When you hear "SOC" (Security Operations Center), many SME owners imagine a room with large screens, a 24/7 security team, and a budget of hundreds of thousands of dollars. In reality, a SOC for small and medium businesses can be very different — lighter, smarter, and most importantly, budget-friendly.
This article guides you through building an SOC with open-source tools, based on agentic AI's real deployment experience.
Why SMEs Need a SOC
43% of cyber attacks target small businesses, and 60% of those go out of business within 6 months of an attack. A SOC helps you:
- Early detection — vulnerabilities found in minutes, not days
- Timely response — real-time alerts, minimize damage
- Compliance — meet security requirements from customers and partners
- Cost savings — average breach costs $20,000-$100,000 for SMEs
SOC Architecture for SMEs
1. SIEM + XDR — Wazuh (free)
Open-source SIEM and XDR platform: log collection, intrusion detection, vulnerability scanning, FIM, compliance monitoring. Docker-based, web dashboard.
Cost: $0 (software) | Resources: 4 vCPU, 8GB RAM for 10-20 agents
2. Metrics Monitoring — Zabbix (free)
Infrastructure monitoring: CPU, RAM, disk, network, services. Visual dashboards, smart thresholds, easy Telegram integration via webhook.
Cost: $0 | Resources: 2 vCPU, 4GB RAM for 20-30 hosts
3. Alerting — Telegram Bot (free)
Ideal alerting channel for SMEs: free, real-time, multi-platform. Connect Wazuh and Zabbix to Telegram via n8n workflows or direct webhooks.
4. Workflow Automation — n8n (free)
Connect systems: receive Wazuh alerts, query OpenSearch, format messages, send Telegram. Automate daily reports without coding.
Deployment Timeline
Weeks 1-2: Infrastructure Setup
Deploy Docker host, install Wazuh stack (indexer + server + dashboard), Zabbix server. Configure network, firewall, backup.
Weeks 3-4: Agent Installation
Install Wazuh agents and Zabbix agents on all servers. Configure groups, rules, alert thresholds. Verify data collection.
Week 5: Alert Integration
Deploy n8n, create Wazuh → Telegram workflow, configure daily report. Test and fine-tune alert thresholds.
Week 6: Operations & Optimization
Run in production, monitor alerts, fine-tune rules, train operations team. Establish incident response procedures.
Real Case Study
agentic AI deployed a SOC for an IT enterprise with many servers. Results: many High + Critical vulnerabilities detected, incident detection within 5 minutes, monitoring 14 hosts via Zabbix, many vulnerability records in OpenSearch. Total software cost: $0.
agentic AI (aAI) — Artificial Intelligence for Your Business
Contact: contact@agentic-ai.vn | +84 901 333 237