diff --git a/docker-security/rules.xml b/docker-security/rules.xml new file mode 100644 index 0000000..31fbfd7 --- /dev/null +++ b/docker-security/rules.xml @@ -0,0 +1,38 @@ + + + + json + ^container_image_scan$ + Docker image vulnerability scan event. + + + 110800 + ^finding_(new|changed)$ + ^yes$ + Review image finding: $(vulnerability_id) [$(severity)] in $(package), containers $(containers). Not proof of exploitability or compromise. + docker_security_review, + + + 110800 + ^finding_(new|changed)$ + ^yes$ + Prioritize assessment/mitigation: $(vulnerability_id) is in CISA KEV and reported in image for $(containers). Exploitation elsewhere, not proof this host was attacked. + docker_security_kev, + + + 110800 + ^scan_problem$ + Docker image scanner needs attention: $(component): $(message). + docker_security_health, + + + 110800 + ^finding_(cleared|out_of_scope)$ + Image finding cleared or no longer in scan scope. + + + 110800 + ^scan_recovered$ + Scanner component recovered. + +