How to Build a Free SIEM With Wazuh for Network and Server Logs

Step by step

1. Install the all-in-one server

   Wazuh's install assistant sets up the indexer, server and dashboard on one machine. It prints the admin password at the end: store it in your password manager.

   curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
   sudo bash ./wazuh-install.sh -a
   

2. Open the dashboard

   Browse to https://<siem-server> and log in as admin. Replace the self-signed certificate with one from your internal CA.

3. Add server agents

   In the dashboard choose Deploy new agent; it gives you the exact install command for Windows, Linux or macOS with your server address.

4. Receive syslog from network devices

   Add a remote syslog listener in /var/ossec/etc/ossec.conf, restart, and point switches, gateways and firewalls to the SIEM.

   <remote>
     <connection>syslog</connection>
     <port>514</port>
     <protocol>udp</protocol>
     <allowed-ips>10.1.99.0/24</allowed-ips>
   </remote>
   
   sudo systemctl restart wazuh-manager
   

5. Check that events arrive

   Generate a test: a failed admin login on a switch or a failed SSH login on a server should appear in Threat Hunting within a minute.

6. Tune the noise

   Look at the top 10 alerts of the first week. Fix real problems, and lower or suppress rules that fire on normal behaviour, so real alerts stand out.

7. Set alerting

   Send high-severity alerts (level 10+) by email or to your chat tool, and define who responds and how fast.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.