Building a Home SIEM Lab: pfSense, Wazuh, Grafana and Threat Intelligence

Introduction

Learning cybersecurity from books and videos is useful, but understanding how security operations work in a real environment requires hands-on practice. Instead of only studying concepts, I wanted to build a home lab where I could simulate network traffic, collect logs, detect threats, and follow the complete workflow from detection to incident analysis.

This series documents my journey of building a home SIEM lab using open-source tools commonly used in modern SOC environments.

The goal is not to create the biggest or most complex lab possible. The goal is to understand how different security components work together and gradually build a realistic environment.

Planned Lab Architecture

Figure 1. Home SIEM Lab architecture used throughout this project series.

The final architecture will include:

• pfSense as the main firewall and router

• Snort for network intrusion detection and prevention

• Ubuntu Server with Nginx and Wazuh Agent

• Wazuh for log collection and SIEM capabilities

• Grafana for custom dashboards and visualization

• TheHive and Cortex for incident management and automated analysis

• Discord or Telegram for real-time notifications

• OWASP Juice Shop and Kali Linux for attack simulation

The lab will be implemented gradually to keep it practical and resource efficient.

Why build this lab?

This project aims to provide hands-on experience with:

• Network segmentation and firewall management

• Threat detection and monitoring

• Log collection and correlation

• Incident response workflows

• Attack simulation and analysis

• Building a practical cybersecurity portfolio

Series Roadmap

📌 Introduction

[Part 1] Building pfSense, VLANs and Snort — Coming Soon.

[Part 2] Installing Wazuh SIEM — Coming Soon.

[Part 3] Adding Ubuntu Server and Wazuh Agent — Coming Soon.

[Part 4] Integrating Grafana — Coming Soon.

[Part 5] Configuring Real-Time Notifications — Coming Soon.

[Part 6] Adding TheHive and Cortex — Coming Soon.

[Part 7] Attack Simulation with OWASP Juice Shop and Kali Linux — Coming Soon.

This article serves as the starting point and table of contents for the entire project series.

Let’s build.