Container Security Monitoring with Wazuh: Docker and Kubernetes Integration#

1
<!-- Enhanced Wazuh Agent Configuration for Docker Monitoring -->
2
<ossec_config>
3

4
  <!-- Docker Daemon Monitoring -->
5
  <localfile>
6
    <log_format>json</log_format>
7
    <location>/var/lib/docker/containers/*/*-json.log</location>
8
  </localfile>
9

10
  <!-- Docker Events Monitoring -->
11
  <localfile>
12
    <log_format>command</log_format>
13
    <command>docker events --format "{{json .}}" --since 1m</command>
14
    <frequency>60</frequency>
15
  </localfile>
16

17
  <!-- Docker System Information -->
18
  <localfile>
19
    <log_format>command</log_format>
20
    <command>docker system info --format "{{json .}}"</command>
21
    <frequency>300</frequency>
22
  </localfile>
23

24
  <!-- Container Resource Usage -->
25
  <localfile>
26
    <log_format>command</log_format>
27
    <command>docker stats --no-stream --format "table {{.Container}}\t{{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}\t{{.BlockIO}}\t{{.PIDs}}"</command>
28
    <frequency>120</frequency>
29
  </localfile>
30

31
  <!-- Docker Security Scanning -->
32
  <localfile>
33
    <log_format>command</log_format>
34
    <command>/var/ossec/bin/docker-security-scan.sh</command>
35
    <frequency>3600</frequency>
36
  </localfile>
37

38
  <!-- Monitor Docker configuration files -->
39
  <syscheck>
40
    <directories>/etc/docker</directories>
41
    <directories>/etc/default/docker</directories>
42
    <directories>/etc/systemd/system/docker.service.d</directories>
43
    <directories>/usr/lib/systemd/system/docker.service</directories>
44
    <directories>/var/lib/docker/containers</directories>
45
  </syscheck>
46

47
  <!-- Active Response for Docker -->
48
  <active-response>
49
    <command>docker-quarantine</command>
50
    <location>local</location>
51
    <level>12</level>
52
    <rules_group>docker_malware,docker_intrusion</rules_group>
53
    <timeout>3600</timeout>
54
  </active-response>
55

56
  <!-- Docker-specific wodle for enhanced monitoring -->
57
  <wodle name="docker-listener">
58
    <disabled>no</disabled>
59
    <interval>10s</interval>
60
    <run_on_start>yes</run_on_start>
61
    <skip_on_error>yes</skip_on_error>
62

63
    <!-- Attempts to connect to the Docker socket -->
64
    <socket>/var/run/docker.sock</socket>
65

66
    <!-- Docker API version -->
67
    <api_version>auto</api_version>
68

69
    <!-- Number of retries to connect to Docker -->
70
    <retries>5</retries>
71

72
    <!-- Time between retries (seconds) -->
73
    <retry_interval>10</retry_interval>
74
  </wodle>
75

76
</ossec_config>

1
#!/bin/bash
2
# Docker Security Scanning Script for Wazuh Integration
3

4
SCRIPT_DIR="/var/ossec/bin"
5
LOG_FILE="/var/log/docker-security-scan.log"
6
TEMP_DIR="/tmp/docker-security-$$"
7

8
# Create temporary directory
9
mkdir -p "$TEMP_DIR"
10

11
# Logging function
12
log_security_event() {
13
    local level=$1
14
    local message=$2
15
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
16

17
    echo "[$timestamp] [$level] $message" | tee -a "$LOG_FILE"
18
}
19

20
# Container security scanning function
21
scan_container_security() {
22
    local container_id=$1
23
    local container_name=$2
24
    local image_name=$3
25

26
    log_security_event "INFO" "Scanning container: $container_name ($container_id)"
27

