containers:host
Container host
Docker and containerd runtime events.
- Host type
- Container runtimes (Docker, containerd)
- Minimum events
- 0
- Recommended events
- 5
- Log sources
- 3
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| containerd runtime events | Minimum | 10 | 0 |
| Docker daemon events and API | Minimum | 18 | 0 |
Minimum
No event reaches the minimum bar for this role at the event level. The logs tiered as a whole, above, are the unit to read.
Recommended
5 more events meet one of the three criteria. Each source opens on its own.
containerd runtime events1 event · Free tool
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| create | 1 | none |
Docker daemon events and API4 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| container_create | 1 | none | ||
| container_start | 1 | none | ||
| docker.events.json | 1 | none | ||
| start | 1 | none |