Container Detections

The Container Detections service collection provides operations for querying and aggregating container security detections. Retrieve runtime detections, aggregate counts by severity and type, and search detection entities using FQL filters.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
GetRuntimeDetectionsCombinedV2 search_runtime_detections	Retrieve container runtime detections by the provided search criteria
ReadCombinedDetections read_combined_detections	Retrieve image assessment detections identified by the provided filter criteria
ReadDetections read_detections	Retrieve image assessment detection entities identified by the provided filter criteria
ReadDetectionsCount read_detections_count	Aggregate count of detections
ReadDetectionsCountBySeverity read_detection_counts_by_severity	Aggregate counts of detections by severity
ReadDetectionsCountByType read_detections_count_by_type	Aggregate counts of detections by detection type
SearchDetections search_detections	Retrieve image assessment detection entities identified by the provided filter criteria

---

GetRuntimeDetectionsCombinedV2

Retrieve container runtime detections by the provided search criteria

Method GET

Route /container-security/combined/runtime-detections/v2

Scope Falcon Container Image: READ

PEP 8 search_runtime_detections

Parameters

filter query · string

Filter Container Runtime Detections using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

agent_type	aid	cid
cloud_name	cloud	cluster_name
computer_name	container_id	detect_timestamp
host_id	host_type	image_id
name	namespace	pod_name
severity

sort query · string

The fields to sort the records on. Supported fields:

Available values (6)

containers_impacted	detection_name	detection_severity
detection_type	images_impacted	last_detected

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.search_runtime_detections(filter="string",
                                            limit=integer,
                                            offset=integer,
                                            sort="string")
print(response)

Operation ID

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.GetRuntimeDetectionsCombinedV2(filter="string",
                                                 limit=integer,
                                                 offset=integer,
                                                 sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetRuntimeDetectionsCombinedV2",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/runtime_detections"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.RuntimeDetections.GetRuntimeDetectionsCombinedV2(
    &runtime_detections.GetRuntimeDetectionsCombinedV2Params{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.runtimeDetections.getRuntimeDetectionsCombinedV2(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::runtime_detections_api::get_runtime_detections_combined_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_runtime_detections_combined_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RuntimeDetections.new

response = api.get_runtime_detections_combined_v2(filter: 'string',
                                                  sort: 'string',
                                                  limit: integer,
                                                  offset: integer)

puts response

Responses

200 OK

[
  {
    "action_taken": "string",
    "agent_type": "string",
    "aid": "string",
    "assigned_to": "string",
    "cid": "string",
    "cloud": "string",
    "cloud_account_id": "string",
    "cloud_id": "string",
    "cloud_instance_id": "string",
    "cloud_name": "string",
    "cluster_name": "string",
    "command_line": "string",
    "computer_name": "string",
    "container_devices": [],
    "container_id": "string",
    "container_interactive_mode": "string",
    "container_name": "string",
    "container_network_ip_address": "string",
    "container_privileged": "string",
    "container_read_only_root_fs": "string",
    "container_user_info": "string",
    "containers_impacted_count": "string",
    "detect_timestamp": "string",
    "detection_description": "string",
    "detection_id": "string",
    "detection_name": [],
    "executable_sha_256": "string",
    "file_name": "string",
    "file_path": "string",
    "host_containers_count": "string",
    "host_detections_count": "string",
    "host_detections_ids": [],
    "host_id": "string",
    "host_last_seen_timestamp": "string",
    "host_type": "string",
    "image_digest": "string",
    "image_first_seen_timestamp": "string",
    "image_id": "string",
    "image_label": "string",
    "image_last_seen_timestamp": "string",
    "image_maintainer": "string",
    "image_name": "string",
    "images_container_count": "string",
    "namespace": "string",
    "network_ip_address": "string",
    "os_version": "string",
    "pod_id": "string",
    "pod_name": "string",
    "pod_namespace": "string",
    "sensor_version": "string",
    "severity": "string",
    "tactic_and_technique": "string",
    "type": "string",
    "vulnerabilities_count": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadCombinedDetections

Retrieve image assessment detections identified by the provided filter criteria

Method GET

Route /container-security/combined/detections/v1

Scope Falcon Container Image: READ

PEP 8 read_combined_detections

Parameters

filter query · string

Filter images detections using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (7)

cid	detection_type	image_digest
image_registry	image_repository	image_tag
severity

sort query · string

The fields to sort the records on. Supported columns:

Available values (6)

containers_impacted	detection_name	detection_severity
detection_type	images_impacted	last_detected

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.read_combined_detections(filter="string",
                                           limit=integer,
                                           offset=integer,
                                           sort="string")
print(response)

Operation ID

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.ReadCombinedDetections(filter="string",
                                         limit=integer,
                                         offset=integer,
                                         sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedDetections",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerDetection -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_detections"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerDetections.ReadCombinedDetections(
    &container_detections.ReadCombinedDetectionsParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerDetections.readCombinedDetections(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_detections_api::read_combined_detections;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_detections(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerDetections.new

response = api.read_combined_detections(filter: 'string',
                                        sort: 'string',
                                        limit: integer,
                                        offset: integer)

