Wazuh: Enterprise SIEM for Homelabs

Introduction

As your homelab grows, security becomes increasingly complex. How do you detect if a server has been compromised? When did that configuration file change? Are there unpatched vulnerabilities across your infrastructure? Traditional logging solutions lack the intelligence to answer these questions, leaving you blind to sophisticated threats.

Wazuh solves this problem by providing an enterprise-grade Security Information and Event Management (SIEM) platform that’s free and open source. It combines log analysis, intrusion detection, file integrity monitoring, vulnerability detection, compliance auditing, and incident response into a unified platform—bringing capabilities previously reserved for Fortune 500 companies to your homelab.

In this comprehensive guide, you’ll learn how to deploy Wazuh’s all-in-one installation, install agents on multiple servers, navigate the powerful dashboard, configure file integrity monitoring, enable vulnerability detection, create custom security rules, and integrate with your existing infrastructure.

What You’ll Build:

Production-ready Wazuh all-in-one server with Elasticsearch backend
Multi-platform agent deployments (Linux, Windows, macOS)
Centralized dashboard for security visibility
File Integrity Monitoring (FIM) for critical system files
Automated vulnerability scanning across infrastructure
Custom security rules and alerting
Compliance monitoring (PCI-DSS, GDPR, HIPAA)
Incident response workflows

Why Wazuh?

Enterprise-Grade: Powers security operations for global organizations
Comprehensive: SIEM, IDS, FIM, vulnerability detection, compliance—all in one
Open Source: Free to use, audit, and extend
Active Development: Regular updates and extensive community
Agent-Based: Deep visibility into endpoints, containers, and cloud
Scalable: From single homelab to thousands of endpoints

Prerequisites

Before starting, ensure you have:

Technical Requirements:

Server with 4 CPU cores, 8GB RAM, 50GB storage (minimum)
Ubuntu 22.04 LTS or CentOS Stream 9 (recommended)
Root or sudo access
Static IP address or hostname
Firewall ports: 1514, 1515, 55000, 443 open
Client systems to monitor (Linux/Windows/macOS)

Knowledge Requirements:

Strong Linux command line skills
Understanding of log analysis and security concepts
Networking fundamentals (firewall, ports, protocols)
YAML configuration experience helpful
Elasticsearch/OpenSearch basics helpful but not required

Preparation:

# Update system
sudo apt update && sudo apt upgrade -y  # Ubuntu/Debian
sudo yum update -y                      # CentOS/RHEL

# Verify system resources
free -h    # Should show 8GB+ RAM
df -h      # Should have 50GB+ free space
nproc      # Should show 4+ CPU cores

# Check ports availability
sudo ss -tlnp | grep -E ':(1514|1515|55000|443)'
# Should show nothing (ports available)

Section 1: Understanding Wazuh Architecture

Core Components

Wazuh Manager: Central intelligence engine that receives data from agents, processes events with decoders and rules, stores alerts, and manages agent registration. Written in C for performance.

Wazuh Agent: Lightweight daemon installed on monitored systems that collects logs, monitors file changes, scans for vulnerabilities, enforces security policies, and reports to the manager. Cross-platform (Linux, Windows, macOS, containers).

Wazuh Indexer (OpenSearch): Distributed search and analytics engine storing events, alerts, and vulnerability data. Fork of Elasticsearch optimized for security use cases.

Wazuh Dashboard (OpenSearch Dashboards): Web interface for visualization, analysis, and administration. Real-time event monitoring, compliance dashboards, rule management, and agent deployment.

Filebeat: Log shipper that securely forwards alerts from Wazuh Manager to Wazuh Indexer using TLS encryption.

Architecture Diagram

┌──────────────────────────────────────────────────────────┐
│                    Monitored Systems                      │
│                                                           │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐      │
│  │   Linux     │  │   Windows   │  │   Docker    │      │
│  │   Agent     │  │   Agent     │  │   Agent     │      │
│  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘      │
│         │                 │                 │             │
│         └─────────────────┴─────────────────┘             │
│                           │                               │
│                    (Agent API / Syslog)                   │
│                           │                               │
└───────────────────────────┼───────────────────────────────┘
                            │
                            ▼
       ┌────────────────────────────────────────┐
       │         Wazuh Manager Server           │
       │                                        │
       │  ┌──────────────────────────────────┐ │
       │  │      Wazuh Manager               │ │
       │  │  - Event processing              │ │
       │  │  - Rule engine                   │ │
       │  │  - Agent management              │ │
       │  └──────────┬───────────────────────┘ │
       │             │                          │
       │             ▼                          │
       │  ┌──────────────────────────────────┐ │
       │  │      Filebeat                    │ │
       │  │  - Alert forwarding              │ │
       │  └──────────┬───────────────────────┘ │
       │             │                          │
       └─────────────┼──────────────────────────┘
                     │
                     ▼
       ┌────────────────────────────────────────┐
       │      Wazuh Indexer (OpenSearch)        │
       │  - Event storage                       │
       │  - Search & analytics                  │
       │  - Vulnerability database              │
       └────────────┬───────────────────────────┘
                    │
                    ▼
       ┌────────────────────────────────────────┐
       │    Wazuh Dashboard (Web UI)            │
       │  - Visualization                       │
       │  - Compliance dashboards               │
       │  - Agent management                    │
       │  - Rule configuration                  │
       └────────────────────────────────────────┘

