SIEM and Threat Detection: Wazuh plus CrowdSec
MRDTech runs a layered detection and response stack using Wazuh for SIEM/endpoint telemetry and CrowdSec for behavior-based blocking.
Sanitized rule and configuration exports are published here:
Four-host deployment
| Host | Role | Security components |
|---|---|---|
| mrdtech-237 | Primary Docker and edge services host | CrowdSec LAPI, Nginx Proxy Manager log ingestion, firewall bouncer, Cloudflare bouncer |
| mrdtech-76 | Secondary Docker and backup host | CrowdSec engine/agent watching local Docker and system logs |
| wazuh-233 | SIEM manager | Wazuh manager, custom Sysmon detection rules, CrowdSec agent, firewall bouncer |
| proxmox-251 | Hypervisor | CrowdSec agent and firewall bouncer protecting Proxmox host access |
Wazuh custom Sysmon rules
Wazuh receives endpoint telemetry and applies local custom rules for Sysmon-oriented detections. The exported local_rules.xml contains custom logic for suspicious Windows behavior, privilege/security events, and high-signal host activity.
Detection goals:
- Preserve endpoint context from Wazuh agents.
- Raise actionable alerts instead of dumping noise into Telegram.
- Keep custom rules version-controlled and reviewable.
- Feed n8n alert workflows for notification and follow-up automation.
CrowdSec bouncer setup
CrowdSec provides behavioral detection and enforcement across the stack.
- Firewall bouncers enforce local decisions on protected hosts.
- Cloudflare bouncer pushes applicable decisions to the Cloudflare edge.
- NPM/reverse-proxy logs feed HTTP attack scenarios.
- SSH and system logs feed brute-force and probing scenarios.
- Host-specific CrowdSec configs are exported by host in the GitHub repository.
Operational notes
- Bouncer API keys, Cloudflare tokens, account IDs, zone IDs, and passwords are redacted from published configs.
- Internal addresses are replaced with placeholders in public repos.
- Host labels are preserved so topology remains understandable.
- Detection configuration should be reviewed before applying to a different environment.
CrowdSec parser note
Wazuh and Proxmox hosts use newer OpenSSH log program names. CrowdSec sshd parsers were adjusted to match both sshd and sshd-session, preventing zero-parse behavior on modern OpenSSH logs.
Repository exports
Sanitized exports are tracked in:
The repository includes Wazuh local_rules.xml and host-specific CrowdSec/bouncer configs with secrets redacted.