From c7cc4ce8b5b3d607deeae7d5ef61563b8f9cd531 Mon Sep 17 00:00:00 2001
From: Fabio Boi <fabio@faboi.de>
Date: Sun, 4 Oct 2026 14:40:12 +0200
Subject: [PATCH] Fix CISA access and publish scanner recovery/status events

---
 docker-security/rules.xml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/docker-security/rules.xml b/docker-security/rules.xml
index 31fbfd7..89bdee4 100644
--- a/docker-security/rules.xml
+++ b/docker-security/rules.xml
@@ -1,4 +1,4 @@
-<!-- Managed by wazuh-docker-security; custom range 110800-110805. -->
+<!-- Managed by wazuh-docker-security; custom range 110800-110806. -->
 <group name="docker_security,trivy,">
   <rule id="110800" level="0">
     <decoded_as>json</decoded_as>
@@ -25,14 +25,20 @@
     <description>Docker image scanner needs attention: $(component): $(message).</description>
     <group>docker_security_health,</group>
   </rule>
-  <rule id="110804" level="0">
+  <rule id="110804" level="3">
     <if_sid>110800</if_sid>
     <field name="event" type="pcre2">^finding_(cleared|out_of_scope)$</field>
     <description>Image finding cleared or no longer in scan scope.</description>
   </rule>
-  <rule id="110805" level="0">
+  <rule id="110805" level="3">
     <if_sid>110800</if_sid>
     <field name="event">^scan_recovered$</field>
     <description>Scanner component recovered.</description>
   </rule>
+  <rule id="110806" level="3">
+    <if_sid>110800</if_sid>
+    <field name="event">^scan_status$</field>
+    <description>Image scanner status: complete=$(complete), fresh KEV=$(kev_fresh), problems=$(problem_count).</description>
+    <group>docker_security_status,</group>
+  </rule>
 </group>