audit watch rules and docker containers