Wazuh for Beginners: Set Up a Lab and Read Your First Alerts

Wazuh is a free, open-source security platform that works as both a SIEM and an endpoint monitoring tool. Because it costs nothing, it is the easiest way to build a real SOC lab at home. This guide explains how it fits together and how to get your first alerts.

How Wazuh Fits Together

• Wazuh agent: installed on each machine you monitor; collects logs, file changes, inventory and configuration data
• Wazuh server: receives agent data, decodes it and applies rules to raise alerts
• Wazuh indexer: stores and indexes alerts so they can be searched
• Wazuh dashboard: the web interface where you search, view alerts and manage agents

Install It in Your Lab

For a lab, put the server, indexer and dashboard on one Linux virtual machine using Wazuh's quickstart installation assistant, which installs all three with one script. Check the quickstart page on documentation.wazuh.com for the current command and hardware requirements; give the machine enough memory, because the indexer is the hungriest part. At the end the installer prints the dashboard address and admin password. Keep the machine on your lab's isolated network; see our home lab guide.

Add a Windows Agent

From the dashboard, use the deploy-agent wizard to generate the install command for Windows, run it on your lab Windows machine, and start the agent service. Install Sysmon on the same machine and configure the agent to collect its log, so you get process, network and DNS detail. See Windows event IDs every SOC analyst should know.

What Wazuh Gives You Out of the Box

• Log analysis: built-in rules for Windows, Linux, web servers and many applications
• File integrity monitoring: alerts when watched files or registry keys change
• Security configuration assessment: checks machines against hardening benchmarks
• Vulnerability detection: matches installed software against known vulnerabilities
• Active response: optional automatic actions, such as blocking an IP address, which you should test carefully before using

Reading an Alert

Each alert shows a rule ID, a description, a level from 0 to 15 that indicates severity, the agent it came from and the full original log. Many rules are mapped to MITRE ATT&CK techniques. Start with the highest levels, open the full log, and ask the analyst's questions: what happened, on which machine, by which account, and is it expected?

Generate Something to Find

• Fail several logins on the Windows machine
• Create a new local user and add it to Administrators
• Change a file in a monitored folder
• Run a scan from Kali against the machine

Find each in the dashboard, note the rule that fired, and write a short case note. That habit is the core of SOC work.

Tuning: The Real Skill

A new deployment is noisy. Tuning means adjusting or adding rules so that alerts are worth reading: raising the level of what matters in your environment, lowering known-good activity, and writing custom rules for things the defaults miss. Every change should be documented.

Learning Wazuh with Guidance

Our SOC analyst, Splunk, Wazuh and DFIR course uses Wazuh for endpoint monitoring alongside Splunk, with Sysmon and Sigma. Read Splunk vs Wazuh for how the two differ.