# Container ID / is\_container on Linux sensor events?

**URL:** <https://community.limacharlie.com/t/container-id-is-container-on-linux-sensor-events/758>\
**Category:** General\
**Created:** [July 29, 2026, 5:16pm UTC](https://community.limacharlie.com/t/container-id-is-container-on-linux-sensor-events/758 "2026-07-29T17:16:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zanegm](https://avatars.discourse-cdn.com/v4/letter/z/6f9a4e/32.png) [@zanegm](https://community.limacharlie.com/u/zanegm)\
**Post date:** [July 29, 2026, 5:16pm UTC](https://community.limacharlie.com/t/container-id-is-container-on-linux-sensor-events/758/1 "2026-07-29T17:16:34Z")

</div>

I’m running the Linux sensor on a VM with Docker containers, and processes inside the containers come through fine as NEW\_PROCESS with the in-container FILE\_PATH. Is there a supported way to get container attribution on those events, something like a container ID or an is\_container flag? Especially interested for the k8s DaemonSet deployment, where a node’s pods would otherwise be hard to tell apart.

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [July 30, 2026, 5:41pm UTC](https://community.limacharlie.com/t/container-id-is-container-on-linux-sensor-events/758/2 "2026-07-30T17:41:46Z")

</div>

Hello, there isn’t a way to get that data built-in right now, but we do have a backlog item to add it as we agree it would be very high value.