<!--
  Wazuh 5.0 Docker listener, agent-side.

  Merge into /var/ossec/etc/ossec.conf on the Docker host, or into the group's
  shared agent.conf inside <agent_config>.

  Options, defaults and allowed values from:
  https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/container-security/monitoring-docker.html
  https://documentation.wazuh.com/5.0-beta/user-manual/reference/ossec-conf/wodle-docker.html

  Prerequisites on the Docker host:
    sudo apt install -y python3 python3-pip
    pip3 install docker==7.1.0 urllib3==1.26.20 requests==2.32.2 (plus the
      break-system-packages flag on PEP 668 systems)
  The versions are pinned by the documentation, which also says to delete any
  newer urllib3 if present. Prefer a virtual environment on a host you care
  about, then repoint the shebang of
  /var/ossec/wodles/docker/DockerListener at that interpreter.

  Then restart the agent:
    sudo systemctl restart wazuh-agent
-->
<ossec_config>

  <wodle name="docker-listener">
    <!-- Waiting time to rerun the listener if it fails. Default 1m.
         This is a restart backoff, not a poll interval: the listener
         subscribes to the Docker event stream. -->
    <interval>2m</interval>
    <!-- Number of attempts to execute the listener if it fails. Default 5.
         Exhaust these and the module stays down until the agent restarts,
         which is what happens when Docker was not up when the agent started. -->
    <attempts>5</attempts>
    <run_on_start>yes</run_on_start>
    <disabled>no</disabled>
  </wodle>

</ossec_config>
