AWSCloudTrail - ECR image scan findings high or critical

Back


Id	f6928301-56da-4d2c-aabe-e1a552bc8892
Rulename	AWSCloudTrail - ECR image scan findings high or critical
Description	Identifies Amazon ECR image scan findings that report high or critical severity vulnerabilities. These findings indicate container images that should be reviewed and remediated before deployment or continued use.
Severity	High
Tactics	Discovery
Techniques	T1083
Required data connectors	AWS
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_ECRContainerHigh.yaml
Version	1.0.3
Arm template	f6928301-56da-4d2c-aabe-e1a552bc8892.json

KQL

AWSCloudTrail
| where EventName == "DescribeImageScanFindings" and isempty(ErrorCode) and isempty(ErrorMessage)
| extend repoName = tostring(parse_json(ResponseElements).repositoryName)
| extend imageId = tostring(parse_json(ResponseElements).imageId.imageDigest)
| extend Critical = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.CRITICAL)
| extend High = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.HIGH)
| where Critical > 0 or High > 0
| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

YAML

queryPeriod: 1d
status: Available
kind: Scheduled
version: 1.0.3
description: |
  Identifies Amazon ECR image scan findings that report high or critical severity vulnerabilities. These findings indicate container images that should be reviewed and remediated before deployment or continued use.
queryFrequency: 1d
customDetails:
  Repository: repoName
  ImageDigest: imageId
  CriticalFindings: Critical
  HighFindings: High
id: f6928301-56da-4d2c-aabe-e1a552bc8892
entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
  - columnName: RecipientAccountId
    identifier: CloudAppAccountId
  entityType: Account
- fieldMappings:
  - columnName: SourceIpAddress
    identifier: Address
  entityType: IP
relevantTechniques:
- T1083
triggerThreshold: 0
tactics:
- Discovery
requiredDataConnectors:
- connectorId: AWS
  dataTypes:
  - AWSCloudTrail
query: |
  AWSCloudTrail
  | where EventName == "DescribeImageScanFindings" and isempty(ErrorCode) and isempty(ErrorMessage)
  | extend repoName = tostring(parse_json(ResponseElements).repositoryName)
  | extend imageId = tostring(parse_json(ResponseElements).imageId.imageDigest)
  | extend Critical = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.CRITICAL)
  | extend High = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.HIGH)
  | where Critical > 0 or High > 0
  | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
  | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
  | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
  | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
alertDetailsOverride:
  alertDescriptionFormat: ECR image {{imageId}} in repository {{repoName}} returned critical and high findings.
  alertDisplayNameFormat: AWS ECR image scan findings with high or critical Vulnerabilities in {{repoName}}
severity: High
triggerOperator: gt
name: AWSCloudTrail - ECR image scan findings high or critical
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_ECRContainerHigh.yaml

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f6928301-56da-4d2c-aabe-e1a552bc8892')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f6928301-56da-4d2c-aabe-e1a552bc8892')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "ECR image {{imageId}} in repository {{repoName}} returned critical and high findings.",
          "alertDisplayNameFormat": "AWS ECR image scan findings with high or critical Vulnerabilities in {{repoName}}"
        },
        "alertRuleTemplateName": "f6928301-56da-4d2c-aabe-e1a552bc8892",
        "customDetails": {
          "CriticalFindings": "Critical",
          "HighFindings": "High",
          "ImageDigest": "imageId",
          "Repository": "repoName"
        },
        "description": "Identifies Amazon ECR image scan findings that report high or critical severity vulnerabilities. These findings indicate container images that should be reviewed and remediated before deployment or continued use.\n",
        "displayName": "AWSCloudTrail - ECR image scan findings high or critical",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountUPNSuffix",
                "identifier": "UPNSuffix"
              },
              {
                "columnName": "RecipientAccountId",
                "identifier": "CloudAppAccountId"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIpAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_ECRContainerHigh.yaml",
        "query": "AWSCloudTrail\n| where EventName == \"DescribeImageScanFindings\" and isempty(ErrorCode) and isempty(ErrorMessage)\n| extend repoName = tostring(parse_json(ResponseElements).repositoryName)\n| extend imageId = tostring(parse_json(ResponseElements).imageId.imageDigest)\n| extend Critical = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.CRITICAL)\n| extend High = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.HIGH)\n| where Critical > 0 or High > 0\n| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)\n| extend UserName = tostring(split(UserIdentityArn, '/')[-1])\n| extend AccountName = case( UserIdentityPrincipalid == \"Anonymous\", \"Anonymous\", isempty(UserIdentityUserName), UserName, UserIdentityUserName)\n| extend AccountName = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 0)[0]), AccountName),\n  AccountUPNSuffix = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 1)[0]), \"\")\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [
          "T1083"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}