Lab: a home SIEM with Wazuh

Aim and what you need

The aim is to build a working SIEM (security information and event management) system and see events flow from endpoints to alerts. Wazuh bundles a manager (rules and agents), an indexer (search database) and a dashboard (web interface).

• A server VM with Ubuntu Server 24.04, at least 4 vCPUs, 8 GB RAM and 50 GB disk for an all-in-one install. Example address 192.168.56.10.
• One Ubuntu VM (192.168.56.20) and, if you can, one Windows 10/11 VM (192.168.56.40) on the same isolated lab network.
• Internet access from the lab during install, through your lab firewall. About 90 minutes.

Steps

1. Take a snapshot of the clean server VM, then run the assisted all-in-one installer. At the end it prints the admin password; store it in your password manager.
2. Browse to https://192.168.56.10 and accept the self-signed certificate warning for this lab only.
3. On the Ubuntu VM, add the Wazuh repository and install the agent, pointing it at the manager.
4. On Windows, open Agents, Deploy new agent in the dashboard. It builds a PowerShell command for you with the manager address; run it as administrator, then start the service.
5. Add a folder to file integrity monitoring on the Ubuntu agent and restart the agent.

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
sudo chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt update
sudo WAZUH_MANAGER="192.168.56.10" apt install -y wazuh-agent
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

sudo nano /var/ossec/etc/ossec.conf
  <syscheck>
    <directories realtime="yes">/opt/labdata</directories>
  </syscheck>
sudo mkdir -p /opt/labdata
sudo systemctl restart wazuh-agent

NET START WazuhSvc

How to verify

In the dashboard, both agents should show as Active. Now create events you can predict. From another VM, try SSH to the Ubuntu agent with a wrong password a few times; within a minute you should see authentication-failure alerts naming the source IP and user, and repeated failures should raise a higher-level brute-force alert. Create and then edit a file in /opt/labdata; file integrity alerts should show it was added and modified, with old and new checksums. On Windows, a few wrong passwords at the lock screen produce logon-failure alerts from the Security event log. Open one alert and read its rule description, level and MITRE ATT&CK technique: being able to explain an alert is the real skill.

Troubleshooting and clean-up

• Installer stops early: usually too little RAM or disk. Check the requirements and the log in /var/log/wazuh-install.log.
• Agent never connects: the agent talks to the manager on TCP 1514 and enrols on TCP 1515. Check the lab firewall and /var/ossec/logs/ossec.log on the agent.
• Dashboard slow or blank: the indexer needs memory. Give the VM more RAM or close other VMs.
• Too many alerts: that is normal. Tuning noisy rules is a lab in itself and a great talking point in interviews.

To pause the lab, shut the VMs down cleanly; the indexer dislikes hard power-offs. To remove it, delete the VMs or revert to the snapshot. Do not expose the dashboard to the internet. Write up two alerts you triaged, with screenshots, for your home SOC project.