docker:events
Docker daemon events and API
- Host type
- Container runtimes (Docker, containerd)
- Tier, as a whole
- Minimum
- Cost class
- Included
- Techniques
- 18
- Rules listed
- 0
- Events
- 4
Why this tier
OMB M-26-14 A5 (Infrastructure changes; our analysis)
Licensing
- License or service
- Docker Engine
- What is free
- docker system events
- What costs
- Nothing
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Infrastructure changes | Supports an activity | our analysis |
Techniques
- T1036 Masquerading
- T1036.010 Masquerade Account Name
- T1059.013 Container CLI/API
- T1070 Indicator Removal
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1485 Data Destruction
- T1496.002 Bandwidth Hijacking
- T1499 Endpoint Denial of Service
- T1525 Implant Internal Image
- T1543 Create or Modify System Process
- T1550 Use Alternate Authentication Material
- T1552.007 Container API
- T1609 Container Administration Command
- T1610 Deploy Container
- T1611 Escape to Host
- T1612 Build Image on Host
- T1613 Container and Resource Discovery
Rules
No vendor rule names this event or source directly.