DEDI.AL

Built by Tech Maniacs. Protected by Passion.

Building a Mini SOC for Your VPS with Wazuh

Building a Mini SOC for Your VPS with Wazuh

, ,

DEDI BLOG

If you’ve ever wondered how enterprise-level security monitoring works, here’s the secret: you don’t need a room full of screens and analysts to start. With tools like Wazuh, you can set up a mini SOC on a single VPS and get enterprise-grade visibility into your server’s security.

At DEDI.AL, we love empowering tech maniacs and developers to own their security — because you can’t defend what you can’t see. Here’s a step-by-step guide.

1. What You’ll Need

  • A VPS running Ubuntu 22.04 LTS (or Debian/CentOS if you prefer).

  • Root or sudo access.

  • Basic knowledge of Linux command line.

  • Some patience — security is serious business.

2. Installing Wazuh

Wazuh is a free, open-source security platform that can:

  • Monitor system logs

  • Detect rootkits and malware

  • Track file integrity

  • Alert you in real-time

Step 1: Add Wazuh Repository

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --dearmor -o /usr/share/keyrings/wazuh-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh-archive-keyring.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt update

Step 2: Install Wazuh Manager

sudo apt install wazuh-manager

Step 3: Start and Enable the Service

sudo systemctl enable wazuh-manager
sudo systemctl start wazuh-manager
sudo systemctl status wazuh-manager

3. Set Up the Wazuh Agent

The agent runs on your VPS and reports back to the Wazuh manager.

sudo apt install wazuh-agent
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Then configure the agent to connect to the manager in /var/ossec/etc/ossec.conf and restart the agent.

4. Optional: Install Wazuh Dashboard

If you want visual dashboards (highly recommended):

  • Install Elasticsearch: Wazuh stores alerts and logs here.

  • Install Kibana: Visualization layer.

  • Install Wazuh App for Kibana: Full dashboard interface.

With this, you can see:

  • Failed SSH logins

  • File changes in /etc

  • Suspicious processes

  • Real-time alerts via email or webhook

5. ⚡ Customizing Your Mini SOC

Here’s where it gets fun — you can tweak Wazuh rules to your exact needs:

  • Monitor critical files: /etc/passwd, /etc/ssh/sshd_config

  • Alert on new users, sudo changes, or root login attempts

  • Set up automated scripts to block IPs after repeated failed logins

6. Why a Mini SOC Matters

Even for a single VPS, having a SOC is a game-changer:

  • You get real-time visibility into threats.

  • You can respond before an attack becomes a disaster.

  • You learn the same monitoring skills that enterprise security teams use — without needing a full security operations floor.

At DEDI.AL, we don’t just host servers — we teach developers and tech enthusiasts to secure them like pros.

7. Final Thoughts

Setting up a mini SOC with Wazuh is not just about software; it’s a mindset. You’re turning your VPS into a secure, monitored fortress. Once it’s running, you’ll sleep easier knowing you’re seeing every suspicious move in real time.

For more advanced tips, like integrating Wazuh alerts with Discord, Slack, or Telegram, check out our upcoming posts — because real tech maniacs don’t just react, they anticipate.

Tags: , ,

Leave a Reply

Your email address will not be published. Required fields are marked *

About Me

Dardan Daci

Author

Dardan is the CEO of DEDI.AL, a forward-thinking hosting and cloud solutions company. With a strong vision for innovation and technology, he leads the team in delivering reliable, secure, and scalable digital infrastructure services to businesses and developers across Albania and beyond.