Kubernetes Container Compliance

The Kubernetes Container Compliance service collection provides operations for assessing and reporting on Kubernetes compliance posture. Aggregate assessments by cluster, asset type, cluster type, compliance framework, failed rules, and images. Retrieve detailed compliance findings for container images and Kubernetes nodes, and access compliance rule metadata.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
AggregateAssessmentsGroupedByClustersV2 `aggregate_assessments_by_cluster`	Returns cluster details along with aggregated assessment results organized by cluster, including pass/fail assessment counts for various asset types.
AggregateAssessmentsGroupedByRulesV2 `aggregate_assessments_by_rules`	Returns rule details along with aggregated assessment results organized by compliance rule, including pass/fail assessment counts.
AggregateComplianceByAssetType `aggregate_compliance_by_asset_type`	Provides aggregated compliance assessment metrics and rule status information, organized by asset type.
AggregateComplianceByClusterType `aggregate_compliance_by_cluster_type`	Provides aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type.
AggregateComplianceByFramework `aggregate_compliance_by_framework`	Provides aggregated compliance assessment metrics and rule status information, organized by compliance framework.
AggregateFailedRulesByClustersV3 `aggregate_failed_rules_by_clusters`	Retrieves the most non-compliant clusters, ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low).
AggregateTopFailedImages `aggregate_top_failed_images`	Retrieves the most non-compliant container images, ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low).
CombinedImagesFindings `image_findings`	Returns detailed compliance assessment results for container images, providing the information needed to identify compliance violations.
CombinedNodesFindings `node_findings`	Returns detailed compliance assessment results for kubernetes nodes, providing the information needed to identify compliance violations.
getRulesMetadataByID `get_rules_metadata`	Retrieve detailed compliance rule information including descriptions, remediation steps, and audit procedures by specifying rule identifiers.

AggregateAssessmentsGroupedByClustersV2

Returns cluster details along with aggregated assessment results organized by cluster, including pass/fail assessment counts for various asset types.

Method GET

Route /container-compliance/aggregates/clusters/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_assessments_by_cluster

Parameters

offset query · integer

The zero-based position of the first record to return.

limit query · integer

The maximum number of records to return. (1-500) Default is 20.

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (11)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.framework_name`	`compliance_finding.framework_name_version`
`compliance_finding.framework_version`	`compliance_finding.severity`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_assessments_by_cluster(filter="string",
                                                   limit=integer,
                                                   offset=integer)
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateAssessmentsGroupedByClustersV2(filter="string",
                                                          limit=integer,
                                                          offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateAssessmentsGroupedByClustersV2",
                          offset=integer,
                          limit=integer,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateAssessmentsGroupedByClustersV2(
    &kubernetes_container_compliance.AggregateAssessmentsGroupedByClustersV2Params{
      Offset: &offset,
      Limit: &limit,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateAssessmentsGroupedByClustersV2(
  integer,  // offset
  integer,  // limit
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_assessments_grouped_by_clusters_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_assessments_grouped_by_clusters_v2(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_assessments_grouped_by_clusters_v2(offset: integer,
                                                            limit: integer,
                                                            filter: 'string')

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

AggregateAssessmentsGroupedByRulesV2

Returns rule details along with aggregated assessment results organized by compliance rule, including pass/fail assessment counts.

Method GET

Route /container-compliance/aggregates/rules/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_assessments_by_rules

Parameters

offset query · integer

The zero-based position of the first record to return.

limit query · integer

The maximum number of records to return. (1-500) Default is 20.

