CrowdStrike Falcon CrowdStrike Subreddit

Using the Container Images service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
AggregateImageAssessmentHistory
PEP8aggregate_assessment_history
Image assessment history
AggregateImageCountByBaseOS
PEP8aggregate_count_by_base_os
Aggregate count of images grouped by Base OS distribution
AggregateImageCountByState
PEP8aggregate_count_by_state
Aggregate count of images grouped by state
AggregateImageCount
PEP8aggregate_count
Aggregate count of images
GetCombinedImages
PEP8get_combined_images
Get image assessment results by providing an FQL filter and paging details
CombinedImageByVulnerabilityCount
PEP8get_combined_images_by_vulnerability_count
Retrieve top x images with the most vulnerabilities
CombinedImageDetail
PEP8get_combined_detail
Retrieve image entities identified by the provided filter criteria
ReadCombinedImagesExport
PEP8read_combined_export
Retrieve images with an option to expand aggregated vulnerabilities/detections
CombinedImageIssuesSummary
PEP8get_combined_issues_summary
Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities
CombinedImageVulnerabilitySummary
PEP8get_combined_vulnerabilities_summary
aggregates information about vulnerabilities for an image

AggregateImageAssessmentHistory

Image assessment history

PEP8 method name

aggregate_assessment_history

Endpoint

MethodRoute
GET/container-security/aggregates/images/assessment-history/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter using a query in Falcon Query Language (FQL). Supported filters: cid,registry,repository

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_assessment_history(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageAssessmentHistory(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageAssessmentHistory", filter="string")

print(response)

AggregateImageCountByBaseOS

Aggregate count of images grouped by Base OS distribution

PEP8 method name

aggregate_count_by_base_os

Endpoint

MethodRoute
GET/container-security/aggregates/images/count-by-os-distribution/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,registry,repository,tag

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count_by_base_os(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCountByBaseOS(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCountByBaseOS", filter="string")

print(response)

AggregateImageCountByState

Aggregate count of images grouped by state

PEP8 method name

aggregate_count_by_state

Endpoint

MethodRoute
GET/container-security/aggregates/images/count-by-state/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: cid,last_seen,registry,repository

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count_by_state(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCountByState(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCountByState", filter="string")

print(response)

AggregateImageCount

Aggregate count of images

PEP8 method name

aggregate_count

Endpoint

MethodRoute
GET/container-security/aggregates/images/count/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,container_id,container_running_status,cps_rating,crowdstrike_user,cve_id,detection_count,detection_name,detection_severity,first_seen,image_digest,image_id,layer_digest,package_name_version,registry,repository,tag,vulnerability_count,vulnerability_severity

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCount(filter="string")
print(response)

Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCount", filter="string")

print(response)

GetCombinedImages

Get image assessment results by providing an FQL filter and paging details

PEP8 method name

get_combined_images

Endpoint

MethodRoute
GET/container-security/combined/image-assessment/images/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: container_id, container_running_status, cve_id, detection_name, detection_severity, first_seen, image_digest, image_id, registry, repository, tag, vulnerability_severity
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve [1-100]
offset
Service Class Support

Uber Class Support
queryintegerThe offset from where to begin.
sort
Service Class Support

Uber Class Support
querystringThe fields to sort the records on. Supported columns: [first_seen highest_detection_severity highest_vulnerability_severity image_digest image_id registry repository tag]

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_images(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string"
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetCombinedImages(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string"
                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedImages",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

CombinedImageByVulnerabilityCount

Retrieve top x images with the most vulnerabilities

PEP8 method name

get_combined_images_by_vulnerability_count

Endpoint

MethodRoute
GET/container-security/combined/images/by-vulnerability-count/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,registry,repository,tag
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve.
offset
Service Class Support

Uber Class Support
queryintegerThis is not used in the backend but is added here for compatibility purposes as some clients expects this i.e UI widgets.

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_images_by_vulnerability_count(filter="string",
                                                             limit=integer,
                                                             offset=integer
                                                             )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageByVulnerabilityCount(filter="string",
                                                    limit=integer,
                                                    offset=integer
                                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageByVulnerabilityCount",
                          filter="string",
                          limit=integer,
                          offset=integer
                          )
print(response)

CombinedImageDetail

Retrieve image entities identified by the provided filter criteria

PEP8 method name

get_combined_detail

Endpoint

MethodRoute
GET/container-security/combined/images/detail/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: registry,repository,tag
with_config
Service Class Support

Uber Class Support
queryboolean(true/false) include image config, default is false
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve.
offset
Service Class Support

Uber Class Support
queryintegerThe offset from where to begin.
sort
Service Class Support

Uber Class Support
querystringThe fields to sort the records on.

