SIEM installation
Today’s focus was expanding the home lab by deploying Wazuh SIEM on a second laptop. To keep things flexible, I opted for a Docker container deployment. Since this is a testing phase, I’m not overly concerned about potential issues; I plan to have a more permanent, dedicated system in place by the time the lab goes "production."
For now, the Dockerized Wazuh will be a "start-and-stop" process. This allows me to keep the laptop available for lab expansions while still having enough resources to stay on top of my university coursework.
The Hurdles: Passwords and Architectures
The first major struggle today was a stubborn authentication issue. For some reason, Wazuh refused to let me change the default admin password. From a security standpoint, leaving default credentials active is a massive red flag, so I spent a good chunk of time troubleshooting until it finally took.
Next came the agent deployment. A small but critical detail the Wazuh dashboard doesn't explicitly highlight is the architecture difference for certain devices. When deploying to my Raspberry Pi, the default "AMD64" code failed. I had to manually swap amd64 to arm64 in the installation string. Once that simple edit was made, the agent connected instantly without further issues.
The Long Road Ahead: Vulnerability Triage
The biggest task—and likely the most time-consuming—is tackling the mountain of vulnerabilities Wazuh just handed me:
40 Critical/High
72 Medium
4 Low
It’s an intimidating list at first glance, but a quick deep-dive reveals some interesting context. Looking at the first few "High" alerts, I found that Debian (the OS on my Pi) has actually marked some of these as "<ignored>".
In many cases, the security team deems the risk "Minor" or "Local only," meaning a user would have to manually run a very specific, obscure command for the vulnerability to even be a threat. It’s a good reminder that SIEM alerts require a human touch to separate real risks from "paper" vulnerabilities.
Next Steps
Over the next few days, I’ll be balancing three plates:
Dissertation Prep: Mapping out my initial ideas and research.
Lab Hardening: Continuing to build out the environment.
Vulnerability Triage: Methodically working through the Wazuh list to see what needs a patch and what is just "noise."