Container Packages

The Container Packages service collection provides operations for querying container software packages and their vulnerability data. Retrieve packages by image count, vulnerability count, zero-day impact, and export package data for analysis.

Language	Last Update
Python	v1.4.8
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Table of Contents

Operation	Description
ReadPackagesByImageCount read_packages_by_image_count	Retrieves the N most frequently used packages across images.
ReadPackagesCountByZeroDay read_zero_day_counts	Retrieve packages count affected by zero day vulnerabilities.
ReadPackagesByFixableVulnCount read_fixable_vuln_count	Retrieve top x app packages with the most fixable vulnerabilities.
ReadPackagesByVulnCount read_vuln_count	Retrieve top x packages with the most vulnerabilities.
ReadPackagesCombinedExport read_combined_export	Retrieve packages identified by the provided filter criteria for the purpose of export.
ReadPackagesCombined read_combined	Retrieve packages identified by the provided filter criteria.
ReadPackagesCombinedV2 read_packages	Retrieve packages identified by the provided filter criteria.

---

ReadPackagesByImageCount

Retrieves the N most frequently used packages across images.

GET /container-security/aggregates/packages/by-image-count/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_packages_by_image_count

Parameters

Name	Type	Data type	Description
filter	query	string	Filter packages using a query in Falcon Query Language (FQL). Supported filter fields: ai_related, cveid, running_images, severity, type, and vulnerability_count.
limit	query	integer	Maximum number of package results to return. Default value: 5.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.read_packages_by_image_count(filter="string", limit=integer)
print(response)

Operation ID

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ReadPackagesByImageCount(filter="string", limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPackagesByImageCount",
                          filter="string",
                          limit=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_packages"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)

  response, err := client.ContainerPackages.ReadPackagesByImageCount(
    &container_packages.ReadPackagesByImageCountParams{
      Filter: &filter,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerPackages.readPackagesByImageCount(
  "string",  // filter
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::container_packages_api::read_packages_by_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_packages_by_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerPackages.new

response = api.read_packages_by_image_count(filter: 'string', limit: integer)

puts response

---

ReadPackagesCountByZeroDay

Retrieve packages count affected by zero day vulnerabilities.

GET /container-security/aggregates/packages/count-by-zero-day/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_zero_day_counts

Parameters

Name	Type	Data type	Description
filter	query	string	Filter packages using a query in Falcon Query Language (FQL). Supported filters: cid.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.read_zero_day_counts(filter="string")
print(response)

Operation ID

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ReadPackagesCountByZeroDay(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPackagesCountByZeroDay",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_packages"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.ContainerPackages.ReadPackagesCountByZeroDay(
    &container_packages.ReadPackagesCountByZeroDayParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerPackages.readPackagesCountByZeroDay("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::container_packages_api::read_packages_count_by_zero_day;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_packages_count_by_zero_day(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerPackages.new

response = api.read_packages_count_by_zero_day(filter: 'string')

puts response

---

ReadPackagesByFixableVulnCount

Retrieve top x app packages with the most fixable vulnerabilities.

GET /container-security/combined/packages/app-by-fixable-vulnerability-count/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_fixable_vuln_count

Parameters

Name	Type	Data type	Description
filter	query	string	Filter packages using a query in Falcon Query Language (FQL). Supported filters: cid, container_id, cveid, fix_status, image_digest, license, package_name_version, severity, type, vulnerability_count.
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.read_fixable_vuln_count(filter="string",
                                          limit=integer,
                                          offset=integer)
print(response)

Operation ID

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ReadPackagesByFixableVulnCount(filter="string",
                                                 limit=integer,
                                                 offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPackagesByFixableVulnCount",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_packages"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerPackages.ReadPackagesByFixableVulnCount(
    &container_packages.ReadPackagesByFixableVulnCountParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerPackages.readPackagesByFixableVulnCount(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_packages_api::read_packages_by_fixable_vuln_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_packages_by_fixable_vuln_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerPackages.new

response = api.read_packages_by_fixable_vuln_count(filter: 'string',
                                                   limit: integer,
                                                   offset: integer)

puts response

---

ReadPackagesByVulnCount

Retrieve top x packages with the most vulnerabilities.

GET /container-security/combined/packages/by-vulnerability-count/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vuln_count

Parameters

Name	Type	Data type	Description
filter	query	string	Filter packages using a query in Falcon Query Language (FQL). Supported filters: cid, container_id, cveid, fix_status, image_digest, license, package_name_version, severity, type, vulnerability_count.
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

Python

PEP 8

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.read_vuln_count(filter="string",
                                  limit=integer,
                                  offset=integer)
print(response)

Operation ID

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ReadPackagesByVulnCount(filter="string",
                                          limit=integer,
                                          offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPackagesByVulnCount",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_packages"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerPackages.ReadPackagesByVulnCount(
    &container_packages.ReadPackagesByVulnCountParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerPackages.readPackagesByVulnCount(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_packages_api::read_packages_by_vuln_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_packages_by_vuln_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerPackages.new

response = api.read_packages_by_vuln_count(filter: 'string',
                                           limit: integer,
                                           offset: integer)

puts response

---

ReadPackagesCombinedExport

Retrieve packages identified by the provided filter criteria for the purpose of export.

GET /container-security/combined/packages/export/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_combined_export

Parameters

Name	Type	Data type	Description
filter	query	string	Filter packages using a query in Falcon Query Language (FQL). Supported filters: cid, container_id, cveid, fix_status, image_digest, license, package_name_version, severity, type, vulnerability_count.
only_zero_day_affected	query	boolean	(true/false) load zero day affected packages, default is false.
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The fields to sort the records on. Supported columns: license, package_name_version, type.

Code Examples

Python

PEP 8

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.read_combined_export(filter="string",
                                       only_zero_day_affected=boolean,
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Operation ID

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ReadPackagesCombinedExport(filter="string",
                                             only_zero_day_affected=boolean,
                                             limit=integer,
                                             offset=integer,
                                             sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPackagesCombinedExport",
                          filter="string",
                          only_zero_day_affected=boolean,
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_packages"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  onlyZeroDayAffected := boolean
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerPackages.ReadPackagesCombinedExport(
    &container_packages.ReadPackagesCombinedExportParams{
      Filter: &filter,
      OnlyZeroDayAffected: &onlyZeroDayAffected,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerPackages.readPackagesCombinedExport(
  "string",  // filter
  boolean,  // onlyZeroDayAffected
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_packages_api::read_packages_combined_export;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_packages_combined_export(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(boolean),  // only_zero_day_affected
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerPackages.new

response = api.read_packages_combined_export(filter: 'string',
                                             only_zero_day_affected: boolean,
                                             sort: 'string',
                                             limit: integer,
                                             offset: integer)

puts response

---

ReadPackagesCombined

Retrieve packages identified by the provided filter criteria.

GET /container-security/combined/packages/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_combined

Parameters

Name	Type	Data type	Description
filter	query	string	Filter packages using a query in Falcon Query Language (FQL). Supported filters: ai_related, cid, container_id, cveid, fix_status, image_digest, license, package_name_version, severity, type, and vulnerability_count.
only_zero_day_affected	query	boolean	Load zero day affected packages. Default: false.
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The fields to sort the records on. Supported columns: license, package_name_version, and type.

Code Examples

Python

PEP 8

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.read_combined(filter="string",
                                only_zero_day_affected=boolean,
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

Operation ID

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ReadPackagesCombined(filter="string",
                                       only_zero_day_affected=boolean,
                                       limit=integer,
                                       offset=integer,
                                       sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPackagesCombined",
                          filter="string",
                          only_zero_day_affected=boolean,
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Get-FalconContainerPackage -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_packages"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  onlyZeroDayAffected := boolean
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerPackages.ReadPackagesCombined(
    &container_packages.ReadPackagesCombinedParams{
      Filter: &filter,
      OnlyZeroDayAffected: &onlyZeroDayAffected,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerPackages.readPackagesCombined(
  "string",  // filter
  boolean,  // onlyZeroDayAffected
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_packages_api::read_packages_combined;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_packages_combined(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(boolean),  // only_zero_day_affected
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerPackages.new

response = api.read_packages_combined(filter: 'string',
                                      only_zero_day_affected: boolean,
                                      sort: 'string',
                                      limit: integer,
                                      offset: integer)

puts response

---

ReadPackagesCombinedV2

Retrieve packages identified by the provided filter criteria.

GET /container-security/combined/packages/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_packages

Parameters

Name	Type	Data type	Description
filter	query	string	Filter packages using a query in Falcon Query Language (FQL). Supported filters: ai_related, cid, container_id, cveid, fix_status, image_digest, license, package_name_version, severity, type, and vulnerability_count.
only_zero_day_affected	query	boolean	Load zero day affected packages. Default: false.
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The fields to sort the records on. Supported columns: license, package_name_version, and type.

Code Examples

Python

PEP 8

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.read_packages(filter="string",
                                only_zero_day_affected=boolean,
                                limit=integer,
                                offset=integer,
                                sort="string")
print(response)

Operation ID

from falconpy import ContainerPackages

falcon = ContainerPackages(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ReadPackagesCombinedV2(filter="string",
                                         only_zero_day_affected=boolean,
                                         limit=integer,
                                         offset=integer,
                                         sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadPackagesCombinedV2",
                          filter="string",
                          only_zero_day_affected=boolean,
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_packages"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  onlyZeroDayAffected := boolean
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerPackages.ReadPackagesCombinedV2(
    &container_packages.ReadPackagesCombinedV2Params{
      Filter: &filter,
      OnlyZeroDayAffected: &onlyZeroDayAffected,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerPackages.readPackagesCombinedV2(
  "string",  // filter
  boolean,  // onlyZeroDayAffected
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::container_packages_api::read_packages_combined_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_packages_combined_v2(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(boolean),  // only_zero_day_affected
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerPackages.new

response = api.read_packages_combined_v2(filter: 'string',
                                         only_zero_day_affected: boolean,
                                         sort: 'string',
                                         limit: integer,
                                         offset: integer)

puts response