The Homelab Is Back Online (And So Is Our Threat Surface)
Deploying Wazuh agents across every endpoint in the house: MacBooks, Proxmox, and a Windows box that almost didn’t make the video.
It’s been about 9 months since my last homelab update. Back in September 2025.
That’s insane to say out loud. It’s July 2026 now.
Life’s been a whirlwind though, a good one. I got married. We went on our honeymoon. And somewhere in the middle of planning a wedding for six straight months, the homelab just… sat there. Dormant. Collecting dust.
But here’s the thing: now more than ever, this project matters. Because my wife and I living together has literally expanded our threat surface. New devices, new habits, new attack surface under one roof.
So this is a two-in-one issue, part homelab, part home security. Time to get this thing back on track.
The mission: deploy the Wazuh agent across four endpoints (three macOS machines and one Windows box) and make sure I have visibility into every single asset in this house.
Endpoint 1: The Command Center
First up is an old MacBook (M1, Apple Silicon) that used to be my daily driver, before it got demoted to “random stuff” duty once I upgraded. Still functional, still useful, so I gave it a new job: command center for the homelab.
Everything still runs off the makeshift PC server, where Proxmox lives. But this MacBook is where I access the Wazuh dashboard and manage the whole operation.
Following the Wazuh macOS install docs, the process is refreshingly simple:
Log into the dashboard, click Deploy a new agent
Confirm the architecture (Apple Silicon vs. Intel)
Point it at the manager IP; mine’s sitting on
192.168.1.133Name the agent (I went with cwx-mac-cmd-ctr)
Copy, paste, run
A few minutes later: agent active. To confirm it was actually working, I ran sudo -i to trigger a privileged session, and sure enough, Wazuh flagged it immediately: “First time user executed sudo.”
That’s the whole point of a homelab, honestly. You don’t just install something and trust it works. You poke it until it proves itself.
Endpoint 2: The Daily Driver
Next up was my actual daily driver, an M4 MacBook, also silicon, also where all my content and work actually happens. Same install flow, new agent name: cwx-mac-daily-driver
Ran the same sudo -i test. This time, four events came through: agent connected, agent stopped, agent started, first-time sudo. Clean.
Two active agents down. Two to go.
Endpoint 3: My Wife’s MacBook (Yes, “Big Bertha”)
This one came with a small hiccup, a connection refused error that turned out to be a missing https:// in the manager address. Classic. Once fixed, the install went smoothly on her M1 MacBook, which (for reasons I will not fully explain in a newsletter) was almost affectionately named Big Bertha.
Same sudo test, same confirmation. Three agents active.
Endpoint 4: The Proxmox Node
This is the one that actually matters most, the bare-metal node running every virtual machine in the lab. Confirmed it was a Debian-based AMD64 system with uname -m, grabbed the Linux install command, and named it cwx-proxmox-lab0, after the lab itself.
Then it broke.
“The job for the wazuh-agent service failed because the control process exited with error code.”
“Invalid server address found for manager IP.”
Classic homelab moment. Turns out I had previously installed the Wazuh manager on this exact node (back when this box briefly played SIEM server), and the config was still pointing at itself instead of the actual manager IP. A quick edit to swap the manager IP field to 192.168.1.133, a service reload, and it connected.
This is the part of homelabbing that never changes, no matter how many years in: trial and error is still the name of the game. Every fix teaches you something about how the system actually behaves under the hood, not just how the docs say it should.
Endpoint 5 (Sort Of): The Windows Box
Last endpoint: a Windows machine I picked up a couple years ago while (half-heartedly) studying for the SANS GCIH cert I never actually took. It’s been sitting around for VMware experiments and “special projects” ever since. Time to put it to work.
Here’s where I have to be honest with you: I goofed. OBS wasn’t configured to capture the screen properly, so the actual Windows install didn’t record. But the process is genuinely this simple:
Copy the install command from the Wazuh dashboard
Run it as admin in PowerShell
Start the service
And then, don’t skip this, install Sysmon. Raw agent telemetry is good, but Sysmon is what turns “I have an agent” into “I actually have visibility.” I recommend Olaf Hartong’s Sysmon-modular config, probably the most useful config out there, or SwiftOnSecurity’s Sysmon config as a solid alternative.
What I’m Taking Away From This
A few things stuck with me rewatching this lab session:
Visibility isn’t a one-time project; it’s a maintenance habit. Nine months of dormancy meant nine months of blind spots. The moment life changes (new house, new person, new devices), your monitoring needs to catch up.
The “boring” fixes are usually config, not code. Every issue in this session (a missing https://, a stale manager IP left over from an old install) was a five-second fix once I actually read the error message instead of assuming the worst.
Test every agent the same way you’d expect a real event to fire. sudo -i isn’t glamorous, but it’s a fast, repeatable way to confirm an agent is actually alive and alerting, not just “installed.”
What’s Next?
The homelab’s back. Let’s see where it goes.
Watch the full episode:
Interested in sponsoring Cyberwox?
Sponsoring Cyberwox helps me continue creating practical cybersecurity education, labs, and industry analysis while connecting your brand with a trusted multi-platform audience of 120,000+ cybersecurity practitioners, engineers, students, founders, and technology leaders across the global cyber community on our YouTube, LinkedIn, X, Substack, and Discord 🌎
Until Next Time
That’s it for this one.
As always, keep learning, keep building, and keep thinking deeply about the systems we’re trusted to defend.
See you in the next one.
~ Day 💙