diff --git a/_vale/config/vocabularies/Docker/accept.txt b/_vale/config/vocabularies/Docker/accept.txt index e86486da2b41..a83e943b081e 100644 --- a/_vale/config/vocabularies/Docker/accept.txt +++ b/_vale/config/vocabularies/Docker/accept.txt @@ -87,6 +87,7 @@ Dockerized Dockerizing Dependabot DuckDuckGo +Dynatrace Entra EPERM ESXi diff --git a/content/manuals/ai/sandboxes/governance/audit/_index.md b/content/manuals/ai/sandboxes/governance/audit/_index.md index e3d10a08fee5..ae311100d135 100644 --- a/content/manuals/ai/sandboxes/governance/audit/_index.md +++ b/content/manuals/ai/sandboxes/governance/audit/_index.md @@ -6,6 +6,8 @@ description: Capture, view, export, and collect structured audit records for Doc keywords: docker sandboxes, audit log, audit logging, AI Governance, policy decision, SIEM, compliance, jsonl --- +{{< summary-bar feature_name="AI Governance Audit Logs" >}} + AI Governance Audit Logs record Docker AI Governance activity for your organization. Each record captures the principal, action, target, decision, and time for a governance event. Records contain metadata only. They don't contain @@ -58,6 +60,8 @@ Docker supports two delivery modes for audit records: Organization owners and users with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) that includes AI Governance audit permissions can configure local disk, Docker Cloud, or both. +The hosted audit log view, CSV export, and SIEM forwarding all require Docker Cloud delivery to be enabled. Local delivery alone does not power these features. + Organizations that used local audit logging before hosted audit logs were available start with cloud delivery off until an owner opts in from [audit delivery settings](configure.md). @@ -75,4 +79,5 @@ Policy](https://www.docker.com/legal/privacy/). - [Local audit logs](local.md) - [Configure audit delivery](configure.md) - [View and export audit events](view-export.md) +- [SIEM forwarding](siem.md) - [Audit record reference](record-reference.md) diff --git a/content/manuals/ai/sandboxes/governance/audit/siem.md b/content/manuals/ai/sandboxes/governance/audit/siem.md new file mode 100644 index 000000000000..bd76c2298bfc --- /dev/null +++ b/content/manuals/ai/sandboxes/governance/audit/siem.md @@ -0,0 +1,61 @@ +--- +title: SIEM forwarding +linkTitle: SIEM forwarding +weight: 35 +description: Forward Docker AI Governance audit events to Splunk, Dynatrace, or a custom HTTPS endpoint. +keywords: docker sandboxes, SIEM, audit logs, Splunk, Dynatrace, AI Governance, forwarding, NDJSON +--- + +Docker can forward audit events to your security information and event +management (SIEM) system, letting you centralize Docker governance data +alongside other security signals. Events are forwarded in NDJSON format. +Docker verifies the endpoint is reachable with the supplied credential before +saving. + +## Supported destinations + +| Destination | Description | +| -------------------------------- | --------------------------------------------------------------- | +| Splunk Cloud (HEC) | Hosted Splunk using the HTTP Event Collector | +| Splunk Enterprise (self-hosted) | Self-hosted Splunk using the HTTP Event Collector | +| Dynatrace | Dynatrace Log Management using the Log Ingest API | +| Custom HTTPS endpoint (advanced) | Any SIEM that accepts HTTPS with a custom authentication header | + +## Before you begin + +SIEM forwarding requires Docker Cloud delivery to be enabled for your +organization. If you haven't already, enable it under **AI Platform** > +**Audit logs** > **Audit delivery** before configuring a SIEM destination. See +[Configure audit delivery](configure.md). + +Gather credentials from your SIEM before configuring forwarding: + +- **Splunk Cloud**: HEC ingest URL and an HEC token. Optionally, a Splunk index + name. See [Splunk documentation](https://docs.splunk.com/). +- **Splunk Enterprise**: HEC endpoint URL (typically port 8088) and an HEC + token. The endpoint must present a publicly-trusted TLS