Container Image Compliance

The Container Image Compliance service collection provides operations for aggregating compliance assessment data across clusters, images, and rules. This service collection has been renamed and is still available using the deprecated name. Legacy service collection name: Compliance Assessments.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
extAggregateClusterAssessments aggregate_cluster_assessments	get the assessments for each cluster
extAggregateFailedContainersByRulesPath aggregate_failed_containers_by_rules	get the containers grouped into rules on which they failed
extAggregateFailedContainersCountBySeverity aggregate_failed_containers_count_by_severity	get the failed containers count grouped into severity levels
extAggregateFailedImagesByRulesPath aggregate_failed_images_by_rules	get the images grouped into rules on which they failed
extAggregateFailedImagesCountBySeverity aggregate_failed_images_count_by_severity	get the failed images count grouped into severity levels
extAggregateFailedRulesByClusters aggregate_failed_rules_by_clusters	get the failed rules for each cluster grouped into severity levels
extAggregateFailedRulesByImages aggregate_failed_rules_by_image	get images with failed rules, rule count grouped by severity for each image
extAggregateFailedRulesCountBySeverity aggregate_failed_rules_count_by_severity	get the failed rules count grouped into severity levels
extAggregateImageAssessments aggregate_image_assessments	get the assessments for each image
extAggregateRulesAssessments aggregate_rules_assessments	get the assessments for each rule
extAggregateRulesByStatus aggregate_rules_by_status	get the rules grouped by their statuses

---

extAggregateClusterAssessments

get the assessments for each cluster

Method GET

Route /container-compliance/aggregates/compliance-by-clusters/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_cluster_assessments

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_cluster_assessments(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateClusterAssessments(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateClusterAssessments",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateClusterAssessments(
    &container_image_compliance.ExtAggregateClusterAssessmentsParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateClusterAssessments("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_cluster_assessments;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_cluster_assessments(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_cluster_assessments(filter: 'string')

puts response

Responses

200 OK

[
  {
    "cid": "string",
    "cloud_account_id": "string",
    "cloud_provider": "string",
    "cloud_region": "string",
    "cluster_name": "string",
    "failed_critical_rules": 0,
    "failed_high_rules": 0,
    "failed_rules": 0,
    "failed_rules_list": "string",
    "non_compliant_containers": 0,
    "non_compliant_images": 0,
    "passed_rules": 0,
    "percentage_of_compliant_assets": 0.0,
    "total_containers": 0,
    "total_images": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cloud_account_id": "string",
      "cloud_provider": "string",
      "cloud_region": "string",
      "cluster_name": "string",
      "failed_critical_rules": 0,
      "failed_high_rules": 0,
      "failed_rules": 0,
      "failed_rules_list": "string",
      "non_compliant_containers": 0,
      "non_compliant_images": 0,
      "passed_rules": 0,
      "percentage_of_compliant_assets": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cloud_account_id": "string",
      "cloud_provider": "string",
      "cloud_region": "string",
      "cluster_name": "string",
      "failed_critical_rules": 0,
      "failed_high_rules": 0,
      "failed_rules": 0,
      "failed_rules_list": "string",
      "non_compliant_containers": 0,
      "non_compliant_images": 0,
      "passed_rules": 0,
      "percentage_of_compliant_assets": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cloud_account_id": "string",
      "cloud_provider": "string",
      "cloud_region": "string",
      "cluster_name": "string",
      "failed_critical_rules": 0,
      "failed_high_rules": 0,
      "failed_rules": 0,
      "failed_rules_list": "string",
      "non_compliant_containers": 0,
      "non_compliant_images": 0,
      "passed_rules": 0,
      "percentage_of_compliant_assets": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "cid": "string",
      "cloud_account_id": "string",
      "cloud_provider": "string",
      "cloud_region": "string",
      "cluster_name": "string",
      "failed_critical_rules": 0,
      "failed_high_rules": 0,
      "failed_rules": 0,
      "failed_rules_list": "string",
      "non_compliant_containers": 0,
      "non_compliant_images": 0,
      "passed_rules": 0,
      "percentage_of_compliant_assets": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

---

---

extAggregateFailedContainersByRulesPath

get the containers grouped into rules on which they failed

Method GET

Route /container-compliance/aggregates/failed-containers-by-rules/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_containers_by_rules

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_containers_by_rules(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedContainersByRulesPath(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedContainersByRulesPath",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedContainersByRulesPath(
    &container_image_compliance.ExtAggregateFailedContainersByRulesPathParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedContainersByRulesPath("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_containers_by_rules_path;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_containers_by_rules_path(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_containers_by_rules_path(filter: 'string')

puts response

Responses

200 OK

[
  {
    "not_applicable_filters": "string",
    "rules": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

