Building a Wazuh SIEM/EDR From Scratch

Wazuh is the detection backbone of the lab. It ingests logs from every host and segment, correlates them against detection rules, and drives automated response. This is the build log for how I got it running and hardened.

Goals

• A single pane of glass for host, network, and application telemetry.
• Custom detection rules mapped to real attacker behavior, not just noisy defaults.
• Automated response for a handful of high-confidence detections.

Deployment

I ran the Wazuh manager, indexer, and dashboard as containers, fronted by the lab's Kemp load balancer for SSL offload. Agents are deployed to each Linux host and report home over TLS.

wazuh-manager   -> rule engine + active response
wazuh-indexer   -> Elasticsearch-compatible store
wazuh-dashboard -> Kibana-based UI

Detection engineering

Out of the box, Wazuh is chatty. The value comes from tuning:

• Suppress the known-good. Baselined normal lab activity, then wrote exceptions.
• Author custom rules. Added rules for lateral-movement patterns and honeypot hits from

OpenCanary, so a canary trip escalates immediately.

• Map to ATT&CK. Tagged rules with technique IDs to make triage faster.

Automated response

For a small set of high-confidence detections (e.g. repeated auth failures from a single source, or any OpenCanary interaction), Wazuh's active-response module triggers a firewall block via the pfSense integration.

What's next

• Feed MISP indicators into Wazuh for real-time IOC matching.
• Expand file-integrity monitoring coverage across the services tier.