Home SOC Setup with Wazuh + Suricata (Free)

What is a Home SOC?

A Security Operations Center (SOC) monitors your systems for threats 24/7. A home SOC uses free, open-source tools to achieve what enterprise teams pay millions for:

• Wazuh — SIEM + HIDS (Host Intrusion Detection) — GitHub
• Suricata — Network IDS/IPS
• Snort 3 — Network intrusion detection

Install Wazuh (SIEM + HIDS)

# Add Wazuh repository
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor -o /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \
  | tee /etc/apt/sources.list.d/wazuh.list

# Install Wazuh agent (on monitored machine)
sudo apt update && sudo apt install wazuh-agent

# Configure manager IP
sudo sed -i 's/MANAGER_IP/your-wazuh-server-ip/' /var/ossec/etc/ossec.conf

# Start agent
sudo systemctl start wazuh-agent
sudo systemctl enable wazuh-agent

# Install Wazuh manager + indexer + dashboard (on server VM)
# Full guide: https://documentation.wazuh.com/current/quickstart.html
curl -sO https://packages.wazuh.com/4.8/wazuh-install.sh
sudo bash wazuh-install.sh -a

# Access dashboard
# https://your-server-ip:443
# Default: admin / (shown at end of install)

Install Suricata IDS

# Install Suricata
sudo apt install suricata

# Update rule sets
sudo suricata-update

# Configure network interface
sudo nano /etc/suricata/suricata.yaml
# Find "af-packet" section, set interface: eth0

# Start Suricata
sudo systemctl start suricata
sudo systemctl enable suricata

# Watch alerts in real-time
sudo tail -f /var/log/suricata/fast.log

# Test with a known-bad request
curl http://testmynids.org/uid/index.html
# Should generate an alert in fast.log

Install Snort 3

# Install Snort 3
sudo apt install snort3

# Verify install
snort3 -V

# Test configuration
sudo snort3 -T -c /etc/snort3/snort3.lua

# Start monitoring on eth0
sudo snort3 -i eth0 -c /etc/snort3/snort3.lua -A alert_fast

# View alerts
sudo tail -f /var/log/snort/alert_fast.txt

Centralise Logs with rsyslog

# On monitored machines — send logs to Wazuh server
# Create /etc/rsyslog.d/10-wazuh.conf:
cat > /etc/rsyslog.d/10-wazuh.conf << 'RSYSLOG'
*.* @wazuh-server-ip:514
RSYSLOG

sudo systemctl restart rsyslog

# Verify logs are arriving on Wazuh server
sudo tail -f /var/ossec/logs/alerts/alerts.log

Test Your SOC Alerts

# Trigger an authentication failure alert
ssh invaliduser@localhost

# Trigger a web attack alert (SQLi)
curl "http://localhost/?id=1' OR 1=1--"

# Trigger a port scan alert
nmap -sS 127.0.0.1

# Check Wazuh dashboard within 30 seconds for alerts
# Navigate to: Threat Detection → Events

# Test file integrity monitoring
echo "test" > /etc/testfile
# Wazuh should alert on unexpected file creation in /etc

Next Steps

• Integrate TheHive for incident management
• Add Elastic Stack for advanced log analytics
• Connect MISP for threat intelligence sharing
• Check IPs in our IP Blacklist Checker
• Look up CVEs in our CVE Lookup