Detection rules › By catalog entry

AWS-ecr

Catalog entry	Rules
any	1
DescribeImageScanFindings	4
PutImage	3
BatchCheckLayerAvailability	1
BatchDeleteImage	1
BatchGetImage	1
CompleteLayerUpload	1
CreateRepository	1
DeleteRepository	1
DeleteRepositoryPolicy	1
GetAuthorizationToken	1
GetDownloadUrlForLayer	1
GetRepositoryPolicy	1
InitiateLayerUpload	1
PutImageScanningConfiguration	1
PutRegistryPolicy	1
SetRepositoryPolicy	2
UploadLayerPart	1

any

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

AWS ECR Events severity informational T1535

DescribeImageScanFindings

4 detection rules reference this catalog entry. View catalog entry.

Splunk (3)

AWS ECR Container Scanning Findings High severity medium T1204,T1204.003
AWS ECR Container Scanning Findings Low Informational Unknown severity low T1204,T1204.003
AWS ECR Container Scanning Findings Medium severity low T1204,T1204.003

Kusto (1)

AWSCloudTrail - ECR image scan findings high or critical severity high T1083

PutImage

3 detection rules reference this catalog entry. View catalog entry.

Splunk (2)

AWS ECR Container Upload Outside Business Hours severity low T1204,T1204.003
AWS ECR Container Upload Unknown User severity low T1204,T1204.003

Panther (1)

ECR CRUD Actions severity informational T1525

BatchCheckLayerAvailability

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

BatchDeleteImage

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

BatchGetImage

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

CompleteLayerUpload

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

CreateRepository

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

DeleteRepository

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

DeleteRepositoryPolicy

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

GetAuthorizationToken

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

GetDownloadUrlForLayer

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

GetRepositoryPolicy

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

InitiateLayerUpload

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

PutImageScanningConfiguration

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

AWSCloudTrail - Amazon ECR image scanning disabled severity medium T1685

PutRegistryPolicy

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS ECR Repository or Registry Policy Granted Public Access severity medium T1537

SetRepositoryPolicy

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS ECR Repository or Registry Policy Granted Public Access severity medium T1537

Panther (1)

ECR CRUD Actions severity informational T1525

UploadLayerPart

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

ECR CRUD Actions severity informational T1525

Back to all AWS-ecr catalog entries