From ceaa0cf45244604ed28d5f4027c676ae8b908835 Mon Sep 17 00:00:00 2001 From: Vishwak Thatikonda Date: Mon, 27 Jul 2026 16:59:47 -0700 Subject: [PATCH] Fix AWS ECR Container Scanning Findings detections returning zero results The final stats command in all three AWS ECR Container Scanning Findings detections (low/informational/unknown, medium, high) grouped by CIM-aliased fields (signature, dest, user, user_agent, src, vendor_account, vendor_region, vendor_product) that nothing in the search pipeline creates. Since stats BY drops rows where any groupby field is undefined, the detections always returned zero results, even against their own attack data. Extract the raw CloudTrail fields explicitly instead of relying on unavailable field aliases, so the searches are self-contained. Fixes #4169 --- .../cloud/aws_ecr_container_scanning_findings_high.yml | 7 ++++--- ...ntainer_scanning_findings_low_informational_unknown.yml | 7 ++++--- .../cloud/aws_ecr_container_scanning_findings_medium.yml | 7 ++++--- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index aa5a5446c2..61ccb00223 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -1,8 +1,8 @@ name: AWS ECR Container Scanning Findings High id: 30a0e9f8-f1dd-4f9d-8fc2-c622461d781c -version: 13 +version: 14 creation_date: '2021-08-18' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,7 +16,8 @@ search: |- | spath input=findings | search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository - | rename user_name as user + | rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest + | eval vendor_product="Amazon Web Services" | stats count min(_time) as firstTime max(_time) as lastTime BY signature dest user user_agent src vendor_account diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index efdc8f0112..703f0747e7 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -1,8 +1,8 @@ name: AWS ECR Container Scanning Findings Low Informational Unknown id: cbc95e44-7c22-443f-88fd-0424478f5589 -version: 13 +version: 14 creation_date: '2021-08-18' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Patrick Bareiss, Eric McGinnis Splunk status: production type: Anomaly @@ -16,7 +16,8 @@ search: |- | spath input=findings | search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN") | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository - | rename user_name as user + | rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest + | eval vendor_product="Amazon Web Services" | stats count min(_time) as firstTime max(_time) as lastTime BY signature dest user user_agent src vendor_account diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index 3cc23e9574..1906b93080 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -1,8 +1,8 @@ name: AWS ECR Container Scanning Findings Medium id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf -version: 13 +version: 14 creation_date: '2021-08-18' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Patrick Bareiss, Splunk status: production type: Anomaly @@ -16,7 +16,8 @@ search: |- | spath input=findings | search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository - | rename user_name as user + | rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest + | eval vendor_product="Amazon Web Services" | stats count min(_time) as firstTime max(_time) as lastTime BY signature dest user user_agent src vendor_account