struggling creating sigma for docker integration

[boredchilada]

Version

Other (please provide detail below)

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

66

Storage for /

128gb

Storage for /nsm

1tb

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello!

Version: 2.4.141

im currently struggling on the way i should approach creating sigma rules for different integrations.

i currently have a policy that has the docker integration, im trying o create a sigma rule for postfix failures from the docker logs, although i cant seem to find the proper ?logsource? details to properly target the right index.

this is one event

{"@timestamp":"2025-05-01T05:42:10.440Z","@version":"1","agent.ephemeral_id":"4f693aba-7f93-4384-8ccb-05c1105d71ea","agent.id":"e33c9bc8-6c41-4259-bcd8-414834633ad0","agent.name":"mailox01","agent.type":"filebeat","agent.version":"8.17.3","cloud.availability_zone":"fsn1-dc14","cloud.instance.id":"61487532","cloud.instance.name":"x","cloud.provider":"x","cloud.region":"eu-central","cloud.service.name":"Cloud","container.id":"c4f3d07667162c87d6a820022129f79592a2234813f63320b4e084e95739ed11","container.image.name":"ghcr.io/xyz/postfix:1.80","container.labels.com_docker_compose_config-hash":"ba3e52507dfb3362ac075c5e59d98f15b6ca1347e1d23dc5e7b8d9848ad9289f","container.labels.com_docker_compose_container-number":"1","container.labels.com_docker_compose_depends_on":"mysql-xyz:service_started:false,unbound-xyz:service_healthy:false","container.labels.com_docker_compose_image":"sha256:5a7d62a180d98cd8534df9cc91c0560ce8dfed31f1534c4b8b86f6f92358504d","container.labels.com_docker_compose_oneoff":"False","container.labels.com_docker_compose_project":"x","container.labels.com_docker_compose_project_config_files":"/root/xyz-dockerized/docker-compose.yml","container.labels.com_docker_compose_project_working_dir":"/root/xyz-dockerized","container.labels.com_docker_compose_service":"postfix-xyz","container.labels.com_docker_compose_version":"2.34.0","container.labels.maintainer":"= The Infrastructure Company GmbH <[email protected]>","container.name":"x-postfix-xyz-1","data_stream.dataset":"docker.container_logs","data_stream.namespace":"default","data_stream.type":"logs","ecs.version":"8.0.0","elastic_agent.id":"e33c9bc8-6c41-4259-bcd8-414834633ad0","elastic_agent.snapshot":false,"elastic_agent.version":"8.17.3","event.agent_id_status":"auth_metadata_missing","event.dataset":"docker.container_logs","event.ingested":"2025-05-01T05:42:19Z","event.module":"docker","host.architecture":"x86_64","host.containerized":false,"host.hostname":"mailox01","host.id":"d0c4f90b03d74b5dbb2b5daac5489d13","host.ip":["157.90.255.36","fe80::9400:4ff:fe25:f47e","172.22.1.1","fd4d:6169:6c63:6f77::1","fe80::8073:8fff:fe6b:557c","172.17.0.1","fd00:dead:beef:c0::1","fe80::80f0:93ff:fe78:38f0","fe80::6007:57ff:feab:3d5b","fe80::d02e:d7ff:fe6e:9e6","fe80::5494:5aff:fe89:e1b6","fe80::87c:d3ff:fe19:e19c","fe80::34b3:38ff:fe3b:424f","fe80::7cd0:9aff:feb0:f4","fe80::cc4c:58ff:fe6e:5420","fe80::4815:93ff:fee6:30ee","fe80::a4b2:ebff:fe25:76f2","fe80::50f4:5aff:fede:29c4","fe80::22:41ff:febf:ad90","fe80::a057:ddff:fe8a:b3ca","fe80::7c63:42ff:fe84:114c","fe80::1c3c:74ff:feb5:566d","fe80::b001:64ff:fe12:a8f5"],"host.mac":["02-22-41-BF-AD-90","0A-7C-D3-19-E1-9C","1E-3C-74-B5-56-6D","36-B3-38-3B-42-4F","4A-15-93-E6-30-EE","52-F4-5A-DE-29-C4","56-94-5A-89-E1-B6","62-07-57-AB-3D-5B","7E-63-42-84-11-4C","7E-D0-9A-B0-00-F4","82-73-8F-6B-55-7C","82-F0-93-78-38-F0","96-00-04-25-F4-7E","A2-57-DD-8A-B3-CA","A6-B2-EB-25-76-F2","B2-01-64-12-A8-F5","BA-1F-56-8D-96-E0","CE-4C-58-6E-54-20","D2-2E-D7-6E-09-E6"],"host.name":"xyz","host.os.codename":"jammy","host.os.family":"debian","host.os.kernel":"5.15.0-138-generic","host.os.name":"Ubuntu","host.os.platform":"ubuntu","host.os.type":"linux","host.os.version":"22.04.5 LTS (Jammy Jellyfish)","input.type":"filestream","log.file.device_id":"2049","log.file.inode":"521842","log.file.path":"/var/lib/docker/containers/c4f3d07667162c87d6a820022129f79592a2234813f63320b4e084e95739ed11/c4f3d07667162c87d6a820022129f79592a2234813f63320b4e084e95739ed11-json.log","log.offset":18317063,"message":"May  1 05:42:10 c4f3d0766716 postfix/smtps/smtpd[851]: warning: unknown[193.46.255.40]: SASL LOGIN authentication failed: (reason unavailable), [email protected]\n","metadata.beat":"filebeat","metadata.input.beats.host.ip":"13.38.61.56","metadata.input_id":"filestream-docker-215cdf32-02b9-490f-a083-270acff3cf4f-docker-c4f3d07667162c87d6a820022129f79592a2234813f63320b4e084e95739ed11","metadata.raw_index":"logs-docker.container_logs-default","metadata.stream_id":"docker-container-logs-x-postfix-x-1-c4f3d07667162c87d6a820022129f79592a2234813f63320b4e084e95739ed11","metadata.type":"_doc","metadata.version":"8.17.3","stream":"stdout","tags":["elastic-agent","input-wrinklyprick","beats_input_codec_plain_applied","container_logs"],"soc_id":"GdReipYB5py03QQpBVVE","soc_score":2,"soc_type":"","soc_timestamp":"2025-05-01T05:42:10.440Z","soc_source":"wrinklyprick:.ds-logs-docker.container_logs-default-2025.04.26-000001"}

