From Docker Home to a SIEM
Top row: an organization policy written in Docker Home under AI Platform is pulled by sandboxd within five minutes and merged with the local policy, whose 194 allow rules become inactive while its deny rules stay active. Second row: the proxy decides one request, example.com:443 from m101-policy, with the reason no applicable policies for op(action=net:connect:tcp, resource=net:domain:example.com:443), and the decision AUDIT_DECISION_DENY. Third row: the daemon writes one record to an audit-<utc>-<uuid>-<seq>.jsonl file under the auditkit directory, and rotation finalizes the file every 5 minutes, 1000 events, or 50 MiB. Bottom row: Docker Cloud delivery keeps the record searchable for 90 days and forwards it to a SIEM destination. A note says this capture had no organization and wrote no record.
WHERE THE RULES COME FROM
Docker Home
Network, Filesystem, MCP
policies, org or team scope
sandboxd
pulls within 5 minutes
sbx policy reset forces it
local-policy
194 allow: inactive
deny: still applied
pull
merge
the proxy decides: example.com:443 from m101-policy
no applicable policies for op(action=net:connect:tcp,
resource=net:domain:example.com:443), decision AUDIT_DECISION_DENY
effective rules
audit-<utc>-<uuid>-<seq>.jsonl
~/Library/Logs/com.docker.sandboxes/sandboxes/auditkit/
written by the daemon under an enforced org policy
one record per decision
rotation
every 5 min, 1000 events,
or 50 MiB, .tmp to .jsonl
Docker Cloud delivery (default on)
searchable 90 days, CSV up to 1 000 000 rows
app.docker.com, AI Platform, Audit logs
SIEM destination
Splunk Cloud, Dynatrace, Datadog, Sumo Logic
needs sbx 0.39.0 and cloud delivery
upload
this capture: no organization, no license, no record written (03-policy-org.txt)