Data Flow

Event Collection: Agents monitor logs, file changes, system calls, network connections
Transmission: Events sent to Manager via encrypted channel (TLS 1.3)
Processing: Manager applies decoders (parse), rules (analyze), and enrichment (GeoIP, threat intelligence)
Indexing: Filebeat forwards alerts to Indexer for storage
Visualization: Dashboard queries Indexer for real-time and historical analysis
Response: Automated actions triggered (block IP, quarantine file, alert admin)

Wazuh vs Alternatives

Feature	Wazuh	Splunk	ELK Stack	Graylog
Cost	Free	$$$$$	Free (OpenSource)	Free/Paid
SIEM Built-in	✅ Yes	✅ Yes	⚠️ Manual	⚠️ Limited
Agent-Based	✅ Yes	✅ Yes	❌ Agentless	⚠️ Optional
FIM	✅ Built-in	⚠️ Via apps	❌ Manual	❌ Manual
Vulnerability Detection	✅ Built-in	⚠️ Via apps	❌ No	❌ No
Compliance	✅ Pre-built	✅ Yes	⚠️ Manual	⚠️ Limited
Setup Complexity	Medium	High	High	Medium
Best For	Security-focused	Enterprise	Flexibility	Log aggregation

Choose Wazuh if:

Need comprehensive SIEM without licensing costs
Want agent-based endpoint visibility
Require built-in FIM and vulnerability scanning
Need compliance reporting (PCI-DSS, HIPAA, GDPR)
Running security-conscious homelab or SMB

Section 2: All-in-One Installation

Wazuh provides an all-in-one installation that deploys Manager, Indexer, and Dashboard on a single server.

Step 1: Download Installation Assistant

# Download Wazuh installation assistant
curl -sO https://packages.wazuh.com/4.8/wazuh-install.sh

# Verify download
ls -lh wazuh-install.sh

# Make executable
chmod +x wazuh-install.sh

Step 2: Run Installation

# Run all-in-one installation
sudo ./wazuh-install.sh --all-in-one

# Installation takes 10-15 minutes
# Monitor progress (do not interrupt)

Installation process:

Downloads and configures Wazuh Indexer
Downloads and configures Wazuh Manager
Downloads and configures Filebeat
Downloads and configures Wazuh Dashboard
Generates SSL certificates
Starts all services
Displays admin credentials

Save credentials shown at end:

INFO: --- Summary ---
INFO: Wazuh web interface admin credentials:
      User: admin
      Password: abc123XYZ789SecurePass

INFO: Wazuh indexer admin credentials:
      User: admin
      Password: def456UVW012IndexPass

INFO: You can access the web interface https://YOUR-SERVER-IP

CRITICAL: Save these credentials in password manager immediately!

Step 3: Verify Installation

# Check all services are running
sudo systemctl status wazuh-manager
sudo systemctl status wazuh-indexer
sudo systemctl status filebeat
sudo systemctl status wazuh-dashboard

# All should show: active (running)

# Check ports listening
sudo ss -tlnp | grep -E ':(1514|1515|55000|443)'

# Expected output:
# 1514  - Wazuh agent connections
# 1515  - Agent enrollment
# 55000 - Wazuh API
# 443   - Dashboard HTTPS

Step 4: Access Dashboard

Navigate to: https://YOUR-SERVER-IP
Accept self-signed certificate warning (we’ll fix this later)
Login with admin credentials (from installation output)
Complete first-time setup wizard
Explore dashboard (don’t make changes yet)

Initial dashboard tour:

Overview: Security events summary
Agents: Connected endpoints
Modules: Security capabilities (FIM, vulnerability detection, etc.)
Management: Configuration and rule management
Settings: Dashboard customization

Step 5: Configure Firewall

# UFW (Ubuntu)
sudo ufw allow 1514/tcp  # Agent communication
sudo ufw allow 1515/tcp  # Agent enrollment
sudo ufw allow 55000/tcp # Wazuh API
sudo ufw allow 443/tcp   # Dashboard
sudo ufw reload

