Researcher Builds Wazuh SIEM Lab to Test Real-World Attack Detection Gaps

A security researcher configured a Wazuh SIEM environment using a Dockerized Damn Vulnerable Web Application (DVWA) to evaluate how well the platform detects real attacks. The setup involved custom container log ingestion, where an initial permission misconfiguration silently blocked the Wazuh agent from reading Apache access logs until directory permissions were corrected. Three live attack scenarios were then executed, including Nmap and Nikto reconnaissance scans, which triggered over 380 events and activated Wazuh rules for scanner activity and web errors. An OS command injection payload submitted through DVWA successfully ran system commands in the browser, revealing a key gap where web-layer logs captured the attack but the host operating system remained blind to the actual commands executed. The experiment highlights that effective SIEM deployment requires deliberate visibility engineering, not just tool activation, to correlate application-level and OS-level telemetry.