The Wazuh agent allows more robust security monitoring than forwarded syslog messages alone, and additionally allows compliance and vulnerability monitoring.
Unlikely to cause negative impact.
User Story
The Wazuh agent requires minimal (if any) user interaction following installation. The primary means of interaction would be through modifying the agent configuration file (typically at path /var/ossec/etc/ossec.conf). Full app support may include options to modify this configuration via the Apps UI, though this would not necessarily be required for MVP.
The Wazuh agent runs as a background service, and forwards messages to a separate Wazuh server on network port 1514, so limited access to the host network would be required.
I’ll give that a try, but I don’t believe the Wazuh docker deployment can monitor the host OS. I think it’s more intended to be an all in one agent/server container.
TLDR: No, it does not seem that it is currently possible for the Wazuh Agent container to monitor the host system.
I was able to install the Wazuh Agent image from dockerhub: https://hub.docker.com/r/opennix/wazuh-agent. Installation is fairly straightforward - note that the environment variables listed in the dockerhub readme as Required but with default value None must be provided when configuring the installation, including the API username/password for the Wazuh indexer.
Unfortunately the installed agent is only forwarding events generated within the container (tested by manually generating logs in /var/log/syslog on both the host and inside the container). This is the case both with privileged and standard installations.
I don’t think this is currently possible, but rather than installing the Wazuh Agent on the host OS an alternative way to monitor the host may be adding the log directory as a read-only bind mount via the storage install configuration, then updating the Wazuh config to monitor the log files in this directory rather than the internal log directory. It seems like it is currently only possible to bind mount locations under the /mnt root, and this would require mounting /var/log, though there may already be a way to mount within the system root that I am unaware of?