Build a home SIEM with Wazuh and catch a brute-force attack
A SIEM is the screen a security operations centre stares at all day: every login, every file change, every alert from every machine in one place. Build your own with Wazuh, the free open-source one many real SOCs run. Put agents on your PCs, set a tripwire folder, attack your own machine with a burst of bad logins, and watch the alert land on your phone a few seconds later.
- Phone alerts: serious alerts pushed to your phone through ntfy with a tested integration script from the kit
- A machine for the server: an old laptop, a mini PC or a virtual machine with 4 CPU cores, 8GB RAM and 50GB disk, running Ubuntu 24.04 (64-bit Intel/AMD or ARM). A Raspberry Pi 5 with 8GB is the absolute minimum and will be slow
- Admin rights on the computers you want to watch (Windows, Mac or Linux)
- The ntfy app on your phone (free, Android and iOS, no account needed)
- Comfortable in a terminal and with SSH. If not, start with Terminal survival kit
What a SIEM does, and what you're building
Understand the three jobs of a SIEM so every later step has a reason.
Logs are the evidenceEvery computer already records what happens on it: Windows writes event 4625 every time a logon fails, Linux writes
Invalid userto its SSH log, and both notice when a file changes if you ask. The problem is that nobody reads them. A SIEM (Security Information and Event Management) collects those logs from every machine, runs detection rules over them, and turns the interesting bits into alerts.Wazuh does all three jobsIt's free, open source and used by real security teams. The agent sits on each computer and ships logs and file changes over an encrypted link. The manager decodes them and runs thousands of built-in rules. The indexer stores the alerts and the dashboard lets you search them. You'll add the fourth piece yourself: a tiny script that pushes serious alerts to your phone.
The whole build. Everything stays inside your home network except the phone push. The rules you'll meetRule levels run from 0 to 16. One failed Windows logon is rule 60122 at level 5: a note, not an emergency. Eight failures from the same address inside four minutes become rule 60204, *Multiple Windows Logon Failures*, at level 10. On Linux, each SSH login for a user that doesn't exist is rule 5710, and eight of them in two minutes become 5712, *sshd: brute force trying to get access to the system*. That correlation, many small events becoming one meaningful alert, is the whole point of a SIEM.
Everything in the kitcustom-ntfy (phone alerts), integration-block.xml, fim-windows.xml, fim-linux.xml, simulate-windows-logon-failures.ps1 and simulate-ssh-failures.sh.