OSS unlimited. OpenCTI Community Free self-hosted, Cloud $1,800/mo. AlienVault OTX Free 100k indicators/day. Anomali Enterprise $60k/yr starter, ThreatConnect $50k/yr min. OTX + MISP feeds free
How this hobby security operations and incident response checklist works.
Each requirement below is something a hobby security operations and incident response build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.