Container Vulnerabilities

The Container Vulnerabilities service collection provides operations for aggregating and retrieving container vulnerability data. Query vulnerability counts grouped by various criteria, retrieve detailed vulnerability information for images, and get combined vulnerability data filtered by FQL expressions.

Language	Last Update
Python	v1.5.2
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
ReadVulnerabilityCountByActivelyExploited `read_vulnerability_counts_by_active_exploited`	Aggregate count of vulnerabilities grouped by actively exploited
ReadVulnerabilityCountByCPSRating `read_vulnerability_counts_by_cps_rating`	Aggregate count of vulnerabilities grouped by csp_rating
ReadVulnerabilityCountByCVSSScore `read_vulnerability_counts_by_cvss_score`	Aggregate count of vulnerabilities grouped by cvss score
ReadVulnerabilityCountBySeverity `read_vulnerability_counts_by_severity`	Aggregate count of vulnerabilities grouped by severity
ReadVulnerabilityCount `read_vulnerability_count`	Aggregate count of vulnerabilities
ReadVulnerabilitiesByImageCount `read_vulnerabilities_by_count`	Retrieve top x vulnerabilities with the most impacted images
ReadVulnerabilitiesPublicationDate `read_vulnerabilities_by_pub_date`	Retrieve top x vulnerabilities with the most recent publication date
ReadCombinedVulnerabilitiesDetails `read_combined_vulnerability_detail`	Retrieve vulnerability details related to an image
ReadCombinedVulnerabilitiesInfo `read_combined_vulnerabilities_info`	Retrieve vulnerability and package related info for this customer
ReadCombinedVulnerabilities `read_combined_vulnerabilities`	Retrieve vulnerability and aggregate data filtered by the provided FQL

ReadVulnerabilityCountByActivelyExploited

Aggregate count of vulnerabilities grouped by actively exploited

GET /container-security/aggregates/vulnerabilities/count-by-actively-exploited/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vulnerability_counts_by_active_exploited

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: ai_related,base_os,cid,container_id,container_running_status,containers_impacted_range,cps_rating,cve_id,cvss_score,description,exploited_status,exploited_status_name,fix_status,image_digest,image_id,images_impacted_range,include_base_image_vuln,index_digest,package_name_version,registry,repository,severity,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_active_exploited(filter="string",
                                                                limit=integer,
                                                                offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountByActivelyExploited(filter="string",
                                                            limit=integer,
                                                            offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountByActivelyExploited",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountByActivelyExploited(
    &container_vulnerabilities.ReadVulnerabilityCountByActivelyExploitedParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountByActivelyExploited(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_actively_exploited;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_actively_exploited(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_actively_exploited(filter: 'string',
                                                              limit: integer,
                                                              offset: integer)

puts response

ReadVulnerabilityCountByCPSRating

Aggregate count of vulnerabilities grouped by csp_rating

GET /container-security/aggregates/vulnerabilities/count-by-cps-rating/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vulnerability_counts_by_cps_rating

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: ai_related,base_os,cid,container_id,container_running_status,containers_impacted_range,cps_rating,cve_id,cvss_score,description,exploited_status,exploited_status_name,fix_status,image_digest,image_id,images_impacted_range,include_base_image_vuln,index_digest,package_name_version,registry,repository,severity,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_cps_rating(filter="string",
                                                          limit=integer,
                                                          offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountByCPSRating(filter="string",
                                                    limit=integer,
                                                    offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountByCPSRating",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountByCPSRating(
    &container_vulnerabilities.ReadVulnerabilityCountByCPSRatingParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountByCPSRating(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_cps_rating;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_cps_rating(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_cps_rating(filter: 'string',
                                                      limit: integer,
                                                      offset: integer)

puts response

ReadVulnerabilityCountByCVSSScore

Aggregate count of vulnerabilities grouped by cvss score

GET /container-security/aggregates/vulnerabilities/count-by-cvss-score/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vulnerability_counts_by_cvss_score

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: ai_related,base_os,cid,container_id,container_running_status,containers_impacted_range,cps_rating,cve_id,cvss_score,description,exploited_status,exploited_status_name,fix_status,image_digest,image_id,images_impacted_range,include_base_image_vuln,index_digest,package_name_version,registry,repository,severity,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_cvss_score(filter="string",
                                                          limit=integer,
                                                          offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountByCVSSScore(filter="string",
                                                    limit=integer,
                                                    offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountByCVSSScore",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountByCVSSScore(
    &container_vulnerabilities.ReadVulnerabilityCountByCVSSScoreParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountByCVSSScore(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_cvss_score;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_cvss_score(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_cvss_score(filter: 'string',
                                                      limit: integer,
                                                      offset: integer)

puts response

ReadVulnerabilityCountBySeverity

Aggregate count of vulnerabilities grouped by severity

GET /container-security/aggregates/vulnerabilities/count-by-severity/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vulnerability_counts_by_severity

