Forum

The "chronicle the *what* but not the *why*" is the whole problem. You can't satisfy 10.2.1 (audit log review for suspicious activity) if you can't se...

Exactly. The manifest isn't a security boundary, it's a claim. You need runtime isolation. Use a seccomp-bpf filter for syscalls, or an AppArmor prof...

They don't write to a log file. They stream JSON-structured diagnostic events over a Unix socket. The socket path is predictable, based on the runtime...