Docker Hub

RunReveal polls Docker Hub audit log events (e.g., repository tag pushes, organization member changes, SSO configuration, team management, billing updates) using the Docker Hub API.

Prerequisites

Docker Business or Team subscription Audit logs are available on Docker Team and Business plans.
Docker Hub Personal Access Token (PAT) A PAT with sufficient permissions to read audit logs for your organization.
RunReveal account with permissions to add sources (admin/editor)

Setup

Step 1: Create a Docker Hub Personal Access Token

Log in to Docker Hub
Navigate to Account Settings > Personal access tokens
Click Generate new token
Give it a descriptive name (e.g., "RunReveal Audit Logs")
Select Read-only access scope
Click Generate and copy the token immediately

Copy the token immediately after creation. It will not be shown again.

Step 2: Find Your Organization Name

Your organization name is the namespace used in Docker Hub. You can find it by:

Log in to Docker Hub
Navigate to Organizations
Your organization name is displayed in the URL and organization list (e.g., mycompany)

You can verify your organization name and audit log access with:

# First, get a bearer token
TOKEN=$(curl -s https://hub.docker.com/v2/auth/token \
  -H 'Content-Type: application/json' \
  -d '{"identifier":"YOUR_USERNAME","secret":"YOUR_PAT"}' \
  | jq -r '.access_token')
 
# Then query audit logs
curl -s "https://hub.docker.com/v2/auditlogs/YOUR_ORG_NAME?page_size=5" \
  -H "Authorization: Bearer $TOKEN" | jq .

Step 3: Create Docker Hub Source in RunReveal

Navigate to Sources in RunReveal
Look for the Docker Hub source tile
Provide a descriptive Source Name (e.g., "Docker Hub Audit Logs")
Enter your Organization name
Enter your Username and Personal Access Token
Save the source

Step 4: Validate Data Collection

Return to RunReveal and open your Docker Hub source page
Confirm that events are being collected (initial polling may take up to 5 minutes)
Search in Explorer or use Native AI Chat to inspect recent Docker Hub audit events

RunReveal polls for new Docker Hub audit events every 5 minutes. Docker Hub retains audit log data for 90 days.

Event Types

Docker Hub audit logs capture a wide range of events across several categories:

Repository events: tag pushes, repository creation/deletion, visibility changes
Organization events: member add/remove, role changes, team management, settings updates
Billing events: plan upgrades/downgrades, seat changes, billing cycle updates
SSO/Enterprise events: SSO connection create/update/delete, SCIM configuration, domain management
Access token events: token creation, updates, deletion for org and personal tokens
Registry Access Management: enabling/disabling registry access, adding/removing registries

Verify It's Working

Once added the source logs should begin flowing within 5 minutes.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'docker-hub' LIMIT 1

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: runreveal_logs (22 columns)

Column	Type
`id`	String
`receivedAt`	DateTime
`workspaceID`	String
`sourceType`	String
`sourceID`	String
`eventID`	String
`eventName`	String
`eventTime`	DateTime
`readOnly`	Bool
`srcIP`	String
`resources`	Array(String)
`serviceName`	String
`srcASOrganization`	Nullable(String)
`srcASNumber`	Nullable(UInt32)
`srcASCountryCode`	Nullable(String)
`dstIP`	String
`dstASOrganization`	Nullable(String)
`dstASNumber`	Nullable(UInt32)
`dstASCountryCode`	Nullable(String)
`actor`	Map(String, String)
`tags`	Map(String, String)
`rawLog`	String

Helpful Links

Docker Hub API Reference - Audit Logs - Official API documentation for the audit logs endpoints
Docker Hub Activity Logs - Docker documentation on activity and audit logging
Docker Hub Personal Access Tokens - How to create and manage PATs