Wazuh

What it is

Wazuh is an open source platform that combines SIEM functions, collecting and correlating log and event data from many sources, with XDR functions such as endpoint agents that monitor file integrity, detect malware indicators and assess system configuration against benchmarks like CIS. It is built from an indexer, a server and a dashboard, plus lightweight agents installed on the machines being monitored.

Why it suits a home lab

Because Wazuh is free and can run as a single-node deployment, it is realistic to install the whole stack on one virtual machine or a small server, add a couple of agents on other lab machines, and start seeing genuine detection output, file integrity alerts, vulnerability findings and correlated events, without needing enterprise infrastructure or a licence.

What the documentation covers

The official documentation includes a quickstart installer for a fast single-node setup, detailed agent installation instructions for Linux, Windows, macOS and several Unix variants, deployment guides for Docker, Kubernetes, Ansible and Puppet, and feature-specific sections on file integrity monitoring, malware and rootkit detection, vulnerability scanning, configuration assessment and compliance mappings to frameworks such as PCI DSS and GDPR.

How to use it

Follow the quickstart guide for a single-node install first, then add an agent to a second lab machine so you can see cross-machine correlation working. From there, deliberately generate some suspicious activity in a controlled way, such as modifying a monitored file or running a benign test script, to see how it appears in the dashboard, which is a far better way to learn a SIEM than reading about one in the abstract.

Free versus paid

The Wazuh platform itself is free and open source with no feature paywall on the core product. Commercial managed hosting and support contracts exist through Wazuh and partners for organisations that want someone else to run the infrastructure, but nothing in the self-hosted documentation requires payment.

Prerequisites

Comfort installing and administering a Linux server is the main prerequisite, since the indexer, server and dashboard components have real resource requirements even in a lab. Basic familiarity with what a SIEM does conceptually helps interpret what you are building.

Common questions

Can it run on a laptop for learning? A modest virtual machine with a few gigabytes of memory can run a single-node instance for learning purposes, though production deployments need considerably more resources.

Does it replace a commercial SIEM for real production use? Many organisations run it in production; whether it is the right choice depends on scale, support needs and existing tooling, which is worth researching separately.

Is prior detection engineering experience required? No, the documentation is written to be followed from a fresh install, though understanding logs and basic networking speeds things up considerably.