---

---

extAggregateFailedContainersCountBySeverity

get the failed containers count grouped into severity levels

Method GET

Route /container-compliance/aggregates/failed-containers-count-by-severity/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_containers_count_by_severity

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_containers_count_by_severity(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedContainersCountBySeverity(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedContainersCountBySeverity",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedContainersCountBySeverity(
    &container_image_compliance.ExtAggregateFailedContainersCountBySeverityParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedContainersCountBySeverity("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_containers_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_containers_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_containers_count_by_severity(filter: 'string')

puts response

Responses

200 OK

[
  {
    "1": 0,
    "2": 0,
    "3": 0,
    "4": 0,
    "not_applicable_filters": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

---

---

extAggregateFailedImagesByRulesPath

get the images grouped into rules on which they failed

Method GET

Route /container-compliance/aggregates/failed-images-by-rules/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_images_by_rules

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_images_by_rules(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedImagesByRulesPath(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedImagesByRulesPath",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedImagesByRulesPath(
    &container_image_compliance.ExtAggregateFailedImagesByRulesPathParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedImagesByRulesPath("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_images_by_rules_path;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_images_by_rules_path(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_images_by_rules_path(filter: 'string')

puts response

Responses

200 OK

[
  {
    "not_applicable_filters": "string",
    "rules": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "rules": []
    }
  ]
}

---

---

extAggregateFailedImagesCountBySeverity

get the failed images count grouped into severity levels

Method GET

Route /container-compliance/aggregates/failed-images-count-by-severity/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_images_count_by_severity

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_images_count_by_severity(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedImagesCountBySeverity(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedImagesCountBySeverity",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedImagesCountBySeverity(
    &container_image_compliance.ExtAggregateFailedImagesCountBySeverityParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedImagesCountBySeverity("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_images_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_images_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_images_count_by_severity(filter: 'string')

puts response

Responses

200 OK

[
  {
    "1": 0,
    "2": 0,
    "3": 0,
    "4": 0,
    "not_applicable_filters": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "not_applicable_filters": "string"
    }
  ]
}

---

---

extAggregateFailedRulesByClusters

get the failed rules for each cluster grouped into severity levels

Method GET

Route /container-compliance/aggregates/failed-rules-by-clusters/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_rules_by_clusters

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_by_clusters(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesByClusters(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesByClusters",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedRulesByClusters(
    &container_image_compliance.ExtAggregateFailedRulesByClustersParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedRulesByClusters("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_rules_by_clusters;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_rules_by_clusters(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_rules_by_clusters(filter: 'string')

puts response

Responses

200 OK

[
  {
    "1": 0,
    "2": 0,
    "3": 0,
    "4": 0,
    "cluster_id": "string",
    "cluster_name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "cluster_id": "string",
      "cluster_name": "string"
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "cluster_id": "string",
      "cluster_name": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "cluster_id": "string",
      "cluster_name": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0,
      "cluster_id": "string",
      "cluster_name": "string"
    }
  ]
}

---

---

extAggregateFailedRulesByImages

get images with failed rules, rule count grouped by severity for each image

Method GET

Route /container-compliance/aggregates/failed-rules-by-images/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_rules_by_image

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_by_image(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesByImages(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesByImages",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedRulesByImages(
    &container_image_compliance.ExtAggregateFailedRulesByImagesParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedRulesByImages("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_rules_by_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_rules_by_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_rules_by_images(filter: 'string')

puts response

Responses

200 OK

[
  {
    "images": [],
    "not_applicable_filters": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "images": [],
      "not_applicable_filters": "string"
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "images": [],
      "not_applicable_filters": "string"
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "images": [],
      "not_applicable_filters": "string"
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "images": [],
      "not_applicable_filters": "string"
    }
  ]
}

---

---

extAggregateFailedRulesCountBySeverity

get the failed rules count grouped into severity levels

Method GET

Route /container-compliance/aggregates/failed-rules-count-by-severity/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_rules_count_by_severity

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_count_by_severity(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesCountBySeverity(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesCountBySeverity",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateFailedRulesCountBySeverity(
    &container_image_compliance.ExtAggregateFailedRulesCountBySeverityParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateFailedRulesCountBySeverity("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_failed_rules_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_failed_rules_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_failed_rules_count_by_severity(filter: 'string')

puts response

Responses

200 OK

[
  {
    "1": 0,
    "2": 0,
    "3": 0,
    "4": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "1": 0,
      "2": 0,
      "3": 0,
      "4": 0
    }
  ]
}

