Container Vulnerabilities

The Container Vulnerabilities service collection provides operations for aggregating and retrieving container vulnerability data. Query vulnerability counts grouped by various criteria, retrieve detailed vulnerability information for images, and get combined vulnerability data filtered by FQL expressions.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
ReadCombinedVulnerabilities `read_combined_vulnerabilities`	Retrieves a paginated list of vulnerabilities filtered by the provided FQL.
ReadCombinedVulnerabilitiesDetails `read_combined_vulnerability_detail`	Retrieve vulnerability details related to an image
ReadCombinedVulnerabilitiesInfo `read_combined_vulnerabilities_info`	Retrieve vulnerability and package related info for this customer
ReadVulnerabilitiesByImageCount `read_vulnerabilities_by_count`	Retrieve top x vulnerabilities with the most impacted images
ReadVulnerabilitiesPublicationDate `read_vulnerabilities_by_pub_date`	Retrieve top x vulnerabilities with the most recent publication date
ReadVulnerabilityCount `read_vulnerability_count`	Aggregate count of vulnerabilities
ReadVulnerabilityCountByActivelyExploited `read_vulnerability_counts_by_active_exploited`	Aggregate count of vulnerabilities grouped by actively exploited
ReadVulnerabilityCountByCPSRating `read_vulnerability_counts_by_cps_rating`	Aggregate count of vulnerabilities grouped by csp_rating
ReadVulnerabilityCountByCVSSScore `read_vulnerability_counts_by_cvss_score`	Aggregate count of vulnerabilities grouped by CVSS score
ReadVulnerabilityCountBySeverity `read_vulnerability_counts_by_severity`	Aggregate count of vulnerabilities grouped by severity

ReadCombinedVulnerabilities

Retrieves a paginated list of vulnerabilities filtered by the provided FQL.

Method GET

Route /container-security/combined/vulnerabilities/v1

Scope Falcon Container Image: READ

PEP 8 read_combined_vulnerabilities

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

`ai_related`	`base_os`	`cid`
`container_id`	`container_running_status`	`containers_impacted_range`
`cps_rating`	`cve_id`	`cvss_score`
`description`	`exploited_status_name`	`exploited_status`
`fix_status`	`image_digest`	`image_id`
`images_impacted_range`	`include_base_image_vuln`	`index_digest`
`package_name_version`	`registry`	`repository`
`severity`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

sort query · string

The fields to sort the records on. Supported columns:

Available values (7)

`cps_current_rating`	`cve_id`	`cvss_score`
`description`	`images_impacted`	`packages_impacted`
`severity`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_combined_vulnerabilities(filter="string",
                                                limit=integer,
                                                offset=integer,
                                                sort="string")
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadCombinedVulnerabilities(filter="string",
                                              limit=integer,
                                              offset=integer,
                                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedVulnerabilities",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

Get-FalconContainerVulnerability -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.ContainerVulnerabilities.ReadCombinedVulnerabilities(
    &container_vulnerabilities.ReadCombinedVulnerabilitiesParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readCombinedVulnerabilities(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_combined_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_vulnerabilities(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_combined_vulnerabilities(filter: 'string',
                                             limit: integer,
                                             offset: integer,
                                             sort: 'string')

puts response

Responses

[
  {
    "ai_related": false,
    "containers_impacted": 0,
    "cps_current_rating": "string",
    "cve_id": "string",
    "cvss_score": 0.0,
    "description": "string",
    "exploit_found": false,
    "exploited_status": 0,
    "exploited_status_string": "string",
    "images_impacted": 0,
    "packages_impacted": 0,
    "published_date": "string",
    "remediation_available": false,
    "severity": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadCombinedVulnerabilitiesDetails

Retrieve vulnerability details related to an image

Method GET

Route /container-security/combined/vulnerabilities/details/v1

Scope Falcon Container Image: READ

PEP 8 read_combined_vulnerability_detail

Parameters

id query · string

Image UUID

filter query · string

Filter the vulnerabilities using a query in Falcon Query Language (FQL). Supported vulnerability filter fields:

Available values (10)

`cid`	`cps_rating`	`cve_id`
`cvss_score`	`exploited_status_name`	`exploited_status`
`include_base_image_vuln`	`is_zero_day`	`remediation_available`
`severity`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 5000.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_combined_vulnerability_detail(id="string",
                                                     filter="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadCombinedVulnerabilitiesDetails(id="string",
                                                     filter="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedVulnerabilitiesDetails",
                          id="string",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadCombinedVulnerabilitiesDetails(
    &container_vulnerabilities.ReadCombinedVulnerabilitiesDetailsParams{
      ID: "string",
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readCombinedVulnerabilitiesDetails(
  "string",  // id
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_combined_vulnerabilities_details;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_vulnerabilities_details(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_combined_vulnerabilities_details('string')

puts response

Responses

[
  {
    "cps_current_rating": "string",
    "cve_id": "string",
    "cvss_score": "string",
    "exploited_status": 0,
    "layer_command": "string",
    "layer_index": 0,
    "package_name_version": "string",
    "package_path": "string",
    "remediation_available": false,
    "severity": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadCombinedVulnerabilitiesInfo

Retrieve vulnerability and package related info for this customer

Method GET

Route /container-security/combined/vulnerabilities/info/v1

Scope Falcon Container Image: READ

PEP 8 read_combined_vulnerabilities_info

Parameters

cve_id query · string

Vulnerability CVE ID

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_combined_vulnerabilities_info(cve_id="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadCombinedVulnerabilitiesInfo(cve_id="string",
                                                  limit=integer,
                                                  offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedVulnerabilitiesInfo",
                          cve_id="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerVulnerability -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadCombinedVulnerabilitiesInfo(
    &container_vulnerabilities.ReadCombinedVulnerabilitiesInfoParams{
      CveID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readCombinedVulnerabilitiesInfo(
  "string",  // cveId
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_combined_vulnerabilities_info;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_vulnerabilities_info(
        &falcon.cfg,  // configuration
        "string",  // cve_id
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_combined_vulnerabilities_info('string')

puts response

Responses

[
  {
    "cps_current_rating": "string",
    "cve_id": "string",
    "cvss_score": "string",
    "description": "string",
    "exploit_found": "string",
    "exploited_status_string": "string",
    "images_impacted": 0,
    "packages": [],
    "published_date": "string",
    "severity": "string",
    "threat_actors": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadVulnerabilitiesByImageCount

Retrieve top x vulnerabilities with the most impacted images

Method GET

Route /container-security/combined/vulnerabilities/by-image-count/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerabilities_by_count

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (5)

`cid`	`cve_id`	`registry`
`repository`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerabilities_by_count(filter="string",
                                                limit=integer,
                                                offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilitiesByImageCount(filter="string",
                                                  limit=integer,
                                                  offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilitiesByImageCount",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilitiesByImageCount(
    &container_vulnerabilities.ReadVulnerabilitiesByImageCountParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilitiesByImageCount(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerabilities_by_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerabilities_by_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerabilities_by_image_count(filter: 'string',
                                                   limit: integer,
                                                   offset: integer)

puts response

Responses

[
  {
    "cve_id": "string",
    "images_impacted": 0,
    "product": [],
    "severity": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadVulnerabilitiesPublicationDate

Retrieve top x vulnerabilities with the most recent publication date

Method GET

Route /container-security/combined/vulnerabilities/by-published-date/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerabilities_by_pub_date

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (5)

`cid`	`cve_id`	`registry`
`repository`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerabilities_by_pub_date(filter="string",
                                                   limit=integer,
                                                   offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilitiesPublicationDate(filter="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilitiesPublicationDate",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilitiesPublicationDate(
    &container_vulnerabilities.ReadVulnerabilitiesPublicationDateParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilitiesPublicationDate(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerabilities_publication_date;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerabilities_publication_date(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerabilities_publication_date(filter: 'string',
                                                     limit: integer,
                                                     offset: integer)

puts response

Responses

[
  {
    "containers_impacted": 0,
    "cve_id": "string",
    "cvss_score": 0.0,
    "images_impacted": 0,
    "published_date": "string",
    "severity": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadVulnerabilityCount

Aggregate count of vulnerabilities

Method GET

Route /container-security/aggregates/vulnerabilities/count/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerability_count

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

`ai_related`	`base_os`	`cid`
`container_id`	`container_running_status`	`containers_impacted_range`
`cps_rating`	`cve_id`	`cvss_score`
`description`	`exploited_status_name`	`exploited_status`
`fix_status`	`image_digest`	`image_id`
`images_impacted_range`	`include_base_image_vuln`	`index_digest`
`package_name_version`	`registry`	`repository`
`severity`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_count(filter="string",
                                           limit=integer,
                                           offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCount(filter="string",
                                         limit=integer,
                                         offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCount",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCount(
    &container_vulnerabilities.ReadVulnerabilityCountParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCount(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count(filter: 'string',
                                        limit: integer,
                                        offset: integer)

puts response

Responses

[
  {
    "count": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadVulnerabilityCountByActivelyExploited

Aggregate count of vulnerabilities grouped by actively exploited

Method GET

Route /container-security/aggregates/vulnerabilities/count-by-actively-exploited/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerability_counts_by_active_exploited

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

`ai_related`	`base_os`	`cid`
`container_id`	`container_running_status`	`containers_impacted_range`
`cps_rating`	`cve_id`	`cvss_score`
`description`	`exploited_status_name`	`exploited_status`
`fix_status`	`image_digest`	`image_id`
`images_impacted_range`	`include_base_image_vuln`	`index_digest`
`package_name_version`	`registry`	`repository`
`severity`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_active_exploited(filter="string",
                                                                limit=integer,
                                                                offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountByActivelyExploited(filter="string",
                                                            limit=integer,
                                                            offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountByActivelyExploited",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountByActivelyExploited(
    &container_vulnerabilities.ReadVulnerabilityCountByActivelyExploitedParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountByActivelyExploited(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_actively_exploited;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_actively_exploited(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_actively_exploited(filter: 'string',
                                                              limit: integer,
                                                              offset: integer)

puts response

Responses

[
  {
    "count": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadVulnerabilityCountByCPSRating

Aggregate count of vulnerabilities grouped by csp_rating

Method GET

Route /container-security/aggregates/vulnerabilities/count-by-cps-rating/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerability_counts_by_cps_rating

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

`ai_related`	`base_os`	`cid`
`container_id`	`container_running_status`	`containers_impacted_range`
`cps_rating`	`cve_id`	`cvss_score`
`description`	`exploited_status_name`	`exploited_status`
`fix_status`	`image_digest`	`image_id`
`images_impacted_range`	`include_base_image_vuln`	`index_digest`
`package_name_version`	`registry`	`repository`
`severity`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_cps_rating(filter="string",
                                                          limit=integer,
                                                          offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountByCPSRating(filter="string",
                                                    limit=integer,
                                                    offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountByCPSRating",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountByCPSRating(
    &container_vulnerabilities.ReadVulnerabilityCountByCPSRatingParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountByCPSRating(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_cps_rating;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_cps_rating(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_cps_rating(filter: 'string',
                                                      limit: integer,
                                                      offset: integer)

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadVulnerabilityCountByCVSSScore

Aggregate count of vulnerabilities grouped by CVSS score

Method GET

Route /container-security/aggregates/vulnerabilities/count-by-cvss-score/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerability_counts_by_cvss_score

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

`ai_related`	`base_os`	`cid`
`container_id`	`container_running_status`	`containers_impacted_range`
`cps_rating`	`cve_id`	`cvss_score`
`description`	`exploited_status_name`	`exploited_status`
`fix_status`	`image_digest`	`image_id`
`images_impacted_range`	`include_base_image_vuln`	`index_digest`
`package_name_version`	`registry`	`repository`
`severity`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_cvss_score(filter="string",
                                                          limit=integer,
                                                          offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountByCVSSScore(filter="string",
                                                    limit=integer,
                                                    offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountByCVSSScore",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountByCVSSScore(
    &container_vulnerabilities.ReadVulnerabilityCountByCVSSScoreParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountByCVSSScore(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_cvss_score;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_cvss_score(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_cvss_score(filter: 'string',
                                                      limit: integer,
                                                      offset: integer)

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

ReadVulnerabilityCountBySeverity

Aggregate count of vulnerabilities grouped by severity

Method GET

Route /container-security/aggregates/vulnerabilities/count-by-severity/v1

Scope Falcon Container Image: READ

PEP 8 read_vulnerability_counts_by_severity

Parameters

filter query · string

Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (23)

`ai_related`	`base_os`	`cid`
`container_id`	`container_running_status`	`containers_impacted_range`
`cps_rating`	`cve_id`	`cvss_score`
`description`	`exploited_status_name`	`exploited_status`
`fix_status`	`image_digest`	`image_id`
`images_impacted_range`	`include_base_image_vuln`	`index_digest`
`package_name_version`	`registry`	`repository`
`severity`	`tag`

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_severity(filter="string",
                                                        limit=integer,
                                                        offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountBySeverity(filter="string",
                                                   limit=integer,
                                                   offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountBySeverity",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountBySeverity(
    &container_vulnerabilities.ReadVulnerabilityCountBySeverityParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountBySeverity(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_severity(filter: 'string',
                                                    limit: integer,
                                                    offset: integer)

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

Container Vulnerabilities

Table of Contents

ReadCombinedVulnerabilities

Parameters

ReadCombinedVulnerabilitiesDetails

Parameters

ReadCombinedVulnerabilitiesInfo

Parameters

ReadVulnerabilitiesByImageCount

Parameters

ReadVulnerabilitiesPublicationDate

Parameters

ReadVulnerabilityCount

Parameters

ReadVulnerabilityCountByActivelyExploited

Parameters

ReadVulnerabilityCountByCPSRating

Parameters

ReadVulnerabilityCountByCVSSScore

Parameters

ReadVulnerabilityCountBySeverity

Parameters