Container Image Compliance

The Container Image Compliance service collection provides operations for aggregating compliance assessment data across clusters, images, and rules. This service collection has been renamed and is still available using the deprecated name. Legacy service collection name: Compliance Assessments.

Language	Last Update
Python	v1.4.9
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
extAggregateClusterAssessments `aggregate_cluster_assessments`	Get the assessments for each cluster.
extAggregateImageAssessments `aggregate_image_assessments`	Get the assessments for each image.
extAggregateRulesAssessments `aggregate_rules_assessments`	Get the assessments for each rule.
extAggregateFailedContainersByRulesPath `aggregate_failed_containers_by_rules`	Get the containers grouped into rules on which they failed.
extAggregateFailedContainersCountBySeverity `aggregate_failed_containers_count_by_severity`	Get the failed containers count grouped into severity levels.
extAggregateFailedImagesByRulesPath `aggregate_failed_images_by_rules`	Get the images grouped into rules on which they failed.
extAggregateFailedImagesCountBySeverity `aggregate_failed_images_count_by_severity`	Get the failed images count grouped into severity levels.
extAggregateFailedRulesByClusters `aggregate_failed_rules_by_clusters`	Get the failed rules for each cluster grouped into severity levels.
extAggregateFailedRulesByImages `aggregate_failed_rules_by_image`	Get images with failed rules, rule count grouped by severity for each image.
extAggregateFailedRulesCountBySeverity `aggregate_failed_rules_count_by_severity`	Get the failed rules count grouped into severity levels.
extAggregateRulesByStatus `aggregate_rules_by_status`	Get the rules grouped by their statuses.

extAggregateClusterAssessments

Get the assessments for each cluster.

GET /container-compliance/aggregates/compliance-by-clusters/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_cluster_assessments

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
cloud_info.namespace	Kubernetes namespace
compliance_finding.framework	Compliance finding framework (available values: `CIS`)

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_cluster_assessments(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateClusterAssessments(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateClusterAssessments",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateClusterAssessments(
    &container_image_compliance.ExtAggregateClusterAssessmentsParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateClusterAssessments("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_cluster_assessments;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_cluster_assessments(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_cluster_assessments(filter: 'string')

puts response

extAggregateImageAssessments

Get the assessments for each image.

GET /container-compliance/aggregates/compliance-by-images/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_image_assessments

Parameters

Name	Type	Data type	Description
after	query	string	`after` value from the last response. Leave empty or do not specify for the first request.
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
limit	query	string	Number of images to return in the response after `after` key. Default when not specified: `10000`.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
asset_type	asset type (`container`, `image`)
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
cloud_info.namespace	Kubernetes namespace
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_image_assessments(filter="string",
                                              after="string",
                                              limit="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateImageAssessments(filter="string",
                                               after="string",
                                               limit="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateImageAssessments",
                          filter="string",
                          after="string",
                          limit="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  after := "string"
  limit := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateImageAssessments(
    &container_image_compliance.ExtAggregateImageAssessmentsParams{
      Filter: &filter,
      After: &after,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateImageAssessments(
  "string",  // filter
  "string",  // after
  "string"  // limit
);

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_image_assessments;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_image_assessments(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // after
        Some("string"),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_image_assessments(filter: 'string',
                                               after: 'string',
                                               limit: 'string')

puts response

extAggregateRulesAssessments

Get the assessments for each rule.

GET /container-compliance/aggregates/compliance-by-rules/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_rules_assessments

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_rules_assessments(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateRulesAssessments(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateRulesAssessments",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateRulesAssessments(
    &container_image_compliance.ExtAggregateRulesAssessmentsParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateRulesAssessments("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_rules_assessments;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_rules_assessments(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_rules_assessments(filter: 'string')

puts response

extAggregateFailedContainersByRulesPath

Get the containers grouped into rules on which they failed.

GET /container-compliance/aggregates/failed-containers-by-rules/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_containers_by_rules

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
cloud_info.namespace	Kubernetes namespace
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_containers_by_rules(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedContainersByRulesPath(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedContainersByRulesPath",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedContainersByRulesPath(
    &container_image_compliance.ExtAggregateFailedContainersByRulesPathParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedContainersByRulesPath("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_containers_by_rules_path;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_containers_by_rules_path(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_containers_by_rules_path(filter: 'string')

puts response

extAggregateFailedContainersCountBySeverity

Get the failed containers count grouped into severity levels.

GET /container-compliance/aggregates/failed-containers-count-by-severity/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_containers_count_by_severity

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
cloud_info.namespace	Kubernetes namespace
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_containers_count_by_severity(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedContainersCountBySeverity(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedContainersCountBySeverity",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedContainersCountBySeverity(
    &container_image_compliance.ExtAggregateFailedContainersCountBySeverityParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedContainersCountBySeverity("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_containers_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_containers_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_containers_count_by_severity(filter: 'string')

puts response

extAggregateFailedImagesByRulesPath

Get the images grouped into rules on which they failed.

