Guilgo Blog

Notes from my daily work with technology.

Kubernetes audit in Wazuh: policy, volume, and webhook (after we broke it)

How to harden the audit policy, keep the disk from filling up, and stop the webhook from swallowing whole EventLists

Hardened Kubernetes audit for Wazuh: first-match policy, port 8088, and one event per datagram—what eight months in a k3s homelab taught us.

Posted by David Guillermo on Saturday, October 3, 2026

Monitor Docker containers with Wazuh docker-listener: no custom rules needed

On 4.14.7 the official ruleset already keys off docker.Action; keep the socket on the host agent, not the manager

Enable Wazuh docker-listener on 4.14.7 without custom rules: the official ruleset already maps docker.Action, and the socket stays on the host agent.

Posted by David Guillermo on Friday, August 28, 2026

Wazuh releases 4.9.1 to mitigate Mirai botnet attacks (CVE-2025-24016)

Wazuh has released 4.9.1, which fixes the CVE-2025-24016 vulnerability (insecure deserialization in the Wazuh Server) that was later exploited by Mirai variants against exposed servers. Effective mitigation is to upgrade to 4.9.1 or later on manager, indexer and dashboard, then upgrade agents to maintain compatibility.

Executive summary

  • CVE-2025-24016 allows RCE on wazuh-manager (v ≥ 4.4.0 and < 4.9.1). Fixed in 4.9.1.
  • There was active exploitation by Mirai botnets in 2025 against servers with exposed API.
  • Wazuh stated that the bug requires API credentials; with panel or API exposed and weak keys, the risk is critical.

Sources: CVE/NVD, Release notes 4.9.1, Akamai/Censys advisories and official upgrade guide.

Posted by David Guillermo on Tuesday, September 30, 2025

avatar

Sysadmin, self-taught by curiosity.

FEATURED TAGS
adguard arch-linux docker homelab k8s kubernetes linux microsoft monitoring parental-control powershell security siem sysadmin tech telegram wazuh wsus