Share feedback
Answers are generated based on the documentation.

View and export audit events

Table of contents
Subscription: AI Governance
For: Administrators

Cloud delivery stores AI Governance audit records in Docker Cloud and makes them available in the hosted audit log view. Use it to investigate policy decisions, such as why a developer's request was blocked or what sandboxes reached over the past week. Open the view to see recent events, narrow it to the ones you care about, then export them to CSV if you need an offline copy.

Before you begin

  • Cloud delivery must be turned on for your organization. The hosted view shows only records delivered to Docker Cloud, not records written to local disk.
  • You need organization owner access, or a custom role with AI Governance audit permissions.

View audit events

  1. Sign in to Docker Home and select your organization.
  2. Go to AI Platform > Audit logs.
  3. Open Audit events.

The Audit events view includes summary tiles for Events, Allowed, Denied, and Consent required. Consent required counts the events with an Approval required decision. The event table includes:

ColumnDescription
TimeWhen Docker recorded the event.
EventThe event type or policy action.
PrincipalThe Docker user associated with the event.
ResourceThe target resource, such as a domain, file path, or tool.
DecisionThe governance decision, such as Allow, Deny, or Approval required.
AgentThe AI agent associated with the event, when Docker knows it.

For every field in a record and what its values mean, see Audit record reference.

Filter and search events

The event table can hold a large number of events, so narrow it to the ones you're investigating. Use the filters above the table:

  • Date range: Today, Last 7 days, Last 14 days, Last 30 days, or a custom range. The table shows the last 7 days by default.
  • Decision: Allow, Deny, Approval required, or Approval unavailable.
  • Event type: the kind of action, such as a network or filesystem evaluation. For the full list, see Action types.
  • Agent: the AI agent associated with the event.
  • Principal: a Docker username.
  • Session ID: an audit session ID. This filter shows the whole session, whatever the date range.

To search across events, principals, resources, and decisions, enter at least three characters in the search box, then press Enter.

For example, set Decision to Deny and Principal to a developer's username to see what their sandboxes were blocked from.

The table shows 25 events per page by default. You can show 100 per page instead.

Export events to CSV

When you need an offline copy of the events you found, export them. The export uses your current filters and search terms:

  1. Open Audit events.
  2. Apply the filters and search terms for the events you want to export.
  3. Select Export.
  4. Download the generated CSV file from the link Docker provides.

CSV exports include up to 1,000,000 rows. An export stays available to download for 24 hours after Docker generates it.

To monitor audit events continuously instead of searching them by hand, forward them to your SIEM.