Wazuh and Snyk (snyk.io) integration to scan Docker image vulnerabilities.

Intro

Snyk will help you find and automatically fix vulnerabilities in your code, open source dependencies, containers, and infrastructure as code.

In this integration we’ll use Snyk’s CLI to scan for vulnerabilities in the Docker images and all their dependencies.

NOTE: Wazuh can use all the features available in an agent to monitor Docker servers and it can also monitor container activity. With the Snyk integration we aim at finding vulnerable packages included in the Docker images that might put the containerised applications at risk.

Vulnerability Management and NIST 800–53 Security Controls

Snyk CLI

Snyk runs as a single binary, no installation required.

The Linux binary can be found here

This article from Snyk’s documentation explains how to use Snyk’s CLI for Docker security.

The Snyk CLI needs to be initialised before being used. In order to do that, you’ll have to create and register an account in their platform (snyk.io). The registration is free. More details on how to initialise the CLI here

Wazuh Capability

Wodle Command configured to run periodic security scans in all Docker images used in the host.

Jq is used in the agent (Docker host) to filter and parse the Snyk CLI output.

Wazuh remote commands execution must be enabled (Docker host).

Integration

1. Bash script to be run via wodle command will list all Docker images in the system and will run Snyk’s CLI to spot known vulnerabilities in all the packages used to build the image.
2. The JSON output will be appended to the active responses log file.
3. Detection rules in Wazuh manager will trigger alerts based on the scan results.

Remote commands execution must be enabled in the agent (Docker host), file “local_internal_options.conf”:

# Wazuh Command Module - If it should accept remote commands from the manager…