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "containers_impacted": 0,
    "description": "string",
    "details": [],
    "detection_id": "string",
    "detection_name": "string",
    "detection_severity": "string",
    "detection_type": "string",
    "images_impacted": 0,
    "last_detected": "string",
    "remediation": "string",
    "title": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDetections

Retrieve image assessment detection entities identified by the provided filter criteria

Method GET

Route /container-security/entities/detections/v1

Scope Falcon Container Image: READ

PEP 8 read_detections

Parameters

filter query · string

Filter images detections using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (7)

cid	detection_type	image_digest
image_registry	image_repository	image_tag
severity

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.read_detections(filter="string",
                                  limit=integer,
                                  offset=integer)
print(response)

Operation ID

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.ReadDetections(filter="string", limit=integer, offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDetections",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_detections"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerDetections.ReadDetections(
    &container_detections.ReadDetectionsParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerDetections.readDetections(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_detections_api::read_detections;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_detections(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerDetections.new

response = api.read_detections(filter: 'string',
                               limit: integer,
                               offset: integer)

puts response

Responses

200 OK

[
  {
    "description": "string",
    "details": "string",
    "detection_type": "string",
    "id": "string",
    "image_architecture": "string",
    "image_created_at": "string",
    "image_digest": "string",
    "image_id": "string",
    "image_registry": "string",
    "image_repository": "string",
    "image_size": "string",
    "image_tag": "string",
    "name": "string",
    "os_name": "string",
    "os_version": "string",
    "remediation": "string",
    "severity": "string",
    "title": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDetectionsCount

Aggregate count of detections

Method GET

Route /container-security/aggregates/detections/count/v1

Scope Falcon Container Image: READ

PEP 8 read_detections_count

Parameters

filter query · string

Filter images detections using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (7)

cid	detection_type	image_digest
image_registry	image_repository	image_tag
severity

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.read_detections_count(filter="string")
print(response)

Operation ID

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.ReadDetectionsCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDetectionsCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_detections"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerDetections.ReadDetectionsCount(
    &container_detections.ReadDetectionsCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerDetections.readDetectionsCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_detections_api::read_detections_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_detections_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerDetections.new

response = api.read_detections_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "count": 0
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDetectionsCountBySeverity

Aggregate counts of detections by severity

Method GET

Route /container-security/aggregates/detections/count-by-severity/v1

Scope Falcon Container Image: READ

PEP 8 read_detection_counts_by_severity

Parameters

filter query · string

Filter images detections using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (7)

cid	detection_type	image_digest
image_registry	image_repository	image_tag
severity

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.read_detection_counts_by_severity(filter="string")
print(response)

Operation ID

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.ReadDetectionsCountBySeverity(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDetectionsCountBySeverity",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_detections"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerDetections.ReadDetectionsCountBySeverity(
    &container_detections.ReadDetectionsCountBySeverityParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerDetections.readDetectionsCountBySeverity("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_detections_api::read_detections_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_detections_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerDetections.new

response = api.read_detections_count_by_severity(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadDetectionsCountByType

Aggregate counts of detections by detection type

Method GET

Route /container-security/aggregates/detections/count-by-type/v1

Scope Falcon Container Image: READ

PEP 8 read_detections_count_by_type

Parameters

filter query · string

Filter images detections using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (7)

cid	detection_type	image_digest
image_registry	image_repository	image_tag
severity

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.read_detections_count_by_type(filter="string")
print(response)

Operation ID

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.ReadDetectionsCountByType(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadDetectionsCountByType",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_detections"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerDetections.ReadDetectionsCountByType(
    &container_detections.ReadDetectionsCountByTypeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerDetections.readDetectionsCountByType("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_detections_api::read_detections_count_by_type;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_detections_count_by_type(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerDetections.new

response = api.read_detections_count_by_type(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

SearchDetections

Retrieve image assessment detection entities identified by the provided filter criteria

Method GET

Route /container-security/queries/detections/v1

Scope Falcon Container Image: READ

PEP 8 search_detections

Parameters

filter query · string

Filter images detections using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (7)

cid	detection_type	image_digest
image_registry	image_repository	image_tag
severity

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.search_detections(filter="string",
                                    limit=integer,
                                    offset=integer)
print(response)

Operation ID

from falconpy import ContainerDetections

falcon = ContainerDetections(client_id=CLIENT_ID,
                             client_secret=CLIENT_SECRET
                             )

response = falcon.SearchDetections(filter="string",
                                   limit=integer,
                                   offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchDetections",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerDetection -Filter "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_detections"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerDetections.SearchDetections(
    &container_detections.SearchDetectionsParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerDetections.searchDetections(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_detections_api::search_detections;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_detections(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerDetections.new

response = api.search_detections(filter: 'string',
                                 limit: integer,
                                 offset: integer)

puts response

Responses

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}