Skip to content

Container Image Compliance

Jump to bottom
Joshua Hiller edited this page Mar 6, 2026 · 3 revisions

CrowdStrike Falcon CrowdStrike Subreddit

Using the Container Image Compliance service collection

Uber class support Service class support Documentation Version Page Updated

This service collection has been renamed and is still available using the deprecated name. Legacy service collection name: Compliance Assessments

Table of Contents

Operation ID Description
extAggregateClusterAssessments
PEP 8 aggregate_cluster_assessments
Get the assessments for each cluster.
extAggregateImageAssessments
PEP 8 aggregate_image_assessments
Get the assessments for each image.
extAggregateRulesAssessments
PEP 8 aggregate_rules_assessments
Get the assessments for each rule.
extAggregateFailedContainersByRulesPath
PEP 8 aggregate_failed_containers_by_rules
Get the containers grouped into rules on which they failed.
extAggregateFailedContainersCountBySeverity
PEP 8 aggregate_failed_containers_count_by_severity
Get the failed containers count grouped into severity levels.
extAggregateFailedImagesByRulesPath
PEP 8 aggregate_failed_images_by_rules
Get the images grouped into rules on which they failed.
extAggregateFailedImagesCountBySeverity
PEP 8 aggregate_failed_images_count_by_severity
Get the failed images count grouped into severity levels.
extAggregateFailedRulesByClusters
PEP 8 aggregate_failed_rules_by_clusters
Get the failed rules for each cluster grouped into severity levels.
extAggregateFailedRulesByImages
PEP 8 aggregate_failed_rules_by_image
Get images with failed rules, rule count grouped by severity for each image.
extAggregateFailedRulesCountBySeverity
PEP 8 aggregate_failed_rules_count_by_severity
Get the failed rules count grouped into severity levels.
extAggregateRulesByStatus
PEP 8 aggregate_rules_by_status
Get the rules grouped by their statuses.

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

extAggregateClusterAssessments

Get the assessments for each cluster.

PEP8 method name

aggregate_cluster_assessments

Endpoint

Method Route
GET /container-compliance/aggregates/compliance-by-clusters/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
cloud_info.namespace Kubernetes namespace
compliance_finding.framework Compliance finding framework (available values: CIS)

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_cluster_assessments(filter="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateClusterAssessments(filter="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateClusterAssessments", filter="string")

print(response)

Back to Table of Contents

extAggregateImageAssessments

Get the assessments for each image.

PEP8 method name

aggregate_image_assessments

Endpoint

Method Route
GET /container-compliance/aggregates/compliance-by-images/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
after Service Class Support Uber Class Support query string after value from the last response. Leave empty or do not specify for the first request.
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
limit Service Class Support Uber Class Support query string number of images to return in the response after after key. Default when not specified: 10000
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
asset_type asset type (container, image)
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
cloud_info.namespace Kubernetes namespace
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_image_assessments(after="string", filter="string", limit="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateImageAssessments(after="string", filter="string", limit="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateImageAssessments",
                          after="string",
                          filter="string",
                          limit="string"
                          )
print(response)

Back to Table of Contents

extAggregateRulesAssessments

Get the assessments for each rule.

PEP8 method name

aggregate_rules_assessments

Endpoint

Method Route
GET /container-compliance/aggregates/compliance-by-rules/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_rules_assessments(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateRulesAssessments(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateRulesAssessments", filter="string")
print(response)

Back to Table of Contents

extAggregateFailedContainersByRulesPath

Get the containers grouped into rules on which they failed.

PEP8 method name

aggregate_failed_containers_by_rules

Endpoint

Method Route
GET /container-compliance/aggregates/failed-containers-by-rules/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
cloud_info.namespace Kubernetes namespace
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_containers_by_rules(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedContainersByRulesPath(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )


response = falcon.command("extAggregateFailedContainersByRulesPath", filter="string")
print(response)

Back to Table of Contents

extAggregateFailedContainersCountBySeverity

Get the failed containers count grouped into severity levels.