# firewalld (CentOS/RHEL)
sudo firewall-cmd --permanent --add-port=1514/tcp
sudo firewall-cmd --permanent --add-port=1515/tcp
sudo firewall-cmd --permanent --add-port=55000/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Step 6: Enable SSL Certificate (Optional but Recommended)

For production, use Let’s Encrypt:

# Install certbot
sudo apt install certbot -y  # Ubuntu
sudo yum install certbot -y  # CentOS

# Obtain certificate
sudo certbot certonly --standalone -d wazuh.example.com

# Certificates saved to:
# /etc/letsencrypt/live/wazuh.example.com/fullchain.pem
# /etc/letsencrypt/live/wazuh.example.com/privkey.pem

# Configure Wazuh Dashboard to use Let's Encrypt
sudo nano /etc/wazuh-dashboard/opensearch_dashboards.yml

Update certificate paths:

# /etc/wazuh-dashboard/opensearch_dashboards.yml
server.ssl.enabled: true
server.ssl.certificate: "/etc/letsencrypt/live/wazuh.example.com/fullchain.pem"
server.ssl.key: "/etc/letsencrypt/live/wazuh.example.com/privkey.pem"

Restart dashboard:

sudo systemctl restart wazuh-dashboard

# Access via HTTPS without warnings
# https://wazuh.example.com

Section 3: Installing Wazuh Agents

Agents provide deep visibility into endpoints. Let’s deploy agents on various platforms.

Linux Agent Installation

Ubuntu/Debian:

# On the system to monitor (not the Wazuh server)

# Download GPG key
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

# Add repository
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list

# Install agent
sudo apt update
sudo apt install wazuh-agent -y

# Configure manager address
sudo sed -i "s/MANAGER_IP/YOUR-WAZUH-SERVER-IP/" /var/ossec/etc/ossec.conf

# Start agent
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

# Verify agent is running
sudo systemctl status wazuh-agent

CentOS/RHEL:

# Import GPG key
sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

# Add repository
cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

# Install agent
sudo yum install wazuh-agent -y

# Configure and start (same as Ubuntu above)
sudo sed -i "s/MANAGER_IP/YOUR-WAZUH-SERVER-IP/" /var/ossec/etc/ossec.conf
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Windows Agent Installation

Download and install:

Download installer: https://packages.wazuh.com/4.x/windows/wazuh-agent-4.8.0-1.msi
Run installer as Administrator
During installation:
- Manager IP: YOUR-WAZUH-SERVER-IP
- Agent name: Windows-Desktop-01 (or descriptive name)
- Agent groups: windows,production
Complete installation
Verify: Open Services → Find “Wazuh Agent” → Should be “Running”

Alternative: Silent installation via PowerShell:

# Run as Administrator
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.8.0-1.msi -OutFile wazuh-agent.msi

# Install with parameters
msiexec.exe /i wazuh-agent.msi /q WAZUH_MANAGER='YOUR-WAZUH-SERVER-IP' WAZUH_AGENT_NAME='Windows-PC'

# Start service
NET START WazuhSvc

macOS Agent Installation

# Download package
curl -O https://packages.wazuh.com/4.x/macos/wazuh-agent-4.8.0-1.intel64.pkg

# Install
sudo installer -pkg wazuh-agent-4.8.0-1.intel64.pkg -target /

# Configure manager
sudo /Library/Ossec/bin/agent-auth -m YOUR-WAZUH-SERVER-IP

# Start agent
sudo /Library/Ossec/bin/wazuh-control start

# Verify
sudo /Library/Ossec/bin/wazuh-control status

Docker Container Monitoring

Deploy Wazuh agent as sidecar:

# docker-compose.yml
version: '3.8'

services:
  myapp:
    image: myapp:latest
    volumes:
      - app-logs:/var/log/app

  wazuh-agent:
    image: wazuh/wazuh-agent:latest
    hostname: docker-myapp
    environment:
      - WAZUH_MANAGER=YOUR-WAZUH-SERVER-IP
      - WAZUH_AGENT_NAME=docker-myapp
    volumes:
      - app-logs:/var/log/app:ro  # Monitor app logs
    restart: unless-stopped

volumes:
  app-logs:

Verify Agent Registration

In Wazuh Dashboard:

Navigate to: Management → Endpoints Summary
View registered agents: Should show newly installed agents
Check agent status: Green = Active, Red = Disconnected
Agent details: Click agent name to view detailed information

Via command line (on Wazuh server):

