Building a Zero-Recurring-Cost Enterprise SecOps & Low-Power Hardware Architecture

In our previous article, we laid out the foundational design for a resilient, high-availability private cloud. But compute and networking are only half the equation. In a production-grade enterprise environment, observability without active threat defense is a liability, and high-availability virtualization shouldn't come at the cost of massive power bills and noisy server racks.

Today, we take a deep dive into our operational Security Operations (SecOps) pipeline: integrating Wazuh SIEM, Suricata v7 IDS/IPS, a Centralized ClamAV Local Mirror UI (192.168.88.34), an AI-Driven Incident Digest Pipeline (n8n + Local Qwen LLM), and our Low-Power Bare-Metal Micro-Cluster Architecture to achieve complete operational autonomy with zero cloud licensing fees[cite: 16, 17].

1. Multi-Layered Threat Defense Architecture

To protect our multi-node Proxmox HA cluster and internal workloads, we enforce a defense-in-depth security approach spanning Layer 3 to Layer 7:

• Perimeter & Network IDS/IPS: Suricata v7 inspects inline and mirrored traffic for protocol anomalies, exploit attempts, and active threat signatures.
• Host & Endpoint SIEM: Wazuh Manager orchestrates 20 active agents across VMs, LXC containers, and physical nodes—monitoring File Integrity Monitoring (FIM), system logs, and security compliance in real time[cite: 16].
• Centralized Endpoint Protection: A dedicated internal ClamAV Local Mirror Server (192.168.88.34) serves antivirus signature updates locally to prevent WAN bandwidth saturation and ensure complete air-gapped readiness[cite: 17].

[ Internet / WAN ] │ [ MikroTik L3 Core ] │ ┌─────────────┴─────────────┐ ▼ ▼ [ Suricata v7 IDS ] [ Wazuh SIEM Manager ] (Packet Inspection/ET Rules) (20 Active Enrolled Agents) │ │ └─────────────┬─────────────┘ ▼ [ Internal Subnet PVE-1 ] │ [ Central ClamAV Mirror ] (192.168.88.34) │ ┌────────────────────────┼────────────────────────┐ ▼ ▼ ▼ [ Node / VM .33 ] [ Node / VM .46 ] [ Node / VM .44 ] (main/daily.cvd) (main/daily.cvd) (main/daily.cvd)

2. Real-Time Security Observability (SIEM & Network IDS)

Host Integrity & Threat Detection

Our vertical NOC display tracks real-time endpoint security status[cite: 16]. With 19/20 active agents enrolled across our infrastructure[cite: 16]:

• File Integrity Monitoring (FIM): Any unauthorized modification to core system binaries (/usr/bin, /etc/pam.d, or web roots) triggers an immediate high-priority alert[cite: 16].
• Automated Active Response: Security event spikes feed directly into n8n webhooks for dynamic firewall address-list mitigation.

Suricata v7 Network Inspection

Suricata operates with updated Emerging Threats (ET) rulesets. Threats are categorized by severity and visualized via a dedicated dashboard—tracking packet inspection rates per minute and protocol breakdowns in real time.

3. Local ClamAV Mirroring & Bandwidth Optimization

Running endpoint antivirus across dozens of containers can easily choke WAN interfaces if every endpoint pulls definition updates (main.cvd, daily.cvd, bytecode.cvd) directly from public mirrors simultaneously[cite: 17].

The Solution: Local Mirror Server (192.168.88.34)

1. Single WAN Pull: The central mirror server fetches signature updates once on schedule[cite: 17].
2. Gigabit Local Distribution: All internal nodes (192.168.88.xx) pull updates directly from 192.168.88.34 over internal LAN speed[cite: 17].
3. Unified Monitoring UI: Our custom dashboard provides instant visibility into endpoint check-in timestamps, downloaded .cvd packages, and subnet status[cite: 17].

