03 / Detect / Home lab SIEM
A security system the agents can read, but not rewrite.
Wazuh security monitoring for my home lab, built with AI agents and operated with them. Agents query it freely. Changes to what it sees need my approval.
Tuning: proposal → human approval
Live since October 2026 · noise baseline under way · contained AI investigator in design
- hosts and network devices reporting
- 10
- custom rules for local systems
- 56
- tuning proposals reviewed before release
- 10
01 / The brief
Watch the platform, including the agents that help run it.
My home lab had reached the point where it deserved real security monitoring: a virtualization host, a storage and services server, containers, VPN links to a remote server, and AI agents with meaningful access to all of it. Those agents are part of the threat model. A prompt-injected or misbehaving agent is as worth detecting as a compromised web service or a device probing its neighbours.
Before anything was installed, I agreed on the threats, the success criteria, and the non-goals with the agent doing the build. Success means notifications are rare and almost always worth reading, and an agent can answer “anything unusual this week?” with evidence rather than reassurance.
02 / The system
One searchable record, from the router to the workstation.
Wazuh runs on a dedicated virtual machine with its own data disk and firewall, never exposed to the internet. Linux servers, a Windows workstation with Sysmon, and a remote server connecting over a private tunnel all run agents. The router, a switch, and the server’s management controller send syslog. DNS queries, certificate issuance, web access logs, and virtual machine activity arrive in the same index. Every event is kept for 30 days and every alert for 90.
Several sources needed custom decoders before Wazuh could read them. The custom rules cover what matters in this environment: an administrative login from an unexpected machine, a certificate issued for an unknown name, a VPN peer connecting for the first time, a monitoring agent going quiet, or a storage pool losing redundancy. Local specifics live in allowlists rather than in the rules themselves, so the logic can eventually be published without the network map.
03 / Agents as operators
Read freely. Propose changes. Treat logs as untrusted.
The build ran from a shared roadmap that several agent sessions worked through: tasks are claimed before work starts, a decision log records every significant choice, and nothing is marked done without a recorded verification. Day to day, agents use read-only identities and wrapper scripts with pinned certificates. A query guide teaches what normal looks like and to confirm coverage before reporting that nothing happened. Log content is attacker-controlled, so agents quote it as evidence and never follow instructions found inside it.
Tuning is where judgment matters most. In its first days, the Windows workstation paged on routine behaviour. A single browser extension update produced 366 alerts and 128 phone notifications in seven seconds. Each fix arrived as a written proposal stating what it changed, why, whether it reduced detection, and how to roll it back. The approved fixes were narrow: they lowered the severity of specific benign patterns without discarding them, and notifications now group repeats from the same source.
04 / Proof and limits
Fire drills first, then autonomy.
Detections are proven by triggering them deliberately. Drills so far cover an SSH brute force, a new local account, a configuration change under /etc, a router administrator login, and encoded PowerShell on the workstation. A two-week baseline period is measuring normal noise before thresholds are lowered. The design also protects privacy: a self-hosted chat agent is monitored for tool activity, but its conversations are never collected.
The next phase is a contained investigator: an unprivileged account with read-only tools, outbound traffic restricted to a short allowlist, a capped model budget, and a drill that plants a prompt-injection payload in a log line to prove it cannot be steered. It will report findings, not act on them. Nothing in this system responds automatically, by design. It is still a home lab: it runs on the hardware it watches, and nobody is on call.