How I Added SIEM to My Homelab With Wazuh — and What It Found on Day One

I've been running Grafana and Prometheus on my homelab for about a year. CPU usage, RAM, disk, container uptime — the usual infrastructure metrics. I thought that was monitoring. Then I deployed Wazuh and found out I had no idea what was happening on my network. What Wazuh Is Wazuh is an open-source SIEM (Security Information and Event Management) and XDR platform. It collects logs and events from agents you deploy on your systems, runs them through detection rules, and alerts you when something looks wrong. It's the same class of tool that security teams use in production environments — and it's free. The key mental model: Grafana asks "is this working?" Wazuh asks "is this being abused?" You need both questions answered. The Setup I'm running a 3-node Proxmox VE 8.x cluster. Wazuh 4.9.2 all-in-one lives in LXC 107 on my main node (nx-core-01). Container specs: 4 vCPU, 8GB RAM, 50GB disk. Wazuh is memory-hungry — don't go below 6GB or the indexer will struggle. The all-in-one install