Guilgo Blog

Notes from my daily work with technology.

Monitor Docker containers with Wazuh docker-listener: no custom rules needed

On 4.14.7 the official ruleset already keys off docker.Action; keep the socket on the host agent, not the manager

Enable Wazuh docker-listener on 4.14.7 without custom rules: the official ruleset already maps docker.Action, and the socket stays on the host agent.

Posted by David Guillermo on Friday, August 28, 2026

avatar

Sysadmin, self-taught by curiosity.

FEATURED TAGS
adguard arch-linux docker homelab kubernetes linux microsoft monitoring parental-control powershell security siem sysadmin tech telegram wazuh wsus