fabio/lxc-enroll
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add docker-security/rules.xml for Docker security monitoring

Browse Source
This commit is contained in:
fabio
2026-10-04 12:54:32 +02:00
parent c099a71680
commit 905fc013d3
1 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-security/rules.xml
+38
View File
@@ -0,0 +1,38 @@
<!-- Managed by wazuh-docker-security; custom range 110800-110805. -->
<group name="docker_security,trivy,">
<rule id="110800" level="0">
<decoded_as>json</decoded_as>
<field name="source">^container_image_scan$</field>
<description>Docker image vulnerability scan event.</description>
</rule>
<rule id="110801" level="4">
<if_sid>110800</if_sid>
<field name="event" type="pcre2">^finding_(new|changed)$</field>
<field name="known_exploited" negate="yes">^yes$</field>
<description>Review image finding: $(vulnerability_id) [$(severity)] in $(package), containers $(containers). Not proof of exploitability or compromise.</description>
<group>docker_security_review,</group>
</rule>
<rule id="110802" level="12">
<if_sid>110800</if_sid>
<field name="event" type="pcre2">^finding_(new|changed)$</field>
<field name="known_exploited">^yes$</field>
<description>Prioritize assessment/mitigation: $(vulnerability_id) is in CISA KEV and reported in image for $(containers). Exploitation elsewhere, not proof this host was attacked.</description>
<group>docker_security_kev,</group>
</rule>
<rule id="110803" level="7">
<if_sid>110800</if_sid>
<field name="event">^scan_problem$</field>
<description>Docker image scanner needs attention: $(component): $(message).</description>
<group>docker_security_health,</group>
</rule>
<rule id="110804" level="0">
<if_sid>110800</if_sid>
<field name="event" type="pcre2">^finding_(cleared|out_of_scope)$</field>
<description>Image finding cleared or no longer in scan scope.</description>
</rule>
<rule id="110805" level="0">
<if_sid>110800</if_sid>
<field name="event">^scan_recovered$</field>
<description>Scanner component recovered.</description>
</rule>
</group>