Labshock Makes Wazuh Available as a Free OT SIEM Lab

July 18, 2026 — Labshock has released a free Wazuh lab, pairing a deployed Wazuh manager and dashboard with a running industrial environment inside the platform.

The distinction the release is built on is that a SIEM fed by static sample logs teaches the query language, while a SIEM fed by a running industrial process teaches detection. Users trigger an action on the OT side, locate the matching event in Wazuh, write a rule, test whether it fires, then break something and read their own alert text.

The company cites the cost of the alternatives as the reason for removing the price: production is not a place to test rules, and a pile of sample logs does not behave like a plant. Detection consequently becomes the skill practitioners read about and rarely practise — an inversion in a discipline where a missed alert has physical consequences.

The lab is part of a broader phase of work adding free detection tooling to every zone. Zeek and Suricata are next, adding network-based detection over industrial traffic alongside Wazuh’s log-based detection over industrial services.