28
    # Check if container is running as root
29
    local container_user=$(docker inspect "$container_id" --format '{{.Config.User}}')
30
    if [[ -z "$container_user" || "$container_user" == "root" || "$container_user" == "0" ]]; then
31
        log_security_event "WARNING" "Container $container_name running as root user"
32
        echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"root_user\",\"severity\":\"medium\",\"description\":\"Container running with root privileges\"}"
33
    fi
34

35
    # Check for privileged containers
36
    local privileged=$(docker inspect "$container_id" --format '{{.HostConfig.Privileged}}')
37
    if [[ "$privileged" == "true" ]]; then
38
        log_security_event "CRITICAL" "Privileged container detected: $container_name"
39
        echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"privileged_container\",\"severity\":\"high\",\"description\":\"Container running in privileged mode\"}"
40
    fi
41

42
    # Check for host network mode
43
    local network_mode=$(docker inspect "$container_id" --format '{{.HostConfig.NetworkMode}}')
44
    if [[ "$network_mode" == "host" ]]; then
45
        log_security_event "WARNING" "Container using host network: $container_name"
46
        echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"host_network\",\"severity\":\"medium\",\"description\":\"Container using host network mode\"}"
47
    fi
48

49
    # Check for volume mounts
50
    local mounts=$(docker inspect "$container_id" --format '{{range .Mounts}}{{.Type}}:{{.Source}}:{{.Destination}} {{end}}')
51
    if echo "$mounts" | grep -q "/:/"; then
52
        log_security_event "CRITICAL" "Root filesystem mounted in container: $container_name"
53
        echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"root_mount\",\"severity\":\"critical\",\"description\":\"Root filesystem mounted in container\"}"
54
    fi
55

56
    # Check for sensitive file mounts
57
    sensitive_paths=(
58
        "/etc/passwd"
59
        "/etc/shadow"
60
        "/etc/group"
61
        "/root"
62
        "/home"
63
        "/var/run/docker.sock"
64
        "/proc"
65
        "/sys"
66
    )
67

68
    for sensitive_path in "${sensitive_paths[@]}"; do
69
        if echo "$mounts" | grep -q "$sensitive_path"; then
70
            log_security_event "HIGH" "Sensitive path mounted in container: $container_name - $sensitive_path"
71
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"sensitive_mount\",\"severity\":\"high\",\"description\":\"Sensitive path $sensitive_path mounted in container\"}"
72
        fi
73
    done
74

75
    # Check container capabilities
76
    local capabilities=$(docker inspect "$container_id" --format '{{range .HostConfig.CapAdd}}{{.}} {{end}}')
77
    dangerous_capabilities=("SYS_ADMIN" "NET_ADMIN" "SYS_PTRACE" "SYS_MODULE" "DAC_OVERRIDE")
78

79
    for cap in $capabilities; do
80
        if [[ " ${dangerous_capabilities[@]} " =~ " ${cap} " ]]; then
81
            log_security_event "HIGH" "Dangerous capability added to container: $container_name - $cap"
82
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"dangerous_capability\",\"severity\":\"high\",\"description\":\"Dangerous capability $cap added to container\"}"
83
        fi
84
    done
85

86
    # Check for resource limits
87
    local memory_limit=$(docker inspect "$container_id" --format '{{.HostConfig.Memory}}')
88
    local cpu_limit=$(docker inspect "$container_id" --format '{{.HostConfig.CpuShares}}')
89

90
    if [[ "$memory_limit" == "0" ]]; then
91
        log_security_event "WARNING" "Container without memory limit: $container_name"
92
        echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"no_memory_limit\",\"severity\":\"low\",\"description\":\"Container running without memory limit\"}"
93
    fi
94

95
    # Check for secrets in environment variables
96
    local env_vars=$(docker inspect "$container_id" --format '{{range .Config.Env}}{{.}} {{end}}')
97
    secret_patterns=("PASSWORD" "SECRET" "KEY" "TOKEN" "API" "CREDENTIAL")
98

