MacSouverain

Build Your Sovereign SIEM

Build your own SIEM on a European VPS, from a hardened base to alerts that actually ring, without a single byte on a US cloud.

Complete series · 7 episodes

Build your sovereign SIEM for SMEs, compliant with GDPR/NIS2 without CLOUD Act

Prologue Tutorial MS Pro

Build your sovereign SIEM for SMEs, compliant with GDPR/NIS2 without CLOUD Act

You're already forced by GDPR to detect a breach within 72 hours. NIS2 just widened the net by 30x. Build your SIEM now, it's security today and compliance amortised before it lands on you.

Your sovereign SIEM's foundation, a hardened VPS outside the CLOUD Act

Episode 1 Tutorial MS Pro

Your sovereign SIEM's foundation, a hardened VPS outside the CLOUD Act

A European VPS, Cloud Act-proof, hardened SSH, reduced attack surface via Tailscale, off-site encrypted backups.

Wazuh all-in-one, your homegrown Splunk for the price of a VPS

Episode 2 Tutorial MS Pro

Wazuh all-in-one, your homegrown Splunk for the price of a VPS

Install Wazuh (manager, indexer, dashboard) on a single node, harden passwords and dashboard in Tailnet-only, adjust JVM heap, initial dashboards without agents.

Deploy Wazuh everywhere, your SIEM finally sees your network

Episode 3 Tutorial MS Pro

Deploy Wazuh everywhere, your SIEM finally sees your network

Enroll Wazuh agents on your Linux servers, Macs, and Windows workstations, with log upload via Tailnet, never through the open internet.

CrowdSec up front, blocking before they hit you

Episode 4 Tutorial MS Pro

CrowdSec up front, blocking before they hit you

Install CrowdSec on your hardened VPS, block malicious IPs upstream with the bouncer firewall, and feed its decisions into Wazuh.

Rspamd in front of your inbox, phishing stops at the doormat

Episode 5 Tutorial MS Pro

Rspamd in front of your inbox, phishing stops at the doormat

Install Rspamd in front of your mail server, tune the anti-spam and anti-phishing scoring, and feed every verdict into your Wazuh SIEM.

Santa on your Macs, the uninvited binary stays at the door

Episode 6 Tutorial MS Pro

Santa on your Macs, the uninvited binary stays at the door

Install Santa on your Macs, map the fleet in Monitor mode, switch to Lockdown, write your allowlist by TeamID, and feed every block into Wazuh.

Alerting and total cost, the final tally of your sovereign SIEM

Episode 7 Tutorial MS Pro

Alerting and total cost, the final tally of your sovereign SIEM

Wire up Wazuh alerting without drowning in noise, then the honest bottom line on your sovereign stack against a SaaS bill six to thirty times heavier.