Project | SOC / Security Monitoring
Wazuh deployed as a self-hosted SIEM and XDR platform in an LXC container on the Proxmox cluster — collecting endpoint events, correlating Suricata network alerts, and providing a real alert triage environment for SOC-style investigation practice.
Suricata runs on OPNsense's WAN interface in netmap mode and forwards IDS alerts to Wazuh via syslog. Network-layer detections and host-layer events appear in the same platform — a detection on the wire can be cross-referenced with what the endpoint was doing at the same time.
Wazuh agents on Linux containers and Windows hosts collect authentication events, process creation, file integrity changes, and system-level activity. The manager correlates these against built-in and custom rules to surface meaningful alerts rather than raw log noise.
Real alerts from the homelab infrastructure — failed logins, config changes, unexpected processes — create a low-stakes environment to practice the analyst triage loop: identify, contextualize, classify, and document. The same workflow scales directly to production SOC work.
Wazuh is used in production SOC environments. I deployed it, wired it to real endpoints, and connected it to a live IDS feed — not a classroom simulation. I understand how alerts are generated, why correlation between network and host events matters, and what the triage workflow looks like from inside the tool. That's day-one relevant for SOC analyst and junior security operations roles.
Project pages covering the infrastructure being monitored.
A production-grade virtualization lab: Proxmox cluster, Cisco switching, and Synology storage.
View project ->Hardened gateway implementation: VLAN segmentation, AdGuard DNS, and Suricata IDS.
View project ->Multi-node compute environment running 20+ VMs/LXCs with focus on high-availability.
View project ->Authentik implementation for SSO, OIDC, and LDAP across the lab infrastructure.
View project ->Open to Junior Network Administrator, SOC Analyst, NOC, MSP, Help Desk, IT Support, and Cybersecurity Internship opportunities.
Email: NazeemDickey@gmail.com | Boynton Beach, FL