PEP8 method name

aggregate_failed_containers_count_by_severity

Endpoint

Method Route
GET /container-compliance/aggregates/failed-containers-count-by-severity/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
cloud_info.namespace Kubernetes namespace
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_containers_count_by_severity(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedContainersCountBySeverity(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedContainersCountBySeverity", filter="string")
print(response)

Back to Table of Contents

extAggregateFailedImagesByRulesPath

Get the images grouped into rules on which they failed.

PEP8 method name

aggregate_failed_images_by_rules

Endpoint

Method Route
GET /container-compliance/aggregates/failed-images-by-rules/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
cloud_info.namespace Kubernetes namespace
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_images_by_rules(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedImagesByRulesPath(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedImagesByRulesPath", filter="string")
print(response)

Back to Table of Contents

extAggregateFailedImagesCountBySeverity

Get the failed images count grouped into severity levels.

PEP8 method name

aggregate_failed_images_count_by_severity

Endpoint

Method Route
GET /container-compliance/aggregates/failed-images-count-by-severity/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
cloud_info.namespace Kubernetes namespace
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_images_count_by_severity(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedImagesCountBySeverity(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedImagesCountBySeverity", filter="string")
print(response)

Back to Table of Contents

extAggregateFailedRulesByClusters

Get the failed rules for each cluster grouped into severity levels.

PEP8 method name

aggregate_failed_rules_by_clusters

Endpoint

Method Route
GET /container-compliance/aggregates/failed-rules-by-clusters/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
asset_type asset type (container, image)
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_by_clusters(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesByClusters(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )


response = falcon.command("extAggregateFailedRulesByClusters", filter="string")
print(response)

Back to Table of Contents

extAggregateFailedRulesByImages

Get images with failed rules, rule count grouped by severity for each image.

PEP8 method name

aggregate_failed_rules_by_image

Endpoint

Method Route
GET /container-compliance/aggregates/failed-rules-by-images/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
asset_type asset type (container, image)
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
cloud_info.namespace Kubernetes namespace
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_by_image(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesByImages(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesByImages", filter="string")
print(response)

Back to Table of Contents

extAggregateFailedRulesCountBySeverity

Get the failed rules count grouped into severity levels.

PEP8 method name

aggregate_failed_rules_count_by_severity

Endpoint

Method Route
GET /container-compliance/aggregates/failed-rules-count-by-severity/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
asset_type asset type (container, image)
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_failed_rules_count_by_severity(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateFailedRulesCountBySeverity(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateFailedRulesCountBySeverity", filter="string")
print(response)

Back to Table of Contents

extAggregateRulesByStatus

Get the rules grouped by their statuses.

PEP8 method name

aggregate_rules_by_status

Endpoint

Method Route
GET /container-compliance/aggregates/rules-by-status/v2

Required Scope

falcon-container-image:read

Content-Type

  • Produces: application/json

Keyword Arguments

Name Service Uber Type Data type Description
filter Service Class Support Uber Class Support query string Filter results using a query in Falcon Query Language (FQL).
parameters Service Class Support Uber Class Support query dictionary Full query string parameters payload in JSON format. Not required when using other keywords.
Supported Filters
Filter Description
asset_type asset type (container, image)
cid Customer ID
cloud_info.cloud_account_id Cloud account ID
cloud_info.cloud_provider Cloud provider
cloud_info.cloud_region Cloud region
cloud_info.cluster_name Kubernetes cluster name
compliance_finding.framework Compliance finding framework (available values: CIS)
compliance_finding.id Compliance finding ID
compliance_finding.name Compliance finding Name
compliance_finding.severity Compliance finding severity; available values: 4, 3, 2, 1 (4: critical, 3: high, 2: medium, 1: low)
container_id Container ID
container_name Container name
image_digest Image digest (sha256 digest)
image_id Image ID
image_registry Image registry
image_repository Image repository
image_tag Image tag

Usage

Service class example (PEP8 syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.aggregate_rules_by_status(filter="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import ContainerImageCompliance

# Do not hardcode API credentials!
falcon = ContainerImageCompliance(client_id=CLIENT_ID,
                                  client_secret=CLIENT_SECRET
                                  )

response = falcon.extAggregateRulesByStatus(filter="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("extAggregateRulesByStatus", filter="string")
print(response)

Back to Table of Contents

CrowdStrike Falcon

Clone this wiki locally