lxc-enroll/docker-security/rules.xml

<!-- Managed by wazuh-docker-security; custom range 110800-110806. -->
<group name="docker_security,trivy,">
  <rule id="110800" level="0">
    <decoded_as>json</decoded_as>
    <field name="source">^container_image_scan$</field>
    <description>Docker image vulnerability scan event.</description>
  </rule>
  <rule id="110801" level="4">
    <if_sid>110800</if_sid>
    <field name="event" type="pcre2">^finding_(new|changed)$</field>
    <field name="known_exploited" negate="yes">^yes$</field>
    <description>Review image finding: $(vulnerability_id) [$(severity)] in $(package), containers $(containers). Not proof of exploitability or compromise.</description>
    <group>docker_security_review,</group>
  </rule>
  <rule id="110802" level="12">
    <if_sid>110800</if_sid>
    <field name="event" type="pcre2">^finding_(new|changed)$</field>
    <field name="known_exploited">^yes$</field>
    <description>Prioritize assessment/mitigation: $(vulnerability_id) is in CISA KEV and reported in image for $(containers). Exploitation elsewhere, not proof this host was attacked.</description>
    <group>docker_security_kev,</group>
  </rule>
  <rule id="110803" level="7">
    <if_sid>110800</if_sid>
    <field name="event">^scan_problem$</field>
    <description>Docker image scanner needs attention: $(component): $(message).</description>
    <group>docker_security_health,</group>
  </rule>
  <rule id="110804" level="3">
    <if_sid>110800</if_sid>
    <field name="event" type="pcre2">^finding_(cleared|out_of_scope)$</field>
    <description>Image finding cleared or no longer in scan scope.</description>
  </rule>
  <rule id="110805" level="3">
    <if_sid>110800</if_sid>
    <field name="event">^scan_recovered$</field>
    <description>Scanner component recovered.</description>
  </rule>
  <rule id="110806" level="3">
    <if_sid>110800</if_sid>
    <field name="event">^scan_status$</field>
    <description>Image scanner status: complete=$(complete), fresh KEV=$(kev_fresh), problems=$(problem_count).</description>
    <group>docker_security_status,</group>
  </rule>
</group>