99
    for pattern in "${secret_patterns[@]}"; do
100
        if echo "$env_vars" | grep -qi "$pattern"; then
101
            log_security_event "HIGH" "Potential secret in environment variables: $container_name"
102
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"image\":\"$image_name\",\"security_issue\":\"secret_in_env\",\"severity\":\"high\",\"description\":\"Potential secret detected in environment variables\"}"
103
            break
104
        fi
105
    done
106
}
107

108
# Image vulnerability scanning
109
scan_image_vulnerabilities() {
110
    local image_name=$1
111

112
    log_security_event "INFO" "Scanning image vulnerabilities: $image_name"
113

114
    # Use Trivy for vulnerability scanning if available
115
    if command -v trivy &> /dev/null; then
116
        local trivy_output="$TEMP_DIR/trivy_scan.json"
117
        trivy image --format json --output "$trivy_output" "$image_name" 2>/dev/null
118

119
        if [[ -f "$trivy_output" ]]; then
120
            local critical_vulns=$(jq '.Results[]?.Vulnerabilities[]? | select(.Severity=="CRITICAL") | length' "$trivy_output" 2>/dev/null | head -1)
121
            local high_vulns=$(jq '.Results[]?.Vulnerabilities[]? | select(.Severity=="HIGH") | length' "$trivy_output" 2>/dev/null | head -1)
122

123
            if [[ "$critical_vulns" -gt 0 ]]; then
124
                log_security_event "CRITICAL" "Critical vulnerabilities found in image: $image_name ($critical_vulns critical)"
125
                echo "{\"timestamp\":\"$(date -Iseconds)\",\"image\":\"$image_name\",\"security_issue\":\"critical_vulnerabilities\",\"severity\":\"critical\",\"count\":$critical_vulns,\"description\":\"Critical vulnerabilities detected in container image\"}"
126
            fi
127

128
            if [[ "$high_vulns" -gt 0 ]]; then
129
                log_security_event "HIGH" "High severity vulnerabilities found in image: $image_name ($high_vulns high)"
130
                echo "{\"timestamp\":\"$(date -Iseconds)\",\"image\":\"$image_name\",\"security_issue\":\"high_vulnerabilities\",\"severity\":\"high\",\"count\":$high_vulns,\"description\":\"High severity vulnerabilities detected in container image\"}"
131
            fi
132
        fi
133
    fi
134

135
    # Check for base image security
136
    local dockerfile_path=$(docker inspect "$image_name" --format '{{range .Config.Labels}}{{if eq .Key "dockerfile.path"}}{{.Value}}{{end}}{{end}}' 2>/dev/null)
137
    if [[ -n "$dockerfile_path" && -f "$dockerfile_path" ]]; then
138
        # Check for insecure base images
139
        if grep -qi "FROM.*:latest" "$dockerfile_path"; then
140
            log_security_event "WARNING" "Image uses latest tag: $image_name"
141
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"image\":\"$image_name\",\"security_issue\":\"latest_tag\",\"severity\":\"medium\",\"description\":\"Image uses latest tag which may introduce unpredictable changes\"}"
142
        fi
143

144
        # Check for running as root in Dockerfile
145
        if ! grep -qi "USER" "$dockerfile_path"; then
146
            log_security_event "WARNING" "No non-root user specified in Dockerfile: $image_name"
147
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"image\":\"$image_name\",\"security_issue\":\"no_user_specified\",\"severity\":\"medium\",\"description\":\"Dockerfile does not specify non-root user\"}"
148
        fi
149
    fi
150
}
151

152
# Network security scanning
153
scan_network_security() {
154
    local container_id=$1
155
    local container_name=$2
156

157
    log_security_event "INFO" "Scanning network security for container: $container_name"
158

