Wazuh Security Monitoring
My Own SIEM, Watching Everything
Overview
Wazuh is an open-source SIEM/XDR platform — the kind of tool security teams use to spot trouble across a whole estate. Mine started life as a VM in the homelab and now lives on a cloud server, keeping an eye on my machines wherever they are.
Why I Built It
I'm working my way deeper into security — TryHackMe paths, PenTest+ labs — and there's no better way to understand the defensive side than running the tooling yourself. Wazuh turns my own lab into the training ground: real logs, real alerts, real noise to tune out.
How It Works
- Lightweight agents on my servers and endpoints report back to the Wazuh manager in the cloud
- Log analysis and correlation flag suspicious activity across the fleet
- File integrity monitoring catches unexpected changes to important files
- Vulnerability detection maps installed software against known CVEs
- Dashboards pull it all together into one security overview
Key Lessons Learned
- What a SIEM actually does day-to-day, beyond the acronym
- Alert tuning — the gap between "collecting logs" and "seeing what matters"
- Agent lifecycle management across home and cloud machines