Skip to Content

Self-Host Wazuh: Enterprise-Grade Security Monitoring in 20 Minutes

Self-Host Wazuh: Enterprise-Grade Security Monitoring in 20 Minutes

Your homelab is a fortress of services — but do you actually know when someone is probing the walls? Most self-hosters run firewalls and maybe Fail2ban, then call it a day. That is like locking your front door but never checking the windows.

Wazuh is an open-source, enterprise-grade security platform that gives you real-time threat detection, vulnerability assessment, file integrity monitoring, and compliance auditing — all from a single dashboard. Originally forked from OSSEC, it is now one of the most widely deployed SIEM (Security Information and Event Management) tools in the world. Companies with 10,000+ endpoints use it. You can run it on a single VPS.

In this guide, you will deploy a complete Wazuh stack with Docker, connect your first agent, and start detecting threats in under 20 minutes.

Why Self-Host Wazuh?

  • Real-time detection — Know instantly when someone brute-forces SSH, modifies critical files, or runs suspicious processes
  • Vulnerability assessment — Scans your systems against 100,000+ known CVEs automatically
  • File integrity monitoring (FIM) — Get alerted when /etc/passwd, nginx configs, or any file you care about changes
  • Compliance ready — PCI DSS, GDPR, HIPAA, and NIST 800-53 built-in
  • No per-agent pricing — Commercial SIEMs charge per endpoint. Wazuh is free and open source (GPLv2)

Prerequisites

  • A VPS with at least 4GB RAM and 2 vCPUs (Wazuh is hungry — 8GB recommended for production)
  • 50GB+ disk for logs and indices
  • Docker and Docker Compose installed
  • A domain pointed at your server (for TLS via reverse proxy)

Architecture Overview

Wazuh has three core components:

  1. Wazuh Manager — Receives and analyzes data from agents, decodes logs, runs detection rules
  2. Wazuh Indexer — Stores and indexes all security data (OpenSearch-based)
  3. Wazuh Dashboard — The web UI for visualizing alerts, hunting threats, and managing agents

We will deploy all three with Docker Compose.

Step 1: Create the Docker Compose Stack

Create a directory for Wazuh and download the official compose file:

mkdir -p ~/wazuh && cd ~/wazuh
curl -so docker-compose.yml https://raw.githubusercontent.com/wazuh/wazuh-docker/v4.8.0/single-node/docker-compose.yml
curl -so generate-certs.yml https://raw.githubusercontent.com/wazuh/wazuh-docker/v4.8.0/single-node/generate-certs.yml

Generate the TLS certificates:

docker-compose -f generate-certs.yml run --rm generator

Now create a .env file to customize the deployment:

cat > .env << 'EOF'
INDEXER_USERNAME=admin
INDEXER_PASSWORD=YourStrongPassword123!
DASHBOARD_USERNAME=admin
DASHBOARD_PASSWORD=YourStrongPassword123!
EOF

Step 2: Launch Wazuh

docker-compose up -d

This pulls and starts four containers:

  • wazuh.manager — The analysis engine
  • wazuh.indexer — OpenSearch for log storage
  • wazuh.dashboard — The web interface
  • wazuh.cert_generator — One-time cert generation (exits after)

Wait 2-3 minutes for initialization. Check status with:

docker-compose ps
docker-compose logs -f wazuh.dashboard

When you see "Wazuh dashboard started", you are ready.

Step 3: Access the Dashboard

Open https://your-server-ip:5601 in your browser. You will need to accept the self-signed certificate warning (or configure your reverse proxy with proper TLS).

Log in with:

  • Username: admin
  • Password: YourStrongPassword123! (from your .env file)

You should see the Wazuh dashboard with zero agents connected — let us fix that.

Step 4: Deploy Your First Agent

On any machine you want to monitor, install the Wazuh agent. For Debian/Ubuntu:

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor -o /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
apt-get update && apt-get install wazuh-agent

Configure the agent to point at your manager:

nano /var/ossec/etc/ossec.conf

Find the <client> section and set your server IP:

<client>
  <server>
    <address>YOUR_WAZUH_SERVER_IP</address>
    <port>1514</port>
    <protocol>tcp</protocol>
  </server>
</client>

Start the agent:

systemctl enable wazuh-agent
systemctl start wazuh-agent

Within 30 seconds, the agent appears in your dashboard under Agents.

Step 5: Verify It Works

Let us trigger a real alert. On the agent machine, run:

sudo useradd testintruder
sudo passwd testintruder

Within seconds, Wazuh fires alert Rule 5902: "New user added to the system". Check your dashboard:

  1. Go to Security Events
  2. Filter by rule.id: 5902
  3. You should see the alert with full context — which user ran the command, from where, and when

Now try SSH brute-force protection. Wazuh detects failed login attempts out of the box. Run ssh wronguser@your-agent-ip a few times and watch the alerts pile up.

What You Get Out of the Box

With zero custom rules, Wazuh immediately provides:

  • SSH brute-force detection — After X failed attempts, alert + optional active response (block the IP)
  • File integrity monitoring — Watches /etc, /bin, /sbin, and /usr/bin for changes
  • Rootkit detection — Scans for known rootkit signatures and anomalies
  • Process monitoring — Alerts on suspicious process names, hidden processes, and privilege escalation
  • Log analysis — Apache, Nginx, MySQL, PostgreSQL, Docker, systemd journal, and 100+ more
  • Vulnerability detection — Correlates installed packages against the CVE database

Enable Vulnerability Detection

By default, vulnerability scanning is off. Enable it on the manager:

docker exec -it wazuh.manager /var/ossec/bin/wazuh-control stop
docker exec -it wazuh.manager sed -i 's/<vulnerability-detection>\n    <enabled>no/<vulnerability-detection>\n    <enabled>yes/' /var/ossec/etc/ossec.conf
docker exec -it wazuh.manager /var/ossec/bin/wazuh-control start

Or edit the config directly:

docker exec -it wazuh.manager vi /var/ossec/etc/ossec.conf

Set:

<vulnerability-detection>
  <enabled>yes</enabled>
</vulnerability-detection>

Restart the manager. Within minutes, every connected agent gets a full CVE report in the dashboard.

Next Steps

You now have a working SIEM. Here is where to go deeper:

  • Active Response — Automatically block attacking IPs with firewall rules
  • Custom Rules — Write your own detection logic for specific threats
  • Integrations — Forward alerts to Slack, Discord, PagerDuty, or TheHive
  • File Integrity on Custom Paths — Monitor your Docker volumes, web roots, or config directories
  • Compliance Modules — Run GDPR or PCI DSS audits with pre-built checks

Wazuh is not just a tool — it is a security operations center you own. No cloud dependency, no per-endpoint licensing, no telemetry leaving your infrastructure. Just you, your data, and full visibility into what is actually happening on your servers.

Deploy it today. Your future self will thank you when the first alert fires at 3 AM.

Self-Host n8n: Build Powerful AI Workflows in Your Homelab in 15 Minutes