A self-hosted SIEM built to monitor lab.maninejad.com's production EC2 host in real time. The manager, indexer, and dashboard run on a local VM behind home NAT; a lightweight agent on EC2 ships logs across a private mesh network back to the manager. Below is the architecture, the build process (including the failures), and real detections it has already caught — including unsolicited scanning traffic from the open internet.
Wazuh over ELK/Security Onion: single-VM footprint, built-in MITRE ATT&CK and compliance mapping (PCI DSS, GDPR, NIST 800-53), and a detection model that closes the loop directly with prior offensive-security lab work.
Tailscale over port-forwarding: the manager sits behind home NAT with no public IP. Rather than forwarding router ports (fragile, exposes the home network), a WireGuard-based mesh gives both machines stable private addresses that reach each other directly — zero-trust networking applied at home-lab scale.
First install attempt failed mid-way through the dashboard package (No space left on device) — the VM's virtual disk had been created at a default 20GB rather than the planned 50GB, and the installer's automatic rollback left the package manager in a broken state.
The rollback left wazuh-manager half-installed — its prerm/postrm maintainer scripts referenced binaries that no longer existed on disk, so every removal attempt failed with exit code 127. Fixed by neutralizing the broken scripts directly and force-purging.
With disk space corrected and package state cleaned, the all-in-one installer (indexer + manager + dashboard) completed successfully in ~10 minutes.
Within hours of the agent going live, an unknown external host began probing the site for common misconfiguration files — no attack was staged for this one, this is ordinary background internet scanning being caught in real time.
| Field | Value |
|---|---|
| Rule | 31101 — Web server 400 error code |
| Requested paths | /config.json, /sitemap.xml |
| Source | external IP, unrelated to lab infrastructure |
| Rule level | 5 |
| Compliance mapping | PCI DSS 6.5 / 11.4 · GDPR IV_35.7.d · NIST 800-53 SA.11 / SI.4 |
A deliberate login attempt against a non-existent account, run from the Kali VM, appeared in the agent's shipped auth.log data within seconds of the attempt — confirming the manager → agent → detection pipeline works end-to-end.
/api/chat endpoint/var/www/html and /etc/nginx