Inventory containers with a Wazuh agent

▤ Summary

This article explains how to use a Wazuh agent and a custom command module to inventory Docker containers. It shows a shell script that collects container metadata such as image, registry, digest, user, privileges, and capabilities, then emits JSON for Wazuh to ingest. It also describes custom detection rules for risky conditions like privileged containers, root user execution, latest tags, and local images. Finally, it demonstrates how to query and visualize the data in Wazuh Dashboards and mentions adapting the approach for other container runtimes and CI/CD workflows.

▦ Linked Companies

Selectel

$50M to $100M