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_detail(filter="string",
                                      with_config=boolean,
                                      limit=integer,
                                      offset=integer,
                                      sort="string"
                                      )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageDetail(filter="string",
                                      with_config=boolean,
                                      limit=integer,
                                      offset=integer,
                                      sort="string"
                                      )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageDetail",
                          filter="string",
                          with_config=boolean,
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

ReadCombinedImagesExport

Retrieve images with an option to expand aggregated vulnerabilities/detections

PEP8 method name

read_combined_export

Endpoint

MethodRoute
GET/container-security/combined/images/export/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
filter
Service Class Support

Uber Class Support
querystringFilter images using a query in Falcon Query Language (FQL). Supported filters: arch,base_os,cid,container_id,container_running_status,cps_rating,crowdstrike_user,cve_id,detection_count,detection_name,detection_severity,first_seen,image_digest,image_id,layer_digest,package_name_version,registry,repository,tag,vulnerability_count,vulnerability_severity
expand_vulnerabilities
Service Class Support

Uber Class Support
querybooleanexpand vulnerabilities
expand_detections
Service Class Support

Uber Class Support
querybooleanexpand detections
limit
Service Class Support

Uber Class Support
queryintegerThe upper-bound on the number of records to retrieve.
offset
Service Class Support

Uber Class Support
queryintegerThe offset from where to begin.
sort
Service Class Support

Uber Class Support
querystringThe fields to sort the records on. Supported columns: [base_os cid containers detections firstScanned first_seen highest_detection_severity highest_vulnerability_severity image_digest image_id last_seen layers_with_vulnerabilities packages registry repository tag vulnerabilities]

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.read_combined_export(filter="string",
                                       expand_vulnerabilities=boolean,
                                       expand_detections=boolean,
                                       limit=integer,
                                       offset=integer,
                                       sort="string"
                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ReadCombinedImagesExport(filter="string",
                                           expand_vulnerabilities=boolean,
                                           expand_detections=boolean,
                                           limit=integer,
                                           offset=integer,
                                           sort="string"
                                           )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedImagesExport",
                          filter="string",
                          expand_vulnerabilities=boolean,
                          expand_detections=boolean,
                          limit=integer,
                          offset=integer,
                          sort="string"
                          )
print(response)

CombinedImageIssuesSummary

Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities

PEP8 method name

get_combined_issues_summary

Endpoint

MethodRoute
GET/container-security/combined/images/issues-summary/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cid
Service Class Support

Uber Class Support
querystringCID
registry
Service Class Support

Uber Class Support
querystringregistry name
repository
Service Class Support

Uber Class Support
querystringrepository name
tag
Service Class Support

Uber Class Support
querystringtag name

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_issues_summary(cid="string",
                                              registry="string",
                                              repository="string",
                                              tag="string"
                                              )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageIssuesSummary(cid="string",
                                             registry="string",
                                             repository="string",
                                             tag="string"
                                             )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageIssuesSummary",
                          cid="string",
                          registry="string",
                          repository="string",
                          tag="string"
                          )
print(response)

CombinedImageVulnerabilitySummary

aggregates information about vulnerabilities for an image

PEP8 method name

get_combined_vulnerabilities_summary

Endpoint

MethodRoute
GET/container-security/combined/images/vulnerabilities-summary/v1

Content-Type

  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
cid
Service Class Support

Uber Class Support
querystringCID
registry
Service Class Support

Uber Class Support
querystringregistry name
repository
Service Class Support

Uber Class Support
querystringrepository name
tag
Service Class Support

Uber Class Support
querystringtag name

Usage

Service class example (PEP8 syntax)
from falconpy.container_images import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_vulnerabilities_summary(cid="string",
                                                       registry="string",
                                                       repository="string",
                                                       tag="string"
                                                       )
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageVulnerabilitySummary(cid="string",
                                                    registry="string",
                                                    repository="string",
                                                    tag="string"
                                                    )
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageVulnerabilitySummary",
                          cid="string",
                          registry="string",
                          repository="string",
                          tag="string"
                          )
print(response)