Security Operations And Incident Response — professional stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
SIEM Platform
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsElastic Free self-hosted unlimited; Elastic Cloud from $109/mo (8GB) + $0.10/GB ingested. Panther Free 500GB/mo then $0.10/GB after. Splunk $150/GB/mo ($1800/GB/yr) min 100GB. Microsoft Sentinel $2.46/GB ingested, $0.10/GB retention 31-100GB, $0.05/GB >100GB
SOAR / Security Automation & Response
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSplunk SOAR Free 100 actions/day, Enterprise $15k/yr. Shuffle OSS free self-hosted, Cloud 1000 executions free then $0.04/exec, Pro $600/mo. XSOAR $50k/yr starter, Enterprise $120k/yr. Swimlane $40k/yr
SOC Case Management / Ticketing
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsTheHive Free OSS self-hosted unlimited cases. Jira $10/mo up to 10 users, Premium $54/user/mo. ServiceNow SIR $50k/yr min, ~$120/user/mo
Threat Detection EDR/XDR Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh+Osquery Free OSS. SentinelOne $60/device/mo Complete ($35 Core). CrowdStrike Falcon Insight $99/device/mo XDR, Falcon Complete MDR $149/device/mo. Defender for Endpoint P2 $5.20/user/mo
Endpoint Forensics Toolkit
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVolatility/Rekall Free OSS. Magnet AXIOM $2,500/yr/user. FTK $4,000/yr/license + $1,200/yr maintenance. EnCase Forensic $3,594/yr
Log Ingestion & Collection Pipeline
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsFluentd/Vector Free OSS unlimited. Cribl Free up to 1TB/day ingest, Cloud free 10TB/mo. Enterprise $25k/yr starter (2TB/day). Logstash free. AWS Kinesis $0.015/shard/hr + $0.028 per GB ingested
Log Management / Long-term Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsGraylog Open Free up to 5GB/day self-hosted. Datadog Security $0.10/GB ingested + $1.70/1M security events, retention 30d incl. Sumo Logic Free 1GB/day, Pro $1.50/GB/mo + Flex credits $0.30/1000 logs. Splunk Cloud $150/GB/mo
Security Orchestration Runbooks Hosting
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsStackStorm/n8n OSS Free self-hosted unlimited workflows. n8n Cloud Free 5k exec/mo, Starter $24/mo 2.5k workflows, Pro $50/mo. AWS Lambda Free 1M req/mo then $0.20/1M + compute. Tines Free 100 actions/day, Business $5k/mo
PagerDuty / On-Call & Alerting Infrastructure
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsGrafana OnCall Free OSS self-hosted. Opsgenie Free 5 users, Standard $29/user/mo, Enterprise $45/user/mo. PagerDuty Free 5 users, Professional $29/user/mo, Business $41/user/mo, Enterprise custom ($99+/user/mo). Incident management platform included
Secrets Management for SOC Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted. AWS Secrets Manager $0.40/secret/mo + $0.05/10k API calls. Infisical Cloud Free 100 secrets, Pro $29/mo. Vault Enterprise $1.20/hr ($860/mo) + support $15k/yr, Cloud Dedicated from $1.58/hr
Threat Intelligence Platform (TIP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP Free OSS unlimited. OpenCTI Community Free self-hosted, Cloud $1,800/mo. AlienVault OTX Free 100k indicators/day. Anomali Enterprise $60k/yr starter, ThreatConnect $50k/yr min. OTX + MISP feeds free
Network Detection & Response (NDR)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsZeek/Suricata Free OSS unlimited. Corelight Cloud from $3k/mo sensor. Darktrace $40k/yr starter 100 IPs, Enterprise $120k+/yr. ExtraHop $50k/yr min. Vectra AI $60k/yr
Incident Response Collaboration Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMattermost Free OSS unlimited users self-hosted. Rocket.Chat Community Free unlimited. Slack Free 90d history, Pro $8.75/user/mo, Business+ $12.50/user/mo, Enterprise Grid $25/user/mo
Digital Forensics Workstation / Sandboxing Lab
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSIFT/REMnux/FLARE VM Free OSS. Any.run Community Free 5 tasks/day unlimited, Pro $60/mo, Enterprise $299/mo. Joe Sandbox Community Free 100 analyses/mo, Cloud Pro $600/mo
Vulnerability Management Platform
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free OSS unlimited IPs. Nessus Essentials Free 16 IPs. Tenable.io $3,600/yr 128 assets (~$28/asset/yr), Qualys $1,995/yr 256 IPs. Rapid7 InsightVM $25/asset/yr
Compliance & Audit Logging (WORM / Immutable)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsimmudb Free OSS 5GB. AWS S3 Object Lock Free (S3 costs $0.023/GB/mo + API), CloudTrail $2.00/100k management events free first copy. Veeam Immutable Backup $36/workload/yr. Glacier Vault Lock $0.004/GB/mo