159
    # Check for exposed ports
160
    local ports=$(docker port "$container_id" 2>/dev/null)
161
    if [[ -n "$ports" ]]; then
162
        while IFS= read -r port_mapping; do
163
            if echo "$port_mapping" | grep -q "0.0.0.0"; then
164
                local port=$(echo "$port_mapping" | cut -d':' -f2 | cut -d'-' -f1)
165
                log_security_event "WARNING" "Container exposing port to all interfaces: $container_name - $port"
166
                echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"security_issue\":\"port_exposure\",\"severity\":\"medium\",\"port\":\"$port\",\"description\":\"Container port exposed to all network interfaces\"}"
167
            fi
168
        done <<< "$ports"
169
    fi
170

171
    # Check network connections
172
    local network_info=$(docker inspect "$container_id" --format '{{range $key, $value := .NetworkSettings.Networks}}{{$key}}: {{$value.IPAddress}} {{end}}')
173
    if echo "$network_info" | grep -q "bridge:"; then
174
        local bridge_ip=$(echo "$network_info" | grep "bridge:" | cut -d' ' -f2)
175
        if [[ "$bridge_ip" =~ ^172\.(1[6-9]|2[0-9]|3[0-1])\. ]]; then
176
            log_security_event "INFO" "Container using default Docker bridge network: $container_name"
177
        fi
178
    fi
179
}
180

181
# Main scanning function
182
run_security_scan() {
183
    log_security_event "INFO" "Starting Docker security scan"
184

185
    # Get all running containers
186
    local containers=$(docker ps --format "{{.ID}}\t{{.Names}}\t{{.Image}}")
187

188
    while IFS=$'\t' read -r container_id container_name image_name; do
189
        [[ -n "$container_id" ]] || continue
190

191
        scan_container_security "$container_id" "$container_name" "$image_name"
192
        scan_network_security "$container_id" "$container_name"
193
    done <<< "$containers"
194

195
    # Get unique images for vulnerability scanning
196
    local unique_images=$(docker ps --format "{{.Image}}" | sort | uniq)
197

198
    while IFS= read -r image_name; do
199
        [[ -n "$image_name" ]] || continue
200
        scan_image_vulnerabilities "$image_name"
201
    done <<< "$unique_images"
202

203
    log_security_event "INFO" "Docker security scan completed"
204
}
205

206
# Docker daemon configuration check
207
check_docker_daemon_security() {
208
    log_security_event "INFO" "Checking Docker daemon security configuration"
209

210
    # Check if Docker daemon is running with TLS
211
    if ! docker info 2>/dev/null | grep -q "Server:"; then
212
        log_security_event "ERROR" "Cannot connect to Docker daemon"
213
        echo "{\"timestamp\":\"$(date -Iseconds)\",\"security_issue\":\"docker_daemon_unreachable\",\"severity\":\"critical\",\"description\":\"Cannot connect to Docker daemon\"}"
214
        return 1
215
    fi
216

217
    # Check Docker daemon configuration
218
    local daemon_config="/etc/docker/daemon.json"
219
    if [[ -f "$daemon_config" ]]; then
220
        # Check for security-relevant configurations
221
        if ! jq -r '.["live-restore"]' "$daemon_config" 2>/dev/null | grep -q "true"; then
222
            log_security_event "WARNING" "Docker daemon live-restore not enabled"
223
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"security_issue\":\"live_restore_disabled\",\"severity\":\"low\",\"description\":\"Docker daemon live-restore feature is not enabled\"}"
224
        fi
225

226
        if ! jq -r '.["userland-proxy"]' "$daemon_config" 2>/dev/null | grep -q "false"; then
227
            log_security_event "WARNING" "Docker userland-proxy not disabled"
228
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"security_issue\":\"userland_proxy_enabled\",\"severity\":\"medium\",\"description\":\"Docker userland-proxy should be disabled for better security\"}"
229
        fi
230

