Key Takeaways
- Containers are a SIEM blind spot unless you deliberately monitor the Docker runtime, container activity and the host underneath.
- Wazuh has a Docker listener that subscribes to the Docker API and captures events: container create, start, stop, exec, image pull, volume and network changes.
- Monitor the host, not just containers. The Wazuh agent on the container host watches the kernel, auditd, Docker daemon logs and file integrity of critical paths.
- High-value detections include privileged container launches, exec into running containers, container escape attempts, and unexpected image pulls.
- For Kubernetes, run the agent on the worker nodes and ingest control-plane and audit logs for cluster-level visibility.
Why Containers Are a Monitoring Blind Spot
Containers changed how applications run, but they also broke a lot of traditional monitoring. Containers are ephemeral, often short-lived, and share the host kernel, so activity inside them does not automatically show up in the host logs a SIEM usually reads. An attacker who compromises a container, or abuses the Docker API, can operate largely unseen if you only monitor the host the old way.
Effective container monitoring therefore needs three layers: the Docker runtime (what containers are being created, started and exec'd into), the container workloads (application logs from inside containers), and the host (kernel, daemon and file activity underneath). Wazuh can cover all three, which is why it is a practical choice for bringing containers into an existing SOC.
The Wazuh Docker Listener
Wazuh includes a Docker listener module that connects to the Docker API and streams Docker events into Wazuh. Once enabled (it uses the Docker Python SDK on the host), it captures the lifecycle and management events that reveal what is happening in the runtime: container create, start, stop, die and destroy; exec into a running container; image pull and build; and changes to volumes and networks.
These events are the backbone of container detection. An unexpected image pull from an unknown registry, an exec into a production container, or the launch of a container with dangerous flags all appear here. Wazuh decodes and rules on the events like any other log source, so container activity joins the same alerting, dashboards and correlation as the rest of your estate rather than sitting in a separate tool.
Need Help Building These Detections?
Codesecure designs, deploys and tunes Wazuh-based SOC stacks (manager, indexer, dashboard, agents, custom rules, decoders and active response) for businesses across India, Singapore, UAE and Malaysia. ISO/IEC 27001:2022 certified delivery, named OSCP, CEH and CISSP consultants, fixed-price proposals.
See SOC and SIEM Services →Monitoring the Container Host
The Docker listener shows runtime events, but the host underneath is just as important. Install the Wazuh agent on every container host and use its full capability set there. Collect the Docker daemon logs and the system journal, enable auditd rules to watch sensitive syscalls and access to the Docker socket, and run file integrity monitoring on critical paths such as /etc, the Docker configuration, and the docker.sock file whose exposure is a common escalation path.
Host-level monitoring catches things container events alone miss: a process on the host interacting directly with the Docker socket, modifications to the daemon configuration, or kernel-level activity consistent with a container escape. Security configuration assessment (SCA) against the CIS Docker Benchmark adds a compliance and hardening view, flagging misconfigurations like containers running as root or with excessive capabilities before they are exploited.
High-Value Container Detections
With runtime and host telemetry flowing, focus on the detections that matter most. Privileged container launches (containers started with --privileged or with the host namespaces, or mounting the Docker socket) are a top signal, because they are a common path to breaking out onto the host. Exec into running containers is normal for developers but suspicious in production, especially outside change windows, and the Docker listener captures it.
Container escape attempts show up as unusual host-level process or syscall activity originating from a container context, which host auditd and FIM help catch. Unexpected image pulls, particularly from untrusted registries, can indicate an attacker deploying tooling. Mapping these to MITRE ATT&CK for Containers helps structure coverage. Prioritise privileged launches, socket access and production exec first, as they cover the most common container attack paths.
Extending to Kubernetes
Most container workloads at scale run under Kubernetes, which adds an orchestration layer on top of the container runtime. To monitor Kubernetes with Wazuh, run the agent on the worker nodes so you keep the host and runtime visibility described above for the nodes where containers actually execute.
On top of node monitoring, ingest the Kubernetes audit logs and control-plane component logs so you can see cluster-level activity: API server requests, changes to roles and role bindings (RBAC), secret access, and pod and deployment changes. Together these give both node-level detection and cluster-level governance. The approach is layered, as with Docker: watch the nodes for runtime and host signals, and the control plane for orchestration and identity activity.
Running Wazuh But Missing Attacks?
Whether you need custom rule development, active response playbooks, a detection coverage review against MITRE ATT&CK, or full tuning, our SOC lead is available for a 30-minute free scoping call. No obligation, no slideware.
Talk to a SOC Engineer →Images, Hygiene and Compliance
Runtime detection is reactive; image and configuration hygiene is preventive. Use Wazuh security configuration assessment against the CIS Docker Benchmark to continuously check that containers are not running as root, do not have unnecessary capabilities, and that the daemon and host are configured securely. These checks surface the misconfigurations that make escapes and abuse possible in the first place.
Wazuh also contributes to compliance reporting for container environments, mapping findings to frameworks you already report against. While dedicated image-scanning tools handle vulnerability scanning of images in the pipeline, Wazuh covers the runtime and host side: what is actually running, how it is configured, and what it is doing. The two together, scan images before deployment, monitor behaviour and configuration at runtime, give end-to-end container security that fits into an existing SOC.
Frequently Asked Questions
How does Wazuh monitor Docker containers?
Wazuh monitors containers in layers. Its Docker listener module connects to the Docker API and streams runtime events (container create, start, exec, image pull, volume and network changes). The Wazuh agent on the container host collects the Docker daemon logs, auditd events and file integrity of critical paths. Together they give visibility into the runtime and the host underneath.
What is the Wazuh Docker listener?
The Docker listener is a Wazuh module that connects to the Docker API (using the Docker Python SDK on the host) and captures Docker events as a log source. It records container lifecycle and management activity such as create, start, stop, exec, image pull and network or volume changes, which Wazuh then decodes and applies rules to like any other log.
Can Wazuh detect container escapes?
Wazuh helps detect container escape attempts by monitoring the host as well as the runtime. Host auditd rules and file integrity monitoring catch unusual syscall activity, access to the Docker socket, and host-level processes originating from a container context, which are the signals of an escape. Combined with detecting privileged container launches, this covers the common escape paths.
How do I monitor Kubernetes with Wazuh?
Run the Wazuh agent on the Kubernetes worker nodes to keep host and runtime visibility where containers execute, and ingest the Kubernetes audit logs and control-plane logs for cluster-level activity such as API server requests, RBAC changes, secret access and pod or deployment changes. This gives both node-level detection and cluster-level governance.
What are the most important container detections to build first?
Prioritise privileged container launches (started with --privileged, host namespaces, or mounting the Docker socket), access to the Docker socket, and exec into production containers outside change windows. These cover the most common routes from a compromised container to taking over the host. Add unexpected image pulls from untrusted registries next.
Can Codesecure set up container monitoring in our Wazuh?
Yes. Codesecure configures the Wazuh Docker listener, host-level auditd and FIM, CIS Docker Benchmark assessment and the key container detections, and extends monitoring to Kubernetes nodes and audit logs. ISO/IEC 27001:2022 certified delivery with named OSCP, CEH and CISSP consultants across India, Singapore, UAE and Malaysia.
Bring Your Containers Into The SOC
Codesecure sets up Wazuh container monitoring across the Docker runtime, the host and Kubernetes nodes, with the detections that catch privileged launches, socket abuse and escape attempts. Delivered by named OSCP, CEH and CISSP consultants.
