Deploying Wazuh Across the Homelab

August 8, 2026 · WazuhSecurityHomelab

As our homelab grew past a handful of containers into a real fleet — virtual machines, LXCs, and dedicated services all running self-hosted software — it became clear we needed a single pane of glass for security. Nothing was broken; we just had no coherent answer to the question, "what is actually running where, and is anything out of the ordinary?"

That's what Wazuh is for. Wazuh is a free, open-source security platform that unifies host monitoring, security event collection, and threat detection into one tool. We deployed it as a single-node setup on our own hardware, and it's now the backbone of how we keep an eye on the lab.

What Wazuh actually does

At its core, Wazuh collects and analyzes security data from every host it's installed on. That breaks down into three things we lean on every day:

• Log analysis & security events. Each host runs a lightweight agent that forwards its logs to the central Wazuh server. The server correlates those events against detection rules and flags anything suspicious — failed logins, privilege escalations, unusual process behavior, and so on.
• File integrity monitoring. Wazuh tracks changes to critical files and system binaries. If something on a host gets modified when it shouldn't, we know about it immediately.
• Vulnerability detection. The platform keeps a running inventory of the software on each host and matches it against known-vulnerability databases, so we can see which of our containers are running versions with known issues.

It also gives us a centralized dashboard — a single screen where every monitored host, alert, and status is visible at a glance. For a self-hosted setup spread across multiple machines, that visibility is the whole point.

Why we chose it

We looked at a few options and kept coming back to Wazuh for three reasons:

• It's open source and free. No per-agent licensing, no subscription math. We run it the same way we run the rest of the lab — on our own hardware, with full control.
• It's a single platform. Instead of stitching together one tool for log monitoring, another for file integrity, and a third for vulnerability scanning, Wazuh does all three from one agent and one dashboard.
• It's lightweight to run. One dedicated node handles the whole fleet comfortably, so it didn't add meaningful overhead to machines already doing real work.

What we use it for

Concretely, Wazuh is how we answer the everyday security questions that used to require digging through each host by hand:

• Keeping agents on every host. Every machine we manage runs a Wazuh agent, so nothing in the lab is invisible to the central server.
• Watching for intrusion and brute-force attempts. The log-correlation rules surface repeated failed logins and other attack patterns the moment they start, instead of days later.
• Tracking file and config drift. If a service's config file or a system binary changes, file integrity monitoring tells us — useful both for catching tampering and for auditing our own changes.
• Staying current on vulnerable software. The vulnerability module keeps our inventory matched against known advisories, so we know when a package needs updating.

How it fits into the lab

Wazuh slots into an existing observability stack rather than replacing it. We already run Nagios for service health and Grafana/Prometheus for metrics — Wazuh covers the security layer those tools aren't built for. It's gated behind a single sign-on login like the rest of our internal dashboards, so only authorized accounts can reach it.

The deployment itself was a dedicated single-node install on our own infrastructure, with agents rolled out across the fleet. From there it was mostly a matter of letting detection rules tune themselves to normal traffic — the same "warm it up, then trust it" approach we use for everything else in the lab.

A small note on transparency

We're writing this up largely because we believe in being open about how a self-hosted operation runs. The lab is a testing ground for software we build and ship — games, music, and tools under the Gravey Studios name — and security is part of doing that responsibly. The stack is ordinary, well-documented open-source software, deployed the straightforward way.

---

Contact: [email protected]