index

Setting up a SIEM in my homelab

My motivation for setting up a Security and Information Event Management (SIEM) platform in my home lab is twofold. On the genuinely useful side of things, I have two old MacBooks that run on Ubuntu’s server and both of them run self-hosted services, among them Jellyfin and a simple todo list. I also have a Raspberry Pi 4 that runs Home Assistant OS, which I’ve been using to explore IoT and home automation for things like smart lighting, adjusting thermostat, and creating reminders/announcements on the smart speakers scattered throughout my home.

On the more experimental side, I will soon have a Dell Optiplex Micro with Proxmox installed that I plan to use for a cyber security sandbox environment. I want to be able to collect information, monitor all of these machines, and ensure that I am experimenting in a secure and responsible way.

Prerequisites

Before starting, you must have an .iso file for Ubuntu Server or whatever OS you decide to use. You can download Ubuntu Server OS here: (https://ubuntu.com/download/server).

My Macbook has an M2 chip, which requires an ISO that is ARM64. Download here: (https://cdimage.ubuntu.com/ubuntu/releases/24.04/release/) Then select ubuntu-24.04.4-live-server-arm64.iso

  1. .iso file
  2. Virtualization software - I’m using UTM. I hear it plays well on MacOS devices and I’ve already tried VirtualBox in the past and found the UX to be janky. Download UTM here: (https://mac.getutm.app/)
  3. 8GB RAM, 50GB Storage, 4vCPU (Official Wazuh recommendation for 1-25 agents and 90 days of storage)

Setting up your first Virtual Machine in UTM

  1. Create new virtual machine
  2. Virtualize
  3. Linux
  4. Hardware: Memory: 8192 MiB CPU Cores: 4 Enable display output: Checked Enable hardware OpenGL acceleration: Unchecked
  5. Linux: Use Apple Virtualization: Unchecked Boot Image Type: Boot form ISO image Browse -> Select .iso
  6. Storage: 50 GiB
  7. Shared Directory: Don’t select anything -> Continue
  8. Summary: Select a name for the VM -> Save

Start up the VM and go through the initial Ubuntu installation process, selecting defaults until the Network Configuration step.

Network Configuration

On the Network Configuration step, use the default IP address range. This is UTMs shared network, which create its own private NAT subnet that exists only inside this Macbook. VM traffic goes out through the Mac, so the home network never sees the VM directly.

You can switch to bridged mode so that the VM gets a 10.0.x.x address from the home DHCP server. This would allow me to put the VM in a VLAN and get metrics, logs, etc. from devices other than my Macbook this VM is running on.

For now, I am going to continue with the installation and setting up Wazuh before I move into Bridged mode. One thing at a time.

Use the default configurations for the following steps, then enter the Profile Configuration. This is where you create your first user, assign a password to it, and create your server name.

SSH Configuration

Check the “Install OpenSSH server” option. This will allow you to connect to the VM from the Mac terminal instead of working in the UTM window. Skip importing an SSH key. Password authentication is fine for now and adding the SSH key later and disabling password authentication is a good hardening exercise to document.

Skip adding additional packages on the following screen.

When the installation completes, select the “Reboot Now” option.

Installing Wazuh

Since this is an all-in-one installation (i.e. dashboard, server, and indexer on one machine) I am using the Wazuh quickstart guide (https://documentation.wazuh.com/current/quickstart.html).

After running the setup script and at the end of its output, it prints the login credentials for your initial login into the Wazuh dashboard.

Once logged into the dashboard, it’s time to add agents for your Wazuh instance to monitor. From the sidebar, select Agent Management -> Summary -> Deploy new agent to get started adding the first agent. It will ask you to select the OS, Wazuh web server IP address, agent name that you create, and the group. Based on these responses, a command is generated for you to download and install, then run the agent. Copy and run each of those commands on your agent.

Once run, the agent should pop up after ~5 minutes and you have your first device to monitor in the new SIEM!