Security Data Lake / SIEM Backend Storage
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsElasticsearch+MinIO Free OSS self-hosted. AWS S3 $0.023/GB/mo, Athena $5/TB scanned, Security Lake Free ingest. Snowflake Standard $2/credit (~$2-4/hr compute), storage $23/TB/mo. Panther Data Lake in S3 cost-covered
Identity Threat Detection & Response (ITDR)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWazuh+Keycloak Free OSS. Microsoft Defender for Identity $5.20/user/mo bundled in M365 A5/E5, standalone $5/mo. CrowdStrike Identity $25/device/mo. CyberArk $80/user/yr min. Okta Workforce Identity $2/user/mo + Advanced $4/user/mo
Threat Hunting Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVelociraptor/Sigma Free OSS unlimited hunting. Censys Free 250 queries/mo, Team $1,500/mo. Elastic Security Hunting Free tier. CrowdStrike Falcon OverWatch $35/device/mo add-on, Managed Hunting $75k/yr min
Malware Analysis Sandbox (Detonation)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCuckoo/Capev2 Free OSS. Any.run Pro $60/mo 100 tasks/mo, Team $299/mo. Joe Sandbox Cloud Basic $300/mo 350 analyses, Unlimited $1,200/mo. VMRay $50k/yr. Hybrid Analysis Free 100/day
Security Automation Infrastructure (Workers/Functions)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTemporal OSS Free self-hosted. AWS Lambda Free 1M req/mo then $0.20/1M + $0.00001667/GB-s, Step Functions $0.025/1k state transitions. Temporal Cloud Free 10k actions/mo then $0.20/1k actions, Pro $500/mo min
Evidence Collection & Chain-of-Custody Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsVelociraptor/GRR Free OSS. S3 Standard $0.023/GB/mo, Glacier Instant $0.004/GB/mo + $0.03/1k requests, Glacier Deep Archive $0.00099/GB/mo, Vault Lock compliance free. FTK Central Case Storage $4k/yr
Packet Capture & Traffic Analysis Infra
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsArkime/Moloch Free OSS unlimited PCAP. CloudShark Free Community 2GB, Pro $199/mo 100GB. ntopng Community Free, Enterprise $3,999/yr. NetWitness $75k/yr appliance + storage. Core hardware: 10TB NVMe ~$1,200 one-time
Security Metrics & SOC Dashboarding
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsGrafana OSS Free unlimited dashboards. Datadog Free dashboards included with log ingest $0.10/GB. Grafana Cloud Free 10k metrics/50GB logs, Pro $8/user/mo, Enterprise $15k/yr. Splunk Dashboard included in $150/GB/mo
Deception Technology Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenCanary/Canarytokens Free OSS unlimited tokens. Thinkst Canary Free 10 canarytokens, Canary device $3,500/yr (5 pack), Enterprise $15k/yr 50 canaries. Attivo (SentinelOne) $30k/yr
Threat Intel Feed Aggregation (Commercial Feeds)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOTX/Abuse.ch/Feodo Free 100k IOCs/day. Shodan API Free 100 queries/mo, Membership $49 one-time + $59/mo developer. Censys Free 250/mo. Recorded Future $120k/yr min, CrowdStrike Intel $60k/yr add-on. Anomali feeds $36k/yr
Incident Containment Orchestration (Isolation/Quarantine)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh Active Response Free OSS. Microsoft Defender for Endpoint auto-isolation included in P2 $5.20/user/mo. CrowdStrike Falcon containment included in $99/device/mo Insight. XSOAR containment playbooks $50k/yr + integration $5k
Backup & Recovery Orchestration for IR
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsRestic/Velero Free OSS. AWS Backup Free tier: $0.05/GB-mo backup storage + $0.02/10k restore. Veeam Community Free 10 workloads, Veeam Universal $18/workload/mo ($36 immutable), Enterprise $1,200/socket/yr. Rubrik $40k/yr min + storage $0.05/GB
Security Training / Tabletop Exercise Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAtomic Red Team + Caldera Free OSS. TryHackMe $18/user/mo Business, HackTheBox $30/user/mo. RangeForce $500/user/yr, Immersive Labs $650/user/yr, AttackIQ $75k/yr min platform
Privileged Access Monitoring for IR
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsTeleport Community Free self-hosted 15 nodes. Teleport Cloud Free 15 nodes + $10/node after, Team $18/node/mo, Enterprise $36/node/mo. CyberArk $120/user/yr min $45k/yr. AWS Session Manager free (EC2/S3 costs)
How this professional security operations and incident response checklist works.
Each requirement below is something a professional security operations and incident response build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.