json ^container_image_scan$ Docker image vulnerability scan event. 110800 ^finding_(new|changed)$ ^yes$ Review image finding: $(vulnerability_id) [$(severity)] in $(package), containers $(containers). Not proof of exploitability or compromise. docker_security_review, 110800 ^finding_(new|changed)$ ^yes$ Prioritize assessment/mitigation: $(vulnerability_id) is in CISA KEV and reported in image for $(containers). Exploitation elsewhere, not proof this host was attacked. docker_security_kev, 110800 ^scan_problem$ Docker image scanner needs attention: $(component): $(message). docker_security_health, 110800 ^finding_(cleared|out_of_scope)$ Image finding cleared or no longer in scan scope. 110800 ^scan_recovered$ Scanner component recovered. 110800 ^scan_status$ Image scanner status: complete=$(complete), fresh KEV=$(kev_fresh), problems=$(problem_count). docker_security_status,