docs(image): document registry scan mode and --registry-list flag

Add Registry Scan Mode section covering --registry, --image-filter,
--tag-filter, --max-images, --registry-insecure, and the new
--registry-list flag for image discovery.

docs/user-guide/providers/image/getting-started-image.mdx

@@ -173,6 +173,103 @@ prowler image -I large-image:latest --timeout 10m
 
 The timeout accepts values in seconds (`s`), minutes (`m`), or hours (`h`). Default: `5m`.
 
+### Registry Scan Mode
+
+<VersionBadge version="5.19.0" />
+
+Registry Scan Mode enumerates and scans all images from an OCI-compatible registry, Docker Hub namespace, or Amazon ECR registry. To activate it, use the `--registry` flag with the registry URL:
+
+```bash
+prowler image --registry myregistry.io
+```
+
+#### Discover Available Images
+
+<VersionBadge version="5.19.0" />
+
+To list all repositories and tags available in the registry without running a scan, use the `--registry-list` flag. This is useful for discovering image names and tags before building filter regexes:
+
+```bash
+prowler image --registry myregistry.io --registry-list
+```
+
+Example output:
+
+```text
+Registry: myregistry.io (3 repositories, 8 images)
+
+  api-service (2 tags)
+    latest, v3.1
+  hub-scanner (3 tags)
+    latest, v1.0, v2.0
+  web-frontend (3 tags)
+    latest, v1.0, v2.0
+```
+
+Filters can be combined with `--registry-list` to preview the results before scanning:
+
+```bash
+prowler image --registry myregistry.io --registry-list --image-filter "api.*"
+```
+
+#### Filter Repositories
+
+To filter repositories by name during enumeration, use the `--image-filter` flag with a Python regex pattern (matched via `re.search`):
+
+```bash
+# Scan only repositories starting with "prod/"
+prowler image --registry myregistry.io --image-filter "^prod/"
+```
+
+#### Filter Tags
+
+To filter tags during enumeration, use the `--tag-filter` flag with a Python regex pattern:
+
+```bash
+# Scan only semantic version tags
+prowler image --registry myregistry.io --tag-filter "^v\d+\.\d+\.\d+$"
+```
+
+Both filters can be combined:
+
+```bash
+prowler image --registry myregistry.io --image-filter "^prod/" --tag-filter "^(latest|v\d+)"
+```
+
+#### Limit the Number of Images
+
+To prevent accidentally scanning a large number of images, use the `--max-images` flag. The scan aborts if the discovered image count exceeds the limit:
+
+```bash
+prowler image --registry myregistry.io --max-images 10
+```
+
+Setting `--max-images` to `0` (default) disables the limit.
+
+<Note>
+When `--registry-list` is active, the `--max-images` limit is not enforced because no scan is performed.
+</Note>
+
+#### Skip TLS Verification
+
+To connect to registries with self-signed certificates, use the `--registry-insecure` flag:
+
+```bash
+prowler image --registry internal-registry.local --registry-insecure
+```
+
+<Warning>
+Skipping TLS verification disables certificate validation for registry connections. Use this flag only for trusted internal registries with self-signed certificates.
+</Warning>
+
+#### Supported Registries
+
+Registry Scan Mode supports the following registry types:
+
+* **OCI-compatible registries:** Any registry implementing the OCI Distribution Specification (e.g., Harbor, GitLab Container Registry, GitHub Container Registry).
+* **Docker Hub:** Specify a namespace with `--registry docker.io/{org_or_user}`.
+* **Amazon ECR:** Use the full ECR endpoint URL (e.g., `123456789.dkr.ecr.us-east-1.amazonaws.com`). Authentication is handled via AWS credentials.
+
 ### Authentication for Private Registries
 
 <VersionBadge version="5.19.0" />

prowler/CHANGELOG.md

@@ -17,7 +17,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - OCI regions updater script and CI workflow [(#10020)](https://github.com/prowler-cloud/prowler/pull/10020)
 - `image` provider for container image scanning with Trivy integration [(#9984)](https://github.com/prowler-cloud/prowler/pull/9984)
 - Private registry authentication for the Image provider via environment variables (`REGISTRY_USERNAME`/`REGISTRY_PASSWORD`, `REGISTRY_TOKEN`) [(#9985)](https://github.com/prowler-cloud/prowler/pull/9985)
-- Registry scan mode for Image provider: enumerate and scan all images from OCI, Docker Hub, and ECR registries with `--registry`, `--image-filter`, `--tag-filter`, `--max-images`, and `--registry-insecure` flags
+- Registry scan mode for Image provider: enumerate and scan all images from OCI, Docker Hub, and ECR registries with `--registry`, `--image-filter`, `--tag-filter`, `--max-images`, `--registry-insecure`, and `--registry-list` flags
 - CSA CCM 4.0 for the Alibaba Cloud provider [(#10061)](https://github.com/prowler-cloud/prowler/pull/10061)
 
 ### 🔄 Changed