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (14)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.asset_type`	`compliance_finding.framework_name`
`compliance_finding.framework_name_version`	`compliance_finding.framework_version`	`compliance_finding.id`
`compliance_finding.severity`	`compliance_finding.status`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_assessments_by_rules(filter="string",
                                                 limit=integer,
                                                 offset=integer)
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateAssessmentsGroupedByRulesV2(filter="string",
                                                       limit=integer,
                                                       offset=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateAssessmentsGroupedByRulesV2",
                          offset=integer,
                          limit=integer,
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateAssessmentsGroupedByRulesV2(
    &kubernetes_container_compliance.AggregateAssessmentsGroupedByRulesV2Params{
      Offset: &offset,
      Limit: &limit,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateAssessmentsGroupedByRulesV2(
  integer,  // offset
  integer,  // limit
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_assessments_grouped_by_rules_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_assessments_grouped_by_rules_v2(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_assessments_grouped_by_rules_v2(offset: integer,
                                                         limit: integer,
                                                         filter: 'string')

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

AggregateComplianceByAssetType

Provides aggregated compliance assessment metrics and rule status information, organized by asset type.

Method GET

Route /container-compliance/aggregates/compliance-by-asset-type/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_compliance_by_asset_type

Parameters

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (12)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.asset_type`	`compliance_finding.framework_name`
`compliance_finding.framework_name_version`	`compliance_finding.framework_version`	`compliance_finding.severity`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_compliance_by_asset_type(filter="string")
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateComplianceByAssetType(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateComplianceByAssetType",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateComplianceByAssetType(
    &kubernetes_container_compliance.AggregateComplianceByAssetTypeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateComplianceByAssetType("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_compliance_by_asset_type;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_compliance_by_asset_type(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_compliance_by_asset_type(filter: 'string')

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

AggregateComplianceByClusterType

Provides aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type.

Method GET

Route /container-compliance/aggregates/compliance-by-cluster-type/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_compliance_by_cluster_type

Parameters

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (12)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.asset_type`	`compliance_finding.framework_name`
`compliance_finding.framework_name_version`	`compliance_finding.framework_version`	`compliance_finding.severity`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_compliance_by_cluster_type(filter="string")
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateComplianceByClusterType(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateComplianceByClusterType",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateComplianceByClusterType(
    &kubernetes_container_compliance.AggregateComplianceByClusterTypeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateComplianceByClusterType("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_compliance_by_cluster_type;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_compliance_by_cluster_type(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_compliance_by_cluster_type(filter: 'string')

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

AggregateComplianceByFramework

Provides aggregated compliance assessment metrics and rule status information, organized by compliance framework.

Method GET

Route /container-compliance/aggregates/compliance-by-framework/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_compliance_by_framework

Parameters

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (12)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.asset_type`	`compliance_finding.framework_name`
`compliance_finding.framework_name_version`	`compliance_finding.framework_version`	`compliance_finding.severity`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_compliance_by_framework(filter="string")
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateComplianceByFramework(filter="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateComplianceByFramework",
                          filter="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateComplianceByFramework(
    &kubernetes_container_compliance.AggregateComplianceByFrameworkParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateComplianceByFramework("string");  // filter

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_compliance_by_framework;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_compliance_by_framework(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_compliance_by_framework(filter: 'string')

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

AggregateFailedRulesByClustersV3

Retrieves the most non-compliant clusters, ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low).

Method GET

Route /container-compliance/aggregates/failed-rules-by-clusters/v3

Scope Falcon Container Image: READ

PEP 8 aggregate_failed_rules_by_clusters

Parameters

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (12)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.asset_type`	`compliance_finding.framework_name`
`compliance_finding.framework_name_version`	`compliance_finding.framework_version`	`compliance_finding.severity`

limit query · integer

The maximum number of records to return. (1-100) Default is 10.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_failed_rules_by_clusters(filter="string",
                                                     limit=integer)
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateFailedRulesByClustersV3(filter="string",
                                                   limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateFailedRulesByClustersV3",
                          filter="string",
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.AggregateFailedRulesByClustersV3(
    &kubernetes_container_compliance.AggregateFailedRulesByClustersV3Params{
      Filter: &filter,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateFailedRulesByClustersV3(
  "string",  // filter
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_failed_rules_by_clusters_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_failed_rules_by_clusters_v3(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_failed_rules_by_clusters_v3(filter: 'string',
                                                     limit: integer)

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

AggregateTopFailedImages

Retrieves the most non-compliant container images, ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low).

