I'd like to utilise some of the free SIEM type products out there to increase the chances that I will detect attacks and compromises of any of the devices on my home network. Most of my home devices run Linux. I'm only interested in solutions that are possible without a large investment of effort (not more than ~5 hours setup time, say, and minimal manual feeding and watering).
I have the usual home network assets I'd like to protect: integrity and availability of compute resources including bandwidth (it would be good to notice I was part of a botnet); confidentiality of online account credentials; availability of stored media, etc.
Some research on this site and Google has suggested that Snort + Snorby might be an option; I also have some experience of using Splunk which is free for up to 500mb of logs per day and can be teamed up with any number of other products (I'm a bit of a Splunk fan, though I haven't used it for security purposes).
Is this viable, or are all SIEM tools designed to be ran by full time security operations professionals? If it is viable, what can I configure Snort+Snorby to detect / what apps or publicly available configs and searches should I use with Splunk?
Which of these two options is most likely to meet my goals of low setup and maintenance effort whilst still actually being useful?
I'm particularly interested in experiences from anyone* who has such a setup, but opinions based on professional experience using these tools are also more than welcome.
*if you have a setup running at home and you're also a secops person doing this for a living, please mention this fact :)