Docker events only generate network bridge connect/disconnect alerts – missing container action alerts (eg. pause/unpause/start)

[Robby Hunters]

Hello Wazuh Team,

I am currently testing Docker monitoring using Wazuh Agent with docker-listener enabled, and I would like to confirm whether there has been a change in Docker event field mapping or rules behavior in recent versions.

Environment

• Wazuh version: 4.14.1

• Docker version: Docker 29.1.3

• Deployment: Centralized agent configuration (agent.conf via manager)

• docker-listener: enabled and running successfully

The docker listener starts correctly:

wazuh-modulesd:docker-listener: INFO: Starting to listening Docker events.

Observed Behavior

1. In Wazuh Alerts, I only receive alerts related to Docker network events, such as:

   • Docker: Network bridge connected

   • Docker: Network bridge disconnected

2. Container lifecycle events (pause, unpause, start, stop, delete) do NOT generate alerts, even though:

   • Docker events are visible using:

     docker events

     Example:

     container pause container unpause

   • The raw Docker events are present in Wazuh logs, for example:

     { "integration": "docker", "docker": { "Type": "container", "Action": "unpause", "Actor": { "Attributes": { "image": "httpd", "name": "test-container" } } } }

3. When testing with wazuh-logtest, I noticed:

   • The event is decoded correctly

   • It matches the base rule:

     rule id: 87900 description: Docker alerts: container level: 0

   • However, child rules that rely on docker.status (e.g. pause, unpause, delete) are not triggered automatically.

Ruleset Observation

I checked the default ruleset and found rules like:

<rule id="87905" level="3"> <if_sid>87900</if_sid> <field name="docker.status">^pause$</field> <description>Docker: Container $(docker.Actor.Attributes.name) paused</description> </rule>

But the incoming events contain:

• docker.Action

• NOT docker.status

This suggests a field mismatch between docker-listener output and the existing ruleset.

Question

Could you please clarify:

1. Has there been a change in recent Wazuh or Docker versions where docker.status is no longer populated and replaced by docker.Action?

2. Is this expected behavior with newer Docker versions (e.g. Docker 29.x)?

3. Should users update or create custom rules to match docker.Action instead of docker.status?

4. Are there plans to update the default Docker ruleset to align with the current Docker event format?

Additional Notes

• When manually crafting a log with docker.status=delete, the corresponding rule (e.g. rule ID 87921) triggers correctly in wazuh-logtest.

• This indicates the rules themselves work, but the runtime Docker events no longer match the expected field names.

Thank you for your support.
Looking forward to your clarification.

Best regards,

Robby

[hasitha.u...@wazuh.com]

Hi  Robby Hunters

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.

[hasitha.u...@wazuh.com]

Hi Robby,

Yes, you are correct. I will create a GitHub issue regarding this.

However, as a workaround, I suggest you overwrite the default Docker rules with the expected rule triggering for your case.

Navigate to the Server management -> Rules -> Custom rules -> Add new rules file -> Copy below rules to the file -> Provide the file name (ex: local_docker_rules) -> Save -> Reload

1. <group name="docker,">
2.  
3. <rule id="87905" level="3" overwrite="yes">
4.     <if_sid>87900</if_sid>
5.     <field name="docker.Action">^pause$</field>

1.     <description>Docker: Container $(docker.Actor.Attributes.name) paused</description>

1.     <options>no_full_log</options>
2. </rule>
3.  
4. <rule id="87906" level="3" overwrite="yes">
5.     <if_sid>87900</if_sid>
6.     <field name="docker.Action">^unpause$</field>
7.     <description>Docker: Container $(docker.Actor.Attributes.name) unpaused</description>
8.     <options>no_full_log</options>
9. </rule>
10.  
11. <rule id="87903" level="3" overwrite="yes">
12.     <if_sid>87900</if_sid>
13.     <field name="docker.Action">^start$</field>
14.     <description>Docker: Container $(docker.Actor.Attributes.name) started</description>
15.     <options>no_full_log</options>
16. </rule>
17.  
18. <rule id="87904" level="3" overwrite="yes">
19.     <if_sid>87900</if_sid>
20.     <field name="docker.Action">^stop$</field>
21.     <description>Docker: Container $(docker.Actor.Attributes.name) stopped</description>
22.     <options>no_full_log</options>
23. </rule>
24.  
25. </group>

For more details regarding overwriting existing default rules, please check this guide.

Let me know if you need further assistance on this.