Kubernetes Container Compliance

The Kubernetes Container Compliance service collection provides operations for assessing and reporting on Kubernetes compliance posture. Aggregate assessments by cluster, asset type, cluster type, compliance framework, failed rules, and images. Retrieve detailed compliance findings for container images and Kubernetes nodes, and access compliance rule metadata.

Language	Last Update
Python	v1.5.3
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Table of Contents

Operation	Description
AggregateAssessmentsGroupedByClustersV2 aggregate_assessments_by_cluster	Returns cluster details along with aggregated assessment results organized by cluster, including pass/fail assessment counts for various asset types.
AggregateComplianceByAssetType aggregate_compliance_by_asset_type	Provides aggregated compliance assessment metrics and rule status information, organized by asset type.
AggregateComplianceByClusterType aggregate_compliance_by_cluster_type	Provides aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type.
AggregateComplianceByFramework aggregate_compliance_by_framework	Provides aggregated compliance assessment metrics and rule status information, organized by compliance framework.
AggregateFailedRulesByClustersV3 aggregate_failed_rules_by_clusters	Retrieves the most non-compliant clusters, ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low).
AggregateAssessmentsGroupedByRulesV2 aggregate_assessments_by_rules	Returns rule details along with aggregated assessment results organized by compliance rule, including pass/fail assessment counts.
AggregateTopFailedImages aggregate_top_failed_images	Retrieves the most non-compliant container images, ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low).
CombinedImagesFindings image_findings	Returns detailed compliance assessment results for container images, providing the information needed to identify compliance violations.
CombinedNodesFindings node_findings	Returns detailed compliance assessment results for kubernetes nodes, providing the information needed to identify compliance violations.
getRulesMetadataByID get_rules_metadata	Retrieve detailed compliance rule information by ID. Includes descriptions, remediation steps, and audit procedures by specifying rule identifiers.

---

AggregateAssessmentsGroupedByClustersV2

Returns cluster details along with aggregated assessment results organized by cluster, including pass/fail assessment counts for various asset types.

GET /container-compliance/aggregates/clusters/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_assessments_by_cluster

Parameters

Name	Type	Data type	Description
offset	query	integer	The zero-based position of the first record to return.
limit	query	integer	The maximum number of records to return. (1-500) Default is 20.
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.severity
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_assessments_by_cluster(filter="string",
                                                   limit=integer,
                                                   offset=integer)
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateAssessmentsGroupedByClustersV2(filter="string",
                                                          limit=integer,
                                                          offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateAssessmentsGroupedByClustersV2",
                          offset=integer,
                          limit=integer,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateAssessmentsGroupedByClustersV2(
    &kubernetes_container_compliance.AggregateAssessmentsGroupedByClustersV2Params{
      Offset: &offset,
      Limit: &limit,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateAssessmentsGroupedByClustersV2(
  integer,  // offset
  integer,  // limit
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_assessments_grouped_by_clusters_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_assessments_grouped_by_clusters_v2(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_assessments_grouped_by_clusters_v2(offset: integer,
                                                            limit: integer,
                                                            filter: 'string')

puts response

---

AggregateComplianceByAssetType

Provides aggregated compliance assessment metrics and rule status information, organized by asset type.

GET /container-compliance/aggregates/compliance-by-asset-type/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_compliance_by_asset_type

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.asset_type, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.severity
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_compliance_by_asset_type(filter="string")
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateComplianceByAssetType(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateComplianceByAssetType",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateComplianceByAssetType(
    &kubernetes_container_compliance.AggregateComplianceByAssetTypeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateComplianceByAssetType("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_compliance_by_asset_type;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_compliance_by_asset_type(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_compliance_by_asset_type(filter: 'string')

puts response

---

AggregateComplianceByClusterType

Provides aggregated compliance assessment metrics and rule status information, organized by Kubernetes cluster type.

