diff --git a/metadata/service/rules/ciscat.yml b/metadata/service/rules/ciscat.yml
index 1596dd5..2417e1c 100644
--- a/metadata/service/rules/ciscat.yml
+++ b/metadata/service/rules/ciscat.yml
@@ -5,6 +5,22 @@
 parameters:
   auditd:
     rules:
+      filter_fs:
+      - binfmt_misc
+      - cgroup
+      - debugfs
+      - devpts
+      - devtmpfs
+      - fusectl
+      - hugetlbfs
+      - mqueue
+      - nsfs
+      - proc
+      - pstore
+      - securityfs
+      - sysfs
+      filter_paths:
+      - /var/lib/docker
       options:
         enabled: 2
         bufsize: 8192