Cairn containerized deployment: worker image pull/run and Docker socket mount
Detects the correlation within a one-hour window where a Cairn dispatcher, server, or Docker socket mounting command is executed, followed by the deployment or launch of the cairn-worker-container image using Docker.
Microsoft Sentinel (KQL)