GET /container-compliance/aggregates/compliance-by-cluster-type/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_compliance_by_cluster_type

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.asset_type, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.severity
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_compliance_by_cluster_type(filter="string")
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateComplianceByClusterType(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateComplianceByClusterType",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateComplianceByClusterType(
    &kubernetes_container_compliance.AggregateComplianceByClusterTypeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateComplianceByClusterType("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_compliance_by_cluster_type;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_compliance_by_cluster_type(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_compliance_by_cluster_type(filter: 'string')

puts response

---

AggregateComplianceByFramework

Provides aggregated compliance assessment metrics and rule status information, organized by compliance framework.

GET /container-compliance/aggregates/compliance-by-framework/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_compliance_by_framework

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.asset_type, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.severity
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_compliance_by_framework(filter="string")
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateComplianceByFramework(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateComplianceByFramework",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateComplianceByFramework(
    &kubernetes_container_compliance.AggregateComplianceByFrameworkParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateComplianceByFramework("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_compliance_by_framework;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_compliance_by_framework(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_compliance_by_framework(filter: 'string')

puts response

---

AggregateFailedRulesByClustersV3

Retrieves the most non-compliant clusters, ranked in descending order based on the number of failed compliance rules across severity levels (critical, high, medium, and low).

GET /container-compliance/aggregates/failed-rules-by-clusters/v3

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_failed_rules_by_clusters

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.asset_type, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.severity
limit	query	integer	The maximum number of records to return. (1-100) Default is 10.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_failed_rules_by_clusters(filter="string",
                                                     limit=integer)
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateFailedRulesByClustersV3(filter="string",
                                                   limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateFailedRulesByClustersV3",
                          filter="string",
                          limit=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.AggregateFailedRulesByClustersV3(
    &kubernetes_container_compliance.AggregateFailedRulesByClustersV3Params{
      Filter: &filter,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateFailedRulesByClustersV3(
  "string",  // filter
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_failed_rules_by_clusters_v3;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_failed_rules_by_clusters_v3(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_failed_rules_by_clusters_v3(filter: 'string',
                                                     limit: integer)

puts response

---

AggregateAssessmentsGroupedByRulesV2

Returns rule details along with aggregated assessment results organized by compliance rule, including pass/fail assessment counts.

GET /container-compliance/aggregates/rules/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_assessments_by_rules

Parameters

Name	Type	Data type	Description
offset	query	integer	The zero-based position of the first record to return.
limit	query	integer	The maximum number of records to return. (1-500) Default is 20.
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.asset_type, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.id, compliance_finding.severity, compliance_finding.status
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_assessments_by_rules(filter="string",
                                                 limit=integer,
                                                 offset=integer)
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateAssessmentsGroupedByRulesV2(filter="string",
                                                       limit=integer,
                                                       offset=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateAssessmentsGroupedByRulesV2",
                          offset=integer,
                          limit=integer,
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  filter := "string"

  response, err := client.KubernetesContainerCompliance.AggregateAssessmentsGroupedByRulesV2(
    &kubernetes_container_compliance.AggregateAssessmentsGroupedByRulesV2Params{
      Offset: &offset,
      Limit: &limit,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateAssessmentsGroupedByRulesV2(
  integer,  // offset
  integer,  // limit
  "string"  // filter
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_assessments_grouped_by_rules_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_assessments_grouped_by_rules_v2(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_assessments_grouped_by_rules_v2(offset: integer,
                                                         limit: integer,
                                                         filter: 'string')

puts response

---

AggregateTopFailedImages

Retrieves the most non-compliant container images, ranked in descending order based on the number of failed assessments across severity levels (critical, high, medium, and low).

GET /container-compliance/aggregates/top-failed-images/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 aggregate_top_failed_images

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.asset_type, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.severity
limit	query	integer	The maximum number of records to return. (1-100) Default is 10.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.aggregate_top_failed_images(filter="string", limit=integer)
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.AggregateTopFailedImages(filter="string", limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("AggregateTopFailedImages",
                          filter="string",
                          limit=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.AggregateTopFailedImages(
    &kubernetes_container_compliance.AggregateTopFailedImagesParams{
      Filter: &filter,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.aggregateTopFailedImages(
  "string",  // filter
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::aggregate_top_failed_images;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = aggregate_top_failed_images(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.aggregate_top_failed_images(filter: 'string', limit: integer)

puts response

---

CombinedImagesFindings

Returns detailed compliance assessment results for container images, providing the information needed to identify compliance violations.