and here is my current sigma

logsource:
  product: docker
  service: container_logs
detection:
  selection:
    message|contains: SASL LOGIN authentication failed
  condition: selection

the conversion of this is

and in the dev tools i get this

I notice that this dev tools query works and show me what i need

GET /.ds-logs-docker.container_logs-*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "data_stream.dataset": "docker.container_logs"
          }
        },
        {
          "match_phrase": {
            "message": "SASL LOGIN authentication failed"
          }
        }
      ]
    }
  }
}

how could i make this work?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Have you tried adding a selection for just the Docker dataset or module? Looks like it is seeing some indices message as text and a few as keyword data type. It is searching all indices as written.

[boredchilada]

so what I did, was create a custom ingest pipeline to break down the message key for the integration and that allowed me to target the created keys and create a sigma rule while keeping the broad check on the wildcard indice.

not sure if thats the most scalable way though , what do you mean by adding a selection for just the docker dataset? how would i do that via sigma?

everytime i seem to try and target docker and check via convert button, it targets the wildcard indice "logs-*". i can target the docker datastream in the devtools and via message and i dont get an error mentioned previously about ambiguity. I'm just not able to get the sigma rule to target the docker dataset.

[cm-ops]

https://www.elastic.co/docs/reference/query-languages/eql/eql-syntax#eql-text-fields Looks like the text field might be the issue with the EQL

[boredchilada]

Right so how would i use DSL or target the proper logs via sigma?

[cm-ops]

What does you ingest node parser look like?