Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt

Use this file to discover all available pages before exploring further.

The Docker integration enables monitoring of Docker container activities, providing visibility into container lifecycle events and operations in your containerized infrastructure.

​
Overview

The Docker integration monitors and collects activity from Docker containers, tracking creation, running, starting, stopping, pausing events, and other container operations. All events are tagged with wazuh.integration.name: docker for filtering and analysis. Reference: plugins/main/common/wazuh-modules.ts:128

​
Key Features

  • Real-time container lifecycle monitoring
  • Container creation and destruction tracking
  • Image usage monitoring
  • Container state change detection
  • Network activity logging
  • Volume mount tracking
  • Docker daemon event collection
  • Resource usage monitoring

​
Data Source Configuration

The Docker data source uses the following configuration: 
const DOCKER_GROUP_KEY = 'wazuh.integration.name';
const DOCKER_GROUP_VALUE = 'docker';
Reference: plugins/main/public/components/common/data-source/pattern/events/docker/docker-data-source.ts:5

​
Monitored Events

The Docker integration collects various container and image events:

​
Container Lifecycle Events

  • create - Container created
  • start - Container started
  • stop - Container stopped
  • restart - Container restarted
  • pause - Container paused
  • unpause - Container unpaused
  • die - Container stopped (exit code captured)
  • kill - Container killed
  • destroy - Container removed

​
Container Operations

  • attach - Attached to container
  • commit - Container committed to image
  • copy - Files copied to/from container
  • exec - Command executed in container
  • export - Container filesystem exported
  • resize - Container terminal resized
  • top - Container processes listed
  • update - Container configuration updated

​
Image Events

  • pull - Image pulled from registry
  • push - Image pushed to registry
  • tag - Image tagged
  • untag - Image tag removed
  • delete - Image deleted
  • import - Image imported
  • load - Image loaded from archive
  • save - Image saved to archive

​
Network Events

  • connect - Container connected to network
  • disconnect - Container disconnected from network
  • create - Network created
  • destroy - Network removed

​
Volume Events

  • create - Volume created
  • mount - Volume mounted
  • unmount - Volume unmounted
  • destroy - Volume removed

​
Event Fields

Docker events include the following key fields:
  • data.docker.Type - Event type (container, image, network, volume)
  • data.docker.Action - Action performed (start, stop, create, etc.)
  • data.docker.Actor.ID - Container or object ID
  • data.docker.Actor.Attributes.image - Container image name
  • data.docker.Actor.Attributes.name - Container name
  • data.docker.from - Parent image
  • data.docker.time - Event timestamp
  • data.docker.timeNano - High-precision timestamp
Reference: plugins/main/public/components/overview/docker/dashboards/dashboard-panels.ts:53

​
Setup and Configuration

​
Prerequisites

  • Docker Engine installed and running
  • Wazuh agent installed on Docker host
  • Access to Docker socket (/var/run/docker.sock)
  • Appropriate permissions for Wazuh agent

​
Configuration Steps

  1. Configure Docker Socket Access Add Wazuh user to Docker group: 
    sudo usermod -aG docker wazuh
    Or configure Docker socket permissions: 
    sudo chmod 666 /var/run/docker.sock
  2. Configure Wazuh Agent Edit /var/ossec/etc/ossec.conf on the agent: 
    <wodle name="docker-listener">
  <disabled>no</disabled>
  <attempts>5</attempts>
  <run_on_start>yes</run_on_start>
  <interval>10m</interval>
</wodle>
  3. Alternative: Remote Docker API For remote Docker daemon monitoring: 
    <wodle name="docker-listener">
  <disabled>no</disabled>
  <attempts>5</attempts>
  <run_on_start>yes</run_on_start>
  <interval>10m</interval>
  <url>tcp://remote-docker-host:2375</url>
</wodle>
    Note: Ensure Docker API is secured with TLS in production.
  4. TLS Configuration (Recommended) For secure remote monitoring: 
    <wodle name="docker-listener">
  <disabled>no</disabled>
  <url>tcp://remote-docker-host:2376</url>
  <ssl_verify_certificate>yes</ssl_verify_certificate>
  <ssl_ca_cert>/path/to/ca.pem</ssl_ca_cert>
  <ssl_cert>/path/to/cert.pem</ssl_cert>
  <ssl_key>/path/to/key.pem</ssl_key>
</wodle>
  5. Verify Configuration
    • Restart Wazuh agent: systemctl restart wazuh-agent
    • Check agent logs: tail -f /var/ossec/logs/ossec.log
    • Verify Docker events are being collected
    • Check dashboard for Docker events

​
Dashboard Visualizations

The Docker integration includes pre-built visualizations:

​
Overview Dashboard

  • Top 5 Images - Most used container images
  • Top 5 Events - Most frequent Docker events
  • Events Over Time - Timeline of Docker activities
  • Container Actions - Distribution of container operations
  • Image Actions - Image-related operations
References:
  • plugins/main/public/components/overview/docker/dashboards/dashboard-panels.ts:4
  • plugins/main/public/components/overview/docker/dashboards/dashboard-panels.ts:68

​
Filtering Events

Filter Docker events in the dashboard: 
wazuh.integration.name: "docker"
Additional filters:
  • By action: data.docker.Action: "start"
  • By image: data.docker.Actor.Attributes.image: "nginx:latest"
  • By container: data.docker.Actor.Attributes.name: "my-container"
  • By type: data.docker.Type: "container"

