Wazuh SIEM Lab Exposes Logging Gaps in Container-Based Attack Detection

A hands-on experiment with the Wazuh SIEM platform revealed critical telemetry blind spots when monitoring containerised web applications running DVWA, a deliberately vulnerable app. The researcher configured custom log ingestion but initially received no events due to restrictive directory permissions blocking the Wazuh agent from reading log files. After fixing permissions, three live attack scenarios were tested: automated reconnaissance, OS command injection, and post-exploitation persistence. While Wazuh successfully detected scanner activity — logging over 380 events — it failed to capture internal OS commands executed via web-based injection due to container namespace isolation. The findings highlight that standard SIEM deployments require dedicated container socket monitoring to achieve full visibility beyond HTTP-layer logs.