Detection rules › By event

AWS-ecr

Event	Rules
any	1
DescribeImageScanFindings	4
PutImage	3
BatchCheckLayerAvailability	1
BatchDeleteImage	1
BatchGetImage	1
CompleteLayerUpload	1
CreateRepository	1
DeleteRepository	1
DeleteRepositoryPolicy	1
GetAuthorizationToken	1
GetDownloadUrlForLayer	1
GetRepositoryPolicy	1
InitiateLayerUpload	1
PutImageScanningConfiguration	1
PutRegistryPolicy	1
SetRepositoryPolicy	2
UploadLayerPart	1

any

1 detection rules reference this event. View event page.

Panther (1)

AWS ECR Events severity informational T1535

DescribeImageScanFindings

4 detection rules reference this event. View event page.

Splunk (3)

AWS ECR Container Scanning Findings High severity medium T1204, T1204.003
AWS ECR Container Scanning Findings Low Informational Unknown severity low T1204, T1204.003
AWS ECR Container Scanning Findings Medium severity low T1204, T1204.003

Kusto (1)

AWSCloudTrail - ECR image scan findings high or critical severity high T1083

PutImage

3 detection rules reference this event. View event page.

Splunk (2)

AWS ECR Container Upload Outside Business Hours severity low T1204, T1204.003
AWS ECR Container Upload Unknown User severity low T1204, T1204.003

Panther (1)

ECR CRUD Actions severity informational T1525

BatchCheckLayerAvailability

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

BatchDeleteImage

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

BatchGetImage

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

CompleteLayerUpload

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

CreateRepository

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

DeleteRepository

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

DeleteRepositoryPolicy

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

GetAuthorizationToken

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

GetDownloadUrlForLayer

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

GetRepositoryPolicy

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

InitiateLayerUpload

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525

PutImageScanningConfiguration

1 detection rules reference this event. View event page.

Kusto (1)

AWSCloudTrail - Amazon ECR image scanning disabled severity medium T1685

PutRegistryPolicy

1 detection rules reference this event. View event page.

Elastic (1)

AWS ECR Repository or Registry Policy Granted Public Access severity medium T1537

SetRepositoryPolicy

2 detection rules reference this event. View event page.

Elastic (1)

AWS ECR Repository or Registry Policy Granted Public Access severity medium T1537

Panther (1)

ECR CRUD Actions severity informational T1525

UploadLayerPart

1 detection rules reference this event. View event page.

Panther (1)

ECR CRUD Actions severity informational T1525