Skip to content

Fix AWS ECR Container Scanning Findings detections returning zero results #4186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vishwakt wants to merge 1 commit into
base: develop
Choose a base branch
from
+12 −9
Open

Fix AWS ECR Container Scanning Findings detections returning zero results #4186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions detections/cloud/aws_ecr_container_scanning_findings_high.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: AWS ECR Container Scanning Findings High
id: 30a0e9f8-f1dd-4f9d-8fc2-c622461d781c
version: 13
version: 14
creation_date: '2021-08-18'
modification_date: '2026-05-13'
modification_date: '2026-07-27'
author: Patrick Bareiss, Splunk
status: production
type: TTP
Expand All @@ -16,7 +16,8 @@ search: |-
| spath input=findings
| search severity=HIGH
| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
| rename user_name as user
| rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest
| eval vendor_product="Amazon Web Services"
| stats count min(_time) as firstTime max(_time) as lastTime
BY signature dest user
user_agent src vendor_account
Expand Down
7 changes: 4 additions & 3 deletions detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: AWS ECR Container Scanning Findings Low Informational Unknown
id: cbc95e44-7c22-443f-88fd-0424478f5589
version: 13
version: 14
creation_date: '2021-08-18'
modification_date: '2026-05-13'
modification_date: '2026-07-27'
author: Patrick Bareiss, Eric McGinnis Splunk
status: production
type: Anomaly
Expand All @@ -16,7 +16,8 @@ search: |-
| spath input=findings
| search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN")
| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
| rename user_name as user
| rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest
| eval vendor_product="Amazon Web Services"
| stats count min(_time) as firstTime max(_time) as lastTime
BY signature dest user
user_agent src vendor_account
Expand Down
7 changes: 4 additions & 3 deletions detections/cloud/aws_ecr_container_scanning_findings_medium.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: AWS ECR Container Scanning Findings Medium
id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
version: 13
version: 14
creation_date: '2021-08-18'
modification_date: '2026-05-13'
modification_date: '2026-07-27'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
Expand All @@ -16,7 +16,8 @@ search: |-
| spath input=findings
| search severity=MEDIUM
| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repository
| rename user_name as user
| rename userIdentity.arn as user, userAgent as user_agent, sourceIPAddress as src, awsRegion as vendor_region, userIdentity.accountId as vendor_account, eventName as signature, responseElements.registryId as dest
| eval vendor_product="Amazon Web Services"
| stats count min(_time) as firstTime max(_time) as lastTime
BY signature dest user
user_agent src vendor_account
Expand Down
Loading