certificate. + Optionally, a Splunk index name. See [Splunk documentation](https://docs.splunk.com/). +- **Dynatrace**: Log Ingest API URL and an API token with the `logs.ingest` + scope. See [Dynatrace documentation](https://docs.dynatrace.com/). +- **Custom HTTPS endpoint**: Your endpoint URL, authentication header name, and + full header value including any scheme (for example, `Bearer `). + +## Add a SIEM destination + +1. Sign in to [Docker Home](https://app.docker.com/). +1. Open your organization. +1. Go to **AI Platform** > **Audit logs**. +1. Open **Export & Connectors**. +1. Select **Add destination**. +1. Select your destination and complete the form. +1. Select **Save**. + +If verification fails, check that the URL and credential are correct and that +the endpoint is accessible from the internet. + +## Manage destinations + +From the **SIEM forwarding** list, select the menu next to a destination to +edit or delete it. The edit form lets you update credentials and toggle +forwarding on or off for that destination. Deleting a destination permanently +removes the endpoint and its stored credential and cannot be undone. diff --git a/content/manuals/ai/sandboxes/governance/audit/view-export.md b/content/manuals/ai/sandboxes/governance/audit/view-export.md index 555e2f36f251..7b1e7adf67b0 100644 --- a/content/manuals/ai/sandboxes/governance/audit/view-export.md +++ b/content/manuals/ai/sandboxes/governance/audit/view-export.md @@ -2,13 +2,13 @@ title: View and export audit events linkTitle: View and export weight: 30 -description: Search, filter, export, and stream Docker AI Governance audit events from the hosted audit log UI. -keywords: docker sandboxes, audit events, audit logs, AI Governance, CSV export, SIEM, Splunk, NDJSON +description: Search, filter, and export Docker AI Governance audit events from the hosted audit log UI. +keywords: docker sandboxes, audit events, audit logs, AI Governance, CSV export --- Cloud delivery stores AI Governance audit records in Docker Cloud and makes them available in the hosted audit log UI. Use the hosted view to investigate -policy decisions, export events to CSV, or stream events to your SIEM. +policy decisions or export events to CSV. ## View audit events @@ -48,20 +48,3 @@ Use CSV export when you need an offline copy of filtered audit events: 1. Download the generated CSV file from the link Docker provides. CSV exports include up to 1 000 000 rows. Download links expire after 24 hours. - -## SIEM forwarding - -Docker can forward audit events to your security information and event -management (SIEM) system, letting you centralize Docker governance data -alongside other security signals in tools such as Datadog or Splunk. - -To set up forwarding, you provide an HTTPS endpoint that will receive the audit -events, choose an output format, and supply the credentials Docker will use to -authenticate against your SIEM. Docker verifies the endpoint is reachable before -saving the configuration. - -Once configured, forwarding can be enabled or disabled without losing your saved -settings. - -To collect host-local files with your own log shipper instead, see -[Local audit logs](local.md). diff --git a/data/summary.yaml b/data/summary.yaml index a529cf9dbfe8..ed5507d44058 100644 --- a/data/summary.yaml +++ b/data/summary.yaml @@ -1,3 +1,6 @@ +AI Governance Audit Logs: + subscription: [AI Governance] + requires: Docker Sandboxes [0.35.0](/manuals/ai/sandboxes/release-notes.md) or later Activity logs: subscription: [Team, Business] for: Administrators diff --git a/layouts/_shortcodes/summary-bar.html b/layouts/_shortcodes/summary-bar.html index a849ca7c305b..98f037117756 100644 --- a/layouts/_shortcodes/summary-bar.html +++ b/layouts/_shortcodes/summary-bar.html @@ -13,6 +13,7 @@ "Docker Hardened Images Enterprise" "/icons/dhi.svg" "Docker Hardened Images Select or Enterprise" "/icons/dhi.svg" "Docker Offload" "cloud" + "AI Governance" "shield-check" }} {{ $availabilityIcons := dict "Experimental" "beaker"