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: ai_related,base_os,cid,container_id,container_running_status,containers_impacted_range,cps_rating,cve_id,cvss_score,description,exploited_status,exploited_status_name,fix_status,image_digest,image_id,images_impacted_range,include_base_image_vuln,index_digest,package_name_version,registry,repository,severity,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_counts_by_severity(filter="string",
                                                        limit="string",
                                                        offset="string")
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCountBySeverity(filter="string",
                                                   limit="string",
                                                   offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCountBySeverity",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCountBySeverity(
    &container_vulnerabilities.ReadVulnerabilityCountBySeverityParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCountBySeverity(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count_by_severity;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count_by_severity(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count_by_severity(filter: 'string',
                                                    limit: integer,
                                                    offset: integer)

puts response

ReadVulnerabilityCount

Aggregate count of vulnerabilities

GET /container-security/aggregates/vulnerabilities/count/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vulnerability_count

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: ai_related,base_os,cid,container_id,container_running_status,containers_impacted_range,cps_rating,cve_id,cvss_score,description,exploited_status,exploited_status_name,fix_status,image_digest,image_id,images_impacted_range,include_base_image_vuln,index_digest,package_name_version,registry,repository,severity,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerability_count(filter="string",
                                           limit=integer,
                                           offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilityCount(filter="string",
                                         limit=integer,
                                         offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilityCount",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilityCount(
    &container_vulnerabilities.ReadVulnerabilityCountParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilityCount(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerability_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerability_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerability_count(filter: 'string',
                                        limit: integer,
                                        offset: integer)

puts response

ReadVulnerabilitiesByImageCount

Retrieve top x vulnerabilities with the most impacted images

GET /container-security/combined/vulnerabilities/by-image-count/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vulnerabilities_by_count

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: cid,cve_id,registry,repository,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerabilities_by_count(filter="string",
                                                limit=integer,
                                                offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilitiesByImageCount(filter="string",
                                                  limit=integer,
                                                  offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilitiesByImageCount",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilitiesByImageCount(
    &container_vulnerabilities.ReadVulnerabilitiesByImageCountParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilitiesByImageCount(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerabilities_by_image_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerabilities_by_image_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerabilities_by_image_count(filter: 'string',
                                                   limit: integer,
                                                   offset: integer)

puts response

ReadVulnerabilitiesPublicationDate

Retrieve top x vulnerabilities with the most recent publication date

GET /container-security/combined/vulnerabilities/by-published-date/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_vulnerabilities_by_pub_date

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: cid,cve_id,registry,repository,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_vulnerabilities_by_pub_date(filter="string",
                                                   limit=integer,
                                                   offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadVulnerabilitiesPublicationDate(filter="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadVulnerabilitiesPublicationDate",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadVulnerabilitiesPublicationDate(
    &container_vulnerabilities.ReadVulnerabilitiesPublicationDateParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readVulnerabilitiesPublicationDate(
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_vulnerabilities_publication_date;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_vulnerabilities_publication_date(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_vulnerabilities_publication_date(filter: 'string',
                                                     limit: integer,
                                                     offset: integer)

puts response

ReadCombinedVulnerabilitiesDetails

Retrieve vulnerability details related to an image

GET /container-security/combined/vulnerabilities/details/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_combined_vulnerability_detail

Parameters

Name	Type	Data type	Description
id	query	string	Image UUID
filter	query	string	Filter the vulnerabilities using a query in Falcon Query Language (FQL). Supported vulnerability filters: cid,cps_rating,cve_id,cvss_score,exploited_status,exploited_status_name,include_base_image_vuln,is_zero_day,remediation_available,severity
limit	query	integer	The upper-bound on the number of records to retrieve. Default: `5000`
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_combined_vulnerability_detail(id="string",
                                                     filter="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadCombinedVulnerabilitiesDetails(id="string",
                                                     filter="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedVulnerabilitiesDetails",
                          id="string",
                          filter="string",
                          limit=integer,
                          offset=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadCombinedVulnerabilitiesDetails(
    &container_vulnerabilities.ReadCombinedVulnerabilitiesDetailsParams{
      ID: "string",
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readCombinedVulnerabilitiesDetails(
  "string",  // id
  "string",  // filter
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_combined_vulnerabilities_details;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_vulnerabilities_details(
        &falcon.cfg,  // configuration
        "string",  // id
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_combined_vulnerabilities_details('string')

puts response

ReadCombinedVulnerabilitiesInfo

Retrieve vulnerability and package related info for this customer

GET /container-security/combined/vulnerabilities/info/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_combined_vulnerabilities_info

