In progress — Wazuh deployed, detection and case management not yet integrated
Overview
A self-hosted detection lab on Proxmox. Wazuh is deployed as the log collection and alerting layer, with Snort providing network-level detection on an isolated segment. TheHive is scoped for case management but is not yet configured, and the Wazuh-to-TheHive alert pipeline is not yet built.
This is a home lab, and the intent is detection engineering practice — writing rules, generating test activity, and confirming the rules fire on it — not simulating a production SOC.
Tool Stack (Current and Planned)
- Wazuh — deployed, collecting logs and generating alerts
- Snort IDS — deployed on an isolated network segment
- Proxmox VE — hypervisor for the lab
- pfSense — network segmentation and firewall rules
- TheHive — planned, not yet configured
- MITRE ATT&CK — planned mapping target for custom detection rules once they exist
Scope
The work is scoped in this order:
- Wazuh agent deployment across Windows and Linux endpoints in the lab
- Custom detection rule creation, tested against generated activity and mapped to MITRE ATT&CK
- TheHive configuration and the Wazuh-to-TheHive alert-to-case integration
- Sample alert triage workflow, documented from alert firing to case closure
- Screenshots from the live dashboard and TheHive case console once the above exists
This page will be updated with real screenshots and specifics as each step is actually working — not before.