elastic / elastic/integrations
[Docker Integration] New Datastream for Docker Engine API logs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
Is it possible to add a new logs datastream that would capture Docker Engine/daemon API requests like `docker run ...`, `docker container ...`, etc. Right now the only way to capture this information seems to be using other integrations like Elastic Defend and Auditbeat. It would be nice to be able to install the Docker Integration and gather this information with all the container context provided in the existing metrics and container log datastreams. Use case would be for creating detection rules around suspicious behavior for example creation of privileged container with host network attached. `docker run -it --privileged --net=host ...`
Contributor guide
Assessment
This issue has not been assessed yet.