​
Use Cases

​
Container Security Monitoring

  • Runtime Security
    • Detect unauthorized container creation
    • Monitor privilege escalation attempts
    • Track suspicious exec commands
    • Identify unusual container behavior
  • Image Security
    • Track image pull sources
    • Monitor unauthorized image usage
    • Detect unknown or unapproved images
    • Identify outdated or vulnerable images
  • Access Control
    • Monitor Docker socket access
    • Track API authentication events
    • Identify unauthorized operations
    • Detect credential misuse

​
Compliance and Auditing

  • Change Management
    • Container lifecycle audit trail
    • Configuration change tracking
    • Image version control
    • Deployment verification
  • Regulatory Compliance
    • PCI DSS container isolation requirements
    • HIPAA container security monitoring
    • SOC 2 change management controls
    • NIST container security guidelines

​
Operational Monitoring

  • Availability Tracking
    • Container crash detection
    • Restart loop identification
    • Failed container starts
    • Service availability monitoring
  • Resource Management
    • Container resource usage tracking
    • Image storage consumption
    • Volume usage monitoring
    • Network usage analysis

​
DevOps and CI/CD

  • Deployment Monitoring
    • Track container deployments
    • Monitor rollout progress
    • Identify deployment failures
    • Verify configuration updates
  • Build Pipeline Security
    • Monitor image builds
    • Track registry pushes
    • Verify image signatures
    • Audit build artifacts

​
Common Security Scenarios

​
Detecting Cryptocurrency Mining

Monitor for:
  • Unexpected container creation
  • High CPU usage containers
  • Unknown base images
  • Containers with suspicious names

​
Identifying Container Escapes

Watch for:
  • Privileged container creation
  • Host namespace access
  • Unusual volume mounts
  • Docker socket mounting

​
Supply Chain Attacks

Track:
  • Image pull sources
  • Unknown registry usage
  • Image tag changes
  • Unverified image pulls

​
Insider Threats

Monitor:
  • After-hours container operations
  • Mass container creation/deletion
  • Sensitive data volume mounts
  • Unauthorized image exports

​
Troubleshooting

​
No Events Appearing

  • Permission Issues
    • Check Wazuh user Docker group membership
    • Verify Docker socket permissions
    • Review SELinux/AppArmor policies
  • Configuration Issues
    • Verify wodle is enabled
    • Check Docker daemon is running
    • Ensure Docker socket path is correct
    • Review Wazuh agent logs

​
Connection Errors

  • Local Socket 
    # Test Docker socket access
sudo -u wazuh docker ps

# Check socket permissions
ls -l /var/run/docker.sock
  • Remote API 
    # Test API connectivity
curl https://remote-docker-host:2376/version

# Verify TLS certificates
openssl s_client -connect remote-docker-host:2376

​
Missing Specific Events

  • Verify Docker daemon is logging events
  • Check Docker daemon configuration
  • Ensure event types are not filtered
  • Review Docker version compatibility

​
Performance Issues

  • Adjust polling interval based on container activity
  • Implement event filtering at source
  • Monitor Wazuh agent resource usage
  • Consider dedicated monitoring agent for large deployments

​
Security Best Practices

  1. Docker Daemon Security
    • Use TLS for remote API access
    • Implement authentication and authorization
    • Limit Docker socket exposure
    • Use rootless Docker when possible
  2. Image Security
    • Use trusted registries only
    • Implement image scanning
    • Enforce image signing
    • Regular vulnerability assessments
  3. Container Hardening
    • Run containers as non-root
    • Use read-only filesystems
    • Limit container capabilities
    • Implement resource constraints
  4. Network Security
    • Isolate container networks
    • Use overlay networks for multi-host
    • Implement network policies
    • Monitor inter-container communication
  5. Monitoring Strategy
    • Alert on critical events (privileged containers, etc.)
    • Regular audit log reviews
    • Baseline normal behavior
    • Implement anomaly detection

​
Advanced Configuration

​
Event Filtering

Filter specific event types: 
<wodle name="docker-listener">
  <disabled>no</disabled>
  <run_on_start>yes</run_on_start>
  <interval>10m</interval>
  <filter_events>
    <container>create,start,stop,die,kill,destroy</container>
    <image>pull,delete</image>
  </filter_events>
</wodle>

​
High-Volume Environments

Optimize for large container deployments: 
<wodle name="docker-listener">
  <disabled>no</disabled>
  <interval>5m</interval>
  <attempts>3</attempts>
  <run_on_start>no</run_on_start>
  <buffer_size>8192</buffer_size>
</wodle>

​
Multiple Docker Hosts

Deploy Wazuh agent on each Docker host:
  • Centralized event collection
  • Per-host event tagging
  • Aggregated dashboard views
  • Cross-host correlation

​
Integration with Orchestration

​
Kubernetes

For Kubernetes environments:
  • Deploy Wazuh agent as DaemonSet
  • Monitor Docker events on each node
  • Correlate with Kubernetes events
  • Track pod lifecycle events

​
Docker Swarm

For Docker Swarm clusters:
  • Monitor manager nodes
  • Track service deployments
  • Monitor stack operations
  • Audit secret usage

​
Docker Compose

For Docker Compose deployments:
  • Track compose stack operations
  • Monitor service dependencies
  • Audit configuration changes
  • Verify service health