elastic / elastic/integrations

[Docker Integration] New Datastream for Docker Engine API logs

Open
#11,094 2 comments 0 reactions 0 assignees View on GitHub
enhancement Integration:docker Team:Cloudnative-Monitoring
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

Is it possible to add a new logs datastream that would capture Docker Engine/daemon API requests like `docker run ...`, `docker container ...`, etc. Right now the only way to capture this information seems to be using other integrations like Elastic Defend and Auditbeat. It would be nice to be able to install the Docker Integration and gather this information with all the container context provided in the existing metrics and container log datastreams. Use case would be for creating detection rules around suspicious behavior for example creation of privileged container with host network attached. `docker run -it --privileged --net=host ...`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.