siem-logging
Warn
Audited by Socket on Feb 16, 2026
1 alert found:
AnomalyAnomalyexamples/architectures/wazuh-docker-compose.yml
LOWAnomalyLOW
examples/architectures/wazuh-docker-compose.yml
No explicit malware or obfuscated/backdoor code found in this Docker Compose file. However, it contains clear security weaknesses: hardcoded plaintext credentials, disabled SSL verification (FILEBEAT_SSL_VERIFICATION_MODE=none), and multiple sensitive ports exposed to the host. These misconfigurations pose a meaningful operational security risk (credential leakage, MITM, unauthorized access). Recommend: remove secrets from the compose file and use Docker secrets or a vault, enable SSL verification and proper TLS certs, restrict host port exposure (use internal networks or firewall rules), and secure persisted volumes and access to docker inspect/compose files.
Confidence: 85%Severity: 65%
Audit Metadata