How I Built a Home Lab SIEM with Wazuh on Debian (Complete Guide)

Setting up a real Security Information and Event Management (SIEM) system in a home lab has been on my list for a while. I wanted something powerful enough to teach me real cybersecurity skills, but free and self-hosted. After comparing several options, I decided to go with Wazuh.

This post documents the entire process of installing and configuring Wazuh on my Debian machine — including the mistakes I made and how I recovered from them.

Why I Chose Wazuh

I looked at several alternatives:

  • Splunk — Excellent but very expensive
  • Elastic SIEM — Powerful but more complex to manage
  • CrowdStrike — Great for endpoint protection, but commercial and cloud-focused
  • Suricata — Strong for network detection, but not a full SIEM
  • OSSEC — The older project that Wazuh forked from

Wazuh stood out because it is completely open source, combines SIEM + XDR capabilities, has strong host monitoring features (file integrity, vulnerability detection, configuration assessment), and is actively maintained. For a home lab, it offered the best balance of power and cost (free).

My Environment

  • Operating System: Debian
  • Goal: All-in-one installation (Manager + Indexer + Dashboard on the same machine)
  • Purpose: Learning and monitoring my home lab

Step 1: Running the Official Installation

I used the official Wazuh installation assistant (version 4.14.7 at the time of writing):

Bash

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

During the installation I received a warning:

“The current system does not match with the list of recommended systems. The installation may not work properly.”

Debian is not officially listed as a recommended operating system (Ubuntu and RHEL-based systems are preferred), but I decided to continue anyway. Many people successfully run Wazuh on Debian.

The installation took some time and successfully installed:

  • Wazuh Indexer
  • Wazuh Manager
  • Filebeat
  • Wazuh Dashboard

At the end, the installer displayed the admin credentials for the dashboard.

Step 2: Accessing the Dashboard

I found my server’s IP address with:

Bash

hostname -I

Then I opened a browser and went to https://192.168.1.71 (one of my local IPs).

As expected, the browser showed a “Not Secure” warning because Wazuh uses a self-signed certificate by default. This is normal for a home lab. I accepted the risk and continued.

Logging in with the provided password initially failed due to special characters. I retrieved the correct password using:

Bash

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

After using the exact password from the file, I successfully logged into the Wazuh Dashboard.

Step 3: The Agent Installation Mistake

I wanted the manager to monitor itself, so I tried installing the Wazuh agent on the same machine:

Bash

sudo WAZUH_MANAGER="127.0.0.1" apt-get install wazuh-agent -y

This was a mistake.

The wazuh-agent and wazuh-manager packages conflict with each other. Installing the agent removed the manager. I quickly realized something was wrong when the dashboard started showing connection errors.

Step 4: Recovering the Manager

I reinstalled the manager:

Bash

sudo apt-get install wazuh-manager -y
sudo systemctl daemon-reload
sudo systemctl enable wazuh-manager
sudo systemctl start wazuh-manager

After restarting the services, I verified everything was running again:

Bash

sudo systemctl status wazuh-manager
sudo systemctl status wazuh-indexer
sudo systemctl status wazuh-dashboard

All three core services came back online. The dashboard started working again shortly after.

Lesson learned: On an all-in-one installation, do not install the agent package on the same host as the manager. The manager already collects a significant amount of local data on its own.

Step 5: Verifying the Configuration

I checked the status of the Wazuh processes:

Bash

sudo /var/ossec/bin/wazuh-control status

Most important components were running correctly (analysisd, syscheckd, logcollector, modulesd, etc.).

I also inspected the main configuration file and confirmed that these key modules were already enabled by default:

  • Syscheck (File Integrity Monitoring)
  • Syscollector (System inventory)
  • SCA (Security Configuration Assessment)
  • Vulnerability Detection

This was a pleasant surprise — the default configuration is already quite capable for a home lab.

Current State

At the time of writing:

  • The Wazuh Dashboard is accessible
  • Hundreds of alerts (mostly Medium and Low severity) are already being generated
  • Core modules for file integrity, vulnerability detection, and configuration assessment are active
  • The manager is collecting useful data from the local system

What’s Next

Now that the core platform is stable, my next steps will be:

  • Exploring the existing alerts to understand what Wazuh is detecting
  • Testing File Integrity Monitoring by making controlled changes
  • Forcing a vulnerability scan
  • Eventually deploying agents on other machines/VMs in my lab the proper way

Final Thoughts

Setting up Wazuh taught me more than just how to install a tool. I learned about package conflicts, self-signed certificates, service recovery, and how a real SIEM collects and presents data.

If you’re building a cybersecurity home lab, I highly recommend giving Wazuh a try. Just remember: on a single-node installation, let the manager handle local monitoring instead of forcing the agent package onto the same machine.