# List all agents
sudo /var/ossec/bin/agent_control -l

# Output:
# Wazuh agent_control. List of available agents:
#    ID: 000, Name: wazuh-server (server), IP: any, Active/Local
#    ID: 001, Name: ubuntu-web-01, IP: 192.168.1.100, Active
#    ID: 002, Name: Windows-Desktop-01, IP: 192.168.1.50, Active
#    ID: 003, Name: docker-myapp, IP: 172.18.0.5, Active

# View specific agent details
sudo /var/ossec/bin/agent_control -i 001

Main Dashboard Components

1. Overview (Security Events)

Default landing page showing:

Security Events Over Time: Line graph of events/alerts
Top 5 Agents: Most active endpoints
Top 5 Rules: Most triggered security rules
Alert Level Distribution: Critical, High, Medium, Low breakdown
Compliance Status: PCI-DSS, GDPR, HIPAA compliance metrics

2. Agents Module

Endpoints Summary: Overview of all registered agents
Agent Details: Click any agent for deep dive:
- Operating system and configuration
- Active modules (FIM, vulnerability detection)
- Recent events and alerts
- Resource usage (CPU, memory)
- Network connections

3. Modules (Security Capabilities)

Each module represents a security capability:

Security Events: Real-time event stream with filtering

Filter by: agent, rule level, rule ID, timestamp
Full event details (raw log, decoded fields, rule description)
Export to CSV/JSON

Integrity Monitoring (FIM): File changes across endpoints

Modified files
Created/deleted files
Permission changes
Registry changes (Windows)

Vulnerability Detection: CVE scanning results

Critical vulnerabilities by agent
Affected packages
CVSS scores
Remediation guidance

Policy Monitoring: Security configuration assessment

CIS benchmarks
Security hardening checks
Compliance violations

MITRE ATT&CK: Threat mapping to MITRE framework

Tactics and techniques detected
Attack chain visualization
Threat hunting insights

4. Management Section

Rules: View and edit detection rules
Decoders: Configure log parsing
Groups: Organize agents by function
Configuration: Manager and agent settings
API: REST API management

Creating Custom Dashboards

Example: Create “Web Server Security” dashboard:

Navigate to: Dashboard → Create new visualization
Select data source: wazuh-alerts-*
Add visualizations:
- Line chart: Nginx 404 errors over time
- Pie chart: HTTP status codes distribution
- Data table: Top source IPs by request count
- Metric: Total web attacks blocked
Save dashboard: Name it “Web Server Security”
Share: Generate shareable link or embed in documentation

Search and Filtering

Powerful query language (Lucene syntax):

# Find all SSH authentication failures
rule.description:"authentication failed" AND agent.name:"web-server-01"

# Critical alerts in last 24 hours
rule.level:>=13 AND timestamp:[now-24h TO now]

# File changes in /etc directory
syscheck.path:"/etc/*" AND syscheck.event:"modified"

# Vulnerabilities with CVSS >= 7.0
vulnerability.cvss.base.score:>=7.0

# Windows login events
rule.id:60106 AND agent.os.platform:"windows"

Saved searches:

Create complex query
Click “Save” → Name it
Access from “Open” menu
Share with team members

Section 5: File Integrity Monitoring (FIM)

FIM detects unauthorized changes to critical files—a key indicator of compromise.

Configuring FIM on Linux Agents

Edit agent configuration:

# On monitored Linux system
sudo nano /var/ossec/etc/ossec.conf

Add FIM directives:

<ossec_config>
  <syscheck>
    <!-- Frequency -->
    <frequency>300</frequency> <!-- Check every 5 minutes -->

    <!-- Directories to monitor -->
    <directories check_all="yes" realtime="yes">/etc</directories>
    <directories check_all="yes" realtime="yes">/usr/bin,/usr/sbin</directories>
    <directories check_all="yes" realtime="yes">/boot</directories>
    <directories check_all="yes">/var/www/html</directories>

    <!-- Ignore specific files -->
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/resolv.conf</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore type="sregex">.log$</ignore> <!-- Ignore all .log files -->

    <!-- What to check -->
    <check_all>yes</check_all>        <!-- All attributes -->
    <check_sha1sum>yes</check_sha1sum>    <!-- SHA1 hash -->
    <check_sha256sum>yes</check_sha256sum> <!-- SHA256 hash -->
    <check_size>yes</check_size>          <!-- File size -->
    <check_owner>yes</check_owner>        <!-- Owner -->
    <check_group>yes</check_group>        <!-- Group -->
    <check_perm>yes</check_perm>          <!-- Permissions -->
    <check_mtime>yes</check_mtime>        <!-- Modification time -->

