Container security
Container security focuses on protecting containerized applications and the infrastructure that runs them. As organizations adopt Docker and Kubernetes to deploy and scale applications, they need visibility into container activity, configuration, vulnerabilities, and runtime events to reduce security risks.
Wazuh helps organizations secure containerized environments by monitoring Docker and Kubernetes activity, collecting container inventory, detecting vulnerabilities and misconfigurations, monitoring container runtime events, and identifying suspicious activity across container workloads.
Monitoring container runtime activity
Wazuh monitors container runtime events generated by Docker and Kubernetes, including container creation, startup, shutdown, restart, and removal events. Wazuh captures real-time events performed by the Docker engine via its Docker listener module. These events provide visibility into Docker operations and container activity.
Security teams can investigate unexpected runtime activity, identify unauthorized container deployments, and monitor lifecycle events across their container environment.
The Docker section of the Wazuh dashboard shows runtime events generated by monitored Docker containers.
Monitoring container inventory
The Docker listener module forwards the events that the Docker daemon reports, including the container and image each event involves. These events help organizations track the container workloads on their Docker hosts.
Security teams can use the Docker section of the Wazuh dashboard to identify running containers, review image information, and investigate container deployments across monitored environments.
The Docker section of the Wazuh dashboard shows the Docker events collected from monitored Docker hosts.
You can also create dedicated dashboards to show these containers and images inventory information.
Detecting vulnerabilities in container images
Wazuh detects known vulnerabilities affecting software installed inside container images and running containers. It correlates software inventory collected from containers with vulnerability intelligence from Wazuh Cyber Threat Intelligence (CTI).
Security teams can identify vulnerable container images, review affected CVEs, prioritize remediation, and monitor vulnerability exposure across container workloads.
Monitoring container resource utilization
Wazuh monitors resource utilization in containerized environments, providing visibility into metrics such as CPU, memory, and network usage. Security and operations teams can use this information to identify unusual consumption patterns and potential performance issues.
Custom detection rules can flag unexpected resource usage, such as a sudden increase in network traffic.
The Docker container security monitoring with Wazuh blog post demonstrates how Wazuh monitors network utilization in a containerized environment.
Centralized logging and visualization of container events
Wazuh centralizes container event logging and visualization. The Wazuh indexer stores and indexes container events, allowing security teams to search and analyze them from the Wazuh dashboard. Organizations can also configure data retention policies to manage how long container event data is stored.
Wazuh dashboards provide a centralized view of container events, enabling security teams to monitor and investigate activity across containerized environments. Teams can use this information to identify suspicious behavior, unauthorized actions, and other security events.
The image below shows the Wazuh dashboard displaying events from monitored containers.
