Kubernetes monitoring using Wazuh

[Ahmed Abdelmajeed]

Hello, 

I'd like to know if there is possibility to monitor the K8s cluster using the Wazuh ? knowing that we are looking to monitor the Infrastructure self-managed infrastructure and Container levels. 

Actually, as we see in Wazuh documentation, all examples about Container security are for Docker engine (Docker host/ Docker containers). 

Thanks,
Ahmed

[Nicolas Zapata]

Hi Ahmed, Thanks for using Wazuh!

We recently published a new blog of this topic! Please check this Auditing Kubernetes with Wazuh

But in summary you need to follow this steps

1. Create a webhook listener on the Wazuh server to receive logs from the Kubernetes cluster.
2. Enable auditing on the Kubernetes cluster and configure it to forward audit logs to the Wazuh webhook listener.
3. Create rules on the Wazuh server to alert about audit events received from Kubernetes.

I hope I have helped you, and do not hesitate to ask if you have questions.