Container Creation — Detection Telemetry

Collection and providers

Collect runtime create events and image/container IDs; correlate with API audit to establish the initiating identity.

• Docker Engine events: Daemon lifecycle events for containers and images; collect continuously.
• Kubernetes API audit: Control-plane context in Kubernetes, not a replacement for runtime observations.

Configuration

• Subscribe to the lab daemon event stream with filters for the relevant object/action; send it to a durable collector.
• Record runtime/container ID, image digest, action, timestamp and host. Join orchestrator identities where available.
• Use a protected collector connection. Docker socket access is privileged; never expose it publicly or grant it to the website.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0072",
  "collector": "illustrative-lab-collector",
  "observation": {
    "container_id": "lab-container-1",
    "image_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
    "action": "create"
  }
}

Visibility and validation

Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• Docker engine event stream
• Kubernetes audit policies and backends