Share feedback
Answers are generated based on the documentation.

SIEM forwarding

Table of contents

Docker can forward audit events to your security information and event management (SIEM) system, letting you centralize Docker governance data alongside other security signals. Events are forwarded in NDJSON format. Docker verifies the endpoint is reachable with the supplied credential before saving.

Supported destinations

DestinationDescription
Splunk Cloud (HEC)Hosted Splunk using the HTTP Event Collector
Splunk Enterprise (self-hosted)Self-hosted Splunk using the HTTP Event Collector
DynatraceDynatrace Log Management using the Log Ingest API
Custom HTTPS endpoint (advanced)Any SIEM that accepts HTTPS with a custom authentication header

Before you begin

SIEM forwarding requires Docker Cloud delivery to be enabled for your organization. If you haven't already, enable it under AI Platform > Audit logs > Audit delivery before configuring a SIEM destination. See Configure audit delivery.

Gather credentials from your SIEM before configuring forwarding:

  • Splunk Cloud: HEC ingest URL and an HEC token. Optionally, a Splunk index name. See Splunk documentation.
  • Splunk Enterprise: HEC endpoint URL (typically port 8088) and an HEC token. The endpoint must present a publicly-trusted TLS certificate. Optionally, a Splunk index name. See Splunk documentation.
  • Dynatrace: Log Ingest API URL and an API token with the logs.ingest scope. See Dynatrace documentation.
  • Custom HTTPS endpoint: Your endpoint URL, authentication header name, and full header value including any scheme (for example, Bearer <token>).

Add a SIEM destination

  1. Sign in to Docker Home.
  2. Open your organization.
  3. Go to AI Platform > Audit logs.
  4. Open Export & Connectors.
  5. Select Add destination.
  6. Select your destination and complete the form.
  7. Select Save.

If verification fails, check that the URL and credential are correct and that the endpoint is accessible from the internet.

Manage destinations

From the SIEM forwarding list, select the menu next to a destination to edit or delete it. The edit form lets you update credentials and toggle forwarding on or off for that destination. Deleting a destination permanently removes the endpoint and its stored credential and cannot be undone.