Reading time: ~14 minutes Audience: Homelabbers who want to know when they are being attacked

What Is Homelab Security Monitoring?

What Exactly Is It?

Security monitoring is the practice of collecting, analyzing, and alerting on events that indicate unauthorized access, misconfiguration, or malicious activity in your self-hosted infrastructure. Unlike a corporate SOC (Security Operations Center), a homelab security stack is typically a single-person operation: you are the analyst, the responder, and the administrator.

A complete homelab security monitoring stack includes: 1. Log aggregation: Centralizing syslog, audit logs, and application logs 2. Host intrusion detection: File integrity monitoring (FIM), rootkit detection, and anomaly detection 3. Network intrusion detection: Suricata or Zeek for packet analysis 4. Vulnerability detection: Scanning for CVEs in containers and OS packages 5. Alerting: Notifying you via Telegram, Slack, or email when something is wrong

Why It Matters Today

A self-hosted homelab is a public target. Every port forwarded, every exposed service, and every default password is a potential entry point. In 2026, automated scanners (Shodan, Censys, and private botnets) probe every IPv4 address continuously. If you run a public-facing service, you are being scanned right now.

Real threats to homelabs: - Credential stuffing: Attackers use leaked password databases against SSH, Nextcloud, and Jellyfin - Container escape: A vulnerable Docker image can grant host-level access - Cryptojacking: Compromised containers mine cryptocurrency using your electricity - Ransomware: Unpatched services (Confluence, Jenkins, etc.) are encrypted for Bitcoin demands

Why It Matters

Benefit 1: You Cannot Defend What You Cannot See

Without monitoring, a compromise is silent. An attacker can lurk for months, pivot between containers, and exfiltrate data before you notice a performance slowdown. Security monitoring turns the lights on.

Benefit 2: Compliance and Learning

If you are studying for security certifications (CompTIA Security+, CISSP, OSCP), a homelab SIEM is the best hands-on training ground. You can generate attack traffic, analyze logs, and write detection rules in a safe environment.

Benefit 3: Insurance for Your Data

You back up your data. Security monitoring is the “backup” for your infrastructure: it tells you when the restore point is needed.

Core Principles

Principle 1: Defense in Depth

No single tool catches everything. Layer your defenses: - Perimeter: Firewall (pfSense/OPNsense) blocks unwanted traffic - Network: VLANs isolate services by trust level - Host: Fail2Ban or CrowdSec blocks brute-force attempts - Application: Vaultwarden enforces strong passwords; 2FA on every admin panel - Monitoring: Wazuh correlates events across all layers

Principle 2: Log Everything, Alert on What Matters

A SIEM that alerts on every failed SSH login will train you to ignore it. Tune your alerts to high-confidence indicators: - File changes in /etc/, /usr/bin/, and container image layers - New listening ports or running processes - Login attempts from non-standard geolocations (if you have a static IP) - CVEs in running container images

Principle 3: Assume Breach

Design your monitoring as if an attacker is already inside. Monitor east-west traffic between containers, not just north-south traffic from the internet. If your Nextcloud container starts talking to a cryptocurrency mining pool, that is a high-fidelity alert.

Applying This to Your Homelab

Homelab Setup Example: Wazuh-Based SIEM

Architecture: - Wazuh Manager: Central server (4 GB RAM, 2 cores, 50 GB SSD) - Wazuh Indexer: Elasticsearch fork for log storage (8 GB RAM recommended) - Wazuh Dashboard: Kibana fork for visualization - Agents: One per monitored host (VM, LXC, or physical)

What Wazuh monitors out of the box: - File integrity (FIM) on /bin, /sbin, /etc, /var/www - Rootkit detection (YARA rules + rootcheck) - Active response (automatically blocks IP after 5 failed SSH attempts) - Docker/container image scanning (CVE database) - CIS benchmark compliance checks

