local_rules.xml about wazuh-docker

Hi,

The wazuh container will map several config files/folders to /var/ossec/data at the first run inside the container, this is intended because the Wazuh Manager runs into a chrooted environment, so in order export all config files from the container to the host please try the following:

1. Stop and remove current container: docker-compose down
2. Create the destination folder on the host: mkdir -p /var/ossec
3. Uncomment the volume section on the wazuh container: /var/ossec:/var/ossec/data
4. Start the containers again: docker-compose up -d

After some time you should be able to see config related files on the host

# ls  /var/ossec/
api  etc  logs  process_list  queue  ruleset  stats  var

Then, you can configure your local_rules.xml by modifying the /var/ossec/etc/rules/local_rules.xml file on the host.

I hope it helps,

Regards,