How to Build a SOC Home Lab on Linux with Wazuh SIEM (2026 Guide)

Last updated: 23 October 2026. Written for Wazuh 4.14 (latest release 4.14.9, 14 October 2026) on Ubuntu 24.04. Commands and requirements are taken from the official Wazuh documentation linked at the end.

A home Security Operations Centre (SOC) lab is the best way to learn how defenders actually work: collecting logs, writing and tuning detection rules, and investigating alerts. You can build a capable lab for free with Wazuh, an open-source SIEM and XDR platform, and two or three virtual machines. This guide walks through the design, installation, connecting endpoints, safe detection tests, and what to practise next.

Lab design

The Wazuh server sizing matches the official quickstart guidance for up to 25 agents (4 vCPU, 8 GiB RAM, 50 GB for 90 days of alerts). A host computer with 16 GB RAM runs all three VMs comfortably. Use VirtualBox, VMware Workstation, Proxmox or Hyper-V, and put the VMs on a host-only or isolated NAT network so lab traffic stays in the lab.

Step 1: Install the Wazuh server

On VM 1, after updating the system, run the official installation assistant. The -a option installs the indexer, server and dashboard on one host.

sudo apt update && sudo apt -y full-upgrade
curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

The installer takes several minutes and prints the admin password at the end. If you miss it, all generated passwords are stored in an archive in the same folder:

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Open https://<VM1-IP> in your browser, accept the self-signed certificate warning (expected in a lab) and log in as admin. Wazuh recommends disabling its package repository after installation so a routine apt upgrade does not upgrade components out of order; upgrade Wazuh deliberately, following its upgrade guide.

Ports the lab uses

Allow 1514 and 1515 from your endpoint VMs and 443 from your host computer only. Never expose a lab SIEM to the internet.

Step 2: Connect endpoints

In the dashboard, open Agents management → Summary → Deploy new agent. Choose the operating system, enter the Wazuh server IP address and an agent name, and the wizard generates the exact install and start commands for that endpoint. Run them on VM 2 (and VM 3), then confirm the agents are connected:

# On the Linux endpoint
sudo systemctl status wazuh-agent

# On the Wazuh server: list agents and their status
sudo /var/ossec/bin/agent_control -l

For the Windows endpoint, also install Sysmon with a well-known community configuration. Sysmon records process creation, network connections and file changes in far more detail than default Windows logs, which makes detections much better.

Step 3: Generate safe test activity

A SIEM is only useful if you know what its alerts look like. These tests are harmless and run only against your own lab machines:

To watch a folder in real time, add a line inside the <syscheck> block of /var/ossec/etc/ossec.conf on the endpoint, then restart the agent:

<directories realtime="yes">/opt/fim-test</directories>

sudo mkdir -p /opt/fim-test
sudo systemctl restart wazuh-agent
echo "hello" | sudo tee /opt/fim-test/test.txt
echo "changed" | sudo tee -a /opt/fim-test/test.txt
sudo rm /opt/fim-test/test.txt

Find the results under Threat Hunting and File Integrity Monitoring in the dashboard. Open each alert and note the rule ID, level, MITRE ATT&CK technique, and which log line triggered it.

Step 4: Practise SOC analyst skills

1. Triage: for each alert, decide whether it is expected, suspicious or malicious, and write down why.
2. Tune: reduce noise from known-good activity using local rules in /var/ossec/etc/rules/local_rules.xml, rather than editing the default rules (they are overwritten on upgrade).
3. Add log sources: collect web server logs (nginx or Apache access logs) and practise spotting scanning and error spikes.
4. Configuration assessment: review the Security Configuration Assessment (SCA) results, which check endpoints against CIS benchmark-based policies, and fix a few failing checks.
5. Write it up: document each investigation as a short incident report. This is exactly what SOC interviews ask about, and it makes a strong portfolio.

When you are comfortable, explore controlled adversary-emulation frameworks such as Atomic Red Team, which map small, documented tests to MITRE ATT&CK techniques. Run them only on isolated lab machines you own, read each test before running it, and take VM snapshots first.

Other tools you can add

Troubleshooting

Frequently asked questions

Can I run the lab on a laptop?

Yes, with 16 GB RAM you can run the Wazuh server and one or two endpoints. With 8 GB, run only the Wazuh server and use your host or a tiny VM as the endpoint, or rent a small cloud VM for the server and keep it firewalled to your own IP address.

Is Wazuh a real SIEM used by companies?

Yes. Wazuh is open source and used in production by many organisations, especially small and mid-sized ones. The skills transfer directly to commercial SIEMs: log sources, rules, alert triage and investigation are the same concepts.

Does a home lab help me get a SOC job?

It helps a lot, especially if you document what you built and investigated. Pair it with our interview preparation hub and the free Linux server hardening checklist.

Need a SIEM or log monitoring set up for your business? Contact us or see our services.

Sources

• Wazuh documentation: Quickstart
• Wazuh documentation: Architecture and required ports
• Wazuh 4.14.9 release notes
• Wazuh documentation: File integrity monitoring basic settings
• Microsoft Sysinternals: Sysmon
• MITRE ATT&CK