Tutorial

How to Deploy a Self-Hosted SIEM on Ubuntu 24.04 LTS

June 202415 min read

This guide walks you through deploying a fully functional self-hosted SIEM on Ubuntu 24.04 LTS. By the end, you will have a live security monitoring platform ingesting logs, running MITRE ATT&CK-aligned detection rules, and generating compliance dashboards.

Prerequisites

Storage matters

ClickHouse is I/O intensive during writes. NVMe SSD gives the best ingestion performance. On VMs, ensure your storage backend is SSD-based.

Step 1: Prepare the Ubuntu Server

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget gnupg2 ca-certificates

Open the required firewall ports for log ingestion and the web interface:

sudo ufw allow 514/tcp && sudo ufw allow 514/udp
sudo ufw allow 5044/tcp && sudo ufw allow 8080/tcp
sudo ufw enable

Step 2: Install nPro

curl -fsSL https://get.npro.ai | sudo bash

The installer detects your Ubuntu version, installs ClickHouse, configures syslog listeners on ports 514, the Filebeat input on 5044, generates TLS certificates, loads MITRE ATT&CK detection rules, and starts all services. Completes in 3 to 5 minutes.

Save your credentials

The installer shows admin credentials once. Save them, then log in at https://YOUR-SERVER-IP:8080.

Step 3: Configure Your First Log Source

Linux server via rsyslog

# /etc/rsyslog.d/99-npro.conf
*.* @@NPRO_IP:514

sudo systemctl restart rsyslog

Windows server via Filebeat

filebeat.inputs:
- type: winlog
  event_logs:
    - name: Security
output.logstash:
  hosts: ["NPRO_IP:5044"]

Firewall via syslog

In your firewall admin interface, set the syslog destination to your nPro server IP on port 514. Supported: pfSense, OPNsense, Cisco, Palo Alto, Fortinet, Juniper.

Step 4: Verify Ingestion and Test Detection

Navigate to Events then Live Feed in nPro. You should see events arriving in real time. Test by generating failed SSH login attempts against your source server — the brute force detection rule should fire within seconds and appear under Alerts then Active.

Step 5: Enable Compliance Dashboards

Navigate to Dashboards then Compliance and select your frameworks (ISO 27001, PCI-DSS, PDPA). Schedule automated reports under Reports then Scheduled.

Priority Log Sources

  1. Domain controller / Active Directory — authentication events
  2. Perimeter firewall — connection logs
  3. Web application server — access and error logs
  4. Email gateway — phishing trace chain
  5. Key databases — access logs for sensitive data stores

Ready to Deploy?

Full platform access. No credit card required.

Deploy FreeDocumentation

Related: What is a SIEM? · nPro SIEM · nPro vs Splunk