231
        if ! jq -r '.icc' "$daemon_config" 2>/dev/null | grep -q "false"; then
232
            log_security_event "WARNING" "Inter-container communication not disabled"
233
            echo "{\"timestamp\":\"$(date -Iseconds)\",\"security_issue\":\"icc_enabled\",\"severity\":\"medium\",\"description\":\"Inter-container communication should be disabled by default\"}"
234
        fi
235
    else
236
        log_security_event "WARNING" "Docker daemon configuration file not found"
237
        echo "{\"timestamp\":\"$(date -Iseconds)\",\"security_issue\":\"no_daemon_config\",\"severity\":\"medium\",\"description\":\"Docker daemon configuration file not found\"}"
238
    fi
239
}
240

241
# Runtime behavior analysis
242
analyze_runtime_behavior() {
243
    log_security_event "INFO" "Analyzing container runtime behavior"
244

245
    # Check for containers with unusual resource usage
246
    local stats_output="$TEMP_DIR/docker_stats.txt"
247
    timeout 10s docker stats --no-stream --format "table {{.Container}}\t{{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}\t{{.BlockIO}}" > "$stats_output" 2>/dev/null
248

249
    if [[ -f "$stats_output" ]]; then
250
        while IFS=$'\t' read -r container_id container_name cpu_perc mem_usage net_io block_io; do
251
            [[ "$container_id" != "CONTAINER" ]] || continue
252
            [[ -n "$container_id" ]] || continue
253

254
            # Parse CPU percentage
255
            cpu_value=$(echo "$cpu_perc" | sed 's/%//' | cut -d'.' -f1)
256
            if [[ "$cpu_value" -gt 80 ]]; then
257
                log_security_event "WARNING" "High CPU usage detected: $container_name ($cpu_perc)"
258
                echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"security_issue\":\"high_cpu_usage\",\"severity\":\"medium\",\"cpu_percent\":\"$cpu_perc\",\"description\":\"Container showing unusually high CPU usage\"}"
259
            fi
260

261
            # Parse memory usage (simplified check)
262
            if echo "$mem_usage" | grep -qE '[0-9]+\.?[0-9]*GiB.*[89][0-9]%|[0-9]+\.?[0-9]*GiB.*100%'; then
263
                log_security_event "WARNING" "High memory usage detected: $container_name ($mem_usage)"
264
                echo "{\"timestamp\":\"$(date -Iseconds)\",\"container_id\":\"$container_id\",\"container_name\":\"$container_name\",\"security_issue\":\"high_memory_usage\",\"severity\":\"medium\",\"memory_usage\":\"$mem_usage\",\"description\":\"Container showing unusually high memory usage\"}"
265
            fi
266

267
        done < "$stats_output"
268
    fi
269
}
270

271
# Main execution
272
main() {
273
    # Ensure we have the necessary tools
274
    if ! command -v docker &> /dev/null; then
275
        log_security_event "ERROR" "Docker is not installed or not in PATH"
276
        exit 1
277
    fi
278

279
    if ! command -v jq &> /dev/null; then
280
        log_security_event "WARNING" "jq is not installed - some checks will be skipped"
281
    fi
282

283
    # Run security checks
284
    check_docker_daemon_security
285
    run_security_scan
286
    analyze_runtime_behavior
287

288
    # Cleanup
289
    rm -rf "$TEMP_DIR"
290

291
    log_security_event "INFO" "Docker security monitoring cycle completed"
292
}
293

294
# Execute main function
295
main "$@"

1
<group name="docker,container,">
2

3
  <!-- Docker Container Lifecycle Events -->
4
  <rule id="800001" level="3">
5
    <decoded_as>json</decoded_as>
6
    <field name="Type">container</field>
7
    <field name="Action">create</field>
8
    <description>Docker: Container created - $(Actor.Attributes.name) ($(Actor.Attributes.image))</description>
9
    <group>docker_container_lifecycle,</group>
10
  </rule>
11

