Wazuh SIEM Deployment

← Back to Projects
Deployed & Operational — Full write-up in progress
Platform
Proxmox LXC
SIEM
Wazuh 4.x
Case Mgmt
TheHive
IDS
Snort
Network
Isolated VLAN

Overview

Deployed a full open-source SOC detection pipeline in a self-hosted Proxmox homelab environment. Wazuh serves as the centralized SIEM for log ingestion, alerting, and rule-based detection. TheHive provides structured incident case management, and Snort IDS handles network-level threat detection — together mirroring a Tier 1 enterprise SOC stack.

The architecture was intentionally designed to reflect production SOC practices: agents deployed across multiple endpoints, custom detection rules mapped to MITRE ATT&CK, and alert pipelines feeding directly into TheHive for case triage.

Tool Stack

Wazuh SIEM TheHive Snort IDS Proxmox VE pfSense MITRE ATT&CK AdGuard Home Nginx Proxy Manager

Write-Up In Progress

A full technical breakdown is being written up. The completed write-up will include:

Coming soon

  • Architecture diagram — VLAN layout, agent communication flow, log pipeline
  • Wazuh agent deployment walkthrough across Windows and Linux endpoints
  • Custom detection rule creation mapped to MITRE ATT&CK tactics
  • TheHive + Wazuh integration — alert-to-case pipeline configuration
  • Snort IDS rule tuning and network traffic analysis
  • Sample alert triage workflow — from alert firing to case closure
  • Screenshots from the live dashboard and TheHive case console