Blue-Team Home Lab: Wazuh SIEM, Sysmon and Security Onion

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion (you are here)
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

The goal

Attacking a lab is half the skill. SOC analyst roles, CySA+, BTL1 and most interviews test the other half: could you see the attack, and could you prove what happened? This part turns your lab into a small SOC.

Step 1: Better Windows telemetry with Sysmon

Default Windows logs miss most of what an analyst needs. Sysmon (System Monitor, from Microsoft Sysinternals) adds process creation with full command lines and hashes, network connections, image loads, and more, in the Microsoft-Windows-Sysmon/Operational log.

1. Download Sysmon from the Sysinternals page onto DC01 and WS01.
2. Download a community configuration - sysmon-modular is a well-maintained starting point. Raw Sysmon without a config is either too noisy or too quiet.
3. Install it from an elevated prompt:

.\Sysmon64.exe -accepteula -i sysmonconfig.xml

4. Open Event Viewer > Applications and Services Logs > Microsoft > Windows > Sysmon > Operational, and confirm events appear (Event ID 1 is process creation).

Also enable PowerShell Script Block Logging through Group Policy (Administrative Templates > Windows Components > Windows PowerShell). It records the actual script content attackers run.

Step 2: Install Wazuh as your SIEM

Wazuh is a free, open-source SIEM and XDR platform. Its all-in-one install puts the indexer, server and dashboard on a single Linux VM.

1. Create an Ubuntu Server VM with 8 GB RAM, 4 CPUs and 50 GB+ disk on the CORP network (it needs internet during install).
2. Follow the Wazuh quickstart and run the install script exactly as published there. The command includes the current version number, so copy it from the documentation rather than from an old blog post. The script prints the admin password at the end - save it.
3. Browse to https://<wazuh-ip> and log in.

Step 3: Enrol your endpoints

In the Wazuh dashboard choose Deploy new agent, select Windows, enter the server address, and copy the generated PowerShell command. Run it on DC01 and WS01, then start the service:

NET START Wazuh

To collect Sysmon events, add the Sysmon channel to the agent's configuration (ossec.conf on the endpoint, or centrally through agent groups):

<localfile>
  <location>Microsoft-Windows-Sysmon/Operational</location>
  <log_format>eventchannel</log_format>
</localfile>

Restart the agent and confirm Sysmon events arrive in the dashboard.

Step 4: Network monitoring with Security Onion

Security Onion is a free Linux distribution for network security monitoring: Suricata IDS alerts, Zeek connection logs, full packet capture and a hunting interface.

• It is resource-hungry. Check the current hardware requirements in its documentation before you start; plan for substantially more RAM than the other VMs.
• It needs two network adapters: one for management and one sniffing interface that sees the traffic you want to watch. In a hypervisor, set the sniffing adapter to promiscuous mode: allow all on the segment you want to monitor (for example ATTACK).
• For a first install choose the evaluation or standalone option the installer offers.

If your hardware cannot carry it, skip Security Onion for now - Wazuh plus Sysmon already gives you a strong endpoint-detection lab.

Step 5: Detect your own attacks

Replay the exercises from earlier parts and find each one in your tools:

Write down what you saw, what you missed, and which rule or log source would have closed the gap. That write-up is exactly the evidence a hiring manager wants to see.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Where to go next

You now have a complete attack-and-defend lab. Parts 10 and 11 extend it to mobile apps and industrial control systems. Keep it useful by snapshotting a clean state, adding one new technique at a time, and documenting each exercise. When you want guided scenarios, our SIEM lab, threat-hunting lab and detection engineering lab run in the browser with realistic data.