12
  <rule id="800002" level="4">
13
    <if_sid>800001</if_sid>
14
    <field name="Actor.Attributes.image" type="pcre2">:latest$</field>
15
    <description>Docker: Container created with latest tag - $(Actor.Attributes.name)</description>
16
    <group>docker_container_lifecycle,docker_insecure,</group>
17
  </rule>
18

19
  <rule id="800003" level="5">
20
    <decoded_as>json</decoded_as>
21
    <field name="Type">container</field>
22
    <field name="Action">start</field>
23
    <description>Docker: Container started - $(Actor.Attributes.name)</description>
24
    <group>docker_container_lifecycle,</group>
25
  </rule>
26

27
  <rule id="800004" level="6">
28
    <decoded_as>json</decoded_as>
29
    <field name="Type">container</field>
30
    <field name="Action">die</field>
31
    <description>Docker: Container died - $(Actor.Attributes.name) (Exit Code: $(Actor.Attributes.exitCode))</description>
32
    <group>docker_container_lifecycle,</group>
33
  </rule>
34

35
  <rule id="800005" level="8">
36
    <if_sid>800004</if_sid>
37
    <field name="Actor.Attributes.exitCode" type="pcre2">^(?!0$)\d+$</field>
38
    <description>Docker: Container failed with non-zero exit code - $(Actor.Attributes.name) (Exit Code: $(Actor.Attributes.exitCode))</description>
39
    <group>docker_container_failure,</group>
40
  </rule>
41

42
  <!-- Docker Security Violations -->
43
  <rule id="800010" level="10">
44
    <decoded_as>json</decoded_as>
45
    <field name="security_issue">privileged_container</field>
46
    <description>Docker Security: Privileged container detected - $(container_name)</description>
47
    <group>docker_security_violation,privilege_escalation,</group>
48
  </rule>
49

50
  <rule id="800011" level="12">
51
    <decoded_as>json</decoded_as>
52
    <field name="security_issue">root_mount</field>
53
    <description>Docker Security: Root filesystem mounted in container - $(container_name)</description>
54
    <group>docker_security_violation,dangerous_mount,</group>
55
  </rule>
56

57
  <rule id="800012" level="9">
58
    <decoded_as>json</decoded_as>
59
    <field name="security_issue">sensitive_mount</field>
60
    <description>Docker Security: Sensitive path mounted - $(container_name) ($(description))</description>
61
    <group>docker_security_violation,sensitive_mount,</group>
62
  </rule>
63

64
  <rule id="800013" level="8">
65
    <decoded_as>json</decoded_as>
66
    <field name="security_issue">dangerous_capability</field>
67
    <description>Docker Security: Dangerous capability added - $(container_name) ($(description))</description>
68
    <group>docker_security_violation,dangerous_capability,</group>
69
  </rule>
70

71
  <rule id="800014" level="9">
72
    <decoded_as>json</decoded_as>
73
    <field name="security_issue">secret_in_env</field>
74
    <description>Docker Security: Potential secret in environment variables - $(container_name)</description>
75
    <group>docker_security_violation,secret_exposure,</group>
76
  </rule>
77

78
  <rule id="800015" level="7">
79
    <decoded_as>json</decoded_as>
80
    <field name="security_issue">host_network</field>
81
    <description>Docker Security: Container using host network mode - $(container_name)</description>
82
    <group>docker_security_violation,network_security,</group>
83
  </rule>
84

85
  <!-- Docker Image Security -->
86
  <rule id="800020" level="12">
87
    <decoded_as>json</decoded_as>
88
    <field name="security_issue">critical_vulnerabilities</field>
89
    <description>Docker Image: Critical vulnerabilities detected - $(image) (Count: $(count))</description>
90
    <group>docker_image_vulnerability,critical_vulnerability,</group>
91
  </rule>
92