Parameters

Name	Type	Data type	Description
cve_id	query	string	Vulnerability CVE ID
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_combined_vulnerabilities_info(cve_id="string",
                                                     limit=integer,
                                                     offset=integer)
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadCombinedVulnerabilitiesInfo(cve_id="string",
                                                  limit=integer,
                                                  offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedVulnerabilitiesInfo",
                          cve_id="string",
                          limit=integer,
                          offset=integer)
print(response)

Get-FalconContainerVulnerability -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := int64(0)
  offset := int64(0)

  response, err := client.ContainerVulnerabilities.ReadCombinedVulnerabilitiesInfo(
    &container_vulnerabilities.ReadCombinedVulnerabilitiesInfoParams{
      CveID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readCombinedVulnerabilitiesInfo(
  "string",  // cveId
  integer,  // limit
  integer  // offset
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_combined_vulnerabilities_info;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_vulnerabilities_info(
        &falcon.cfg,  // configuration
        "string",  // cve_id
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_combined_vulnerabilities_info('string')

puts response

ReadCombinedVulnerabilities

Retrieve vulnerability and aggregate data filtered by the provided FQL

GET /container-security/combined/vulnerabilities/v1

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 read_combined_vulnerabilities

Parameters

Name	Type	Data type	Description
filter	query	string	Filter vulnerabilities using a query in Falcon Query Language (FQL). Supported filters: ai_related,base_os,cid,container_id,container_running_status,containers_impacted_range,cps_rating,cve_id,cvss_score,description,exploited_status,exploited_status_name,fix_status,image_digest,image_id,images_impacted_range,include_base_image_vuln,index_digest,package_name_version,registry,repository,severity,tag
limit	query	integer	The upper-bound on the number of records to retrieve.
offset	query	integer	The offset from where to begin.
parameters	query	dictionary	Full query string parameters payload in JSON format. Not required if using other keywords.
sort	query	string	The fields to sort the records on. Supported columns: [cps_current_rating cve_id cvss_score description images_impacted packages_impacted severity]

Code Examples

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.read_combined_vulnerabilities(filter="string",
                                                limit=integer,
                                                offset=integer,
                                                sort="string")
print(response)

from falconpy import ContainerVulnerabilities

falcon = ContainerVulnerabilities(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.ReadCombinedVulnerabilities(filter="string",
                                              limit=integer,
                                              offset=integer,
                                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadCombinedVulnerabilities",
                          filter="string",
                          limit=integer,
                          offset=integer,
                          sort="string")
print(response)

Get-FalconContainerVulnerability -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/container_vulnerabilities"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)
  offset := int64(0)
  sort := "string"

  response, err := client.ContainerVulnerabilities.ReadCombinedVulnerabilities(
    &container_vulnerabilities.ReadCombinedVulnerabilitiesParams{
      Filter: &filter,
      Limit: &limit,
      Offset: &offset,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.containerVulnerabilities.readCombinedVulnerabilities(
  "string",  // filter
  integer,  // limit
  integer,  // offset
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::container_vulnerabilities_api::read_combined_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_combined_vulnerabilities(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
        Some(integer),  // offset
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::ContainerVulnerabilities.new

response = api.read_combined_vulnerabilities(filter: 'string',
                                             limit: integer,
                                             offset: integer,
                                             sort: 'string')

puts response

Container Vulnerabilities

Table of Contents

ReadVulnerabilityCountByActivelyExploited

Parameters

Code Examples

ReadVulnerabilityCountByCPSRating

Parameters

Code Examples

ReadVulnerabilityCountByCVSSScore

Parameters

Code Examples

ReadVulnerabilityCountBySeverity

Parameters

Code Examples

ReadVulnerabilityCount

Parameters

Code Examples

ReadVulnerabilitiesByImageCount

Parameters

Code Examples

ReadVulnerabilitiesPublicationDate

Parameters

Code Examples

ReadCombinedVulnerabilitiesDetails

Parameters

Code Examples

ReadCombinedVulnerabilitiesInfo

Parameters

Code Examples

ReadCombinedVulnerabilities

Parameters

Code Examples