GET /container-compliance/aggregates/failed-images-by-rules/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_images_by_rules

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
cloud_info.namespace	Kubernetes namespace
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_images_by_rules(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedImagesByRulesPath(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedImagesByRulesPath",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedImagesByRulesPath(
    &container_image_compliance.ExtAggregateFailedImagesByRulesPathParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedImagesByRulesPath("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_images_by_rules_path;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_images_by_rules_path(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_images_by_rules_path(filter: 'string')

puts response

extAggregateFailedImagesCountBySeverity

Get the failed images count grouped into severity levels.

GET /container-compliance/aggregates/failed-images-count-by-severity/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_images_count_by_severity

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
cloud_info.namespace	Kubernetes namespace
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_images_count_by_severity(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedImagesCountBySeverity(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedImagesCountBySeverity",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedImagesCountBySeverity(
    &container_image_compliance.ExtAggregateFailedImagesCountBySeverityParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedImagesCountBySeverity("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_images_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_images_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_images_count_by_severity(filter: 'string')

puts response

extAggregateFailedRulesByClusters

Get the failed rules for each cluster grouped into severity levels.

GET /container-compliance/aggregates/failed-rules-by-clusters/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_rules_by_clusters

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
asset_type	asset type (`container`, `image`)
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_by_clusters(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesByClusters(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesByClusters",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedRulesByClusters(
    &container_image_compliance.ExtAggregateFailedRulesByClustersParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedRulesByClusters("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_rules_by_clusters;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_rules_by_clusters(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_rules_by_clusters(filter: 'string')

puts response

extAggregateFailedRulesByImages

Get images with failed rules, rule count grouped by severity for each image.

GET /container-compliance/aggregates/failed-rules-by-images/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_rules_by_image

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
asset_type	asset type (`container`, `image`)
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
cloud_info.namespace	Kubernetes namespace
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_by_image(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesByImages(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesByImages",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedRulesByImages(
    &container_image_compliance.ExtAggregateFailedRulesByImagesParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedRulesByImages("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_rules_by_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_rules_by_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_rules_by_images(filter: 'string')

puts response

extAggregateFailedRulesCountBySeverity

Get the failed rules count grouped into severity levels.

GET /container-compliance/aggregates/failed-rules-count-by-severity/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_rules_count_by_severity

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
asset_type	asset type (`container`, `image`)
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_count_by_severity(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesCountBySeverity(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesCountBySeverity",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedRulesCountBySeverity(
    &container_image_compliance.ExtAggregateFailedRulesCountBySeverityParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedRulesCountBySeverity("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_rules_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_rules_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_rules_count_by_severity(filter: 'string')

puts response

extAggregateRulesByStatus

Get the rules grouped by their statuses.

GET /container-compliance/aggregates/rules-by-status/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_rules_by_status

Parameters

Name	Type	Data type	Description
filter	query	string	Filter results using a query in Falcon Query Language (FQL).
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required when using other keywords.

Supported Filters

Filter	Description
asset_type	asset type (`container`, `image`)
cid	Customer ID
cloud_info.cloud_account_id	Cloud account ID
cloud_info.cloud_provider	Cloud provider
cloud_info.cloud_region	Cloud region
cloud_info.cluster_name	Kubernetes cluster name
compliance_finding.framework	Compliance finding framework (available values: `CIS`)
compliance_finding.id	Compliance finding ID
compliance_finding.name	Compliance finding Name
compliance_finding.severity	Compliance finding severity; available values: `4`, `3`, `2`, `1` (`4`: critical, `3`: high, `2`: medium, `1`: low)
container_id	Container ID
container_name	Container name
image_digest	Image digest (sha256 digest)
image_id	Image ID
image_registry	Image registry
image_repository	Image repository
image_tag	Image tag

Code Examples

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_rules_by_status(filter="string")
print(response)

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateRulesByStatus(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateRulesByStatus",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateRulesByStatus(
    &container_image_compliance.ExtAggregateRulesByStatusParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateRulesByStatus("string");  // filter

console.log(response);

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_rules_by_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_rules_by_status(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_rules_by_status(filter: 'string')

puts response

Container Image Compliance

Table of Contents

extAggregateClusterAssessments

Parameters

Supported Filters

Code Examples

extAggregateImageAssessments

Parameters

Supported Filters

Code Examples

extAggregateRulesAssessments

Parameters

Supported Filters

Code Examples

extAggregateFailedContainersByRulesPath

Parameters

Supported Filters

Code Examples

extAggregateFailedContainersCountBySeverity

Parameters

Supported Filters

Code Examples

extAggregateFailedImagesByRulesPath

Parameters

Supported Filters

Code Examples

extAggregateFailedImagesCountBySeverity

Parameters

Supported Filters

Code Examples

extAggregateFailedRulesByClusters

Parameters

Supported Filters

Code Examples

extAggregateFailedRulesByImages

Parameters

Supported Filters

Code Examples

extAggregateFailedRulesCountBySeverity

Parameters

Supported Filters

Code Examples

extAggregateRulesByStatus

Parameters

Supported Filters

Code Examples