Guilgo Blog

Commercial parental-control products are expensive and opaque. This post shows how to build an open-source parental control stack with Wazuh as the SIEM, AdGuard Home for DNS filtering, Hayabusa for local threat hunting, and Telegram for real-time alerts on your phone.

What does this system detect?

System architecture

┌─────────────────────────────────────────────────────────────────────┐
│                      CHILDREN'S DEVICES                              │
│   PC-Child-1 (Windows)                 PC-Child-2 (Windows)          │
│   ┌─────────────────────┐            ┌─────────────────────┐         │
│   │ • Wazuh Agent 4.9.2 │            │ • Wazuh Agent 4.9.2 │         │
│   │ • Parental Control   │            │ • Parental Control  │         │
│   │   Script (.ps1)      │            │   Script (.ps1)     │         │
│   │ • Hayabusa           │            │ • Hayabusa          │         │
│   └──────────┬──────────┘            └──────────┬──────────┘         │
│              │    Windows events (1514/tcp)      │                    │
│              └────────────────┬─────────────────┘                    │
│                          DNS (53)                                    │
└───────────────────────────────┼─────────────────────────────────────┘
                                ▼
┌─────────────────────────────────────────────────────────────────────┐
│                        CENTRAL SERVER (Docker Host)                  │
│  ┌──────────────────────┐      ┌──────────────────────┐             │
│  │   WAZUH MANAGER      │      │   ADGUARD HOME       │             │
│  │   • Events, rules    │ cron │   • DNS filtering    │             │
│  │   • Telegram         │ */5m │   • Block lists      │             │
│  │   Ports: 1514,1515,  │      │   • Querylog JSON    │             │
│  │   55000               │      └──────────────────────┘             │
│  └──────────┬───────────┘                                             │
│             │ Alerts level ≥7                                         │
│             ▼                                                         │
│  ┌──────────────────────┐      ┌──────────────────────┐              │
│  │   TELEGRAM BOT       │─────►│   PARENT'S PHONE     │              │
│  └──────────────────────┘      └──────────────────────┘              │
└─────────────────────────────────────────────────────────────────────┘

Components

Server software

Client software

Prerequisites

Server: Linux with Docker; minimum 4GB RAM, 20GB disk; ports 53, 1514, 1515, 55000.

Windows clients: Windows 10/11; PowerShell 5.1+; Administrator rights; connectivity to server.

Server installation

1. Docker Compose for Wazuh Manager

# docker-compose.yml
services:
  wazuh-manager-lite:
    image: wazuh/wazuh-manager:4.9.2
    container_name: wazuh-lite
    ports:
      - "1514:1514/tcp"
      - "1515:1515/tcp"
      - "55000:55000/tcp"
    volumes:
      - ./etc:/var/ossec/etc
      - ./data:/var/ossec/data
    networks:
      - labnet
    restart: unless-stopped

networks:
  labnet:
    external: true

docker-compose up -d
docker exec wazuh-lite /var/ossec/bin/wazuh-control status

2. AdGuard Home

# docker-compose-adguard.yml
services:
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "80:80/tcp"
      - "443:443/tcp"
    volumes:
      - ./adguard/work:/opt/adguardhome/work
      - ./adguard/conf:/opt/adguardhome/conf
    restart: unless-stopped

3. Recommended block lists for AdGuard

In the AdGuard web UI, add these lists:

Wazuh Manager configuration

Create a group for Windows agents and use centralized config (agent.conf) to monitor Security, System, Application, PowerShell and Windows Defender event channels, plus FIM on Startup and Run key, and syscollector for inventory. (Full XML lives in the Spanish deep-dive; this EN post keeps the architecture and rule IDs.)

AdGuard DNS integration

Use a script that reads AdGuard’s querylog.json, filters by children’s IPs, and appends JSON lines to a file that Wazuh reads via a <localfile> with log_format=json. Configure Wazuh rules (e.g. 111001–111050) for DNS queries and blocks (adult, VPN, piracy, persistent blocks).

Telegram integration

1. Create a bot with @BotFather and get the token.
2. Get your Chat ID by messaging the bot and calling https://api.telegram.org/bot<TOKEN>/getUpdates.
3. Add a custom integration script (e.g. custom-telegram.py) that reads JSON alerts, filters by level ≥7 and groups (control_parental, adguard, hayabusa — group names match the Spanish lab config), and posts to Telegram with Markdown.
4. In ossec.conf add <integration> for the script with level="7" and the appropriate groups.
5. Install requests in the container and set script permissions.

Parental control script (PowerShell)

The script collects: installed apps, running processes, network connections, uptime/screen time, USB devices, Defender status; builds a JSON payload with ReportType=ParentalControl (lab configs may still use ControlParental); saves it locally and copies to a network share; optionally writes to the Wazuh agent path for integration. Schedule it every 30 minutes with Task Scheduler.

Hayabusa (threat hunting)

Install Hayabusa on Windows (e.g. C:\Tools\Hayabusa), update Sigma rules, and run csv-timeline on C:\Windows\System32\winevt\Logs; use -m critical or -m high for focused alerts. Correlate with Wazuh via custom rules (e.g. 110060) on the report payload.

Custom rules summary

• 110001–110099 (control_parental): base report, excessive use (110010, 110011), gaming (110020), social (110030), VPN/proxy (110040), Defender off (110050), Hayabusa critical (110060), night use (110080).
• 111001–111099 (adguard/dns): base DNS query (111001), kids’ queries (111010), blocked adult/VPN/piracy (111020–111022), any block (111040), persistent blocks (111050).

Example Telegram alerts

Adult content blocked: “BLOQUEADO ADULTO: Child1 – domain” with rule 111020.
VPN detected: “VPN/Proxy detected” with rule 111021.
Night use: “Active at night” with rule 110080.

Useful commands

Wazuh: docker exec wazuh-lite /var/ossec/bin/agent_control -l, wazuh-control status, tail on alerts.log and ossec.log.
Telegram test: curl -X POST "https://api.telegram.org/botTOKEN/sendMessage" -d "chat_id=ID" -d "text=Test".
Windows: Get-Service WazuhSvc, agent logs, Restart-Service WazuhSvc.

Closing thoughts

You get real-time visibility of device activity, DNS blocking of inappropriate content, phone alerts, evasion detection (VPN, TOR, proxy), and Sigma-based hunting — without license fees.

Limitations: setup needs sysadmin skills; tech-savvy kids may try to disable the agent; mobile data bypasses home Wi‑Fi DNS.

References: Wazuh Documentation, AdGuard Home, Hayabusa, Sigma Rules.

Full XML rules, PowerShell, Python integration and installer scripts: see the Spanish deep-dive.