"Container Creation" data component captures details about the initial construction of a container in a containerized environment. This includes events where a new container is instantiated, such as through Docker, Kubernetes, or other container orchestration platforms. Monitoring these events helps detect unauthorized or potentially malicious container creation. Examples:
docker create my-container, docker run --name=my-container nginx:latestkubectl run my-pod --image=nginx, kubectl create deployment my-deployment --image=nginxRunTask or CreateService).| Name | Channel |
|---|---|
| containerd:events | create |
| docker:daemon | container create/start with privileged flag or host volume mount |
| docker:events | created,started: new container from untrusted registry or unexpected entrypoint |
| docker:events | docker run with restart=always or modifying init |
| kubernetes:apiserver | create/exec: Kubernetes API calls to exec into containers or create pods from curl, kubectl, or SDK clients |
| kubernetes:audit | create: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=true |
| kubernetes:events | container start/stop activity via Docker, containerd, or CRI-O |
| systemd:unit | container run with restart policy set to 'always' or 'unless-stopped' |