CrowdStrike Falcon CrowdStrike Subreddit

Using the Container Images service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
AggregateImageAssessmentHistory
PEP8aggregate_assessment_history
Image assessment history
AggregateImageCountByBaseOS
PEP8aggregate_count_by_base_os
Aggregate count of images grouped by Base OS distribution
AggregateImageCountByState
PEP8aggregate_count_by_state
Aggregate count of images grouped by state
AggregateImageCount
PEP8aggregate_count
Aggregate count of images
GetCombinedImages
PEP8get_combined_images
Get image assessment results by providing an FQL filter and paging details
CombinedImageByVulnerabilityCount
PEP8get_combined_images_by_vulnerability_count
Retrieve top x images with the most vulnerabilities
CombinedImageDetail
PEP8get_combined_detail
Retrieve image entities identified by the provided filter criteria
ReadCombinedImagesExport
PEP8read_combined_export
Retrieve images with an option to expand aggregated vulnerabilities/detections
CombinedImageIssuesSummary
PEP8get_combined_issues_summary
Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities
CombinedImageVulnerabilitySummary
PEP8get_combined_vulnerabilities_summary
aggregates information about vulnerabilities for an image

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

AggregateImageAssessmentHistory

Image assessment history

PEP8 method name

aggregate_assessment_history

Endpoint

MethodRoute
GET/container-security/aggregates/images/assessment-history/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter using a query in Falcon Query Language (FQL). Supported filters: cid,registry,repository
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_assessment_history(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageAssessmentHistory(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageAssessmentHistory", filter="string")

print(response)

AggregateImageCountByBaseOS

Aggregate count of images grouped by Base OS distribution

PEP8 method name

aggregate_count_by_base_os

Endpoint

MethodRoute
GET/container-security/aggregates/images/count-by-os-distribution/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,registry,repository,tag
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count_by_base_os(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCountByBaseOS(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCountByBaseOS", filter="string")

print(response)

AggregateImageCountByState

Aggregate count of images grouped by state

PEP8 method name

aggregate_count_by_state

Endpoint

MethodRoute
GET/container-security/aggregates/images/count-by-state/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: cid,last_seen,registry,repository
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count_by_state(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCountByState(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCountByState", filter="string")

print(response)

AggregateImageCount

Aggregate count of images

PEP8 method name

aggregate_count

Endpoint

MethodRoute
GET/container-security/aggregates/images/count/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,container_id,container_running_status,cps_rating,crowdstrike_user,cve_id,detection_count,detection_name,detection_severity,first_seen,image_digest,image_id,layer_digest,package_name_version,registry,repository,tag,vulnerability_count,vulnerability_severity
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCount(filter="string")
print(response)

Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCount", filter="string")

print(response)

GetCombinedImages

Get image assessment results by providing an FQL filter and paging details

PEP8 method name

get_combined_images

Endpoint

MethodRoute
GET/container-security/combined/image-assessment/images/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: container_id, container_running_status, cve_id, detection_name, detection_severity, first_seen, image_digest, image_id, registry, repository, tag, vulnerability_severity
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve [1-100]
offset
Service Class Support

Uber Class Support
queryintegerThe offset from where to begin.
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.
sort
Service Class Support

Uber Class Support
querystringThe fields to sort the records on. Supported columns: [first_seen highest_detection_severity highest_vulnerability_severity image_digest image_id registry repository tag]

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_images(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string"
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetCombinedImages(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string"
                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedImages",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

CombinedImageByVulnerabilityCount

Retrieve top x images with the most vulnerabilities

PEP8 method name

get_combined_images_by_vulnerability_count

Endpoint

MethodRoute
GET/container-security/combined/images/by-vulnerability-count/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,registry,repository,tag
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve.
offset
Service Class Support

Uber Class Support
queryintegerThis is not used in the backend but is added here for compatibility purposes as some clients expects this i.e UI widgets.
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_images_by_vulnerability_count(filter="string",
                                                             limit=integer,
                                                             offset=integer
                                                             )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageByVulnerabilityCount(filter="string",
                                                    limit=integer,
                                                    offset=integer
                                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageByVulnerabilityCount",
                          filter="string",
                          limit=integer,
                          offset=integer
                          )
print(response)

CombinedImageDetail

Retrieve image entities identified by the provided filter criteria

PEP8 method name

get_combined_detail

Endpoint

MethodRoute
GET/container-security/combined/images/detail/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: registry,repository,tag
with_config
Service Class Support

Uber Class Support
queryboolean(true/false) include image config, default is false
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve.
offset
Service Class Support

Uber Class Support
queryintegerThe offset from where to begin.
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.
sort
Service Class Support

Uber Class Support
querystringThe fields to sort the records on.