Automated Orchestration via Ansible Semaphore

Using Ansible Semaphore, we push ClamAV client configurations and schedule light daily scans across all Linux endpoints with a single playbook execution:

- name: Deploy ClamAV Client & Local Mirror Config
  hosts: pve_endpoints
  become: yes
  tasks:
    - name: Configure freshclam to use local mirror
      lineinfile:
        path: /etc/clamav/freshclam.conf
        regexp: '^DatabaseMirror'
        line: 'DatabaseMirror http://192.168.88.34/clamav'
    - name: Trigger Light Daily Scan
      cron:
        name: "Daily ClamAV Light Scan"
        hour: "03"
        minute: "00"
        job: "clamscan -r --quiet --no-summary /bin /sbin /usr/bin"

4. AIOps Automated Incident Analysis & Daily Executive Briefings

Sifting through thousands of telemetry logs across Zabbix, Wazuh, and Suricata leads to alert fatigue. To automate root-cause analysis, we built an air-gapped AIOps pipeline using n8n workflows paired with our local Qwen/Ollama LLM running on a dedicated NVIDIA Tesla P4 GPU.

How the Automated AIOps Pipeline Works

• Automated Log Aggregation: Scheduled n8n workflows pull live host statuses (MikroTik load, Zabbix CPU/RAM warnings), Suricata IDS alert logs, and Wazuh Security Configuration Assessment (SCA) compliance scores.
• On-Premise LLM Synthesis: Raw JSON logs are passed to our local Qwen LLM for context-aware analysis. The AI generates structured insights, identifying traffic bottlenecks, anomalous outbound connections, and CIS benchmark failures.
• Executive Email Digest: The system sends an automated HTML status report directly to the administrator's inbox—complete with system uptime, host health tables, threat logs, and prioritized Actionable Remediations.

🧠 Example: Local AI Technical Analysis & Actionable Remediations

• MikroTik & Zabbix Analysis: Detects moderate traffic spikes and warning thresholds for CPU/memory usage, triggering proactive resource monitoring.
• Suricata & Wazuh Audit: Identifies unusual outbound connections for security validation and highlights heightened SCA vulnerability scores.
• Actionable Steps: Recommends dynamic traffic shaping policies on MikroTik, connection auditing, and patch deployment for affected Wazuh agents.

5. Bare-Metal Hardware Stack & Visual Telemetry Showcase

While we leverage open-source software to eliminate licensing costs, our resilient architecture requires a foundational, low-power physical layer. This ensures that even during a partial power outage or WAN disconnection, our local command center remains operational.

• 3x Dell OptiPlex Micro Stack: Core compute nodes running Proxmox VE with Ceph distributed storage, maintaining cluster quorum and instant VM failover.
• 1x HP SFF / Tower Node: Dedicated GPU worker host housing an NVIDIA Tesla P4 for local AI inference (Qwen/Ollama) and n8n AIOps automation workflows.
• 1x HP Thin Client / Vertical Node: Low-power perimeter gateway running core routing, DNS load balancing, and network traffic control.
• Gigabit Managed Switching: Isolated physical links and VLANs for Cluster Heartbeat, Ceph Storage Replication, and Management Telemetry.

📸 Infrastructure & NOC Telemetry Gallery

Figure 1: High-Density Low-Power SFF Node Stack & Networking Hardware

System Status Overview

Suricata IDS/IPS Alerts

Wazuh SCA Compliance

6. Key Takeaways for Enterprise Deployments

• Zero License Overhead: Unifying open-source tools (Wazuh, Suricata, ClamAV, Zabbix, Proxmox) delivers complete enterprise SecOps capability without subscription lock-in[cite: 16, 17].
• Automated AI Incident Briefings: Integrating local LLMs with n8n transforms raw security logs into executive daily action plans, eliminating alert fatigue.
• Local Operational Efficiency: Centralizing signature updates keeps internal security traffic fast, predictable, and WAN-optimized[cite: 17].
• Integrated NOC Control: Dual-monitor NOC setups allow engineers to correlate live network topology changes (Zabbix) directly with endpoint security events (Wazuh/Suricata) and cluster health (Proxmox) in real time[cite: 16].