wazuh agent as a docker image
Tags: wazuh, agent, docker, cybersecurity
Published: 2023-01-24 12:54:09

one problem I have faced is having different SIEMS monitoring one host device for instance you need different logs from one endpoint device. Having all the agents running on that device could lead to resource contention and potential conflicts. One way around this is have one agent run as a docker container and map the host directories to the docker container directories. In this guide I will be running the wazuh agent in a docker container. For Demo purposes. Both the wazuh manager are deployed in local VM.

**PREREQUISITES**
I am assuming you already have your wazuh manager running and ready to connect to the agent.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4a8gxsj3wy0k4gxxx45q.PNG)

**PROCEDURE**
In this guide, my wazuh manager is using the IP address 10.0.2.16 while the agent IP is agent47: 10.0.2.15

_First step is to install docker on the agent_ 

```
sudo apt update
sudo apt install apt-transport-https curl gnupg-agent ca-certificates software-properties-common -y
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"
sudo apt install docker-ce docker-ce-cli containerd.io -y
sudo usermod -aG docker $USER
newgrp docker
```
check the docker version
`docker version`
Ensure docker is running
`sudo systemctl status docker`

If docker is not running for some reason, run the following commands.

```
sudo systemctl start docker
sudo systemctl enable docker
sudo systemctl restart docker
```
Now that docker is installed. The next step is to get the image from docker hub.
One of the challenges I faced was getting the right image. I tried working with noenv but for some reason could not make it work. Shout out to fajarhide for deploying the centos image that worked for me. To pull the image:
`docker pull fajarhide/wazuh-agent`
To check the image pulled:
`docker images -a`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vza0l3de9k3etmr40668.PNG)

**Running the docker image**
Now this is the part that got me scratching my head the most.
How well your image will run is determined by the tags you use in this one command 

`docker run --network host --env WAZUH_MANAGER_IP='10.0.2.16' -e WAZUH_MANAGER_PORT=1514 -e WAZUH_REGISTRATION_PASSWORD=admin --add-host=agent47:'10.0.2.15' --name wazuh-agent -v /var/log/syslog:/var/log/syslog -v /var/log/auth.log:/var/log/auth.log -v /var/log/dpkg.log:/var/log/dpkg.log -v /var/run/docker.sock:/var/run/docker.sock:ro -v /etc/localtime:/etc/localtime:ro -v /etc/timezone:/etc/timezone:ro fajarhide/wazuh-agent`

**--network host** this line will enable the image to take the current network interface being used by your device
**-v tag** this tag is very important. it's used to map various directories you want to scan from to the directories in the docker image.

check that the docker image is running
`docker ps -a`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mmlz3pln3zw0ij7ku8ce.PNG)

When you navigate to agents tag of your wazuh manager, you'll see that your agent is connected.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pckbx1y6ewtzwl867m67.PNG)
The final step is to configure ossec.conf to scan varies directories. You can add as many configurations as you want based on what you want to scan i.e vulnerabilities, file integrity etc.
To access the image, you'll need the image ID shown above

`docker exec  -it b031b69b5364 /bin/bash`
You will need to install an editor either vim or nano depending on which works best for you.

```
yum update -y
yum install vim
yum install nano
```
`vim /var/ossec/etc/ossec.conf`
edit the ossec.conf file and configure it according to your needs.
This is the minimal configurations I used 

```
<ossec_config>
  <client>
    <server>
      <address>10.0.2.16</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <config-profile>centos, centos7, centos7.9</config-profile>
    <notify_time>10</notify_time>
    <time-reconnect>60</time-reconnect>
    <auto_restart>yes</auto_restart>
    <crypto_method>aes</crypto_method>
  </client>

  <client_buffer>
    <!-- Agent buffer options -->
    <disabled>no</disabled>
    <queue_size>5000</queue_size>
    <events_per_second>500</events_per_second>
  </client_buffer>
<!-- Policy monitoring -->
<rootcheck>
    <disabled>no</disabled>
    <check_files>yes</check_files>
    <check_trojans>yes</check_trojans>
    <check_dev>yes</check_dev>
    <check_sys>yes</check_sys>
    <check_pids>yes</check_pids>
    <check_ports>yes</check_ports>
    <check_if>yes</check_if>

  <!-- Frequency that rootcheck is executed - every 12 hours -->
  <frequency>43200</frequency>

  <rootkit_files>etc/shared/rootkit_files.txt</rootkit_files>
  <rootkit_trojans>etc/shared/rootkit_trojans.txt</rootkit_trojans>

  <skip_nfs>yes</skip_nfs>
</rootcheck>
<syscheck>
   <directories check_all="yes" realtime="yes">/home/dut</directories>
</syscheck>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/auth.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/syslog</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/dpkg.log</location>
  </localfile>
<global>
<fim_daemon>yes</fim_daemon>
</global>
<sca>
    <enabled>yes</enabled>
    <scan_on_start>yes</scan_on_start>
    <interval>12h</interval>
    <skip_nfs>yes</skip_nfs>
</sca>
<wodle name="syscollector">
   <disabled>no</disabled>
   <interval>1h</interval>
   <os>yes</os>
   <packages>yes</packages>
   <hotfixes>yes</hotfixes>
</wodle>
</ossec_config>

```
I'm assuming you already know how to work with the ossec.conf file

Save and exit the editor
 
Exit and restart the container

Now your wazuh manager should be able to show the various security events.