Wazuh SIEM Home Lab
A single-node Security Information and Event Management (SIEM) lab built with Wazuh, Docker Compose, and Kali Linux. The lab collects endpoint telemetry, surfaces alerts, and supports alert-investigation practice in an isolated environment.
Training-lab experience, not paid SOC employment. All work was performed in an authorized, self-directed lab environment.
Draft / sample template. The investigation table below uses placeholder data only. Replace with real screenshots, logs, and a verified investigation before deploying this page publicly.
Overview and Goal
The goal of this lab was to understand how security events are collected, analyzed, and investigated in a SIEM. I deployed a single-node Wazuh stack (manager, indexer, dashboard) on Kali Linux using Docker Compose, then practiced endpoint onboarding, alert triage, and detection rule analysis.
This is a learning lab. No production systems were involved, and no real incidents were investigated.
Architecture
Data flow: endpoint activity is captured by the Wazuh agent, forwarded to the Wazuh manager, indexed, and surfaced in the Wazuh dashboard for investigation.
Endpoint VM → Wazuh Agent → Wazuh Manager → Indexer → Dashboard
Environment
- Host: Kali Linux
- Orchestration: Docker Compose (single-node)
- Components: Wazuh manager, indexer, dashboard
- Endpoint: lightweight VM with Wazuh agent (planned/verified as available)
Problems Solved
During setup, the following connectivity, certificate, and resource-allocation issues were encountered and worked through:
- Agent-to-manager connectivity and port exposure
- Certificate trust and TLS configuration between Wazuh components
- Docker Compose resource allocation (memory/CPU limits for indexer)
- [document exact fixes and commands applied for each issue]
Detection Scenarios
Detection scenarios reviewed in the lab (planned tests; results to be confirmed with evidence):
- Failed-login / brute-force telemetry from authentication logs
- Suspicious process execution review
- File Integrity Monitoring (FIM) on sensitive system binaries and configs
- Privilege and administrative activity monitoring
Worked Investigation Template (sample)
The following template structures each alert investigation. Values below are sample placeholders only — replace with real data before publishing.
| Field | Sample template value |
|---|---|
| Timestamp | [insert real alert timestamp] |
| Source | [endpoint / agent name] |
| Rule ID | [Wazuh rule identifier] |
| Evidence | [raw event / log excerpt] |
| Verdict | True / False positive [determine] |
| Recommended Action | [escalate / close / monitor] |
| MITRE ATT&CK (optional) | [technique ID, if mapped] |
MITRE ATT&CK mapping is included only as an optional field in this template and is not claimed as a site-wide skill.
Lessons Learned
- SIEM value comes from verified telemetry, not just tool deployment.
- Agent connectivity and certificate trust are common first-week blockers.
- Alert triage requires separating baseline noise from suspicious events.
- Documentation (timestamps, rule IDs, evidence) makes investigations repeatable.
Screenshots
Placeholder slots for lab evidence. Replace with real screenshots once captured.
Add real screenshots with alt text; redact credentials, tokens, and secrets before publishing.