GET /container-compliance/combined/findings-by-images/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 image_findings

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, cloud_info.namespace, compliance_finding.asset_uid, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.id, compliance_finding.severity, compliance_finding.status, image_digest, image_id, image_registry, image_repository, image_tag
after	query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit	query	integer	The maximum number of images for which assessments are to be returned: 1-100. Default is 100. Use with the after parameter to manage pagination of results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.image_findings(after="string", filter="string", limit=integer)
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.CombinedImagesFindings(after="string",
                                         filter="string",
                                         limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedImagesFindings",
                          filter="string",
                          after="string",
                          limit=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  after := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.CombinedImagesFindings(
    &kubernetes_container_compliance.CombinedImagesFindingsParams{
      Filter: &filter,
      After: &after,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.combinedImagesFindings(
  "string",  // filter
  "string",  // after
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::combined_images_findings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_images_findings(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // after
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.combined_images_findings(filter: 'string',
                                        after: 'string',
                                        limit: integer)

puts response

---

CombinedNodesFindings

Returns detailed compliance assessment results for kubernetes nodes, providing the information needed to identify compliance violations.

GET /container-compliance/combined/findings-by-nodes/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 node_findings

Parameters

Name	Type	Data type	Description
filter	query	string	FQL filter expression used to limit the results. Filter fields include: cid, cloud_info.cloud_account_id, cloud_info.cloud_provider, cloud_info.cloud_region, cloud_info.cluster_id, cloud_info.cluster_name, cloud_info.cluster_type, compliance_finding.asset_type, compliance_finding.asset_uid, compliance_finding.framework_name, compliance_finding.framework_name_version, compliance_finding.framework_version, compliance_finding.id, compliance_finding.severity, compliance_finding.status, aid, node_id, node_name, node_type
after	query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
limit	query	integer	The maximum number of nodes for which assessments are to be returned: 1-100. Default is 100. Use with the after parameter to manage pagination of results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.node_findings(after="string", filter="string", limit=integer)
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

response = falcon.CombinedNodesFindings(after="string",
                                        filter="string",
                                        limit=integer)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedNodesFindings",
                          filter="string",
                          after="string",
                          limit=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  after := "string"
  limit := int64(0)

  response, err := client.KubernetesContainerCompliance.CombinedNodesFindings(
    &kubernetes_container_compliance.CombinedNodesFindingsParams{
      Filter: &filter,
      After: &after,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.combinedNodesFindings(
  "string",  // filter
  "string",  // after
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::combined_nodes_findings;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = combined_nodes_findings(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // after
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.combined_nodes_findings(filter: 'string',
                                       after: 'string',
                                       limit: integer)

puts response

---

getRulesMetadataByID

Retrieve detailed compliance rule information by ID.

Includes descriptions, remediation steps, and audit procedures by specifying rule identifiers.

GET /container-compliance/combined/findings-by-nodes/v2

Scope Falcon Container Image: READ Consumes · Produces application/json

PEP 8 get_rules_metadata

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Rule IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rules_metadata(ids=id_list)
print(response)

Operation ID

from falconpy import KubernetesContainerCompliance

falcon = KubernetesContainerCompliance(client_id=CLIENT_ID,
                                       client_secret=CLIENT_SECRET
                                       )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.getRulesMetadataByID(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("getRulesMetadataByID",
                          ids=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/kubernetes_container_compliance"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.KubernetesContainerCompliance.GetRulesMetadataByID(
    &kubernetes_container_compliance.GetRulesMetadataByIDParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.kubernetesContainerCompliance.getRulesMetadataByID(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::kubernetes_container_compliance_api::get_rules_metadata_by_id;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_rules_metadata_by_id(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KubernetesContainerCompliance.new

response = api.get_rules_metadata_by_id(['ID1', 'ID2', 'ID3'])

puts response