Monitoring Docker Containers on Amazon ECS

[John Doe]

Hello,

We are running our Wazuh Manager on a seperate VPS (Linode) and we would like to know how we can deploy the agents to monitor the docker containers deployed in Amazon ECS. 

Thank you,

[Jose Camargo]

Hi,

For more information on how to monitor Docker, you can check the following documents:

- Monitoring Docker

- Docker Container Security Monitoring with Wazuh

- Monitoring Docker PoC

First of all, you need to check module of docker listener is active or not. Go to Wazuh > Settings and under the “Threat Detection and Response” tab, there is “Docker listener”. Enable it.

Now, install the Wazuh Agent on the container and then enable the Wazuh Docker listener adding this config to the agent's /var/ossec/etc/ossec.conf file:

<ossec_config>
    ...
    <wodle name="docker-listener">
        <interval>10m</interval>
        <attempts>5</attempts>
        <run_on_start>yes</run_on_start>
        <disabled>no</disabled>
    </wodle>
    ...
</ossec_config>

After that change in the config file, save it and then we need to restart the wazuh agent:

systemctl restart wazuh-agent

Python docker library is required by the wodle, you have to deploy it to test device for monitoring

pip install docker

Now, you'll be able to see the agent on the Dashboard.

Please let me know if you run into any issues, I'll be glad to help

Regards,

Jose Camargo

[John Doe]

Hi Jose,

Two questions:
Will i need to identify the OS types inside those containers? 
"pip install docker" needs to be run on the seperate wazuh manager or on each monitored container?

Thank you,

[Jose Camargo]

Hi,

Sorry for the delay. You must install the Wazuh agent on the host where the containers are in. It is not necessary to do it on each container. The docker-listener module will get the logs generated by the containers and ingest them. Once you do, you can send the docker-listener module to all agents using centralized configuration as explained here: https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html

I'll be awaiting your comments.

Regards,

Jose Camargo

[Julio Cesar Biset]

Hi John.

I recommend following the strategy that José proposes, if the host of the containers you have can be accessed, it would be to install the agent there.
If this is not possible, reading the features of AWS ECS (https://aws.amazon.com/es/ecs/features/?pg=ln&sec=gs), there, it may be useful to use monitoring as a strategy. service-based AWS, perhaps using CloudTrail (https://documentation.wazuh.com/current/cloud-security/amazon/services/supported-services/cloudtrail.html#amazon-cloudtrail) or CloudWatch (https:// documentation.wazuh.com/current/cloud-security/amazon/services/supported-services/cloudwatchlogs.html#aws-cloudwatchlogs) depending on what you want to monitor.

Regards!