Method GET

Route /container-compliance/aggregates/top-failed-images/v2

Scope Falcon Container Image: READ

PEP 8 aggregate_top_failed_images

Parameters

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (12)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.asset_type`	`compliance_finding.framework_name`
`compliance_finding.framework_name_version`	`compliance_finding.framework_version`	`compliance_finding.severity`

limit query · integer

The maximum number of records to return. (1-100) Default is 10.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_top_failed_images(filter="string", limit=integer)
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateTopFailedImages(filter="string", limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateTopFailedImages",
                          filter="string",
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.AggregateTopFailedImages(
    &kubernetes_container_compliance.AggregateTopFailedImagesParams{
      Filter: &filter,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateTopFailedImages(
  "string",  // filter
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_top_failed_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_top_failed_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_top_failed_images(filter: 'string', limit: integer)

puts response

Responses

[
  {
    "buckets": [],
    "name": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "buckets": [],
      "name": "string"
    }
  ]
}

CombinedImagesFindings

Returns detailed compliance assessment results for container images, providing the information needed to identify compliance violations.

Method GET

Route /container-compliance/combined/findings-by-images/v2

Scope Falcon Container Image: READ

PEP 8 image_findings

Parameters

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (20)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`cloud_info.namespace`	`compliance_finding.asset_uid`
`compliance_finding.framework_name`	`compliance_finding.framework_name_version`	`compliance_finding.framework_version`
`compliance_finding.id`	`compliance_finding.severity`	`compliance_finding.status`
`image_digest`	`image_id`	`image_registry`
`image_repository`	`image_tag`

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.

limit query · integer

The maximum number of images for which assessments are to be returned: 1-100. Default is 100. Use with the after parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.image_findings(after="string", filter="string", limit=integer)
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.CombinedImagesFindings(after="string",
                                         filter="string",
                                         limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImagesFindings",
                          filter="string",
                          after="string",
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  after := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.CombinedImagesFindings(
    &kubernetes_container_compliance.CombinedImagesFindingsParams{
      Filter: &filter,
      After: &after,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.combinedImagesFindings(
  "string",  // filter
  "string",  // after
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::combined_images_findings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_images_findings(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // after
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.combined_images_findings(filter: 'string',
                                        after: 'string',
                                        limit: integer)

puts response

Responses

[
  {
    "assessments": [],
    "cid": "string",
    "image_digest": "string",
    "image_id": "string",
    "image_registry": "string",
    "image_repository": "string",
    "image_tag": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assessments": [],
      "cid": "string",
      "image_digest": "string",
      "image_id": "string",
      "image_registry": "string",
      "image_repository": "string",
      "image_tag": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assessments": [],
      "cid": "string",
      "image_digest": "string",
      "image_id": "string",
      "image_registry": "string",
      "image_repository": "string",
      "image_tag": "string"
    }
  ]
}

CombinedNodesFindings

Returns detailed compliance assessment results for kubernetes nodes, providing the information needed to identify compliance violations.

Method GET

Route /container-compliance/combined/findings-by-nodes/v2

Scope Falcon Container Image: READ

PEP 8 node_findings

Parameters

filter query · string

FQL filter expression used to limit the results. Filter fields include:

Available values (19)

`cid`	`cloud_info.cloud_account_id`	`cloud_info.cloud_provider`
`cloud_info.cloud_region`	`cloud_info.cluster_id`	`cloud_info.cluster_name`
`cloud_info.cluster_type`	`compliance_finding.asset_type`	`compliance_finding.asset_uid`
`compliance_finding.framework_name`	`compliance_finding.framework_name_version`	`compliance_finding.framework_version`
`compliance_finding.id`	`compliance_finding.severity`	`compliance_finding.status`
`aid`	`node_id`	`node_name`
`node_type`

after query · string

limit query · integer

The maximum number of nodes for which assessments are to be returned: 1-100. Default is 100. Use with the after parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.node_findings(after="string", filter="string", limit=integer)
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.CombinedNodesFindings(after="string",
                                        filter="string",
                                        limit=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedNodesFindings",
                          filter="string",
                          after="string",
                          limit=integer)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  after := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.CombinedNodesFindings(
    &kubernetes_container_compliance.CombinedNodesFindingsParams{
      Filter: &filter,
      After: &after,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.combinedNodesFindings(
  "string",  // filter
  "string",  // after
  integer  // limit
);

