← All projects Labs

My SIEM Lab.

A personal Wazuh lab in VirtualBox for learning security monitoring, alert review, and endpoint visibility.

Wazuh VirtualBox SIEM Home lab
Wazuh overview dashboard showing alert-severity summaries and an initial setup with no endpoint agents registered.
Wazuh overview during the initial setup. No endpoint agents were registered at the time of this capture. Open full-size screenshot ↗

The goal

Build practical experience with a security information and event management (SIEM) platform in a home lab. My focus is learning how security events are collected, organized, and investigated through a central interface.

The environment

The lab uses the Wazuh virtual appliance in VirtualBox on my Windows computer. The all-in-one appliance brings the Wazuh server, indexer, and dashboard together in one virtual machine.

Setup and troubleshooting

I imported the Wazuh appliance into VirtualBox and worked through virtual-machine startup issues. Adjusting the VM’s resource allocation helped get the virtual machine running.

The overview screenshot captures the initial dashboard view and provides a starting point for the next stage of the lab.

Next stage

The planned expansion is to enroll a Windows endpoint and add Sysmon event collection. This will provide a basis for practicing endpoint monitoring and alert investigation as the lab develops.

PROJECT DISCOVERY

Explore more work.

All projects ↗
Analytics Dashboards & Reports

Average Time to Cut Keys Dashboard

A Power BI dashboard for Ingress Management Services and Facilities Services, tracking monthly key-cutting workload, completion time, and backlog trends from 2023 onward.

Power BI Operational reporting Backlog analysis
Explore project