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_detail(filter="string",
                                      with_config=boolean,
                                      limit=integer,
                                      offset=integer,
                                      sort="string"
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageDetail(filter="string",
                                      with_config=boolean,
                                      limit=integer,
                                      offset=integer,
                                      sort="string"
                                      )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageDetail",
                          filter="string",
                          with_config=boolean,
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

ReadCombinedImagesExport

Retrieve images with an option to expand aggregated vulnerabilities/detections

PEP8 method name

read_combined_export

Endpoint

MethodRoute
GET/container-security/combined/images/export/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,container_id,container_running_status,cps_rating,crowdstrike_user,cve_id,detection_count,detection_name,detection_severity,first_seen,image_digest,image_id,layer_digest,package_name_version,registry,repository,tag,vulnerability_count,vulnerability_severity
expand_vulnerabilities
Service Class Support

Uber Class Support
querybooleanexpand vulnerabilities
expand_detections
Service Class Support

Uber Class Support
querybooleanexpand detections
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve.
offset
Service Class Support

Uber Class Support
queryintegerThe offset from where to begin.
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.
sort
Service Class Support

Uber Class Support
querystringThe fields to sort the records on. Supported columns: [base_os cid containers detections firstScanned first_seen highest_detection_severity highest_cps_current_rating highest_vulnerability_severity image_digest image_id last_seen layers_with_vulnerabilities packages registry repository tag vulnerabilities]

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.read_combined_export(filter="string",
                                       expand_vulnerabilities=boolean,
                                       expand_detections=boolean,
                                       limit=integer,
                                       offset=integer,
                                       sort="string"
                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ReadCombinedImagesExport(filter="string",
                                           expand_vulnerabilities=boolean,
                                           expand_detections=boolean,
                                           limit=integer,
                                           offset=integer,
                                           sort="string"
                                           )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedImagesExport",
                          filter="string",
                          expand_vulnerabilities=boolean,
                          expand_detections=boolean,
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

CombinedImageIssuesSummary

Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities

PEP8 method name

get_combined_issues_summary

Endpoint

MethodRoute
GET/container-security/combined/images/issues-summary/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cid
Service Class Support

Uber Class Support
querystringCID
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.
registry
Service Class Support

Uber Class Support
querystringregistry name
repository
Service Class Support

Uber Class Support
querystringrepository name
tag
Service Class Support

Uber Class Support
querystringtag name

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_issues_summary(cid="string",
                                              registry="string",
                                              repository="string",
                                              tag="string"
                                              )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageIssuesSummary(cid="string",
                                             registry="string",
                                             repository="string",
                                             tag="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageIssuesSummary",
                          cid="string",
                          registry="string",
                          repository="string",
                          tag="string"
                          )
print(response)

CombinedImageVulnerabilitySummary

aggregates information about vulnerabilities for an image

PEP8 method name

get_combined_vulnerabilities_summary

Endpoint

MethodRoute
GET/container-security/combined/images/vulnerabilities-summary/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cid
Service Class Support

Uber Class Support
querystringCID
parametersService Class Support
Uber Class SupportquerydictionaryFull query string parameters payload in JSON format. Not required if using other keywords.
registry
Service Class Support

Uber Class Support
querystringregistry name
repository
Service Class Support

Uber Class Support
querystringrepository name
tag
Service Class Support

Uber Class Support
querystringtag name

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_vulnerabilities_summary(cid="string",
                                                       registry="string",
                                                       repository="string",
                                                       tag="string"
                                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

# Do not hardcode API credentials!
falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageVulnerabilitySummary(cid="string",
                                                    registry="string",
                                                    repository="string",
                                                    tag="string"
                                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageVulnerabilitySummary",
                          cid="string",
                          registry="string",
                          repository="string",
                          tag="string"
                          )
print(response)