Deploying Wazuh SIEM Home Lab on Proxmox - Security Monitoring and Threat Detection

Introduction

Cybersecurity has become a critical part of modern IT operations, with Security Information and Event Management (SIEM) tools playing an important role in monitoring, detecting, and responding to security events.

To deepen my understanding of cybersecurity operations, I built a home lab environment to deploy Wazuh SIEM using Proxmox virtualization and Ubuntu 24.04 Server. This project provided hands-on experience with security monitoring, log analysis, threat detection, and centralized visibility across multiple systems.

In this project, I explored the deployment of a pure Wazuh environment, tested its monitoring capabilities, and configured it to work with both Linux and Windows systems in a virtualized home lab environment.

1. Deploying Wazuh on Proxmox

To build my Wazuh environment, I used Proxmox as the virtualization platform. The deployment process included:

• Creating a new virtual machine on Proxmox and installing Ubuntu 24.04 Server.
• Manually downloading and installing Wazuh components, including the Wazuh Manager, Wazuh API, and required dependencies.
• Configuring the environment to ensure compatibility with my hardware and network setup.

Using Proxmox provided flexibility in managing virtual machines and allowed me to create a dedicated security monitoring environment for testing and learning.

This manual installation approach helped me understand the Wazuh architecture and the configuration requirements needed for deployment.

2. Exploring Wazuh Core Functionalities

After deploying Wazuh, I connected both Debian Linux and Windows systems using Wazuh agents. This allowed me to explore how Wazuh works as a centralized security monitoring and threat detection platform.

Monitoring Debian Linux Systems

To simulate a Linux environment, I installed the Wazuh agent on a Debian virtual machine.

This allowed me to explore several security monitoring features:

Log Monitoring

Wazuh collected system logs to monitor:

• User activity.
• Login attempts.
• System changes.
• Software updates.

For testing, I generated failed SSH login attempts to observe how Wazuh detected and generated alerts for potential brute-force activity.

File Integrity Monitoring (FIM)

I enabled File Integrity Monitoring (FIM) to track changes in important system files, including:

• /etc/passwd
• /etc/ssh/sshd_config

Wazuh generated alerts when these files were modified, demonstrating its ability to detect unauthorized configuration changes.

Rootkit Detection

Using Wazuh's built-in rootkit detection capability, I scanned the Debian system for potential signs of:

• Rootkits.
• Malicious kernel modifications.

This provided insight into endpoint monitoring and security detection capabilities.

Monitoring Windows Systems

I extended the Wazuh environment by installing the Wazuh agent on a Windows 10 virtual machine.

The Windows agent allowed me to explore:

User Activity Monitoring

I monitored:

• User login activity.
• Application activity.
• Administrative actions.

This helped demonstrate how Wazuh can identify suspicious user behavior and potential unauthorized activities.

Registry Monitoring

Wazuh monitored Windows registry changes to detect modifications that could indicate suspicious activity or persistence mechanisms.

Windows Event Log Analysis

By integrating Windows Event Logs with Wazuh, I was able to monitor security events such as:

• Failed login attempts.
• User authentication activity.
• Privilege-related events.

This provided practical experience with Windows security monitoring and auditing.

3. Real-Time Alerting and Visualization

One of the key features I explored in Wazuh was its real-time alerting capability.

By simulating different security events, I observed how Wazuh categorized alerts based on severity levels, helping prioritize potential security issues.

Examples included:

SSH Brute Force Detection

Repeated failed SSH login attempts on Debian generated security alerts indicating possible brute-force activity.

Unauthorized Software Installation

Installing an unapproved executable on Windows allowed me to observe how Wazuh detected suspicious software activity.

Through these tests, I gained experience with Wazuh alerts and how custom rules can be configured to match specific monitoring requirements.

4. Cross-Platform Security Monitoring

Using Wazuh, I explored centralized monitoring across both Linux and Windows environments.

This included:

Unified Monitoring Rules

Creating consistent monitoring rules for:

• Log analysis.
• File integrity monitoring.
• Security events.

This helped demonstrate how organizations can maintain a consistent security monitoring approach across different operating systems.

Custom Scripts for Automation

I used automation scripts to support security testing:

• Bash scripts on Linux for collecting important log information.
• PowerShell scripts on Windows for generating security events during testing.

5. Key Takeaways

This project provided practical experience in:

Cross-Platform Security Monitoring

Wazuh demonstrated its ability to monitor both Linux and Windows systems from a centralized platform.

Practical Threat Detection

By simulating security events, I gained a better understanding of how SIEM platforms detect suspicious activities and support incident response.

Custom Configuration

Learning how to configure monitoring rules and security policies improved my understanding of SIEM administration and security operations.

Conclusion

Through this hands-on project, I gained practical experience deploying and using Wazuh as a centralized security monitoring platform in a mixed operating system environment.

The project improved my understanding of:

• Threat detection.
• Log analysis.
• Security monitoring.
• Compliance auditing.
• Incident response processes.

Building this Wazuh home lab provided a strong foundation for further development in cybersecurity operations and SIEM administration.