Security Operations And Incident Response — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
SIEM Platform
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsElastic Free self-hosted unlimited; Elastic Cloud from $109/mo (8GB) + $0.10/GB ingested. Panther Free 500GB/mo then $0.10/GB after. Splunk $150/GB/mo ($1800/GB/yr) min 100GB. Microsoft Sentinel $2.46/GB ingested, $0.10/GB retention 31-100GB, $0.05/GB >100GB
SOAR / Security Automation & Response
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSplunk SOAR Free 100 actions/day, Enterprise $15k/yr. Shuffle OSS free self-hosted, Cloud 1000 executions free then $0.04/exec, Pro $600/mo. XSOAR $50k/yr starter, Enterprise $120k/yr. Swimlane $40k/yr
SOC Case Management / Ticketing
Understands your users and supports them. Drives product decisions and retention.Pricing & free-tier limitsTheHive Free OSS self-hosted unlimited cases. Jira $10/mo up to 10 users, Premium $54/user/mo. ServiceNow SIR $50k/yr min, ~$120/user/mo
Threat Detection EDR/XDR Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWazuh+Osquery Free OSS. SentinelOne $60/device/mo Complete ($35 Core). CrowdStrike Falcon Insight $99/device/mo XDR, Falcon Complete MDR $149/device/mo. Defender for Endpoint P2 $5.20/user/mo
Endpoint Forensics Toolkit
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVolatility/Rekall Free OSS. Magnet AXIOM $2,500/yr/user. FTK $4,000/yr/license + $1,200/yr maintenance. EnCase Forensic $3,594/yr
Log Ingestion & Collection Pipeline
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsFluentd/Vector Free OSS unlimited. Cribl Free up to 1TB/day ingest, Cloud free 10TB/mo. Enterprise $25k/yr starter (2TB/day). Logstash free. AWS Kinesis $0.015/shard/hr + $0.028 per GB ingested
Log Management / Long-term Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsGraylog Open Free up to 5GB/day self-hosted. Datadog Security $0.10/GB ingested + $1.70/1M security events, retention 30d incl. Sumo Logic Free 1GB/day, Pro $1.50/GB/mo + Flex credits $0.30/1000 logs. Splunk Cloud $150/GB/mo
Security Orchestration Runbooks Hosting
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsStackStorm/n8n OSS Free self-hosted unlimited workflows. n8n Cloud Free 5k exec/mo, Starter $24/mo 2.5k workflows, Pro $50/mo. AWS Lambda Free 1M req/mo then $0.20/1M + compute. Tines Free 100 actions/day, Business $5k/mo
PagerDuty / On-Call & Alerting Infrastructure
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsGrafana OnCall Free OSS self-hosted. Opsgenie Free 5 users, Standard $29/user/mo, Enterprise $45/user/mo. PagerDuty Free 5 users, Professional $29/user/mo, Business $41/user/mo, Enterprise custom ($99+/user/mo). Incident management platform included
Secrets Management for SOC Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free self-hosted. AWS Secrets Manager $0.40/secret/mo + $0.05/10k API calls. Infisical Cloud Free 100 secrets, Pro $29/mo. Vault Enterprise $1.20/hr ($860/mo) + support $15k/yr, Cloud Dedicated from $1.58/hr
Threat Intelligence Platform (TIP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP Free OSS unlimited. OpenCTI Community Free self-hosted, Cloud $1,800/mo. AlienVault OTX Free 100k indicators/day. Anomali Enterprise $60k/yr starter, ThreatConnect $50k/yr min. OTX + MISP feeds free
Network Detection & Response (NDR)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsZeek/Suricata Free OSS unlimited. Corelight Cloud from $3k/mo sensor. Darktrace $40k/yr starter 100 IPs, Enterprise $120k+/yr. ExtraHop $50k/yr min. Vectra AI $60k/yr
Incident Response Collaboration Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMattermost Free OSS unlimited users self-hosted. Rocket.Chat Community Free unlimited. Slack Free 90d history, Pro $8.75/user/mo, Business+ $12.50/user/mo, Enterprise Grid $25/user/mo
Digital Forensics Workstation / Sandboxing Lab
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSIFT/REMnux/FLARE VM Free OSS. Any.run Community Free 5 tasks/day unlimited, Pro $60/mo, Enterprise $299/mo. Joe Sandbox Community Free 100 analyses/mo, Cloud Pro $600/mo
Vulnerability Management Platform
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Free OSS unlimited IPs. Nessus Essentials Free 16 IPs. Tenable.io $3,600/yr 128 assets (~$28/asset/yr), Qualys $1,995/yr 256 IPs. Rapid7 InsightVM $25/asset/yr
Compliance & Audit Logging (WORM / Immutable)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsimmudb Free OSS 5GB. AWS S3 Object Lock Free (S3 costs $0.023/GB/mo + API), CloudTrail $2.00/100k management events free first copy. Veeam Immutable Backup $36/workload/yr. Glacier Vault Lock $0.004/GB/mo
Security Data Lake / SIEM Backend Storage
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsElasticsearch+MinIO Free OSS self-hosted. AWS S3 $0.023/GB/mo, Athena $5/TB scanned, Security Lake Free ingest. Snowflake Standard $2/credit (~$2-4/hr compute), storage $23/TB/mo. Panther Data Lake in S3 cost-covered
Identity Threat Detection & Response (ITDR)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWazuh+Keycloak Free OSS. Microsoft Defender for Identity $5.20/user/mo bundled in M365 A5/E5, standalone $5/mo. CrowdStrike Identity $25/device/mo. CyberArk $80/user/yr min. Okta Workforce Identity $2/user/mo + Advanced $4/user/mo
Threat Hunting Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVelociraptor/Sigma Free OSS unlimited hunting. Censys Free 250 queries/mo, Team $1,500/mo. Elastic Security Hunting Free tier. CrowdStrike Falcon OverWatch $35/device/mo add-on, Managed Hunting $75k/yr min
How this small scale security operations and incident response checklist works.
Each requirement below is something a small scale security operations and incident response build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.