93
  <rule id="800021" level="8">
94
    <decoded_as>json</decoded_as>
95
    <field name="security_issue">high_vulnerabilities</field>
96
    <description>Docker Image: High severity vulnerabilities detected - $(image) (Count: $(count))</description>
97
    <group>docker_image_vulnerability,high_vulnerability,</group>
98
  </rule>
99

100
  <rule id="800022" level="6">
101
    <decoded_as>json</decoded_as>
102
    <field name="security_issue">latest_tag</field>
103
    <description>Docker Image: Using latest tag - $(image)</description>
104
    <group>docker_image_security,insecure_practice,</group>
105
  </rule>
106

107
  <rule id="800023" level="5">
108
    <decoded_as>json</decoded_as>
109
    <field name="security_issue">no_user_specified</field>
110
    <description>Docker Image: No non-root user specified - $(image)</description>
111
    <group>docker_image_security,configuration,</group>
112
  </rule>
113

114
  <!-- Docker Network Security -->
115
  <rule id="800030" level="6">
116
    <decoded_as>json</decoded_as>
117
    <field name="security_issue">port_exposure</field>
118
    <description>Docker Network: Port exposed to all interfaces - $(container_name) (Port: $(port))</description>
119
    <group>docker_network_security,port_exposure,</group>
120
  </rule>
121

122
  <rule id="800031" level="8">
123
    <if_sid>800030</if_sid>
124
    <field name="port">22|3389|1433|3306|5432|6379|11211|27017</field>
125
    <description>Docker Network: Sensitive service port exposed - $(container_name) (Port: $(port))</description>
126
    <group>docker_network_security,sensitive_port_exposure,</group>
127
  </rule>
128

129
  <!-- Docker Daemon Security -->
130
  <rule id="800040" level="12">
131
    <decoded_as>json</decoded_as>
132
    <field name="security_issue">docker_daemon_unreachable</field>
133
    <description>Docker Daemon: Cannot connect to Docker daemon</description>
134
    <group>docker_daemon,service_failure,</group>
135
  </rule>
136

137
  <rule id="800041" level="4">
138
    <decoded_as>json</decoded_as>
139
    <field name="security_issue">no_daemon_config</field>
140
    <description>Docker Daemon: Configuration file not found</description>
141
    <group>docker_daemon,configuration,</group>
142
  </rule>
143

144
  <rule id="800042" level="6">
145
    <decoded_as>json</decoded_as>
146
    <field name="security_issue">live_restore_disabled</field>
147
    <description>Docker Daemon: Live-restore feature not enabled</description>
148
    <group>docker_daemon,configuration,</group>
149
  </rule>
150

151
  <rule id="800043" level="5">
152
    <decoded_as>json</decoded_as>
153
    <field name="security_issue">userland_proxy_enabled</field>
154
    <description>Docker Daemon: Userland-proxy should be disabled</description>
155
    <group>docker_daemon,configuration,</group>
156
  </rule>
157

158
  <rule id="800044" level="5">
159
    <decoded_as>json</decoded_as>
160
    <field name="security_issue">icc_enabled</field>
161
    <description>Docker Daemon: Inter-container communication should be disabled</description>
162
    <group>docker_daemon,configuration,</group>
163
  </rule>
164

165
  <!-- Docker Runtime Behavior -->
166
  <rule id="800050" level="6">
167
    <decoded_as>json</decoded_as>
168
    <field name="security_issue">high_cpu_usage</field>
169
    <description>Docker Runtime: High CPU usage detected - $(container_name) ($(cpu_percent))</description>
170
    <group>docker_runtime,resource_abuse,</group>
171
  </rule>
172

173
  <rule id="800051" level="6">
174
    <decoded_as>json</decoded_as>
175
    <field name="security_issue">high_memory_usage</field>
176
    <description>Docker Runtime: High memory usage detected - $(container_name) ($(memory_usage))</description>
177
    <group>docker_runtime,resource_abuse,</group>
178
  </rule>
179

