Docker Containers

[ACH MUQODDAM]

How does Wazuh detect application-level attacks across multiple Docker containers when the Wazuh agent is installed on the host?

[Olamilekan Abdullateef Ajani]

Hello,

Wazuh can help with this, but mainly through log collection. The agent on the Docker host can collect Docker events and container logs, and then the manager applies decoders and rules to those logs to generate an alert.
https://documentation.wazuh.com/current/user-manual/capabilities/container-security/monitoring-docker.html

For application attacks across containers, make sure each application writes their logs to a file, collect those logs from the host, and tag them by container/service. 

https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/index.html

For runtime behavior like unexpected process execution, reverse shells, or container escape activity, you can make use of Wazuh with a runtime tool like Falco. For image vulnerabilities, use Trivy or ECR image scanning and forward the results to Wazuh.
https://wazuh.com/blog/container-image-security-with-wazuh-and-trivy/
https://wazuh.com/blog/container-vulnerability-scanning-with-wazuh-and-snyk/
https://github.com/wazuh/wazuh/issues/35989