---

---

extAggregateImageAssessments

get the assessments for each image

Method GET

Route /container-compliance/aggregates/compliance-by-images/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_image_assessments

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

after query · string

’after’ value from the last response. Keep it empty for the first request.

limit query · string

number of images to return in the response after ‘after’ key. Keep it empty for the default number of 10000

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_image_assessments(filter="string",
                                              after="string",
                                              limit="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateImageAssessments(filter="string",
                                               after="string",
                                               limit="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateImageAssessments",
                          filter="string",
                          after="string",
                          limit="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  after := "string"
  limit := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateImageAssessments(
    &container_image_compliance.ExtAggregateImageAssessmentsParams{
      Filter: &filter,
      After: &after,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateImageAssessments(
  "string",  // filter
  "string",  // after
  "string"  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_image_assessments;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_image_assessments(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // after
        Some("string"),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_image_assessments(filter: 'string',
                                               after: 'string',
                                               limit: 'string')

puts response

Responses

200 OK

{
  "after": {},
  "results": []
}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "after": {},
    "results": []
  }
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "after": {},
    "results": []
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "after": {},
    "results": []
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {
    "after": {},
    "results": []
  }
}

---

---

extAggregateRulesAssessments

get the assessments for each rule

Method GET

Route /container-compliance/aggregates/compliance-by-rules/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_rules_assessments

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_rules_assessments(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateRulesAssessments(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateRulesAssessments",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateRulesAssessments(
    &container_image_compliance.ExtAggregateRulesAssessmentsParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateRulesAssessments("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_rules_assessments;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_rules_assessments(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_rules_assessments(filter: 'string')

puts response

Responses

200 OK

[
  {
    "asset_type": "string",
    "authority": "string",
    "clusters": 0,
    "clusters_list": "string",
    "failed_containers": 0,
    "failed_images": 0,
    "name": "string",
    "passed_containers": 0,
    "passed_images": 0,
    "rule_id": "string",
    "severity": 0.0,
    "total_containers": 0,
    "total_images": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "asset_type": "string",
      "authority": "string",
      "clusters": 0,
      "clusters_list": "string",
      "failed_containers": 0,
      "failed_images": 0,
      "name": "string",
      "passed_containers": 0,
      "passed_images": 0,
      "rule_id": "string",
      "severity": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "asset_type": "string",
      "authority": "string",
      "clusters": 0,
      "clusters_list": "string",
      "failed_containers": 0,
      "failed_images": 0,
      "name": "string",
      "passed_containers": 0,
      "passed_images": 0,
      "rule_id": "string",
      "severity": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "asset_type": "string",
      "authority": "string",
      "clusters": 0,
      "clusters_list": "string",
      "failed_containers": 0,
      "failed_images": 0,
      "name": "string",
      "passed_containers": 0,
      "passed_images": 0,
      "rule_id": "string",
      "severity": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "asset_type": "string",
      "authority": "string",
      "clusters": 0,
      "clusters_list": "string",
      "failed_containers": 0,
      "failed_images": 0,
      "name": "string",
      "passed_containers": 0,
      "passed_images": 0,
      "rule_id": "string",
      "severity": 0.0,
      "total_containers": 0,
      "total_images": 0
    }
  ]
}

---

---

extAggregateRulesByStatus

get the rules grouped by their statuses

Method GET

Route /container-compliance/aggregates/rules-by-status/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_rules_by_status

Parameters

filter query · string

Filter results using a query in Falcon Query Language (FQL).

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_rules_by_status(filter="string")
print(response)

Operation ID

from falconpy import ContainerImageCompliance

falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateRulesByStatus(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateRulesByStatus",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_image_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImageCompliance.ExtAggregateRulesByStatus(
    &container_image_compliance.ExtAggregateRulesByStatusParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImageCompliance.extAggregateRulesByStatus("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_image_compliance_api::ext_aggregate_rules_by_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ext_aggregate_rules_by_status(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImageCompliance.new

response = api.ext_aggregate_rules_by_status(filter: 'string')

puts response

Responses

200 OK

[
  {
    "not_applicable_filters": "string",
    "percentage_of_passed_rules": 0.0,
    "rule_status_list": []
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "percentage_of_passed_rules": 0.0,
      "rule_status_list": []
    }
  ]
}

401 Unauthorized

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "percentage_of_passed_rules": 0.0,
      "rule_status_list": []
    }
  ]
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "percentage_of_passed_rules": 0.0,
      "rule_status_list": []
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "not_applicable_filters": "string",
      "percentage_of_passed_rules": 0.0,
      "rule_status_list": []
    }
  ]
}