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::combined_nodes_findings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_nodes_findings(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // after
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.combined_nodes_findings(filter: 'string',
                                       after: 'string',
                                       limit: integer)

puts response

Responses

[
  {
    "aid": "string",
    "assessments": [],
    "cid": "string",
    "cloud_account_id": "string",
    "cloud_provider": "string",
    "cloud_region": "string",
    "cluster_name": "string",
    "cluster_type": "string",
    "node_id": "string",
    "node_ipv4": "string",
    "node_ipv6": "string",
    "node_name": "string",
    "node_type": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "aid": "string",
      "assessments": [],
      "cid": "string",
      "cloud_account_id": "string",
      "cloud_provider": "string",
      "cloud_region": "string",
      "cluster_name": "string",
      "cluster_type": "string",
      "node_id": "string",
      "node_ipv4": "string",
      "node_ipv6": "string",
      "node_name": "string",
      "node_type": 0
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "aid": "string",
      "assessments": [],
      "cid": "string",
      "cloud_account_id": "string",
      "cloud_provider": "string",
      "cloud_region": "string",
      "cluster_name": "string",
      "cluster_type": "string",
      "node_id": "string",
      "node_ipv4": "string",
      "node_ipv6": "string",
      "node_name": "string",
      "node_type": 0
    }
  ]
}

getRulesMetadataByID

Retrieve detailed compliance rule information including descriptions, remediation steps, and audit procedures by specifying rule identifiers.

Method GET

Route /container-compliance/combined/rule-details-by-rule-ids/v1

Scope Falcon Container Image: READ

PEP 8 get_rules_metadata

Parameters

ids query · string or list of strings

comma separated list of rule ids

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules_metadata(ids=id_list)
print(response)

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRulesMetadataByID(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRulesMetadataByID",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesContainerCompliance.GetRulesMetadataByID(
    &kubernetes_container_compliance.GetRulesMetadataByIDParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.getRulesMetadataByID(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::kubernetes_container_compliance_api::get_rules_metadata_by_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rules_metadata_by_id(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.get_rules_metadata_by_id(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "assessment_status": "string",
    "asset_type": "string",
    "audit_procedure": "string",
    "default_value": "string",
    "description": "string",
    "framework_name": "string",
    "framework_name_version": "string",
    "framework_version": "string",
    "impact": "string",
    "name": "string",
    "recommendation_no": "string",
    "references": "string",
    "remediation": "string",
    "rule_id": "string",
    "severity": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assessment_status": "string",
      "asset_type": "string",
      "audit_procedure": "string",
      "default_value": "string",
      "description": "string",
      "framework_name": "string",
      "framework_name_version": "string",
      "framework_version": "string",
      "impact": "string",
      "name": "string",
      "recommendation_no": "string",
      "references": "string",
      "remediation": "string",
      "rule_id": "string",
      "severity": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": [
    {
      "assessment_status": "string",
      "asset_type": "string",
      "audit_procedure": "string",
      "default_value": "string",
      "description": "string",
      "framework_name": "string",
      "framework_name_version": "string",
      "framework_version": "string",
      "impact": "string",
      "name": "string",
      "recommendation_no": "string",
      "references": "string",
      "remediation": "string",
      "rule_id": "string",
      "severity": "string"
    }
  ]
}

Kubernetes Container Compliance

Table of Contents

AggregateAssessmentsGroupedByClustersV2

Parameters

AggregateAssessmentsGroupedByRulesV2

Parameters

AggregateComplianceByAssetType

Parameters

AggregateComplianceByClusterType

Parameters

AggregateComplianceByFramework

Parameters

AggregateFailedRulesByClustersV3

Parameters

AggregateTopFailedImages

Parameters

CombinedImagesFindings

Parameters

CombinedNodesFindings

Parameters

getRulesMetadataByID

Parameters