top of page

Wazuh SIEM/XDR Home Lab

​

End-to-End Deployment, Troubleshooting, and Log Ingestion​

​

Lab Overview

​

Designed and deployed a Wazuh SIEM/XDR home lab to gain hands-on experience with endpoint monitoring, log ingestion, and agent-to-server communication in a real-world security environment.

The lab included a Linux-based Wazuh server and a client endpoint configured to forward security telemetry for centralized analysis.

 

​Challenges Encountered

​

During setup, the environment did not behave as expected despite following official documentation. Several issues surfaced that required structured troubleshooting rather than simple configuration changes:

  • Silent agent communication failures with no immediate errors

  • Confusion between host OS, Linux VM, and Wazuh server networking

  • Misuse of loopback (127.0.0.1) instead of a reachable server IP

  • Editing configuration files that were not actively used by the agent

  • Configuration changes not applying due to missing service restarts

 

Troubleshooting Process

​

To resolve these issues, I methodically validated each layer of the environment:

  • Identified the correct NAT-assigned IP address for agent communication

  • Verified active network interfaces and connectivity

  • Updated the correct Wazuh agent configuration file

  • Restarted required services to apply changes

  • Confirmed successful agent registration and log flow

 

Outcome​

​

Successfully established stable agent-to-server communication and verified log ingestion within the Wazuh dashboard. The environment now reliably collects and visualizes endpoint security data.

​

 Key Takeaways

​

This lab reinforced core security engineering and SOC-relevant skills, including:

  • Real-world troubleshooting of SIEM deployments

  • Understanding how misconfigurations fail silently

  • Service lifecycle awareness in Linux environments

  • Reading logs and system output instead of relying on assumptions

This project provided a realistic view of how enterprise security tools behave outside of ideal documentation scenarios and strengthened my ability to diagnose issues systematically.

bottom of page