A self-built SOC environment — Wazuh SIEM watching a segmented network behind OPNsense, with real telemetry from Windows and Linux hosts instead of a lab dataset.
Role
Sole engineer — design, build, tuning
Timeline
2025 · ongoing
Status
Running
Stack
Wazuh · OPNsense · TrueNAS · Ubuntu Server · Zabbix
Network topology — OPNsense terminating the SLT 4G uplink, wired hosts behind a managed switch, and wireless clients hanging off their own access point.
Wazuh endpoint view: MITRE ATT&CK tactic counts, PCI DSS compliance breakdown, and a CIS benchmark scan against the Windows 11 host.
Vulnerability detection on the Ubuntu server — the kernel package alone accounted for the bulk of the findings.
4.12
Wazuh version deployed
26%
CIS Windows 11 baseline at first scan
2
critical CVEs surfaced on day one
01
Why build it
Detection engineering is hard to practise on someone else's network. Reading about correlation rules teaches you the syntax; it doesn't teach you what a noisy rule feels like at two in the morning, or how much of a default rule set is irrelevant to the hosts you actually run. I wanted somewhere I could break things on purpose and watch what the tooling said about it.
02
The build
OPNsense on a mini PC terminates the uplink and handles segmentation, with TrueNAS for storage and an Ubuntu server carrying the services. That server runs the full Wazuh stack — manager, indexer, and dashboard — alongside Zabbix for infrastructure metrics, AdGuard Home for DNS filtering, and Jellyfin as the household-facing reason the lab stays powered on. Agents report from both Windows and Linux hosts, so the rule set has to cope with two very different log vocabularies.
03
What the telemetry showed
The first CIS Microsoft Windows 11 Enterprise benchmark scan came back at 26% — 123 checks passed against 350 failed. That number is the point of the exercise: a machine that felt fine was measurably far from a hardening baseline, and the failures were specific enough to work through. Vulnerability detection on the Ubuntu host surfaced 2 critical and 266 high findings, most of them tracing back to a single unpatched kernel package rather than 266 separate problems.
04
Tuning is the real work
Standing the stack up took an evening. Making its alerts worth reading took considerably longer. Out of the box the rules fired on ordinary behaviour often enough that ignoring the dashboard became the rational response — which is the exact failure mode a SIEM is supposed to prevent. Most of the ongoing effort goes into suppressing known-good activity and correlating events across the Zabbix and AdGuard feeds, so that what remains is small enough to actually triage.
