From 905fc013d38c452e814c02435ad25bc12e482b0b Mon Sep 17 00:00:00 2001 From: Fabio Boi Date: Sun, 4 Oct 2026 12:54:32 +0200 Subject: [PATCH] Add docker-security/rules.xml for Docker security monitoring --- docker-security/rules.xml | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 docker-security/rules.xml diff --git a/docker-security/rules.xml b/docker-security/rules.xml new file mode 100644 index 0000000..31fbfd7 --- /dev/null +++ b/docker-security/rules.xml @@ -0,0 +1,38 @@ + + + + json + ^container_image_scan$ + Docker image vulnerability scan event. + + + 110800 + ^finding_(new|changed)$ + ^yes$ + Review image finding: $(vulnerability_id) [$(severity)] in $(package), containers $(containers). Not proof of exploitability or compromise. + docker_security_review, + + + 110800 + ^finding_(new|changed)$ + ^yes$ + Prioritize assessment/mitigation: $(vulnerability_id) is in CISA KEV and reported in image for $(containers). Exploitation elsewhere, not proof this host was attacked. + docker_security_kev, + + + 110800 + ^scan_problem$ + Docker image scanner needs attention: $(component): $(message). + docker_security_health, + + + 110800 + ^finding_(cleared|out_of_scope)$ + Image finding cleared or no longer in scan scope. + + + 110800 + ^scan_recovered$ + Scanner component recovered. + +