Docker and Wazuh Integration - Let's Build A Host Intrusion Detection System

Join me as we implement a Wazuh Wodle to monitor Docker images, containers, and more! Let's deploy a Host Intrusion Detection System and SIEM with free open source tools. Join me as we explore and learn together.
Defend with us on Slack: bit.ly/2Pi1byt
Check us out: www.opensecure...
Interact with our demo: www.opensecure...
Hire us: www.opensecure...

[@LeonardoSkorianez]

Very nice videos, keep doing thoses for the ultimate Open Source SIEM :)

[@taylorwalton_socfortress]

Hey Leonardo, thanks for watching and for the kind words :)

[@SimoneBacciglieriAS]

Very good video, thank you

[@taylorwalton_socfortress]

Thanks for watching :)

[@dedsec0173]

very insightful!!, but this is tutorial for docker host i think, and then how to monitor inside container with wazuh ? Thanks!

[@taylorwalton_socfortress]

Correct, you could mount a volume to the container that grabs the log files that you want and have your wazuh-agent read that volume mount. I also recommend Falco: github.com/falcosecurity/falco but I plan on covering that soon! Thanks for watching :)

[@andrewa3216]

Could you please post the docs you use to do these videos and also links to related videos? I jumped into this one and I had no idea how to install wazuh in the configuration that you have in this video... I also have no idea what a wodle is.

[@s0j0urner15]

Windows agents are sending docker events to wazuh