--- title: "Discussion on \"Setting Up Wazuh as Your SIEM on Debian 12 & Proxmox: A Step-by-Step Guide\" | Hashnode" description: "Discussion on \"Setting Up Wazuh as Your SIEM on Debian 12 & Proxmox: A Step-by-Step Guide\". Welcome to the SIEM Homelab Series - We will walk through the process of installing your very own instance of Wazuh as a Security Information and Event Management System (SIEM).\nIf you want to do threat research or learn more about the ins and outs o..." url: "https://hashnode.com/posts/setting-up-wazuh-as-your-siem-on-debian-12-proxmox-a-step-by-step-guide/64e8a7773bae5e9719b4b970" --- [Feed](https://hashnode.com/feed) / Discussion # [Setting Up Wazuh as Your SIEM on Debian 12 & Proxmox: A Step-by-Step Guide](https://maikroservice.com/setting-up-wazuh-as-your-siem-on-debian-12-proxmox-a-step-by-step-guide?utm_source=hashnode&utm_medium=feed) Welcome to the SIEM Homelab Series - We will walk through the process of installing your very own instance of Wazuh as a Security Information and Event Management System (SIEM). If you want to do threat research or learn more about the ins and outs o... Aug 25, 2023 · 10 min read · maikroservice.com Updated Sep 27, 2023 Read the article - [#siem](https://hashnode.com/tag/siem) - [#soc-analyst](https://hashnode.com/tag/soc-analyst) - [#cybersecurity-1](https://hashnode.com/tag/cybersecurity-1) - [#hacking](https://hashnode.com/tag/hacking) ## Written by [Maik Ro](https://hashnode.com/@maikroservice) @maikroservice · Gran Canaria, Spain [View profile](https://hashnode.com/@maikroservice) (he/him) Cybersecurity Expert Cyber Security my passion. On this blog I am sharing how to detect adversaries with a Purple Team mindset - hack your own applications like an attacker would, to understand how to better protect them. ## Responses 1 Markdown supported · ⌘↵ to post [Michele Dal Bosco (Michele)](https://hashnode.com/@mike145) [Sep 27, 2023](https://hashnode.com/posts/setting-up-wazuh-as-your-siem-on-debian-12-proxmox-a-step-by-step-guide/64e8a7773bae5e9719b4b970/comment/65145f115d5d746448ea4457) Hi, first of all congratulations on the guide; I have a problem following it; in my proxmox I made sure that the downloaded ISOs go to an NFS folder on my synology nas, while my proxmox is on a mini PC. Here I am going to put the various VMs and CTs on an LVM type disk, but here in the creation of the VM (following your guide) I noticed that in the part relating to the disks section, precisely in the area relating to the format, everything appears to me in gray not clickable and therefore I have no way to select the QEMU image format. How can I solve it? Thanks for your possible response. [Maik Ro](https://hashnode.com/@maikroservice) [Sep 28, 2023](https://hashnode.com/posts/setting-up-wazuh-as-your-siem-on-debian-12-proxmox-a-step-by-step-guide/64e8a7773bae5e9719b4b970/comment/65145f115d5d746448ea4457#reply-65157e58f80d7d64789786e0) [Michele Dal Bosco (Michele)](https://hashnode.com/@mike145) ok let me know if it works out 🤞 [Michele Dal Bosco (Michele)](https://hashnode.com/@mike145) [Sep 28, 2023](https://hashnode.com/posts/setting-up-wazuh-as-your-siem-on-debian-12-proxmox-a-step-by-step-guide/64e8a7773bae5e9719b4b970/comment/65145f115d5d746448ea4457#reply-6515aac2f80d7d6478978b92) [Maik Ro](https://hashnode.com/@maikroservice) Hi, it worked even without using the QEMU image format for the disk; could it be that maybe in that case it would have performed better? Now I have to understand why if in the agent (I tried the one for a Debian ct) during the installation phase, despite telling it which group to add and what name to give it, it seems that the command (WAZUH\_AGENT\_GROUP='SERVER' where server is the name of the group WAZUH\_AGENT\_NAME='AdGuard-debian' where in this case the name is AdGuard-debian) is ignored since it puts the agent in the default group (I created a couple of them, one for the servers and one for any client in lan), ditto for the name that takes for its own sake that of the hostname. Therefore it is up to (as far as the group is concerned) to issue the appropriate shell command on the "server" side of wazuh for each agent to be moved to the group and then the same to remove this agent from the default group. [Maik Ro](https://hashnode.com/@maikroservice) [Oct 16, 2023](https://hashnode.com/posts/setting-up-wazuh-as-your-siem-on-debian-12-proxmox-a-step-by-step-guide/64e8a7773bae5e9719b4b970/comment/65145f115d5d746448ea4457#reply-652d2d229458381f383a9aca) [Michele Dal Bosco (Michele)](https://hashnode.com/@mike145) Unfortunately, we will not know if it would perform better without performance testing and I think that is out of scope for my home lab. If possible I would encourage you to test it, but again not a mandatory experience. I am glad you got it to work :) let me know how the rest of the journey is going!