Intrusion detection and security monitoring

I want to pick an open-source replacement for Splunk, CrowdStrike Falcon, SentinelOne (spotting attacks and suspicious activity on servers and computers). Below is a list from Open Source Everything (CC BY-SA 4.0), in the order its website shows it. The order is a starting point, not a verdict. - CrowdSec: CrowdSec is a security program that watches server logs and web traffic for attacks, then blocks the attacking internet addresses. It also shares blocked addresses with a community blocklist so other users are protected too. It is aimed at system administrators and IT teams who run servers or websites. [Advanced setup; Windows; replaces fully; MIT; https://github.com/crowdsecurity/crowdsec] - Suricata: Suricata is a program that watches network traffic and flags possible attacks or suspicious activity. It is aimed at security teams and IT staff who protect networks and servers. [Advanced setup; Linux; replaces partly; GPL-2.0; https://github.com/OISF/suricata] - Velociraptor: Velociraptor is a tool that collects detailed information from computers and servers to help investigators see what is happening on them. It is aimed at security staff, incident responders and IT administrators. [Advanced setup; Windows · Mac · Linux; replaces partly; AGPL-3.0-only; https://github.com/Velocidex/velociraptor] Setup rating: "Easy setup" means you can install it like a normal app, use it in a browser. "Advanced setup" means you must run it on your own server or use the command line, or it is a tool for developers. Full details: https://opensourceeverything.org/data/groups/security-monitoring.json Before recommending anything, ask me these three questions (one at a time, in plain words): 1) Which device or devices will I use it on (Windows, Mac, Linux, Android, iPhone)? 2) How comfortable am I with technical setup: only installing apps from a store, happy to follow a step-by-step guide, or comfortable with servers and the command line? 3) What is my budget: free only, or willing to pay for hosting or support? Then recommend one to three projects from this list only, and for each say why, using how fully it replaces the app, its setup rating, and the devices it runs on. If nothing on the list fits me, say so plainly instead of stretching.

Read the list of open-source projects at https://opensourceeverything.org/data/groups/security-monitoring.json. Compare it with my project or idea below. Tell me which projects overlap, what I could reuse instead of rewriting, and what mine does that none of them do. My project or idea: