Container Images

The Container Images service collection provides operations for assessing and managing container images in your CrowdStrike Falcon environment. Retrieve assessment history, aggregate image counts by base OS, state, and vulnerability count, retrieve combined image details and export data, manage base images, and review issues and vulnerability summaries per image.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
AggregateImageAssessmentHistory aggregate_assessment_history	Image assessment history
AggregateImageCount aggregate_count	Aggregate count of images
AggregateImageCountByBaseOS aggregate_count_by_base_os	Aggregate count of images grouped by Base OS distribution
AggregateImageCountByState aggregate_count_by_state	Aggregate count of images grouped by state
CombinedBaseImages get_combined_base_images	Retrieves a list of base images for the provided filter.
CombinedImageByVulnerabilityCount get_combined_images_by_vulnerability_count	Retrieve top x images with the most vulnerabilities
CombinedImageDetail get_combined_detail	Retrieve image entities identified by the provided filter criteria
CombinedImageIssuesSummary get_combined_issues_summary	Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities
CombinedImageVulnerabilitySummary get_combined_vulnerabilities_summary	aggregates information about vulnerabilities for an image
CreateBaseImagesEntities create_base_images	Creates base images using the provided details
DeleteBaseImages delete_base_images	Delete base images by base image uuid
GetCombinedImages get_combined_images	Get image assessment results by providing an FQL filter and paging details
ReadCombinedImagesExport read_combined_export	Retrieves a paginated list of images, with an option to expand aggregated vulnerabilities/detections.

---

AggregateImageAssessmentHistory

Image assessment history

Method GET

Route /container-security/aggregates/images/assessment-history/v1

Scope Falcon Container Image: READ

PEP 8 aggregate_assessment_history

Parameters

filter query · string

Filter using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (3)

cid

registry

repository

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_assessment_history(filter="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageAssessmentHistory(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageAssessmentHistory",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImages.AggregateImageAssessmentHistory(
    &container_images.AggregateImageAssessmentHistoryParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.aggregateImageAssessmentHistory("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::aggregate_image_assessment_history;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_image_assessment_history(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.aggregate_image_assessment_history(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

AggregateImageCount

Aggregate count of images

Method GET

Route /container-security/aggregates/images/count/v1

Scope Falcon Container Image: READ

PEP 8 aggregate_count

Parameters

filter query · string

Filter images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (27)

ai_related	ai_vulnerability_count	architecture
base_os	cid	container_id
container_running_status	cps_rating	crowdstrike_user
cve_id	detection_count	detection_name
detection_severity	first_seen	image_digest
image_id	include_base_image_vuln	index_digest
layer_digest	multi_arch	package_name_version
registry	repository	source
tag	vulnerability_count	vulnerability_severity

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count(filter="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImages.AggregateImageCount(
    &container_images.AggregateImageCountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.aggregateImageCount("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::aggregate_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.aggregate_image_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

AggregateImageCountByBaseOS

Aggregate count of images grouped by Base OS distribution

Method GET

Route /container-security/aggregates/images/count-by-os-distribution/v1

Scope Falcon Container Image: READ

PEP 8 aggregate_count_by_base_os

Parameters

filter query · string

Filter images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (12)

architecture	base_os	cid
first_seen	image_digest	image_id
index_digest	multi_arch	registry
repository	source	tag

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count_by_base_os(filter="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCountByBaseOS(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCountByBaseOS",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImages.AggregateImageCountByBaseOS(
    &container_images.AggregateImageCountByBaseOSParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.aggregateImageCountByBaseOS("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::aggregate_image_count_by_base_os;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_image_count_by_base_os(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.aggregate_image_count_by_base_os(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

AggregateImageCountByState

Aggregate count of images grouped by state

Method GET

Route /container-security/aggregates/images/count-by-state/v1

Scope Falcon Container Image: READ

PEP 8 aggregate_count_by_state

Parameters

filter query · string

Filter images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (12)

architecture	base_os	cid
first_seen	image_digest	image_id
index_digest	multi_arch	registry
repository	source	tag

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.aggregate_count_by_state(filter="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.AggregateImageCountByState(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateImageCountByState",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImages.AggregateImageCountByState(
    &container_images.AggregateImageCountByStateParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.aggregateImageCountByState("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::aggregate_image_count_by_state;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_image_count_by_state(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.aggregate_image_count_by_state(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CombinedBaseImages

Retrieves a list of base images for the provided filter.

Method GET

Route /container-security/combined/base-images/v1

Scope Falcon Container Image: READ

PEP 8 get_combined_base_images

Parameters

filter query · string

Search base images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (5)

image_digest	image_id	registry
repository	tag

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_base_images(filter="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedBaseImages(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedBaseImages",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerImages.CombinedBaseImages(
    &container_images.CombinedBaseImagesParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.combinedBaseImages("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::combined_base_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_base_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.combined_base_images(filter: 'string')

puts response

Responses

200 Created

{}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "code": 0,
  "id": "string",
  "message": "string"
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CombinedImageByVulnerabilityCount

Retrieve top x images with the most vulnerabilities

Method GET

Route /container-security/combined/images/by-vulnerability-count/v1

Scope Falcon Container Image: READ

PEP 8 get_combined_images_by_vulnerability_count

Parameters

filter query · string

Filter images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (12)

architecture	base_os	cid
first_seen	image_digest	image_id
index_digest	multi_arch	registry
repository	source	tag

limit query · integer

The upper-bound on the number of records to retrieve.

offset query · integer

The fields to sort the records on. **Not supported.**

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_images_by_vulnerability_count(filter="string",
                                                             limit=integer,
                                                             offset=integer)
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageByVulnerabilityCount(filter="string",
                                                    limit=integer,
                                                    offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageByVulnerabilityCount",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerImages.CombinedImageByVulnerabilityCount(
    &container_images.CombinedImageByVulnerabilityCountParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.combinedImageByVulnerabilityCount(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::combined_image_by_vulnerability_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_image_by_vulnerability_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.combined_image_by_vulnerability_count(filter: 'string',
                                                     limit: integer,
                                                     offset: integer)

puts response

Responses

200 OK

[
  {
    "image_id": "string",
    "registry": "string",
    "repository": "string",
    "tag": "string",
    "vulnerability_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CombinedImageDetail

Retrieve image entities identified by the provided filter criteria

Method GET

Route /container-security/combined/images/detail/v1

Scope Falcon Container Image: READ

PEP 8 get_combined_detail

Parameters

filter query · string

Filter images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (12)

architecture	base_os	cid
first_seen	image_digest	image_id
index_digest	multi_arch	registry
repository	source	tag

with_config query · boolean

(true/false) include image config, default is false

sort query · string

The fields to sort the records on.

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_detail(filter="string",
                                      with_config=boolean,
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageDetail(filter="string",
                                      with_config=boolean,
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageDetail",
                          filter="string",
                          with_config=boolean,
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerImage -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -WithConfig $boolean `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  withConfig := boolean
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerImages.CombinedImageDetail(
    &container_images.CombinedImageDetailParams{
      Filter: &filter,
      WithConfig: &withConfig,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.combinedImageDetail(
  "string",  // filter
  boolean,  // withConfig
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::combined_image_detail;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_image_detail(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(boolean),  // with_config
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.combined_image_detail(filter: 'string',
                                     with_config: boolean,
                                     sort: 'string',
                                     limit: integer,
                                     offset: integer)

puts response

Responses

200 OK

[
  {
    "ai_related": false,
    "base_image_id": "string",
    "base_os": "string",
    "base_os_version": "string",
    "cid": "string",
    "config": {},
    "created_at": "string",
    "crowdstrike_user": "string",
    "digest": "string",
    "eol_date": "string",
    "first_scanned": "string",
    "image_id": "string",
    "image_scanning_active": false,
    "image_size": 0,
    "index_digest": "string",
    "is_base_image": false,
    "multi_arch": false,
    "registry": "string",
    "repository": "string",
    "source": "string",
    "source_base_image": {},
    "tag": "string",
    "updated_at": "string",
    "uuid": "string",
    "warning": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CombinedImageIssuesSummary

Retrieve image issues summary such as Image detections, Runtime detections, Policies, vulnerabilities

Method GET

Route /container-security/combined/images/issues-summary/v1

Scope Falcon Container Image: READ

PEP 8 get_combined_issues_summary

Parameters

cid query · string

CS Customer ID

registry query · string

Registry

repository query · string

Repository name

tag query · string

Tag name

image_digest query · string

Digest ID

include_base_image_vuln query · boolean

Include base image vulnerabilities.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_issues_summary(cid="string",
                                              image_digest="string",
                                              registry="string",
                                              repository="string",
                                              tag="string",
                                              include_base_image_vuln=boolean)
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageIssuesSummary(cid="string",
                                             image_digest="string",
                                             registry="string",
                                             repository="string",
                                             tag="string",
                                             include_base_image_vuln=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageIssuesSummary",
                          cid="string",
                          registry="string",
                          repository="string",
                          tag="string",
                          image_digest="string",
                          include_base_image_vuln=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  imageDigest := "string"
  includeBaseImageVuln := boolean

  response, err := client.ContainerImages.CombinedImageIssuesSummary(
    &container_images.CombinedImageIssuesSummaryParams{
      Cid: "string",
      Registry: "string",
      Repository: "string",
      Tag: "string",
      ImageDigest: &imageDigest,
      IncludeBaseImageVuln: &includeBaseImageVuln,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.combinedImageIssuesSummary(
  "string",  // cid
  "string",  // registry
  "string",  // repository
  "string",  // tag
  "string",  // imageDigest
  boolean  // includeBaseImageVuln
);

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::combined_image_issues_summary;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_image_issues_summary(
        &falcon.cfg,  // configuration
        "string",  // cid
        "string",  // registry
        "string",  // repository
        "string",  // tag
        Some("string"),  // image_digest
        Some(boolean),  // include_base_image_vuln
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.combined_image_issues_summary('string', 'string', 'string', 'string')

puts response

Responses

200 OK

[
  {
    "image_container_info": {},
    "image_detections": [],
    "is_dca_run": false,
    "known_issues": 0,
    "packages_info": {},
    "policies_summary": [],
    "runtime_detections": [],
    "vulnerabilities_summary": [],
    "zero_day_impacted": false
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CombinedImageVulnerabilitySummary

aggregates information about vulnerabilities for an image

Method GET

Route /container-security/combined/images/vulnerabilities-summary/v1

Scope Falcon Container Image: READ

PEP 8 get_combined_vulnerabilities_summary

Parameters

cid query · string

CS Customer ID

registry query · string

Registry

repository query · string

Repository name

tag query · string

Tag name

image_digest query · string

Digest ID

include_base_image_vuln query · boolean

Include base image vulnerabilities.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_vulnerabilities_summary(cid="string",
                                                       image_digest="string",
                                                       registry="string",
                                                       repository="string",
                                                       tag="string",
                                                       include_base_image_vuln=boolean)
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CombinedImageVulnerabilitySummary(cid="string",
                                                    image_digest="string",
                                                    registry="string",
                                                    repository="string",
                                                    tag="string",
                                                    include_base_image_vuln=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImageVulnerabilitySummary",
                          cid="string",
                          registry="string",
                          repository="string",
                          tag="string",
                          image_digest="string",
                          include_base_image_vuln=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  imageDigest := "string"
  includeBaseImageVuln := boolean

  response, err := client.ContainerImages.CombinedImageVulnerabilitySummary(
    &container_images.CombinedImageVulnerabilitySummaryParams{
      Cid: "string",
      Registry: "string",
      Repository: "string",
      Tag: "string",
      ImageDigest: &imageDigest,
      IncludeBaseImageVuln: &includeBaseImageVuln,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.combinedImageVulnerabilitySummary(
  "string",  // cid
  "string",  // registry
  "string",  // repository
  "string",  // tag
  "string",  // imageDigest
  boolean  // includeBaseImageVuln
);

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::combined_image_vulnerability_summary;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_image_vulnerability_summary(
        &falcon.cfg,  // configuration
        "string",  // cid
        "string",  // registry
        "string",  // repository
        "string",  // tag
        Some("string"),  // image_digest
        Some(boolean),  // include_base_image_vuln
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.combined_image_vulnerability_summary('string', 'string', 'string', 'string')

puts response

Responses

200 OK

[
  {
    "app_packages_with_vulnerabilities": 0,
    "app_vuln_by_severity": [],
    "image_vuln_by_severity": [],
    "layers_with_vulnerabilities": 0,
    "os_packages_with_vulnerabilities": 0,
    "os_vuln_by_severity": [],
    "total_app_packages": 0,
    "total_os_packages": 0,
    "total_vulnerabilities": 0
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

CreateBaseImagesEntities

Creates base images using the provided details

Method POST

Route /container-security/entities/base-images/v1

Scope Falcon Container Image: WRITE

PEP 8 create_base_images

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

base_images body · array

image_digest body · string

Image digest.

image_id body · string

UUID for the image.

registry body · string

Image registry.

repository body · string

Image repository.

tag body · string

Image tag.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.create_base_images(image_digest="string",
                                     image_id="string",
                                     registry="string",
                                     repository="string",
                                     tag="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.CreateBaseImagesEntities(image_digest="string",
                                           image_id="string",
                                           registry="string",
                                           repository="string",
                                           tag="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_images": [
        {
            "image_digest": "string",
            "image_id": "string",
            "registry": "string",
            "repository": "string",
            "tag": "string"
        }
    ]
}

response = falcon.command("CreateBaseImagesEntities", body=body_payload)
print(response)

PowerShell

New-FalconContainerImage -ImageId "string" `
  -ImageDigest "string" `
  -Registry "string" `
  -Repository "string" `
  -Tag "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  image_digest := "string"
  image_id := "string"
  registry := "string"
  repository := "string"
  tag := "string"

  response, err := client.ContainerImages.CreateBaseImagesEntities(
    &container_images.CreateBaseImagesEntitiesParams{
      Body: &models.ModelsCreateBaseImagesRequest{
        BaseImages: []interface{}{
          {
          ImageDigest: &image_digest,
          ImageID: &image_id,
          Registry: &registry,
          Repository: &repository,
          Tag: &tag,
          },
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.createBaseImagesEntities(
  {
    baseImages: [{
        imageDigest: "string",
        imageId: "string",
        registry: "string",
        repository: "string",
        tag: "string"
      }]
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::create_base_images_entities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ModelsCreateBaseImagesRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ModelsCreateBaseImagesRequest {
        base_images: vec![],
        ..Default::default()
    };

    let response = create_base_images_entities(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

body = Falcon::ModelsCreateBaseImagesRequest.new(
  base_images: [{
      image_digest: 'string',
      image_id: 'string',
      registry: 'string',
      repository: 'string',
      tag: 'string'
    }]
)

response = api.create_base_images_entities(body)

puts response

Responses

200 Created

{}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "code": 0,
  "id": "string",
  "message": "string"
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

DeleteBaseImages

Delete base images by base image uuid

Method DELETE

Route /container-security/entities/base-images/v1

Scope Falcon Container Image: WRITE

PEP 8 delete_base_images

Parameters

ids query · string or list of strings

BaseImageIDs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_base_images(ids=id_list)
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.DeleteBaseImages(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("DeleteBaseImages",
                          ids=id_list)
print(response)

PowerShell

Remove-FalconContainerImage -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.ContainerImages.DeleteBaseImages(
    &container_images.DeleteBaseImagesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.deleteBaseImages(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::delete_base_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = delete_base_images(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.delete_base_images(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 Created

{}

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

403 Forbidden

{
  "code": 0,
  "id": "string",
  "message": "string"
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

GetCombinedImages

Get image assessment results by providing an FQL filter and paging details

Method GET

Route /container-security/combined/image-assessment/images/v1

Scope Falcon Container Image: READ

PEP 8 get_combined_images

Parameters

filter query · string

Filter images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

ai_related	architecture	container_id
container_running_status	cve_id	detection_name
detection_severity	first_seen	image_digest
image_id	index_digest	multi_arch
registry	repository	tag
vulnerability_severity

sort query · string

The fields to sort the records on. Supported columns:

Available values (12)

architecture	first_seen	highest_detection_severity
highest_vulnerability_severity	image_digest	image_id
index_digest	multi_arch	registry
repository	source	tag

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.get_combined_images(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.GetCombinedImages(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetCombinedImages",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerAssessment -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerImages.GetCombinedImages(
    &container_images.GetCombinedImagesParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.getCombinedImages(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::get_combined_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_combined_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.get_combined_images(filter: 'string',
                                   sort: 'string',
                                   limit: integer,
                                   offset: integer)

puts response

Responses

200 OK

[
  {
    "ai_related": false,
    "architecture": "string",
    "base_os": "string",
    "cid": "string",
    "containers": 0,
    "detections": 0,
    "first_seen": "string",
    "highest_detection_severity": "string",
    "highest_vulnerability_severity": "string",
    "image_digest": "string",
    "image_id": "string",
    "index_digest": "string",
    "last_seen": "string",
    "layers_with_vulnerabilities": 0,
    "multi_arch": false,
    "packages": 0,
    "registry": "string",
    "report_url_by_id_and_digest": "string",
    "report_url_by_repo_and_tag": "string",
    "repository": "string",
    "tag": "string",
    "vulnerabilities": 0,
    "warning": 0
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "ai_related": false,
      "architecture": "string",
      "base_os": "string",
      "cid": "string",
      "containers": 0,
      "detections": 0,
      "first_seen": "string",
      "highest_detection_severity": "string",
      "highest_vulnerability_severity": "string",
      "image_digest": "string",
      "image_id": "string",
      "index_digest": "string",
      "last_seen": "string",
      "layers_with_vulnerabilities": 0,
      "multi_arch": false,
      "packages": 0,
      "registry": "string",
      "report_url_by_id_and_digest": "string",
      "report_url_by_repo_and_tag": "string",
      "repository": "string",
      "tag": "string",
      "vulnerabilities": 0,
      "warning": 0
    }
  ]
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "ai_related": false,
      "architecture": "string",
      "base_os": "string",
      "cid": "string",
      "containers": 0,
      "detections": 0,
      "first_seen": "string",
      "highest_detection_severity": "string",
      "highest_vulnerability_severity": "string",
      "image_digest": "string",
      "image_id": "string",
      "index_digest": "string",
      "last_seen": "string",
      "layers_with_vulnerabilities": 0,
      "multi_arch": false,
      "packages": 0,
      "registry": "string",
      "report_url_by_id_and_digest": "string",
      "report_url_by_repo_and_tag": "string",
      "repository": "string",
      "tag": "string",
      "vulnerabilities": 0,
      "warning": 0
    }
  ]
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "ai_related": false,
      "architecture": "string",
      "base_os": "string",
      "cid": "string",
      "containers": 0,
      "detections": 0,
      "first_seen": "string",
      "highest_detection_severity": "string",
      "highest_vulnerability_severity": "string",
      "image_digest": "string",
      "image_id": "string",
      "index_digest": "string",
      "last_seen": "string",
      "layers_with_vulnerabilities": 0,
      "multi_arch": false,
      "packages": 0,
      "registry": "string",
      "report_url_by_id_and_digest": "string",
      "report_url_by_repo_and_tag": "string",
      "repository": "string",
      "tag": "string",
      "vulnerabilities": 0,
      "warning": 0
    }
  ]
}

---

---

ReadCombinedImagesExport

Retrieves a paginated list of images, with an option to expand aggregated vulnerabilities/detections.

Method GET

Route /container-security/combined/images/export/v1

Scope Falcon Container Image: READ

PEP 8 read_combined_export

Parameters

filter query · string

Filter images using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (27)

ai_related	ai_vulnerability_count	architecture
base_os	cid	container_id
container_running_status	cps_rating	crowdstrike_user
cve_id	detection_count	detection_name
detection_severity	first_seen	image_digest
image_id	include_base_image_vuln	index_digest
layer_digest	multi_arch	package_name_version
registry	repository	source
tag	vulnerability_count	vulnerability_severity

expand_vulnerabilities query · boolean

Expand vulnerabilities details

expand_detections query · boolean

Expand detections details

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

sort query · string

The fields to sort the records on. Supported columns:

Available values (22)

ai_vulnerabilities	architecture	base_os
cid	detections	firstScanned
first_seen	highest_cps_current_rating	highest_detection_severity
highest_vulnerability_severity	image_digest	image_id
index_digest	last_seen	layers_with_vulnerabilities
multi_arch	packages	registry
repository	source	tag
vulnerabilities

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.read_combined_export(filter="string",
                                       expand_vulnerabilities=boolean,
                                       expand_detections=boolean,
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Operation ID

from falconpy import ContainerImages

falcon = ContainerImages(client_id=CLIENT_ID,
                         client_secret=CLIENT_SECRET
                         )

response = falcon.ReadCombinedImagesExport(filter="string",
                                           expand_vulnerabilities=boolean,
                                           expand_detections=boolean,
                                           limit=integer,
                                           offset=integer,
                                           sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedImagesExport",
                          filter="string",
                          expand_vulnerabilities=boolean,
                          expand_detections=boolean,
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_images"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  expandVulnerabilities := boolean
  expandDetections := boolean
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.ContainerImages.ReadCombinedImagesExport(
    &container_images.ReadCombinedImagesExportParams{
      Filter: &filter,
      ExpandVulnerabilities: &expandVulnerabilities,
      ExpandDetections: &expandDetections,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerImages.readCombinedImagesExport(
  "string",  // filter
  boolean,  // expandVulnerabilities
  boolean,  // expandDetections
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

Rust

use rusty_falcon::apis::container_images_api::read_combined_images_export;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_images_export(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(boolean),  // expand_vulnerabilities
        Some(boolean),  // expand_detections
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerImages.new

response = api.read_combined_images_export(filter: 'string',
                                           expand_vulnerabilities: boolean,
                                           expand_detections: boolean,
                                           limit: integer,
                                           offset: integer,
                                           sort: 'string')

puts response

Responses

200 OK

[
  {
    "ai_related": false,
    "architecture": "string",
    "base_os": "string",
    "business_impact": [],
    "business_unit": [],
    "cid": "string",
    "cloud_groups_v2": [],
    "cve_exploited_status": 0,
    "cve_first_seen": "string",
    "cve_id": "string",
    "cve_publication_date": "string",
    "cvss_score": "string",
    "detection_name": "string",
    "detection_severity": "string",
    "detection_type": "string",
    "environment": [],
    "first_seen": "string",
    "groups": [],
    "image_build_date": "string",
    "image_digest": "string",
    "image_id": "string",
    "index_digest": "string",
    "is_base_image": false,
    "last_seen": "string",
    "package_name_version": "string",
    "packages_impacted": 0,
    "registry": "string",
    "repository": "string",
    "source": "string",
    "started_containers": 0,
    "stopped_containers": 0,
    "tag": "string",
    "vulnerability_cps_rating": "string",
    "vulnerability_description": "string",
    "vulnerability_severity": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}