Overview
This is a personal home lab covering hands-on design and deployment of an endpoint monitoring and detection capability using Wazuh, a Security Information and Event Management (SIEM) platform. The lab provides real-time monitoring and threat detection across multiple virtualized endpoints. It is not a production or client environment.
Problem
Reading about SIEM concepts is not the same as operating one. I wanted direct, hands-on experience with the full loop — agent deployment, event forwarding, detection rule authoring, and alert triage — that endpoint monitoring work actually involves.
Objective
Build and operate a working Wazuh deployment across multiple endpoint types, with file integrity monitoring and custom detection rules, in an isolated virtualized network.
Environment
A virtualized network built in VirtualBox with host-only networking for isolation: a Windows endpoint, an Ubuntu endpoint, and a Wazuh manager running on Ubuntu.
Architecture
Text description: both endpoints run a Wazuh agent and forward security events over a host-only virtual network to the centralized Wazuh manager, which runs on Ubuntu.
My Responsibilities
Solo build — design, deployment, configuration, and troubleshooting for every component in the lab.
Technical Implementation
I set up a virtualized environment with Wazuh agents on Windows and Ubuntu endpoints, forwarding system-level security events to a centralized manager running on Ubuntu. Work centered on implementing file integrity monitoring and writing custom alerting rules for suspicious activity, alongside network traffic monitoring and log analysis for indicators of compromise. The build also involved troubleshooting network configuration and agent communication to keep the system reliable.
Security Controls
- File Integrity Monitoring (FIM) for detecting unauthorized file changes
- Custom detection rules for endpoint anomalies
- Real-time event correlation and alerting
- Network traffic monitoring and analysis
- Host-only network isolation between the lab and the host system
Testing & Validation
[CONTENT NEEDED: specific test events generated to confirm detection — e.g. simulated file tampering, failed-login bursts — and how the resulting alerts were verified]
Challenges & Decisions
Issue: Configuring agent communication in a virtualized environment that also required network isolation.
Decision: Used host-only networking in VirtualBox so agents could reach the manager reliably while the lab stayed isolated from the host network — trading off some realism (a production network wouldn't be host-only) for a safer, simpler environment to iterate in.
Results
[ADD METRIC: e.g. number of custom rules written, alert types successfully detected, or time to build]
Lessons Learned
[CONTENT NEEDED]
Future Improvements
- Add advanced threat detection for more sophisticated attack patterns
- Build a centralized dashboard for endpoint status visualization
Screenshots & Diagrams
[ADD SCREENSHOT: Wazuh dashboard, a triggered alert, and an FIM detection event]
Setup Steps
- Clone the lab repository
- Install Wazuh on both the server and client VMs
- Configure the agent and server per the repository config files
- (Optional) Run network traffic analysis with Wireshark
Technologies
Wazuh · VirtualBox · Windows · Ubuntu · Wireshark
Repository / Demo
[CONTENT NEEDED: repository link, if this lab's config is published]