Docker Compose deployment:

services:
  wazuh.manager:
    image: wazuh/wazuh-manager:4.7.2
    hostname: wazuh.manager
    restart: unless-stopped
    ports:
      - "1514:1514"
      - "1515:1515"
      - "514:514/udp"
      - "55000:55000"
    volumes:
      - wazuh-api:/var/ossec/api/configuration
      - wazuh-etc:/var/ossec/etc
      - wazuh-logs:/var/ossec/logs
      - wazuh-queue:/var/ossec/queue
      - wazuh-var:/var/ossec/var
      - wazuh-share:/var/ossec/share
      - wazuh-active-response:/var/ossec/active-response/bin

  wazuh.indexer:
    image: wazuh/wazuh-indexer:4.7.2
    hostname: wazuh.indexer
    restart: unless-stopped
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - wazuh-indexer:/var/lib/wazuh-indexer

  wazuh.dashboard:
    image: wazuh/wazuh-dashboard:4.7.2
    hostname: wazuh.dashboard
    restart: unless-stopped
    ports:
      - "443:5601"
    environment:
      - WAZUH_INDEXER_URL=https://wazuh.indexer:9200
    depends_on:
      - wazuh.indexer

volumes:
  wazuh-api:
  wazuh-etc:
  wazuh-logs:
  wazuh-queue:
  wazuh-var:
  wazuh-share:
  wazuh-active-response:
  wazuh-indexer:

Agent installation (on a Debian/Ubuntu host):

# Add Wazuh repository
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list

# Install agent
apt-get update && apt-get install -y wazuh-agent

# Register with manager
/var/ossec/bin/agent-auth -m <WAZUH_MANAGER_IP>

# Start agent
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

Practical Steps: CrowdSec as a Lightweight Alternative

If Wazuh is too heavy for your setup, CrowdSec is a modern, community-driven IPS/IDS that is lighter and easier to deploy:

# Install CrowdSec
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
apt-get install -y crowdsec

# Install a collection (e.g., nginx logs)
cscli collections install crowdsecurity/nginx

# Install a bouncer (e.g., firewall bouncer)
apt-get install -y crowdsec-firewall-bouncer

# View decisions
watch -n 1 cscli decisions list

CrowdSec shares attack intelligence with a global community. If an IP attacks your server, it is automatically blocked on every other CrowdSec user’s firewall. This is ” crowdsourced defense.”

Common Mistakes to Avoid

Mistake 1: Exposing Your SIEM to the Internet

Wazuh Dashboard, Elasticsearch, and Grafana should never be public-facing. Use a VPN (Tailscale, WireGuard) or a reverse proxy with strong authentication to access them. If you must expose a dashboard, put it behind Cloudflare Access or Authelia.

Mistake 2: Ignoring Container Security

Docker containers are not inherently secure. A 2026 audit of Docker Hub images found that 60% of official images had known CVEs. Run Trivy or Wazuh’s container scanning to audit your images:

# Scan a running container for CVEs
trivy image nextcloud:latest

Mistake 3: Alert Fatigue

A SIEM that sends 50 emails per day is a SIEM that will be ignored. Tune your rules: - Use thresholding: “5 failed SSH logins in 10 minutes” not “1 failed SSH login” - Use suppression: “Alert once per hour per source IP” - Use severity: Reserve email for “Critical” and “High”; send “Low” to a log file

Conclusion

Summary

Security monitoring is not optional for a public-facing homelab. Wazuh provides a complete SIEM experience with FIM, rootkit detection, and vulnerability scanning. CrowdSec offers a lightweight, community-driven alternative. The key principles are defense in depth, tuned alerting, and assuming breach.

Next Steps

  1. Deploy Wazuh or CrowdSec on a dedicated VM or LXC
  2. Install agents on every host that faces the internet
  3. Enable FIM on /etc, /usr/bin, and web root directories
  4. Set up alerting to Telegram or Slack
  5. Run a weekly Trivy scan on your Docker images

Affiliate Opportunities

  • Mini PCs for SIEM: Intel N100/N305 with 16 GB RAM (Amazon, AliExpress)
  • Networking: Ubiquiti, TP-Link Omada (Amazon)
  • VPS: Hetzner, OVH for offsite log backup (referral)

Internal Linking Strategy

  • wazuh-setup → guide: “wazuh-siem-setup.md”
  • docker-security → guide: “docker-security-hardening.md”
  • network-segmentation → guide: “homelab-networking-basics.md”
  • vpn-access → guide: “tailscale-homelab-guide.md”

CTA

  • [comment] What security tools do you run in your homelab? Share your SIEM stack below.
  • [newsletter] Subscribe for our quarterly security hardening guides and CVE roundups.
  • [internal_link] Ready to deploy Wazuh? Read our Wazuh SIEM setup guide next.