    <!-- Real-time monitoring (inotify on Linux) -->
    <realtime>yes</realtime>

    <!-- Report file changes, even if not modified -->
    <report_changes>yes</report_changes>
  </syscheck>
</ossec_config>

Restart agent:

sudo systemctl restart wazuh-agent

Windows FIM Configuration

Edit Windows agent config:

<!-- C:Program Files (x86)ossec-agentossec.conf -->
<ossec_config>
  <syscheck>
    <frequency>300</frequency>

    <!-- Monitor Windows directories -->
    <directories check_all="yes" realtime="yes">C:WindowsSystem32</directories>
    <directories check_all="yes" realtime="yes">C:Program Files</directories>
    <directories check_all="yes" realtime="yes">C:Users</directories>

    <!-- Monitor Registry -->
    <windows_registry>HKEY_LOCAL_MACHINESoftware</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINESystemCurrentControlSetServices</windows_registry>
    <windows_registry arch="both">HKEY_LOCAL_MACHINESystemCurrentControlSetControlSession ManagerKnownDLLs</windows_registry>

    <realtime>yes</realtime>
    <report_changes>yes</report_changes>
  </syscheck>
</ossec_config>

Restart Wazuh service:

# PowerShell as Administrator
Restart-Service WazuhSvc

Testing FIM

Trigger file change:

# On monitored Linux system
sudo touch /etc/test-fim-file
echo "Test content" | sudo tee /etc/test-fim-file
sudo chmod 777 /etc/test-fim-file

View FIM alerts in Dashboard:

Navigate to: Modules → Integrity Monitoring
Filter: Last 5 minutes
Find event: /etc/test-fim-file
Inspect details:
- Old vs new file hash
- Permission changes (644 → 777)
- Modification timestamp
- User who made change

FIM event example:

{
  "syscheck": {
    "path": "/etc/test-fim-file",
    "mode": "realtime",
    "size_before": "0",
    "size_after": "13",
    "perm_before": "rw-r--r--",
    "perm_after": "rwxrwxrwx",
    "uid_before": "0",
    "uid_after": "0",
    "gid_before": "0",
    "gid_after": "0",
    "md5_before": "d41d8cd98f00b204e9800998ecf8427e",
    "md5_after": "9a0364b9e99bb480dd25e1f0284c8555",
    "sha1_before": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
    "sha1_after": "94b5dc3c7d8bb05a7a0b76bf35cdf0e8d8b8f10f",
    "event": "modified"
  },
  "rule": {
    "level": 7,
    "description": "Integrity checksum changed.",
    "id": "550",
    "firedtimes": 1,
    "groups": ["ossec","syscheck"]
  }
}

Advanced FIM: Who-Data

Who-data provides context on who made changes:

<directories check_all="yes" whodata="yes">/etc/sensitive-config</directories>

Who-data alerts include:

User who modified file
Process that made change
Command-line arguments
Parent process
Effective UID/GID

Section 6: Vulnerability Detection

Wazuh scans agents for known vulnerabilities (CVEs) in installed software.

Enable Vulnerability Detector

On Wazuh Manager, edit configuration:

sudo nano /var/ossec/etc/ossec.conf

Add vulnerability detector module:

<ossec_config>
  <vulnerability-detector>
    <enabled>yes</enabled>
    <interval>1h</interval> <!-- Scan every hour -->
    <ignore_time>6h</ignore_time>
    <run_on_start>yes</run_on_start>

    <!-- Ubuntu/Debian vulnerability feeds -->
    <provider name="canonical">
      <enabled>yes</enabled>
      <os>jammy</os>    <!-- Ubuntu 22.04 -->
      <os>focal</os>    <!-- Ubuntu 20.04 -->
      <os>bookworm</os> <!-- Debian 12 -->
      <update_interval>1h</update_interval>
    </provider>

    <!-- Red Hat/CentOS feeds -->
    <provider name="redhat">
      <enabled>yes</enabled>
      <os>centos9</os>
      <os>rhel9</os>
      <update_interval>1h</update_interval>
    </provider>

    <!-- Windows feeds -->
    <provider name="msu">
      <enabled>yes</enabled>
      <update_interval>1h</update_interval>
    </provider>

    <!-- National Vulnerability Database -->
    <provider name="nvd">
      <enabled>yes</enabled>
      <update_interval>24h</update_interval>
    </provider>
  </vulnerability-detector>
</ossec_config>

Restart Wazuh Manager:

sudo systemctl restart wazuh-manager

# Monitor vulnerability database updates
sudo tail -f /var/ossec/logs/ossec.log | grep vulnerability

View Vulnerability Scan Results

In Dashboard:

