--- title: Docker AI Governance: Audit Logs, Now Where Your... description: Docker AI Governance now streams policy decision audit logs to SIEM tools like Splunk, Datadog, Dynatrace, and Grafana, while also providing a searchable... canonical: https://daily.dev/posts/docker-ai-governance-audit-logs-now-where-your-security-team-already-works-ssahro5qo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Docker AI Governance: Audit Logs, Now Where Your Security Team Already Works | daily.dev og:description: Docker AI Governance now streams policy decision audit logs to SIEM tools like Splunk, Datadog, Dynatrace, and Grafana, while also providing a searchable... og:url: https://daily.dev/posts/docker-ai-governance-audit-logs-now-where-your-security-team-already-works-ssahro5qo og:image: https://api.daily.dev/og/posts/ssahRo5Qo.png og:image:alt: Docker AI Governance: Audit Logs, Now Where Your Security Team Already Works og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Docker AI Governance: Audit Logs, Now Where Your Security Team Already Works **[Docker](https://daily.dev/sources/docker)** · 3 min read · 0 upvotes · 0 comments ## Summary Docker AI Governance now streams policy decision audit logs to SIEM tools like Splunk, Datadog, Dynatrace, and Grafana, while also providing a searchable 90-day record in Docker Cloud with CSV export. The feature captures all three policy outcomes — allowed, denied, and held for human review — which is only possible at the enforcement point rather than via log collection after the fact. Coverage currently includes Docker Sandboxes policy decisions and sandbox session events, with MCP Gateway enforcement decisions coming later. Records are metadata-only and never include prompt content or agent output. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does Docker AI Governance support streaming audit logs to a SIEM like Splunk or Datadog? Yes, Docker AI Governance now natively streams audit events to SIEM tools including Splunk, Datadog, Dynatrace, and Grafana. Audit logs are also viewable in Docker Cloud with 90-day retention and CSV export, and local disk delivery still works alongside SIEM streaming. This is available for organizations with an AI Governance license and an enforced organization policy. _Security teams standardizing agent oversight can track governance updates like this on daily.dev._ ### Why can't a log collector see denied or blocked AI agent actions? A log collector only reads what an agent actually produced as output, so it never sees a tool call that was refused, a domain that was unreachable, or a credential that was requested and withheld, because the process that would have generated that output never ran. Only the enforcement point where the policy decision is made can capture allowed, denied, and held-for-human outcomes. _Anyone evaluating agent guardrails can follow how enforcement-layer auditing evolves on daily.dev._ ### What data do Docker AI Governance audit records contain about AI agent activity? Audit records are metadata only and never contain prompt content, agent output, or parameter values. They currently cover Docker Sandboxes policy decisions and sandbox session events, with MCP Gateway enforcement decisions and other sources planned to share records through the same schema as they become available. _Teams weighing agent security tooling can keep tabs on coverage expansions via daily.dev._ ## Similar posts on daily.dev - [Docker AI Governance: Unlock Agent Autonomy, Safely](https://daily.dev/posts/docker-ai-governance-unlock-agent-autonomy-safely-s3gotzrnq) · Docker · 2 upvotes · 0 comments - [As agentic dev tools boom, workflow auditability becomes the constraint](https://daily.dev/posts/as-agentic-dev-tools-boom-workflow-auditability-becomes-the-constraint-vr9ylzsgj) · The New Stack · 0 upvotes · 0 comments - [The rise of agentic AI part 7: introducing data governance and audit trails for AI services](https://daily.dev/posts/the-rise-of-agentic-ai-part-7-introducing-data-governance-and-audit-trails-for-ai-services-yecy6n7ec) · Dynatrace · 0 upvotes · 0 comments - [Make zero CVEs your new default](https://daily.dev/posts/make-zero-cves-your-new-default-dk7ir7jif) · Docker · 0 upvotes · 0 comments - [Monitor OCI Audit Logs with Datadog Cloud SIEM](https://daily.dev/posts/monitor-oci-audit-logs-with-datadog-cloud-siem-i7fkb8uf5) · Datadog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/docker-ai-governance-audit-logs-now-where-your-security-team-already-works-ssahro5qo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Docker AI Governance: Audit Logs, Now Where Your Security Team Already Works","url":"https://daily.dev/posts/docker-ai-governance-audit-logs-now-where-your-security-team-already-works-ssahro5qo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/docker-ai-governance-audit-logs-now-where-your-security-team-already-works-ssahro5qo"},"datePublished":"2026-08-03T13:00:52.835Z","dateModified":"2026-09-14T08:55:34.588Z","description":"Docker AI Governance now streams policy decision audit logs to SIEM tools like Splunk, Datadog, Dynatrace, and Grafana, while also providing a searchable...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Docker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Docker","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8a1022bebfc04a7d824c309bd3686787","url":"https://daily.dev/sources/docker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/docker-ai-governance-audit-logs-now-where-your-security-team-already-works-ssahro5qo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,docker,ai-governance","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Docker","item":"https://daily.dev/sources/docker"},{"@type":"ListItem","position":3,"name":"Docker AI Governance: Audit Logs, Now Where Your Security Team Already Works"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/docker-ai-governance-audit-logs-now-where-your-security-team-already-works-ssahro5qo#faq","mainEntity":[{"@type":"Question","name":"Does Docker AI Governance support streaming audit logs to a SIEM like Splunk or Datadog?","acceptedAnswer":{"@type":"Answer","text":"Yes, Docker AI Governance now natively streams audit events to SIEM tools including Splunk, Datadog, Dynatrace, and Grafana. Audit logs are also viewable in Docker Cloud with 90-day retention and CSV export, and local disk delivery still works alongside SIEM streaming. This is available for organizations with an AI Governance license and an enforced organization policy. Security teams standardizing agent oversight can track governance updates like this on daily.dev."}},{"@type":"Question","name":"Why can't a log collector see denied or blocked AI agent actions?","acceptedAnswer":{"@type":"Answer","text":"A log collector only reads what an agent actually produced as output, so it never sees a tool call that was refused, a domain that was unreachable, or a credential that was requested and withheld, because the process that would have generated that output never ran. Only the enforcement point where the policy decision is made can capture allowed, denied, and held-for-human outcomes. Anyone evaluating agent guardrails can follow how enforcement-layer auditing evolves on daily.dev."}},{"@type":"Question","name":"What data do Docker AI Governance audit records contain about AI agent activity?","acceptedAnswer":{"@type":"Answer","text":"Audit records are metadata only and never contain prompt content, agent output, or parameter values. They currently cover Docker Sandboxes policy decisions and sandbox session events, with MCP Gateway enforcement decisions and other sources planned to share records through the same schema as they become available. Teams weighing agent security tooling can keep tabs on coverage expansions via daily.dev."}}]} ```