Unidentified Containers

The Unidentified Containers service collection provides operations for searching and counting unidentified containers in your CrowdStrike Falcon environment. Retrieve counts by date range or total time period, and search for containers by criteria including cloud provider, cluster, severity, and namespace.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
ReadUnidentifiedContainersByDateRangeCount read_count_by_date_range	Returns the count of Unidentified Containers over the last 7 days
ReadUnidentifiedContainersCount read_count	Returns the total count of Unidentified Containers over a time period
SearchAndReadUnidentifiedContainers search_and_read	Search Unidentified Containers by the provided search criteria

---

ReadUnidentifiedContainersByDateRangeCount

Returns the count of Unidentified Containers over the last 7 days

Method GET

Route /container-security/aggregates/unidentified-containers/count-by-date/v1

Scope Falcon Container Image: READ

PEP 8 read_count_by_date_range

Parameters

filter query · string

Search Unidentified Containers using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

assessed_images_count	cid	cloud_account_id
cloud_name	cloud_region	cluster_id
cluster_name	containers_impacted_count	detections_count
image_assessment_detections_count	last_seen	namespace
node_name	severity	unassessed_images_count
visible_to_k8s

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import UnidentifiedContainers

falcon = UnidentifiedContainers(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.read_count_by_date_range(filter="string")
print(response)

Operation ID

from falconpy import UnidentifiedContainers

falcon = UnidentifiedContainers(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.ReadUnidentifiedContainersByDateRangeCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadUnidentifiedContainersByDateRangeCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/unidentified_containers"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.UnidentifiedContainers.CountByDateRange(
    &unidentified_containers.CountByDateRangeParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.unidentifiedContainers.countByDateRange("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::unidentified_containers_api::read_unidentified_containers_by_date_range_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_unidentified_containers_by_date_range_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UnidentifiedContainers.new

response = api.read_unidentified_containers_by_date_range_count(filter: 'string')

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "name": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

ReadUnidentifiedContainersCount

Returns the total count of Unidentified Containers over a time period

Method GET

Route /container-security/aggregates/unidentified-containers/count/v1

Scope Falcon Container Image: READ

PEP 8 read_count

Parameters

filter query · string

Search Unidentified Containers using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

assessed_images_count	cid	cloud_account_id
cloud_name	cloud_region	cluster_id
cluster_name	containers_impacted_count	detections_count
image_assessment_detections_count	last_seen	namespace
node_name	severity	unassessed_images_count
visible_to_k8s

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import UnidentifiedContainers

falcon = UnidentifiedContainers(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.read_count(filter="string")
print(response)

Operation ID

from falconpy import UnidentifiedContainers

falcon = UnidentifiedContainers(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.ReadUnidentifiedContainersCount(filter="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ReadUnidentifiedContainersCount",
                          filter="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/unidentified_containers"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"

  response, err := client.UnidentifiedContainers.Count(
    &unidentified_containers.CountParams{
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.unidentifiedContainers.count("string");  // filter

console.log(response);

Rust

use rusty_falcon::apis::unidentified_containers_api::read_unidentified_containers_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = read_unidentified_containers_count(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UnidentifiedContainers.new

response = api.read_unidentified_containers_count(filter: 'string')

puts response

Responses

200 OK

{
  "Resources": [
    {
      "count": 0,
      "label": "string"
    }
  ],
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

---

---

SearchAndReadUnidentifiedContainers

Search Unidentified Containers by the provided search criteria

Method GET

Route /container-security/combined/unidentified-containers/v1

Scope Falcon Container Image: READ

PEP 8 search_and_read

Parameters

filter query · string

Search Unidentified Containers using a query in Falcon Query Language (FQL). Supported filter fields:

Available values (16)

assessed_images_count	cid	cloud_account_id
cloud_name	cloud_region	cluster_id
cluster_name	containers_impacted_count	detections_count
image_assessment_detections_count	last_seen	namespace
node_name	severity	unassessed_images_count
visible_to_k8s

sort query · string

The fields to sort the records on.

limit query · integer

The upper-bound on the number of records to retrieve. Maximum limit: 100.

offset query · integer

The offset from where to begin. Maximum offset = 10000 - limit.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import UnidentifiedContainers

falcon = UnidentifiedContainers(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.search_and_read(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

Operation ID

from falconpy import UnidentifiedContainers

falcon = UnidentifiedContainers(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.SearchAndReadUnidentifiedContainers(filter="string",
                                                      limit=integer,
                                                      offset=integer,
                                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("SearchAndReadUnidentifiedContainers",
                          filter="string",
                          sort="string",
                          limit=integer,
                          offset=integer)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/unidentified_containers"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := int64(0)
  offset := int64(0)

  response, err := client.UnidentifiedContainers.Search(
    &unidentified_containers.SearchParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.unidentifiedContainers.search(
  "string",  // filter
  "string",  // sort
  integer,  // limit
  integer  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::unidentified_containers_api::search_and_read_unidentified_containers;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = search_and_read_unidentified_containers(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some(integer),  // limit
        Some(integer),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::UnidentifiedContainers.new

response = api.search_and_read_unidentified_containers(filter: 'string',
                                                       sort: 'string',
                                                       limit: integer,
                                                       offset: integer)

puts response

Responses

200 OK

[
  {
    "assessed_images": [],
    "assessed_images_count": "string",
    "cid": "string",
    "cluster_name": "string",
    "containers_impacted": [],
    "containers_impacted_count": "string",
    "detect_timestamp": "string",
    "detections_count": "string",
    "first_seen": "string",
    "host_id": "string",
    "image_assessment_detections_count": "string",
    "last_seen": "string",
    "namespace": "string",
    "node_name": "string",
    "pod_id": "string",
    "pod_name": "string",
    "runtime_detections_count": "string",
    "severity": "string",
    "unassessed_images": [],
    "unassessed_images_count": "string",
    "visible_to_k8s": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}