Cis Docker V160 2.13
DevOps & Securitycis-docker-v160-2.13Cis Docker V160 2.13 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure centralized and remote logging is configured
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.6.0/cis-docker-v160-2.13/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-v160-2-13, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure centralized and remote logging is configured
Profile Applicability: Level 2 - Docker - Linux
Assessment Status: Manual
Description
Docker supports various logging mechanisms. A preferable method for storing logs is one that supports centralized and remote management.
Rationale
Centralized and remote logging ensures that all important log records are safe even in the event of a major data availability issue . Docker supports various logging methods and you should use the one that best corresponds to your IT security policy.
Impact
None.
Audit Procedure
Run docker info and ensure that the Logging Driver property set as appropriate.
docker info --format '{{ .LoggingDriver }}'
Alternatively, the below command would give you the --log-driver setting. If configured you should ensure that it is set appropriately.
ps -ef | grep dockerd
The contents of /etc/docker/daemon.json should also be reviewed for this setting.
Remediation
Step 1: Set up the desired log driver following its documentation. Step 2: Start the docker daemon using that logging driver. For example:
dockerd --log-driver=syslog --log-opt syslog-address=tcp://192.xxx.xxx.xxx
Default Value
By default, container logs are maintained as json files
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.1 Establish and Maintain an Audit Log Management ProcessEstablish and maintain an audit log management process that defines the enterprise's logging requirements. At a minimum, address the collection, review, and retention of audit logs for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. | ● | ● | ● |
| v8 | 8.9 Centralize Audit LogsCentralize, to the extent possible, audit log collection and retention across enterprise assets. | ● | ● | |
| v7 | 6.6 Deploy SIEM or Log Analytic toolDeploy Security Information and Event Management (SIEM) or log analytic tool for log correlation and analysis. | ● | ● | |
| v7 | 6.8 Regularly Tune SIEMOn a regular basis, tune your SIEM system to better identify actionable events and decrease event noise. | ● |
Profile/Assessment Status
Profile: Level 2 - Docker - Linux Assessment Status: Manual