Darshan Sanjel
  1. Portfolio
  2. Projects
  3. Wazuh SIEM lab
Case study

A self-hosted SIEM that drafts its own incident write-ups.

Wazuh collecting logs from my home lab, with a Node.js proxy that hands alerts to locally hosted language models and a React dashboard on top.

Status
Ongoing
Core
Wazuh 4.14 · Ubuntu 24.04
Glue
Node.js · Express
UI
React · TypeScript

01The problem

Security courses show alerts as screenshots. I wanted real ones: a SIEM watching machines I actually run, so I could practice triage and turn alerts into incident-response write-ups the way an analyst would.

02Setup

  • Wazuh 4.14 all-in-one (manager, indexer and dashboard) on a dedicated Ubuntu 24.04 VM.
  • Agents enrolled on the hypervisor and on the SIEM host itself for log collection and alerting.
  • A Node.js / Express proxy that takes collected alerts and sends them to locally hosted language models, which draft incident-response write-ups.
  • A React + TypeScript dashboard that shows Wazuh alerts and network anomalies next to the native Wazuh interface.

Because the models run on my own hardware, alert data (hostnames, usernames, IP addresses) never has to leave the lab to get a write-up drafted.

03Architecture

Wazuh SIEM lab architecture Wazuh agents on the hypervisor and SIEM host send logs to a Wazuh all-in-one VM. Alerts go to a Node.js Express proxy, which sends prompts to a local language model and returns drafted write-ups. The proxy also feeds a React dashboard. Home lab Hypervisor Wazuh agent Wazuh 4.14 all-in-one Ubuntu 24.04 VM manager · indexer · dashboard + local agent Express proxy Node.js Local LLM self-hosted model React dashboard alerts + network anomalies logs alerts prompt draft feeds
Logs flow left to right: agents → Wazuh → proxy → local model. The dashed line is the drafted write-up coming back.

04What broke and how I fixed it

The write-up of the problems I hit while building this is in progress. The networking faults in the lab that hosts it are documented in the Proxmox case study.

05What I'd do next

  • Enroll more endpoints, including a Windows machine, so the alerts cover more than Linux hosts.
  • Map alerts to MITRE ATT&CK techniques in the dashboard to make triage faster.
  • Score the drafted write-ups against my own to see where the local models get things wrong.