Wazuh is a relatively new player in the Security Information and Event Management (SIEM) space, and given its open-source nature, I decided to take a closer look. My goal was to see how easy it is to install, how user-friendly it is, and whether it meets the needs of someone like me, who is running a small, home-lab-style environment.
Unfortunately, I don’t own a full home lab, but I set up a simple two-node network composed of my host machine and a Kali Linux virtual machine (VM). My host machine ran Wazuh using the Docker installation method, while the Kali VM acted as an agent. I was pleasantly surprised to find that setting everything up took me around 15 minutes. The installation process was seamless, and the Kali VM was quickly recognized as an agent.
After running a few commands on my Kali Linux VM, I was able to start visualizing its security data within the Wazuh dashboard. I honestly didn’t expect it to be this straightforward, but it was. Wazuh has proven itself as a robust open-source SIEM solution, and this is great news for the cybersecurity community, especially for those looking for accessible, reliable security tools for their home labs or small networks.
Installation Process
Wazuh Manager:
To install the Wazuh Manager, I followed these steps:
- Clone the Git repository: I cloned the Wazuh Docker repository from GitHub.
- Navigate to the appropriate directory: I changed into the
single-nodedirectory (designed for small setups like mine). - Run Docker Compose: Running
docker-compose up -dinitiated the deployment of all the necessary Docker images, including the Wazuh Manager, Indexer, and Dashboard. Everything was set up automatically with minimal effort.
Wazuh agent:
What I found particularly user-friendly about Wazuh is how it provides clear instructions for adding agents. The Manager displays commands tailored to the agent’s operating system. Here’s what I did to set up the Kali Linux agent:
- Download the agent: I followed the instructions provided in the Wazuh dashboard to download the appropriate agent for my system.
- Configure the agent: I specified the local IP address of my Wazuh Manager during the configuration step to ensure communication between the agent and the manager.
- Start the agent: After configuring the agent, I simply ran
systemctl start wazuh-agent, and my Kali Linux VM was successfully connected to the Wazuh Manager.
What i learned
This experience highlighted a few key points about Wazuh and the broader cybersecurity community:
- Ease of Use: Despite being a powerful and complex tool, Wazuh manages to be beginner-friendly, especially for those using Docker. The installation process was smooth, and the detailed agent setup instructions made the entire experience hassle-free.
- Accessibility: Wazuh is a strong option for home lab enthusiasts or small businesses that want an open-source SIEM without the complexities and costs of enterprise-grade solutions.
- Community Support: The fact that Wazuh is open-source and backed by an active community ensures continuous improvement and support. This shows that the future of cybersecurity tools, especially in the open-source domain, is bright.
