OpenParable
Skip to content
← Back to skills

Cis Docker 2.14

DevOps & Security
cis-docker-2.14

Cis Docker 2.14 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure centralized and remote logging is configured

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-2.14/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-2-14, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure centralized and remote logging is configured (Manual)

Profile Applicability

• Level 2 - Docker - Linux

Description

Docker supports various logging mechanisms. A preferable method for storing logs is one that supports centralized and remote management.

Rationale

Centralized and remote logging ensures that all important log records are safe even in the event of a major data availability issue. Docker supports various logging methods and you should use the one that best corresponds to your IT security policy.

Impact

None.

Audit Procedure

Run docker info and ensure that the Logging Driver property set as appropriate.

docker info --format '{{ .LoggingDriver }}'

Alternatively, the below command would give you the --log-driver setting. If configured you should ensure that it is set appropriately.

grep "--log-driver" /etc/docker/daemon.json

The contents of /etc/docker/daemon.json should also be reviewed for this setting.

Remediation

Step 1: Set up the desired log driver following its documentation.

Step 2: Start the docker daemon using that logging driver.

For example:

dockerd --log-driver=syslog --log-opt syslog-address=tcp://192.xxx.xxx.xxx

Default Value

By default, container logs are maintained as json files

References

  1. https://docs.docker.com/config/containers/logging/configure/

CIS Controls

Controls Version: v8

Control: 8.1 Establish and Maintain an Audit Log Management Process

Establish and maintain an audit log management process that defines the enterprise's logging requirements. At a minimum, address the collection, review, and retention of audit logs for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

IG 1: ● IG 2: ● IG 3: ●

Control: 8.9 Centralize Audit Logs

Centralize, to the extent possible, audit log collection and retention across enterprise assets.

IG 1: IG 2: ● IG 3: ●

Controls Version: v7

Control: 6.6 Deploy SIEM or Log Analytic tool

Deploy Security Information and Event Management (SIEM) or log analytic tool for log correlation and analysis.

IG 1: IG 2: ● IG 3: ●

Control: 6.8 Regularly Tune SIEM

On a regular basis, tune your SIEM system to better identify actionable events and decrease event noise.

IG 1: IG 2: IG 3: ●