Can OSSEC be used to check files which on inside a docker. From what I have read OSSEC can only monitor file integrity of the Host machine.
1
There are 1 best solutions below
Related Questions in OSSEC
- Best way to make an HABTM association via console
- undefined method `namespace' for main:Object (NoMethodError) - active record / rakefile
- Ruby destroy is not working? Or objects still present?
- Trying to set the value of an input with mechanize
- How to split the logic in a ruby game
- How can I monitor an endpoint's status with Ruby?
- Why can a private class method be explicitly invoked in Ruby?
- Rails - Ajax do not work properly on production server
- syntax error, unexpected kEND
- Carrierwave file upload with different file types
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular # Hahtags
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Yes, you may configure an OSSEC or Wazuh agent to do File Integrity Monitoring within docker containers.
Docker uses the OverlayFS storage driver that places the file structure of containers within the
/var/lib/docker/overlay2/directory (or/var/lib/docker/overlay/in older versions), more information on this can be found here: https://docs.docker.com/storage/storagedriver/overlayfs-driver/To determine which is the folder of the container you wish to monitor, you may use the inspect command:
docker inspect <container-name> | grep MergedDirand then configure OSSEC or Wazuh to monitor this path.For example, let's say you have an nginx container and want to monitor its configuration files:
The first step is to determine the container's folder:
and then add the directory to monitor in the
ossec.conffile of your OSSEC or Wazuh agent:A detailed explanation of how to configure File Integrity Monitoring can be found here: https://documentation.wazuh.com/3.13/user-manual/capabilities/file-integrity/fim-configuration.html
If you also want to monitor the docker server activity, you can use the Wazuh docker module: https://documentation.wazuh.com/3.13/docker-monitor/monitoring_containers_activity.html
Best regards,
Sandra.