180
  <!-- Docker Escape Attempts -->
181
  <rule id="800060" level="12">
182
    <if_group>docker</if_group>
183
    <match>/proc/self/cgroup</match>
184
    <match>docker</match>
185
    <description>Docker: Potential container escape attempt - Process accessing container information</description>
186
    <group>docker_escape,container_breakout,</group>
187
  </rule>
188

189
  <rule id="800061" level="12">
190
    <if_group>docker</if_group>
191
    <match>/var/run/docker.sock</match>
192
    <description>Docker: Container accessing Docker socket - potential privilege escalation</description>
193
    <group>docker_escape,privilege_escalation,</group>
194
  </rule>
195

196
  <!-- Docker File System Events -->
197
  <rule id="800070" level="7">
198
    <if_group>docker</if_group>
199
    <field name="file">/etc/passwd|/etc/shadow|/etc/sudoers</field>
200
    <description>Docker: Critical system file modified in container - $(file)</description>
201
    <group>docker_filesystem,critical_file_change,</group>
202
  </rule>
203

204
  <!-- Docker Process Events -->
205
  <rule id="800080" level="8">
206
    <if_group>docker</if_group>
207
    <match>/bin/sh -c|/bin/bash -c</match>
208
    <match>curl|wget|nc |netcat|python|perl|ruby</match>
209
    <description>Docker: Suspicious command execution in container - $(command)</description>
210
    <group>docker_process,suspicious_command,</group>
211
  </rule>
212

213
  <rule id="800081" level="10">
214
    <if_group>docker</if_group>
215
    <match>chmod +x|chown root|sudo|su -</match>
216
    <description>Docker: Privilege escalation attempt in container - $(command)</description>
217
    <group>docker_process,privilege_escalation,</group>
218
  </rule>
219

220
  <!-- Docker Volume Events -->
221
  <rule id="800090" level="5">
222
    <decoded_as>json</decoded_as>
223
    <field name="Type">volume</field>
224
    <field name="Action">create</field>
225
    <description>Docker: Volume created - $(Actor.Attributes.name)</description>
226
    <group>docker_volume,</group>
227
  </rule>
228

229
  <rule id="800091" level="6">
230
    <decoded_as>json</decoded_as>
231
    <field name="Type">volume</field>
232
    <field name="Action">destroy</field>
233
    <description>Docker: Volume destroyed - $(Actor.Attributes.name)</description>
234
    <group>docker_volume,data_loss,</group>
235
  </rule>
236

237
  <!-- Docker Network Events -->
238
  <rule id="800100" level="5">
239
    <decoded_as>json</decoded_as>
240
    <field name="Type">network</field>
241
    <field name="Action">create</field>
242
    <description>Docker: Network created - $(Actor.Attributes.name)</description>
243
    <group>docker_network,</group>
244
  </rule>
245

246
  <rule id="800101" level="6">
247
    <decoded_as>json</decoded_as>
248
    <field name="Type">network</field>
249
    <field name="Action">destroy</field>
250
    <description>Docker: Network destroyed - $(Actor.Attributes.name)</description>
251
    <group>docker_network,</group>
252
  </rule>
253

254
  <!-- Correlation Rules -->
255
  <rule id="800200" level="10" frequency="5" timeframe="300">
256
    <if_matched_sid>800005</if_matched_sid>
257
    <same_field>Actor.Attributes.name</same_field>
258
    <description>Docker: Container repeatedly failing - $(Actor.Attributes.name)</description>
259
    <group>docker_correlation,container_instability,</group>
260
  </rule>
261

262
  <rule id="800201" level="12">
263
    <if_matched_sid>800010</if_matched_sid>
264
    <if_matched_sid>800011</if_matched_sid>
265
    <same_field>container_name</same_field>
266
    <timeframe>60</timeframe>
267
    <description>Docker: Multiple severe security violations - $(container_name)</description>
268
    <group>docker_correlation,multiple_violations,</group>
269
  </rule>
270

271
</group>