Navigate to: Modules → Vulnerabilities
View summary:
- Total vulnerabilities by severity (Critical, High, Medium, Low)
- Most vulnerable agents
- Top CVEs across infrastructure
Filter by agent: Click specific endpoint
Inspect CVE: Click vulnerability for details:
- CVSS score and vector
- Affected package and version
- Fixed in version
- References (NVD, vendor advisories)

Example vulnerability alert:

{
  "vulnerability": {
    "package": {
      "name": "openssl",
      "version": "1.1.1f-1ubuntu2.19",
      "architecture": "amd64"
    },
    "cvss": {
      "base": {
        "score": 9.8,
        "severity": "CRITICAL"
      }
    },
    "cve": "CVE-2023-12345",
    "title": "OpenSSL Memory Corruption Vulnerability",
    "severity": "Critical",
    "published": "2023-11-15",
    "updated": "2023-12-01",
    "reference": "https://nvd.nist.gov/vuln/detail/CVE-2023-12345",
    "condition": "Package less than 1.1.1f-1ubuntu2.20"
  },
  "agent": {
    "id": "001",
    "name": "web-server-01"
  }
}

Vulnerability Remediation Workflow

Identify critical vulnerabilities (CVSS >= 9.0)
Review affected agents and prioritize by exposure
Check patch availability in vendor advisories
Test patches in development/staging

Deploy updates:

# Ubuntu/Debian
sudo apt update && sudo apt upgrade openssl -y

# CentOS/RHEL
sudo yum update openssl -y

Verify fix: Wait for next scan cycle (1 hour) or trigger manual scan
Confirm vulnerability removed in dashboard

False Positive Management

Suppress specific CVE:

# On Wazuh Manager
sudo nano /var/ossec/etc/shared/agent.conf

<agent_config>
  <vulnerability-detector>
    <suppress cve="CVE-2023-99999">
      <agent_id>001</agent_id> <!-- Specific agent -->
    </suppress>
    <suppress cve="CVE-2023-88888" />  <!-- All agents -->
  </vulnerability-detector>
</agent_config>

Section 7: Custom Security Rules

Wazuh’s power lies in custom rules tailored to your environment.

Understanding Rule Structure

Example rule:

<rule id="100001" level="5">
  <if_sid>5716</if_sid>
  <srcip>203.0.113.0/24</srcip>
  <description>SSH authentication from suspicious subnet</description>
  <group>authentication_failed,ssh</group>
</rule>

Components:

id: Unique rule identifier (100000-120000 for custom rules)
level: Alert severity (0-15, higher = more critical)
if_sid: Parent rule to inherit from
srcip: Source IP matching
description: Human-readable alert message
group: Tags for organization

Create Custom Rule: Detect Excessive Web 404s

Edit custom rules file:

# On Wazuh Manager
sudo nano /var/ossec/etc/rules/local_rules.xml

Add rule:

<group name="web,apache,nginx,custom">
  <!-- Detect 20+ 404 errors in 2 minutes (directory enumeration) -->
  <rule id="100010" level="10" frequency="20" timeframe="120">
    <if_matched_sid>31101</if_matched_sid> <!-- Parent: HTTP 404 -->
    <same_source_ip />
    <description>Multiple 404 errors from same IP (possible directory enumeration)</description>
    <group>web_scan,attack</group>
  </rule>
</group>

Reload rules:

sudo systemctl restart wazuh-manager

# Verify rule loaded
sudo /var/ossec/bin/wazuh-logtest
# Type test log entry to see if rule matches

Create Custom Rule: Detect Sudo Abuse

Detect when non-privileged user attempts sudo:

<rule id="100020" level="8">
  <if_sid>5401</if_sid> <!-- Parent: sudo executed -->
  <user>^(?!root|admin)</user> <!-- NOT root or admin -->
  <description>Sudo executed by non-privileged user</description>
  <group>sudo,privilege_escalation</group>
</rule>

<rule id="100021" level="12" frequency="5" timeframe="300">
  <if_matched_sid>100020</if_matched_sid>
  <same_source_ip />
  <description>Multiple sudo attempts by non-privileged user (possible privilege escalation)</description>
  <group>sudo,privilege_escalation,attack</group>
</rule>

Create Custom Rule: Detect Database Access from Unauthorized IP

<rule id="100030" level="10">
  <if_sid>50200</if_sid> <!-- Parent: PostgreSQL authentication -->
  <srcip>!192.168.1.0/24</srcip> <!-- NOT from internal network -->
  <description>Database access attempt from external IP</description>
  <group>database,authentication,attack</group>
</rule>

Testing Custom Rules

Use wazuh-logtest:

sudo /var/ossec/bin/wazuh-logtest

# Interactive mode: paste log entry
# Example:
203.0.113.45 - - [16/Dec/2025:10:30:45 +0000] "GET /admin/config.php HTTP/1.1" 404 162

# Output shows matched rule:
# **Rule: 100010 (level 10) -> 'Multiple 404 errors from same IP'

Monitor real-time rule triggers:

sudo tail -f /var/ossec/logs/alerts/alerts.log | grep "Rule: 100010"

Section 8: Active Response

Automatically block malicious IPs based on alerts.

