Monitoring Docker events

Infrastructure

Configuration

Perform the following steps to install Docker on the Ubuntu endpoint and configure Wazuh to monitor Docker events.

1. Install Python and pip:

   $ sudo apt install -y python3 python3-pip
   

2. Install Docker:

   $ curl -sSL https://get.docker.com | sh
   

3. Install the Python Docker library and other dependencies:

   $ sudo apt remove python3-urllib3
   $ sudo pip3 install docker==7.1.0 urllib3==1.26.20 requests==2.32.2 --break-system-packages
   

   Note

   This command modifies the default externally managed Python environment. See the PEP 668 description for more information. To prevent the modification, you can run pip3 install --upgrade pip within a virtual environment. You must update the Docker /var/ossec/wodles/docker/DockerListener script shebang with your virtual environment interpreter, for example, #!</path/to/your/virtual/environment>/bin/python3.

   Some Ubuntu distributions have urllib3 already installed using Debian packages. Uninstall and reinstall with the method above. Before you confirm the removal, check the packages that apt lists. Removing python3-urllib3 also removes the packages that depend on it, such as cloud-init and python3-boto3.

4. Start and enable the Docker service:

   $ sudo systemctl start docker.service
   $ sudo systemctl enable docker.service
   

5. Edit the Wazuh agent configuration file /var/ossec/etc/ossec.conf and add this block to enable the docker-listener module:

   <ossec_config>
     <wodle name="docker-listener">
       <interval>5m</interval>
       <attempts>5</attempts>
       <run_on_start>yes</run_on_start>
       <disabled>no</disabled>
     </wodle>
   </ossec_config>
   

6. Restart the Wazuh agent to apply the changes:

   $ sudo systemctl restart wazuh-agent
   

Perform the following steps on the Wazuh dashboard to enable the docker integration.

1. Navigate to Ruleset management > Overview.

2. Enter docker in the search box and select the docker integration.

3. Click the docker integration name to open it, then click Actions and select Enable.

   

Test the configuration

Perform several Docker activities, such as pulling a Docker image, running a container, running additional Docker commands, and deleting the container.

1. Pull an image, such as the NGINX image, and run a container:

   $ sudo docker pull nginx
   $ sudo docker run -d -P --name nginx_container nginx
   $ sudo docker exec -it nginx_container cat /etc/passwd
   $ sudo docker exec -it nginx_container /bin/bash
   $ exit
   

2. Stop and remove the container:

   $ sudo docker stop nginx_container
   $ sudo docker rm nginx_container
   

Visualize the findings

You can visualize the findings on the Wazuh dashboard. Go to Cloud security > Docker and select Findings.