39 lines
1.8 KiB
XML
39 lines
1.8 KiB
XML
<!-- Managed by wazuh-docker-security; custom range 110800-110805. -->
|
|
<group name="docker_security,trivy,">
|
|
<rule id="110800" level="0">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="source">^container_image_scan$</field>
|
|
<description>Docker image vulnerability scan event.</description>
|
|
</rule>
|
|
<rule id="110801" level="4">
|
|
<if_sid>110800</if_sid>
|
|
<field name="event" type="pcre2">^finding_(new|changed)$</field>
|
|
<field name="known_exploited" negate="yes">^yes$</field>
|
|
<description>Review image finding: $(vulnerability_id) [$(severity)] in $(package), containers $(containers). Not proof of exploitability or compromise.</description>
|
|
<group>docker_security_review,</group>
|
|
</rule>
|
|
<rule id="110802" level="12">
|
|
<if_sid>110800</if_sid>
|
|
<field name="event" type="pcre2">^finding_(new|changed)$</field>
|
|
<field name="known_exploited">^yes$</field>
|
|
<description>Prioritize assessment/mitigation: $(vulnerability_id) is in CISA KEV and reported in image for $(containers). Exploitation elsewhere, not proof this host was attacked.</description>
|
|
<group>docker_security_kev,</group>
|
|
</rule>
|
|
<rule id="110803" level="7">
|
|
<if_sid>110800</if_sid>
|
|
<field name="event">^scan_problem$</field>
|
|
<description>Docker image scanner needs attention: $(component): $(message).</description>
|
|
<group>docker_security_health,</group>
|
|
</rule>
|
|
<rule id="110804" level="0">
|
|
<if_sid>110800</if_sid>
|
|
<field name="event" type="pcre2">^finding_(cleared|out_of_scope)$</field>
|
|
<description>Image finding cleared or no longer in scan scope.</description>
|
|
</rule>
|
|
<rule id="110805" level="0">
|
|
<if_sid>110800</if_sid>
|
|
<field name="event">^scan_recovered$</field>
|
|
<description>Scanner component recovered.</description>
|
|
</rule>
|
|
</group>
|