diff --git a/docs/api-reference/spec/firework-v4-openapi.json b/docs/api-reference/spec/firework-v4-openapi.json
index a6b661b..b60ffd8 100644
--- a/docs/api-reference/spec/firework-v4-openapi.json
+++ b/docs/api-reference/spec/firework-v4-openapi.json
@@ -420,6 +420,9 @@
{
"$ref": "#/components/schemas/ForumPostEvent"
},
+ {
+ "$ref": "#/components/schemas/DockerImageEvent"
+ },
{
"$ref": "#/components/schemas/InvalidCredentialEvent"
},
@@ -461,6 +464,7 @@
"bucket": "#/components/schemas/BucketEvent",
"chat_message": "#/components/schemas/ChatMessageEvent",
"cc": "#/components/schemas/FinancialEvent",
+ "docker_image": "#/components/schemas/DockerImageEvent",
"docker_repository": "#/components/schemas/DockerRepositoryEvent",
"forum_post": "#/components/schemas/ForumPostEvent",
"invalid_credential": "#/components/schemas/InvalidCredentialEvent",
@@ -4629,6 +4633,117 @@
],
"title": "CredentialsQueryPayload"
},
+ "DockerImageEvent": {
+ "properties": {
+ "event_type": {
+ "type": "string",
+ "const": "docker_image",
+ "title": "Event Type",
+ "default": "docker_image"
+ },
+ "data": {
+ "$ref": "#/components/schemas/DockerImageEventData"
+ },
+ "metadata": {
+ "$ref": "#/components/schemas/EventMetadata"
+ }
+ },
+ "type": "object",
+ "required": [
+ "data",
+ "metadata"
+ ],
+ "title": "Docker Image"
+ },
+ "DockerImageEventData": {
+ "properties": {
+ "content": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Content"
+ },
+ "digest": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Digest"
+ },
+ "architecture": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Architecture"
+ },
+ "os": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Os"
+ },
+ "last_pushed_at": {
+ "anyOf": [
+ {
+ "type": "string",
+ "format": "date-time"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Last Pushed At"
+ },
+ "last_pulled_at": {
+ "anyOf": [
+ {
+ "type": "string",
+ "format": "date-time"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Last Pulled At"
+ },
+ "tags": {
+ "anyOf": [
+ {
+ "items": {
+ "$ref": "#/components/schemas/Tag"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Tags",
+ "default": []
+ }
+ },
+ "type": "object",
+ "title": "DockerImageEventData"
+ },
"DockerRepositoryEvent": {
"properties": {
"event_type": {
diff --git a/docs/docs.json b/docs/docs.json
index 6c994fc..7c79f06 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -330,6 +330,7 @@
"event-types-v2/forum-post",
"event-types-v2/invalid-credential",
"event-types-v2/leaked-credential",
+ "event-types-v2/docker-image",
"event-types-v2/docker-repository",
"event-types-v2/listing",
"event-types-v2/mitigated-credential",
diff --git a/docs/event-types-v2/docker-image.mdx b/docs/event-types-v2/docker-image.mdx
new file mode 100644
index 0000000..037af8c
--- /dev/null
+++ b/docs/event-types-v2/docker-image.mdx
@@ -0,0 +1,16 @@
+---
+title: "Docker Image"
+---
+
+import DockerImageExample from '/snippets/event_model_examples/docker_image.mdx'
+
+The `docker_image` type represents a Docker image discovered on Docker Hub that has been recently created or updated. Image manifests are scanned for identifiers and secrets.
+
+Each record corresponds to a single image and may include:
+- The image digest and the tags it is published under, with their repository names.
+- Platform details (architecture and operating system).
+- When the image was last pushed and last pulled.
+- The raw image manifest content.
+
+
+
diff --git a/docs/event-types-v2/overview.mdx b/docs/event-types-v2/overview.mdx
index 4916028..9e32b3c 100644
--- a/docs/event-types-v2/overview.mdx
+++ b/docs/event-types-v2/overview.mdx
@@ -16,6 +16,7 @@ Currently these event type models are supported on the
| `credit_card` | [Chat Message ](/event-types-v2/chat-message) |
| `docker_repository`| [Docker Repository ](/event-types-v2/docker-repository) |
| `document` | [Ransomleak (document) ](/event-types-v2/ransom-leak) |
+| `docker Image` | [Docker Image ](/event-types-v2/docker-image) |
| `domain` | [Lookalike Domain (domain) ](/event-types-v2/domain) |
| `forum_post` | [Forum Post & Topic ](/event-types-v2/forum-post) |
| `invalid_credential` | [Invalid Credential ](/event-types-v2/invalid-credential) |
diff --git a/docs/snippets/event_model_examples/docker_image.mdx b/docs/snippets/event_model_examples/docker_image.mdx
new file mode 100644
index 0000000..fa7768e
--- /dev/null
+++ b/docs/snippets/event_model_examples/docker_image.mdx
@@ -0,0 +1,36 @@
+{/*
+ If you are in pyro:
+ - If this file changes, you should also modify the API docs.
+ - https://github.com/flared/docs-api/
+
+ If you are in mintlify:
+ - Don't edit this directly, edit the generator in pyro.
+ - pyro/pyro/mintlify/test_firework_event_models.py
+*/}
+
+```json Docker Image
+{
+ "event_type": "docker_image",
+ "data": {
+ "content": "Docker image description",
+ "digest": "sha256:e4b991038fd226016a60046db2109bf634f7f4b4ea9a2c548b559d3652e4cc38",
+ "architecture": "amd64",
+ "os": "linux",
+ "last_pushed_at": "2025-01-01T00:00:00",
+ "last_pulled_at": "2025-01-01T00:00:00",
+ "tags": [
+ {
+ "name": "latest",
+ "repository_name": "flared/docker"
+ }
+ ]
+ },
+ "metadata": {
+ "estimated_created_at": "2025-01-01T00:00:00",
+ "flare_url": "https://app.flare.io/#/uid",
+ "matched_at": null,
+ "severity": "info",
+ "uid": "index/source/id"
+ }
+}
+```
diff --git a/docs/snippets/event_model_examples/events_overview.mdx b/docs/snippets/event_model_examples/events_overview.mdx
index e36a10e..9497515 100644
--- a/docs/snippets/event_model_examples/events_overview.mdx
+++ b/docs/snippets/event_model_examples/events_overview.mdx
@@ -16,6 +16,7 @@ import ChatMessage from '/snippets/event_model_examples/chat_message.mdx'
import CreditCard from '/snippets/event_model_examples/credit_card.mdx'
+import DockerImage from '/snippets/event_model_examples/docker_image.mdx'
import DockerRepository from '/snippets/event_model_examples/docker_repository.mdx'
@@ -38,6 +39,7 @@ import StealerLog from '/snippets/event_model_examples/stealer_log.mdx'
+