Three Free Security Stacks, One $99 Mini PC, and a Fake Ransomware Drill
A $99 refurbished mini PC is not a security operations center. That was the point. We wanted to see which free stack a two-person IT shop could actually run on cheap hardware without hiring a SOC analyst. We built an isolated lab, simulated ransomware-like file activity and lateral movement, and gave each stack a fair shot. No real malware, no production data, and no dramatic movie hacking. Just scripts, logs, and a lot of coffee.
The Lab Setup
Hardware: a refurbished HP EliteDesk 800 G2 with an i5-6500T, 8GB RAM, and a 256GB SSD. We paid $99 on a local surplus listing. For each run we wiped the mini PC and installed the stack plus a lightweight Ubuntu endpoint. The lab sat on an isolated VLAN with no route to the internet except a controlled update mirror. We measured idle RAM and CPU after 30 minutes, setup time from first command to first useful alert, and alert volume over 24 hours. Then we ran the same drill against each stack.
How We Simulated the Bad Guys
Safe scripts only. Phase one: file encryption simulation. A Python script copied 2,000 test documents into a temp directory, appended .locked to the copies, dropped a ransom-note text file, and deleted shadow-copy-like snapshots in a fake directory. No real user files. Phase two: lateral movement. We used SSH with a known test account and a fake credential spray against a second lab VM, plus SMB enumeration with a test share. Phase three: persistence-ish behavior, a cron entry and a new local user. All isolated, all reversible. The goal was behavior, not malware.
Wazuh: The Heavyweight
Setup time: 2 hours 10 minutes for all-in-one. Idle RAM: 3.8GB. Idle CPU: 8-12% on the i5. It caught the file encryption script via FIM and Syscheck, flagged the new user, and generated a high-severity alert for the cron change. It also caught the SSH spray after we added auth.log rules. Detection quality was strong. Noise was the problem: 312 alerts in 24 hours, most of them low-level FIM changes from package updates and our own test scripts. Without tuning, the dashboard becomes wallpaper. Tuning took another 3 hours. Response workflow is good if you like dashboards and already know Wazuh. For a small shop, it is the closest thing to a real SIEM, but it wants RAM and attention.
Velociraptor: The Forensic Scalpel
Setup time: 1 hour 25 minutes. Idle RAM: 420MB. Idle CPU: 3%. Velociraptor did not scream at us. It collected. We used a simple artifact to hunt for .locked files, recent cron changes, and new users. It found the file encryption artifacts and the cron entry, but it did not block anything. That is not its job. The power is in the queries: once we knew what to ask, we could pull a timeline in minutes. The catch is that you need to know what to ask. Alert volume was low because we had to build the hunts. For a shop without a SOC, Velociraptor is a great incident-response tool and a poor 3 a.m. alarm. Setup was easy; operationalizing it was the weekend.
CrowdSec: The Community Bouncer
Setup time: 35 minutes. Idle RAM: 95MB. Idle CPU: 1-2%. CrowdSec shined on the SSH spray. The Linux collection and firewall bouncer banned the test source after a handful of failures, and the community blocklist added context. It did not catch the file encryption script or the cron persistence. That is expected: CrowdSec is behavior and reputation at the network edge, not endpoint forensics. Alert volume was 18 in 24 hours, mostly SSH and web probes. For a small shop with exposed services, it is the lowest-effort win. For ransomware-like file activity, it is a complement, not a replacement.
| Stack | Setup time | Idle RAM | Alerts in 24h | Caught file sim | Caught SSH spray | Small-shop verdict |
|---|---|---|---|---|---|---|
| Wazuh | 2h 10m | 3.8GB | 312 | Yes | Yes, after rule tuning | Strong SIEM, needs care and feeding |
| Velociraptor | 1h 25m | 420MB | 6 | Yes, via hunt | Yes, via hunt | Great IR, not an alarm |
| CrowdSec | 35m | 95MB | 18 | No | Yes | Best quick network win |
Alert Fatigue and the CPU Bill
All three are free to download. None are free to run. Wazuh consumed nearly half the mini PC's RAM before we added a browser. CrowdSec was nearly invisible. Velociraptor sat in the middle. The real cost was not CPU. It was the human cost of deciding what matters. Wazuh's 312 alerts are not a failure; they are a tuning backlog. Velociraptor's 6 alerts are not a win; they are the result of us writing the hunts. CrowdSec's 18 alerts were the easiest to act on because the action was automatic.
What a Small Shop Should Actually Deploy
If you have one tinkerer and a handful of servers, start with CrowdSec on anything exposed to the internet. Add Velociraptor for incident response and keep a few saved hunts ready. Add Wazuh only if you can give it 4GB of RAM and a weekly tuning hour. The combination is not free in time. It is free in license fees. That distinction matters when you are the entire SOC.
The Weekend Tax
We spent 14 hours across setup, tuning, and writing hunts. That is not a product review number; that is a weekend. The best stack for a small IT shop is the one you will actually check on a Monday. For us, CrowdSec plus Velociraptor covered the most ground for the least ongoing attention. Wazuh was the most capable and the most likely to become noise. None of them replace a patch schedule, backups, and a tested restore. A fake ransomware drill is a good start. A real one is not.
