Wazuh

In Part 10, I added the Windows identity layer: Active Directory, DNS, DHCP, and a domain-joined client. In this part, I turn the lab from “everything can reach everything while I build” into an explicit firewall policy. The goal is not to make the rules fancy. The goal is to make every allowed path explainable. What I Built I replaced the temporary build-phase allow rules with a segmented pfSense policy: Default posture: deny by default Management: Tailscale + break-glass LAN/WAN access Jumpbox: Alpine SSH path into Kali Client VLAN: AD, DNS, Wazuh, Windows Update only Container VLAN: Docker host + n8n explicit egress only Honeypot VLAN: Wazuh telemetry only Pentest VLAN: no internet egress Isolated VLAN: no ingress, no egress ‹ › ...

In Part 6, Wazuh started collecting Docker and pfSense logs. In this part, I add detection and deception: Snort on pfSense and T-Pot in the HONEYPOT VLAN. The goal is to generate useful security telemetry, not just run tools. Snort alerts need to reach Wazuh, T-Pot attack logs need to be parsed, and I need to understand why dashboards can look empty even when events exist. What I Built Snort: pfSense package, IDS mode Interfaces: WAN and LAN Rules: Community + focused ET Open categories Honeypot: T-Pot in VLAN 50 Telemetry: T-Pot Suricata eve.json -> Wazuh agent Test source: Kali in VLAN 40 ‹ › ...

In Part 5, I added Kali and Metasploitable. In this part, I add the first visibility layer: Wazuh as the lab SIEM. The goal is to centralize security telemetry without trying to monitor everything at once. I start with the Wazuh server, a Docker host agent, Docker event collection, and pfSense syslog forwarding. What I Built Wazuh VM: 10.10.10.99 Segment: SIEM / VLAN 10 RAM: 8 GB CPU: 4 vCPU Disk: 128 GB Agent target: Docker host at 10.10.30.100 Syslog source: pfSense ‹ › ...