Can an Ubuntu virtual machine running in Microsoft Azure send SSH security events to a Wazuh Manager hosted on a local VMware environment without exposing the SIEM to the public internet?

I wanted to validate this with a real end-to-end test, rather than relying only on service status or network connectivity checks.

The result: I successfully connected an Azure Ubuntu 24.04 VM to my on-premises Wazuh 4.14.8 Manager using Tailscale, generated a controlled SSH authentication failure, and verified that the corresponding alert reached Wazuh Dashboard.

This was an isolated, authorized laboratory experiment, not production security monitoring.

1.…