Detection on a Budget: Building Useful Visibility With Open-Source Tools

A recurring myth among smaller Canadian organizations is that meaningful detection requires an expensive commercial platform and a large team. It does not. The 2025 intrusions we responded to were rarely missed because the victim lacked a premium tool. They were missed because no one was collecting the right logs, or no one was looking. Good detection starts with visibility and discipline, not budget.

Start With the Logs That Matter

Before buying anything, make sure you are capturing high-value telemetry: authentication events, especially failures and new-device logins; endpoint process creation and command lines; cloud and SaaS admin activity; and edge-device and firewall logs. Most environments already generate this data and simply throw it away. Centralizing it with adequate retention is the single highest-value step.

A Practical Open-Source Stack

• Endpoint telemetry from built-in tooling such as detailed Windows logging and Sysmon on critical hosts.
• Centralized collection using an open-source log pipeline and search backend.
• Sigma rules as a vendor-neutral way to write and share detections that map to real attacker techniques.
• The MITRE ATTACK framework to prioritize which behaviors to detect first.

Discipline Over Tooling

The hard part is not the software; it is the ongoing work of tuning detections, triaging alerts, and closing the loop when something fires. A modest open-source stack that someone actually watches will outperform an expensive platform that nobody tunes. Start small, prove value on a handful of high-fidelity detections mapped to ATTACK, and expand from there.

Takeaway

Effective detection is about collecting the right logs, retaining them, and having someone review what fires, not about spending the most money. Centralize authentication, endpoint, cloud, and edge logs; write detections with Sigma mapped to MITRE ATTACK; and start with a few high-fidelity alerts you will actually tune.