Configure Active Response

Edit manager configuration:

sudo nano /var/ossec/etc/ossec.conf

Add active response:

<ossec_config>
  <active-response>
    <!-- Block IP on firewall for 10 minutes -->
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>100010,5710,5720</rules_id> <!-- Trigger on these rules -->
    <timeout>600</timeout> <!-- 10 minutes -->
  </active-response>

  <active-response>
    <!-- Disable user account on repeated authentication failures -->
    <command>disable-account</command>
    <location>local</location>
    <rules_id>100021</rules_id>
    <timeout>3600</timeout> <!-- 1 hour -->
  </active-response>
</ossec_config>

Restart manager:

sudo systemctl restart wazuh-manager

Custom Active Response Script

Create custom response script:

sudo nano /var/ossec/active-response/bin/custom-slack-notify.sh

#!/bin/bash
# Send alert to Slack webhook

SLACK_WEBHOOK="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"

# Get alert details from STDIN
read INPUT_JSON

# Extract fields
ALERT_ID=$(echo $INPUT_JSON | jq -r '.rule.id')
DESCRIPTION=$(echo $INPUT_JSON | jq -r '.rule.description')
SRC_IP=$(echo $INPUT_JSON | jq -r '.data.srcip')
AGENT=$(echo $INPUT_JSON | jq -r '.agent.name')

# Send to Slack
curl -X POST -H 'Content-type: application/json'   --data "{"text":"🚨 Wazuh Alert\n*Agent:* $AGENT\n*Rule:* $ALERT_ID - $DESCRIPTION\n*Source IP:* $SRC_IP"}"   $SLACK_WEBHOOK

Make executable:

sudo chmod 755 /var/ossec/active-response/bin/custom-slack-notify.sh

Register command:

<command>
  <name>slack-notify</name>
  <executable>custom-slack-notify.sh</executable>
  <timeout_allowed>no</timeout_allowed>
</command>

<active-response>
  <command>slack-notify</command>
  <location>server</location>
  <rules_id>100010,100020,100030</rules_id>
</active-response>

Section 9: Compliance Monitoring

Wazuh provides pre-built compliance dashboards.

Enable Compliance Modules

PCI-DSS:

# Dashboard → Management → Configuration → Edit Configuration
# Enable PCI-DSS module

View compliance dashboard:

Navigate to: Modules → PCI-DSS
Requirements overview (11.5, 10.2, etc.)
Failed requirements by agent
Remediation guidance

Compliance Use Cases

PCI-DSS 11.5 (File Integrity Monitoring):

Wazuh FIM automatically satisfies this requirement
Dashboard shows all monitored files and changes
Generate compliance reports for audits

HIPAA (Health Insurance Portability and Accountability Act):

Audit trail of all access to patient data
Encryption verification
Access control monitoring

GDPR (General Data Protection Regulation):

Data access logging
Breach detection
Privacy impact assessments

CIS Benchmarks:

Automated security configuration checks
OS hardening verification
Continuous compliance monitoring

Section 10: Troubleshooting and Optimization

Issue 1: Agent Not Connecting

Symptoms: Agent shows “Disconnected” in dashboard

Diagnostic steps:

# On agent system
sudo systemctl status wazuh-agent

# Check manager IP in config
sudo grep "<address>" /var/ossec/etc/ossec.conf

# Test connectivity
telnet YOUR-WAZUH-SERVER-IP 1514

# View agent logs
sudo tail -f /var/ossec/logs/ossec.log

Solutions:

Verify firewall allows port 1514/tcp
Check manager IP is correct in agent config
Ensure manager is running: sudo systemctl status wazuh-manager

Issue 2: High Disk Usage

Symptoms: Indexer consuming excessive disk space

Check disk usage:

# On Wazuh server
sudo du -sh /var/lib/wazuh-indexer/
sudo df -h

Solutions:

# Reduce index retention period
curl -X PUT "https://localhost:9200/_all/_settings"   -H 'Content-Type: application/json'   -u admin:admin -k   -d '{"index":{"lifecycle":{"name":"wazuh-policy","rollover_alias":"wazuh-alerts-4.x-*"}}}'

