How to Set Up SIEM for Your Small Business on AWS

Why Small Businesses Need SIEM on AWS

If you're running your business infrastructure on AWS, you're already generating security logs from dozens of sources: EC2 instances, S3 buckets, CloudTrail, VPC Flow Logs, and more. Without a centralized system to collect and analyze these logs, you're essentially flying blind when it comes to security threats.

Security Information and Event Management (SIEM) sounds like enterprise-level complexity, but small businesses actually need it more than anyone. You don't have a 24/7 security operations center, which means you need automated tools to watch for problems while you focus on running your business.

The good news? Setting up SIEM on AWS doesn't require a massive budget or a dedicated security team. This guide walks you through a practical approach that works for small businesses.

Choosing Your SIEM Solution

For small businesses on AWS, you have three realistic options:

AWS Security Hub is the simplest starting point. It's native to AWS, aggregates findings from various AWS services, and costs about $0.0010 per 10,000 finding ingestion events. For most small businesses, this means $20-50 per month.

Amazon OpenSearch Service (formerly Elasticsearch) gives you more flexibility and powerful search capabilities. You can ingest logs from anywhere and create custom dashboards. Expect to spend $100-300 monthly for a small deployment.

CloudWatch Logs Insights is AWS's built-in log analysis tool. While not a full SIEM, it's included with CloudWatch and works well if you're just starting out and want to keep costs minimal.

For this guide, we'll focus on AWS Security Hub combined with CloudWatch, which gives you the best balance of functionality and cost for a small business.

Step 1: Enable AWS CloudTrail

CloudTrail records every API call made in your AWS account. This is your audit trail and the foundation of your SIEM setup.

1. Open the CloudTrail console
2. Click "Create trail"
3. Give it a name like "company-security-trail"
4. Choose "Create new S3 bucket" to store your logs
5. Enable log file validation (this prevents tampering)
6. Turn on CloudWatch Logs integration
7. Apply the trail to all regions

This creates a permanent record of who did what in your AWS account. The S3 storage costs are minimal—usually a few dollars per month.

Step 2: Configure VPC Flow Logs

VPC Flow Logs capture information about network traffic going to and from your resources.

1. Go to the VPC console
2. Select your VPC
3. Click "Actions" → "Create flow log"
4. Choose "All" for traffic type
5. Set the destination to CloudWatch Logs
6. Create a new IAM role when prompted

Repeat this for each VPC you're using. Flow logs help you spot unusual network patterns, like someone trying to scan your infrastructure or data exfiltration attempts.

Step 3: Enable AWS Security Hub

Security Hub is your central dashboard that pulls everything together.

1. Navigate to AWS Security Hub
2. Click "Go to Security Hub"
3. Choose the security standards you want to enable (start with AWS Foundational Security Best Practices)
4. Enable integrations with services you're using: GuardDuty, Inspector, IAM Access Analyzer
5. Set up your region aggregation if you use multiple regions

Security Hub automatically starts collecting findings from your enabled services. Give it a few hours to populate data.

Step 4: Set Up Amazon GuardDuty

GuardDuty is AWS's threat detection service that uses machine learning to identify suspicious activity.

1. Open the GuardDuty console
2. Click "Get Started"
3. Enable GuardDuty (30-day free trial, then typically $5-20/month for small businesses)
4. Configure trusted IP lists if you have static office IPs
5. Set up threat lists if you have known malicious IPs to block

GuardDuty automatically analyzes CloudTrail logs, VPC Flow Logs, and DNS logs. It sends findings to Security Hub automatically.

Step 5: Create CloudWatch Alarms

Now that data is flowing, you need alerts for critical events.

Create metric filters in CloudWatch Logs for events like:

• Root account usage
• Failed login attempts (more than 5 in 5 minutes)
• Changes to security groups
• S3 bucket policy changes
• IAM policy modifications

For each filter:

1. Go to CloudWatch → Logs → Log groups
2. Select your CloudTrail log group
3. Click "Create metric filter"
4. Define your filter pattern
5. Create an alarm based on the metric
6. Set up SNS notifications to email or Slack

This ensures you get notified immediately when something important happens, rather than discovering it weeks later.

Step 6: Build Your Response Playbook

A SIEM is only useful if you know what to do when it alerts you. Create a simple document that covers:

• Who gets notified for different alert types
• Initial response steps (don't panic and delete everything)
• How to investigate using Security Hub and CloudWatch
• When to escalate or get outside help
• How to document incidents

Keep this playbook accessible to your team. Review and update it quarterly.

Ongoing Maintenance

Your SIEM isn't set-it-and-forget-it. Schedule these regular tasks:

Weekly: Review Security Hub findings and dismiss false positives

Monthly: Check your CloudWatch costs and adjust retention periods if needed (30 days is usually sufficient for small businesses)

Quarterly: Review and update your alert rules based on what's actually useful versus noisy

Most small businesses spend 2-4 hours monthly on SIEM maintenance once everything is configured.

Cost Management Tips

Keep your SIEM costs reasonable:

• Set CloudWatch Logs retention to 30 days instead of indefinite
• Use S3 Intelligent-Tiering for long-term CloudTrail storage
• Archive old logs to S3 Glacier after 90 days
• Disable verbose logging for non-critical resources
• Review your Security Hub findings regularly to avoid accumulating charges

A typical small business running 10-20 AWS resources should expect $50-150 monthly for a complete SIEM setup.

When to Get Help

Setting up SIEM is manageable for most technical small business owners, but you might need assistance if:

• You're dealing with compliance requirements (HIPAA, PCI-DSS, SOC 2)
• You have complex multi-account AWS organizations
• You need custom integrations with non-AWS tools
• You want someone to monitor and respond to alerts for you

Our team at O-Cyrus helps small businesses implement and manage security solutions and cloud infrastructure without the enterprise price tag.

Ready to Secure Your AWS Environment?

Setting up SIEM on AWS doesn't have to be overwhelming. Start with the basics—CloudTrail, Security Hub, and GuardDuty—and expand from there as your needs grow.

Need help getting started or want someone to review your current setup? Get in touch with our team and we'll help you build a security monitoring system that actually works for your business.

FAQ

How long does it take to set up SIEM on AWS for a small business?

The basic setup described in this guide takes 2-4 hours if you're comfortable with AWS. Plan an additional 2-3 hours for fine-tuning alerts and creating your response playbook. Most of the work is one-time configuration.

What's the minimum AWS setup that needs SIEM monitoring?

If you're running any production workloads on AWS—even just a single web application—you should have basic SIEM in place. At minimum, enable CloudTrail and Security Hub. These two services alone will catch most common security issues.

Can I use open-source SIEM tools instead of AWS services?

Yes, tools like Wazuh or Elastic Security work on AWS, but they require you to manage additional infrastructure (servers, updates, scaling). For small businesses, AWS-native tools are usually more cost-effective because you're not paying for the infrastructure to run the SIEM itself.