Wazuh ships with a docker-listener wodle on Linux agents. It subscribes to the Docker events API and forwards every container lifecycle event (create, start, stop, kill, exec, image pull, volume mount) to the manager for detection.
1. Install Python dependencies on the agent host
/var/ossec/framework/python/bin/pip3 install docker==7.1.02. Enable the wodle in ossec.conf
<wodle name="docker-listener">
<interval>10m</interval>
<attempts>5</attempts>
<run_on_start>yes</run_on_start>
<disabled>no</disabled>
</wodle>3. Add wazuh user to the docker group
usermod -aG docker root
systemctl restart wazuh-agent4. Generate a test event
docker run --rm alpine echo helloNote: Built-in rules in 87900-87999 cover Docker events. Add custom rules to alert on dangerous operations (docker exec into prod, privileged containers).
We build Wazuh detections for Docker, containerd and Kubernetes runtime threats, contact us.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhDockerContainer Security