Building a Wazuh SIEM Lab: Multi-Source Security Monitoring with Custom Detection Rules

Introduction

One of my goals as an aspiring Security Operations Center (SOC) Analyst is to understand how security events are collected, monitored, and investigated in a real-world security operations environment.

To build this practical experience, I developed a hands-on Security Information and Event Management (SIEM) lab using Wazuh. The project focused on centralizing logs from multiple sources, creating security dashboards, writing custom detection rules, and investigating authentication events and suspicious system activity.

Rather than relying only on theoretical knowledge, I used this lab to understand how a SIEM helps an analyst gain visibility into endpoint activity and identify behaviour that may require further investigation.

In this article, I share the lab architecture, tools, implementation, detection logic, findings, challenges, and lessons learned from the project.

1. Overview

The objective was to create a centralized security monitoring environment that could collect and display events from different systems in one place.

The lab included a Wazuh server, a Windows endpoint, a Linux endpoint, and simulated firewall logs. I configured log collection and created dashboards to help visualize security events.

I also developed custom detection rules for repeated authentication failures and suspicious execution of trusted Windows binaries.

The project gave me practical exposure to SIEM deployment, endpoint monitoring, log analysis, custom detection rules, and security investigation.

2. Objectives

The main objectives were to:

• Deploy a Wazuh SIEM server.
• Collect security logs from Windows and Linux endpoints.
• Integrate simulated firewall logs.
• Centralize and visualize events through Wazuh dashboards.
• Create custom detection rules for suspicious activity.
• Investigate authentication events and identify patterns that could indicate a security threat.
• Troubleshoot issues encountered during deployment and integration.

3. Tools and Technologies

• Wazuh: Centralized security monitoring, event analysis, and alerting.
• Ubuntu Server 22.04: Operating system for the Wazuh server.
• Windows: Endpoint for collecting Windows security events.
• Linux: Endpoint for collecting system logs.
• Simulated firewall logs: Additional data for practicing network-related monitoring.
• UTM virtualization: Used to run the lab environment on my computer.

4. Lab Architecture

The lab was designed around a central Wazuh server receiving logs from multiple sources.

5. Log Collection and Security Monitoring

I connected multiple sources to the lab to improve visibility across different types of activity.

Windows security event logs provided visibility into endpoint events, while Linux system logs added another source of operational and security information. Simulated firewall logs provided additional data for exploring network-related events.

Centralizing these sources helped me understand why a SOC analyst should not investigate every event in isolation. Looking at multiple sources can provide useful context when determining whether activity is expected or suspicious.

6. Developing Custom Detection Rules

After establishing log collection, I created custom rules to identify security-related patterns.

Detecting repeated authentication failures

One rule was designed to identify five failed authentication attempts within five minutes. Repeated failures can indicate a possible brute-force attempt, although legitimate mistakes or automated services may also cause repeated failures.

The rule was designed to flag a potentially suspicious pattern for the analyst's further validation.

Detecting suspicious use of trusted Windows binaries

I also created a rule to identify potentially suspicious execution of trusted Windows binaries, often referred to as living-off-the-land binaries (LOLBins).

These binaries can have legitimate administrative uses but may also be abused. Their execution should therefore be assessed in context rather than automatically treated as malicious.

7. Building Investigation Dashboards

I created dashboards to make important information easier to review.

These included views for Windows events, authentication activity, network traffic, endpoint status, and frequently observed processes.

The dashboards helped me explore event patterns and see how visual summaries can support investigations. They also reinforced the importance of selecting useful data rather than relying on the number of alerts alone.

8. Key Findings

The project demonstrated that I could centralize logs from multiple sources, visualize security events, and create custom rules for selected suspicious behaviours.

The authentication dashboard made repeated login failures easier to examine, while the custom rules provided a starting point for identifying behaviour that needed further investigation.

I also learned that an alert is not, by itself, proof of an attack. Analysts need to examine the available evidence, understand the context, and decide whether an event requires escalation or can be closed as legitimate activity.

9. Challenges Encountered

One challenge was running multiple virtual machines while working with limited hardware resources. I also encountered a Wazuh Manager startup timeout that required troubleshooting.

Integrating different log sources and developing detection rules that minimized false positives required additional testing and configuration.

Working through these challenges improved my troubleshooting skills and helped me better understand the relationship between system configuration, log collection, and reliable security monitoring.

10. What I Learned

This project helped me understand the practical role of a SIEM in a SOC environment.

I gained experience with Wazuh deployment, endpoint log collection, security dashboards, custom correlation rules, authentication monitoring, and event investigation.

I also learned that an effective monitoring environment depends on more than installing a tool. Analysts need reliable telemetry, useful detection logic, appropriate context, and a repeatable investigation process.

Conclusion

Building this lab was an important step in my journey toward becoming a SOC Analyst. It allowed me to move from learning SIEM concepts to working with a hands-on monitoring environment that brought together Windows, Linux, and simulated firewall data.

The experience established a foundation for my subsequent work in detection engineering and alert triage, where I developed and tested more focused detections using Wazuh, Sysmon, Atomic Red Team, and MITRE ATT&CK.

Project Repository

The repository includes the project README, architecture diagram, screenshots, technical report, and presentation.

Explore the project on GitHub: https://github.com/CyberTife/SIEM-Lab-Wazuh