# Delete old indices manually
curl -X DELETE "https://localhost:9200/wazuh-alerts-4.x-2025.01.*"   -u admin:admin -k

Issue 3: Missing Vulnerability Scans

Symptoms: No vulnerabilities detected

Diagnostic:

# Check vulnerability detector is enabled
sudo grep -A 10 "vulnerability-detector" /var/ossec/etc/ossec.conf

# View vulnerability database status
sudo /var/ossec/bin/wazuh-control status

# Check logs
sudo grep "vulnerability" /var/ossec/logs/ossec.log

Solution:

Enable vulnerability detector module
Wait for database download (can take 30+ minutes on first run)
Verify internet connectivity for CVE feed downloads

Conclusion

Congratulations! You’ve deployed enterprise-grade security monitoring with Wazuh. You now have:

✅ Centralized SIEM platform with Elasticsearch backend
✅ Multi-platform agent deployment and management
✅ Real-time file integrity monitoring
✅ Automated vulnerability detection across infrastructure
✅ Custom security rules tailored to your environment
✅ Active response for automated threat mitigation
✅ Compliance monitoring dashboards

Best Practices

Regular rule tuning: Review and adjust rules monthly to reduce false positives
Agent health checks: Monitor agent connectivity weekly
Vulnerability remediation: Prioritize Critical/High CVEs within 7 days
Log retention: Balance storage costs with compliance requirements (90-365 days)
Backup configuration: Version control ossec.conf and custom rules
Performance monitoring: Watch Indexer CPU/RAM, scale if needed
Security hardening: Keep Wazuh components updated

Next Steps

Integrate with SOAR: Connect to TheHive, Cortex for incident response
Add cloud agents: Monitor AWS, Azure, GCP instances
Container security: Deploy agents in Kubernetes pods
Threat intelligence feeds: Integrate MISP, AlienVault OTX
Custom decoders: Parse proprietary application logs
Machine learning: Enable anomaly detection modules

Resources

Official Documentation: https://documentation.wazuh.com/
Ruleset Database: https://github.com/wazuh/wazuh-ruleset
Community Forums: https://groups.google.com/g/wazuh
Slack Community: https://wazuh.com/community/join-us-on-slack/

Final Thoughts

Wazuh brings Fortune 500 security capabilities to your homelab without the Fortune 500 price tag. By implementing comprehensive logging, FIM, vulnerability detection, and compliance monitoring, you’ve transformed your infrastructure from reactive security to proactive threat hunting.

The insights Wazuh provides—from file changes to CVE exposure to attack patterns—enable you to operate your homelab with confidence, knowing that threats are detected and mitigated before they cause damage.

Your homelab is now monitored by enterprise SIEM. Happy homelabbing, and stay vigilant!

Guide Version: 1.0 Last Updated: December 2025 Wazuh Version: 4.8+ Tested On: Ubuntu 22.04, CentOS Stream 9

Author Note: This guide is maintained as part of the homelabbing.io project. Found an issue or have improvements? Contribute on GitHub!

Introduction

Prerequisites

Section 1: Understanding Wazuh Architecture

Core Components

Architecture Diagram

Data Flow

Wazuh vs Alternatives

Section 2: All-in-One Installation

Step 1: Download Installation Assistant

Step 2: Run Installation

Step 3: Verify Installation

Step 4: Access Dashboard

Step 5: Configure Firewall

Step 6: Enable SSL Certificate (Optional but Recommended)

Section 3: Installing Wazuh Agents

Linux Agent Installation

Windows Agent Installation

macOS Agent Installation

Docker Container Monitoring

Verify Agent Registration

Section 4: Dashboard Overview and Navigation

Main Dashboard Components

Creating Custom Dashboards

Search and Filtering

Section 5: File Integrity Monitoring (FIM)

Configuring FIM on Linux Agents

Windows FIM Configuration

Testing FIM

Advanced FIM: Who-Data

Section 6: Vulnerability Detection

Enable Vulnerability Detector

View Vulnerability Scan Results

Vulnerability Remediation Workflow

False Positive Management

Section 7: Custom Security Rules

Understanding Rule Structure

Create Custom Rule: Detect Excessive Web 404s

Create Custom Rule: Detect Sudo Abuse

Create Custom Rule: Detect Database Access from Unauthorized IP

Testing Custom Rules

Section 8: Active Response

Configure Active Response

Custom Active Response Script

Section 9: Compliance Monitoring

Enable Compliance Modules

Compliance Use Cases

Section 10: Troubleshooting and Optimization

Issue 1: Agent Not Connecting

Issue 2: High Disk Usage

Issue 3: Missing Vulnerability Scans

Conclusion

Best Practices

Next Steps

Resources

Final Thoughts