fabio/lxc-enroll
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix CISA access and publish scanner recovery/status events

Browse Source
This commit is contained in:
fabio
2026-10-04 14:40:12 +02:00
parent 792dd928b1
commit c7cc4ce8b5
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-security/rules.xml
+9 -3
View File
@@ -1,4 +1,4 @@
<!-- Managed by wazuh-docker-security; custom range 110800-110805. -->
<!-- Managed by wazuh-docker-security; custom range 110800-110806. -->
<group name="docker_security,trivy,">
<rule id="110800" level="0">
<decoded_as>json</decoded_as>
@@ -25,14 +25,20 @@
<description>Docker image scanner needs attention: $(component): $(message).</description>
<group>docker_security_health,</group>
</rule>
<rule id="110804" level="0">
<rule id="110804" level="3">
<if_sid>110800</if_sid>
<field name="event" type="pcre2">^finding_(cleared|out_of_scope)$</field>
<description>Image finding cleared or no longer in scan scope.</description>
</rule>
<rule id="110805" level="0">
<rule id="110805" level="3">
<if_sid>110800</if_sid>
<field name="event">^scan_recovered$</field>
<description>Scanner component recovered.</description>
</rule>
<rule id="110806" level="3">
<if_sid>110800</if_sid>
<field name="event">^scan_status$</field>
<description>Image scanner status: complete=$(complete), fresh KEV=$(kev_fresh), problems=$(problem_count).</description>
<group>docker_security_status,</group>
</rule>
</group>