What open-source tools do you use for security monitoring?

As a free SIEM, I use Wazuh, but with my own little custom modifications, because the out-of-the-box version does not fit all of my use cases. I have also tried Security Onion and the free version of ELK.

For Windows systems, I collect basic logs and Sysmon events.

For Linux systems, I use Falco, which also covers containers. I also tried Tetragon, but decided to move forward with Sysmon for Linux, since Tetragon required more time to properly configure and operationalize. Auditd is another option, but I have never really liked it for analyzing Linux system logs.

For network monitoring, I use Zeek and RITA. In practice, however, I do not use them very often, because production teams do not always have the capacity to process large volumes of traffic or maintain this type of setup.