Tutorial

How to Deploy a Self-Hosted SIEM on Ubuntu 24.04 LTS

June 2024 15 min read Tutorial · Ubuntu · SIEM

This guide walks you through deploying a fully functional self-hosted SIEM on Ubuntu 24.04 LTS from scratch. By the end, you will have a live security monitoring platform ingesting logs from your infrastructure, running MITRE ATT&CK-aligned detection rules, and generating compliance-ready dashboards — without sending a single log to a third-party cloud.

Prerequisites

Before you begin, ensure your environment meets the following requirements:

Hardware (minimum for production)

Software

Storage choice matters

ClickHouse — the database engine nPro uses — is extremely I/O intensive during write operations. NVMe SSD storage will give you the best ingestion performance. If you are running on a VM, ensure your storage backend is SSD-based, not HDD.

Step 1: Prepare the Ubuntu Server

Start with a clean Ubuntu 24.04 LTS installation. Run a full system update before installing any additional packages:

# Update package lists and upgrade all packages
sudo apt update && sudo apt upgrade -y

# Install required dependencies
sudo apt install -y curl wget gnupg2 apt-transport-https ca-certificates

Set a static IP address for the SIEM server if you have not already done so. You will need a predictable address to point your log sources at:

# Check your current network interface name
ip addr show

# Edit Netplan configuration (replace ens3 with your interface name)
sudo nano /etc/netplan/00-installer-config.yaml

Ensure your firewall allows the ports nPro requires: TCP 514 and UDP 514 for syslog, TCP 5044 for Filebeat input, and TCP 8080 for the web interface.

# If using UFW (Ubuntu's default firewall)
sudo ufw allow 514/tcp
sudo ufw allow 514/udp
sudo ufw allow 5044/tcp
sudo ufw allow 8080/tcp
sudo ufw enable
sudo ufw status

Step 2: Install nPro

nPro ships as a single installer script that automates the entire deployment — ClickHouse database, backend services, web interface, and default detection rules:

# Download and run the nPro installer
curl -fsSL https://get.npro.ai | sudo bash

The installer will:

  1. Detect your Ubuntu version and validate compatibility
  2. Install ClickHouse and configure it for security log storage
  3. Deploy the nPro backend services
  4. Configure syslog listeners on UDP/TCP 514
  5. Set up the Filebeat input on port 5044
  6. Generate self-signed TLS certificates for the web interface
  7. Load default MITRE ATT&CK-aligned detection rules
  8. Start all services and perform a health check

The installation typically completes in 3–5 minutes depending on your internet connection speed and hardware.

First login credentials

After installation, the installer outputs your initial admin credentials. Save these immediately — they are shown only once. You will use them to log into the web interface at https://YOUR-SERVER-IP:8080.

Step 3: Access the Web Interface

Open a browser and navigate to https://YOUR-SERVER-IP:8080. You will see a certificate warning because nPro uses a self-signed certificate by default — proceed past it (in production environments, replace this with a certificate from Let's Encrypt or your internal CA).

Log in with the credentials provided by the installer. The first thing you should do after logging in is:

  1. Change the admin password under Settings > Account
  2. Configure your organisation's name and timezone
  3. Review the default detection rules under Detection > Rules

Step 4: Configure Your First Log Source

A SIEM is only as useful as the logs it receives. Let's configure your first log source — a Linux server sending syslog to nPro.

Option A: Linux Server via Syslog (rsyslog)

On the Linux server you want to monitor, edit the rsyslog configuration:

# On the SOURCE server (not the nPro server)
sudo nano /etc/rsyslog.d/99-npro.conf

# Add this line (replace NPRO_IP with your nPro server's IP)
*.* @@NPRO_IP:514
sudo systemctl restart rsyslog

Within a few seconds, you should see logs appearing in the nPro web interface under Events > All Events.

Option B: Windows Server via Filebeat

For Windows servers, install the Filebeat agent and configure it to forward Windows Event Logs to nPro:

# Download Filebeat for Windows from elastic.co
# Then configure filebeat.yml:

filebeat.inputs:
- type: winlog
event_logs:
- name: Application
- name: System
- name: Security

output.logstash:
hosts: ["NPRO_IP:5044"]

Option C: Firewall via Syslog

Most enterprise firewalls (pfSense, OPNsense, Cisco, Palo Alto, Fortinet) support syslog forwarding natively. In your firewall's administration interface, configure the syslog destination as your nPro server's IP on port 514 (UDP or TCP).

Step 5: Verify Ingestion and Check for Alerts

After connecting your first log source, navigate to Events > Live Feed in the nPro interface. You should see events arriving in real time.

To verify that detection rules are running, you can generate a test event by triggering a failed SSH login attempt against your source server:

# On a test machine — try SSH with a wrong password
ssh wronguser@SOURCE_SERVER_IP

After a few failed attempts, nPro's brute force detection rule should fire and generate an alert visible under Alerts > Active.

Step 6: Add Network Monitoring (NRTG)

nPro includes NRTG (Network Real-Time Geographics) for infrastructure and network device monitoring. This gives you topology maps, bandwidth graphs, and uptime monitoring alongside your SIEM data.

To add a network device:

  1. Navigate to Network > Devices > Add Device
  2. Enter the device IP address and SNMP community string (v2c or v3)
  3. nPro will auto-discover the device type and available metrics
  4. Set alerting thresholds for bandwidth utilisation, packet loss, and interface down events

Step 7: Configure Compliance Dashboards

nPro ships with pre-built compliance dashboards for common frameworks. To enable them:

  1. Navigate to Dashboards > Compliance
  2. Select the frameworks relevant to your organisation (ISO 27001, PCI-DSS, PDPA)
  3. nPro will automatically map incoming events to the relevant control requirements
  4. Schedule automated compliance reports under Reports > Scheduled

Production Hardening Checklist

Before treating your deployment as production-ready, complete the following hardening steps:

What to Monitor First: Recommended Priority Log Sources

If you are starting from scratch and need to prioritise which log sources to connect first, this is the order that gives you the best threat detection coverage per effort:

  1. Domain controller / Active Directory — authentication events are the single most valuable source for detecting both external attackers and insider threats
  2. Perimeter firewall — connection logs show inbound attack attempts and outbound C2 communication
  3. Web application server — application logs reveal exploitation attempts and data access patterns
  4. Email gateway — phishing is still the most common initial access vector; email logs help trace the attack chain
  5. Key servers and databases — access logs for systems holding your most sensitive data

Scaling Beyond a Single Node

The single-node deployment described in this guide handles environments up to approximately 5,000 endpoints or 10,000 events per second. For larger environments, nPro supports distributed deployment that separates the ingestion, processing, and storage layers across multiple servers.

Distributed deployment requires a licence upgrade — see the nPro pricing page for details, or contact sales to discuss your specific requirements.

Ready to Deploy?

Start with the free tier: SIEM, XDR and network monitoring, no credit card required.

Deploy Free Read the Docs

Related reading: What is a SIEM? · nPro SIEM Overview · nPro vs Splunk · Documentation