I have a spare i9-1200 series CPU with 32gigs of rams and 5 Gb network card just sitting around gathering dust. I am thinking of spending this weekend just deploying a home lab, I used to run Untangle, and Sophos NGFW but now I just want to go a full free route or low cost route. What would you all […]
Hi cartaphilus. Since you already run
pfSense and Snort, I would build around
Wazuh rather than deploy another complete IDS stack immediately. It gives you centralized logging, endpoint telemetry, file-integrity monitoring, vulnerability inventory and limited automated response without duplicating what Snort is already doing.
Suggested build
| Component | Allocation | Purpose |
|---|
| Proxmox VE | Bare metal | Keeps the lab flexible and makes rebuilding/testing easier |
| Wazuh all-in-one VM | 8 vCPU, 16 GB RAM, 500 GB–1 TB SSD | SIEM/HIDS, dashboards, correlation and alerting |
| Velociraptor VM | 2–4 vCPU, 4–6 GB RAM, 100–250 GB | Optional endpoint hunting and incident-response collection |
| Remaining resources | Host/cache/future VM | Syslog relay, test endpoint, sandbox, etc. |
For a normal home endpoint count, that is comfortably above Wazuh’s published quick-start recommendation of 4 vCPU and 8 GiB for 1–25 agents. An all-in-one installation is specifically intended for labs and small deployments. Ubuntu 24.04 is currently supported for the central components. See the Wazuh quick-start requirements.
The important purchase is
storage, not more CPU. Search indexes generate constant writes, and retention consumes space surprisingly quickly. I would use at least a decent 1 TB NVMe/SSD, preferably 2 TB if you later add network metadata or packet capture. Start with roughly 30 days’ retention and increase it after measuring actual ingestion.
Feed it useful data
I would add sources gradually:
- pfSense firewall, DHCP, DNS and VPN logs
- Snort alerts
- Wazuh agents on Windows and Linux systems you actually administer
- Windows Event Logs and a sensibly tuned Sysmon policy
- Linux authentication,
journald and selected auditd events
- Managed switches, APs, NAS devices and Pi-hole/AdGuard through syslog where supported
Snort can copy alerts into the pfSense system log, specifically for forwarding to a remote parser. Netgate documents that under
Send Alerts to System Logs in the Snort interface settings. Forward those logs to Wazuh rather than trying to scrape files from the firewall.
Do not turn on every log source and every Sysmon event on the first evening. That generally produces an impressive graph showing that your family uses the Internet. Add one source at a time, verify parsing, then suppress known noise.
Start Wazuh’s active-response features in
alert-only mode. Once particular rules have proved reliable, you can enable narrowly scoped responses. Automatically blocking everything that annoys Snort is an efficient way to invent your own availability incident.
Where Velociraptor fits
Velociraptor is useful for querying endpoints, collecting artifacts and running hunts when an alert warrants investigation. It complements Wazuh, but it is not a replacement for endpoint prevention and should not be treated as a set-and-forget commercial EDR.
Together, Wazuh, your existing Snort deployment and Velociraptor provide something
XDR-like, but not a literal free equivalent of a mature commercial XDR. You get collection, correlation, hunting and some response; you do not automatically get the vendor threat intelligence, polished cross-layer detections and carefully tested response workflows that the licence fee normally buys.
When I would choose Security Onion instead
If your real interest is
network detection and packet investigation, install Security Onion directly on the hardware instead. It gives you Suricata, Zeek metadata, packet-oriented investigation and endpoint log collection in one platform.
Your 32 GB is enough for a small standalone deployment, but only just in comfortable territory: Security Onion lists 24 GB as the standalone minimum and recommends 32 GB or more even for a small amount of monitored traffic. It also expects a management NIC and a separate sniffing NIC connected to a TAP or switch SPAN port. See its hardware requirements.
A few practical qualifications:
- Choose Standalone, not Evaluation, if you want remote Elastic Agents; Evaluation mode does not run the required Logstash service.
- It is free to run, although some Security Onion and Elastic components use ELv2 rather than conventional open-source licences; the distinction is explained on its licence page.
- Running Security Onion’s Suricata beside pfSense Snort duplicates signature inspection. The additional value would mainly be Zeek metadata, packet capture and better network hunting.
- The 5 Gb NIC only matters if it receives mirrored traffic. A SIEM receiving logs will barely exercise it. For packet monitoring, add a separate supported Intel NIC for management or sniffing.
My choice for your hardware: Proxmox with Wazuh all-in-one first, ingest the existing pfSense/Snort data, then add Velociraptor once the basic logging is clean. I would only dedicate the whole box to Security Onion if packet-level network hunting is the main objective.
Sources
