# Cis Docker 2.14

> Cis Docker 2.14 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure centralized and remote logging is configured

- Skill name: `cis-docker-2.14`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-2.14/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure centralized and remote logging is configured (Manual)

## Profile Applicability

• Level 2 - Docker - Linux

## Description

Docker supports various logging mechanisms. A preferable method for storing logs is one that supports centralized and remote management.

## Rationale

Centralized and remote logging ensures that all important log records are safe even in the event of a major data availability issue. Docker supports various logging methods and you should use the one that best corresponds to your IT security policy.

## Impact

None.

## Audit Procedure

Run `docker info` and ensure that the `Logging Driver` property set as appropriate.

```bash
docker info --format '{{ .LoggingDriver }}'
```

Alternatively, the below command would give you the `--log-driver` setting. If configured you should ensure that it is set appropriately.

```bash
grep "--log-driver" /etc/docker/daemon.json
```

The contents of `/etc/docker/daemon.json` should also be reviewed for this setting.

## Remediation

**Step 1:** Set up the desired log driver following its documentation.

**Step 2:** Start the docker daemon using that logging driver.

For example:

```bash
dockerd --log-driver=syslog --log-opt syslog-address=tcp://192.xxx.xxx.xxx
```

## Default Value

By default, container logs are maintained as json files

## References

1. https://docs.docker.com/config/containers/logging/configure/

## CIS Controls

**Controls Version:** v8

**Control:** 8.1 Establish and Maintain an Audit Log Management Process

Establish and maintain an audit log management process that defines the enterprise's logging requirements. At a minimum, address the collection, review, and retention of audit logs for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

**IG 1:** ●
**IG 2:** ●
**IG 3:** ●

---

**Control:** 8.9 Centralize Audit Logs

Centralize, to the extent possible, audit log collection and retention across enterprise assets.

**IG 1:**
**IG 2:** ●
**IG 3:** ●

---

**Controls Version:** v7

**Control:** 6.6 Deploy SIEM or Log Analytic tool

Deploy Security Information and Event Management (SIEM) or log analytic tool for log correlation and analysis.

**IG 1:**
**IG 2:** ●
**IG 3:** ●

---

**Control:** 6.8 Regularly Tune SIEM

On a regular basis, tune your SIEM system to better identify actionable events and decrease event noise.

**IG 1:**
**IG 2:**
**IG 3:** ●

---

Source: https://www.openparable.com/skill/devops-security/cis-docker-2-14 (OpenParable). Cite the canonical URL above.