Introduction
In architectures that are focused on container and microservices, you can use IBM Cloud® Security and Compliance Center Workload Protection to protect, monitor, and enhance forensic analysis of your pipeline and runtime components.
IBM Cloud Security and Compliance Center Workload Protection is available natively on IBM Cloud with an API and SDK that is maintained and provided by Sysdig.
For details about using IBM Cloud Security and Compliance Center Workload Protection, see the IBM Cloud docs.
Use the following syntax from a terminal to run a cURL command:
curl -X <METHOD> <ENDPOINT>/<API_URL> <-H HEADERS,> [-d DATA]
Where
<METHOD>indicates the type of REST API call that you want to make.<ENDPOINT>indicates the endpoint where the IBM Cloud Security and Compliance Center Workload Protection instance is available. For more information, see Endpoints.<API_URL>The API URL.HEADERSadd additional information such as information to authenticate with the IBM Cloud Security and Compliance Center Workload Protection service.DATAallows you to pass additional information that might be required.
The code examples on this tab use the client library that is provided for Python.
import os
import sys
sys.path.insert(0, os.path.join(os.path.dirname(os.path.realpath(sys.argv[0])), '..'))
from sdcclient import IbmAuthHelper, SdMonitorClient
# Parse arguments.
def usage():
print('usage: %s <ENDPOINT_URL> <API_KEY> <INSTANCE_GUID>' % sys.argv[0])
print('ENDPOINT_URL: IBM Cloud endpoint URL (for example https://us-south.security-compliance-secure.cloud.ibm.com')
print('API_KEY: IBM Cloud IAM API key. This key is used to retrieve an IAM access token.')
print('INSTANCE_GUID: GUID of an Security and Compliance Center Workload Protection instance.')
sys.exit(1)
if len(sys.argv) != 4:
usage()
URL = sys.argv[1]
APIKEY = sys.argv[2]
GUID = sys.argv[3]
# Instantiate the client
ibm_headers = IbmAuthHelper.get_headers(URL, APIKEY, GUID)
sdclient = SdMonitorClient(sdc_url=URL, custom_headers=ibm_headers)
Endpoint URL
You can use public and private endpoints. To find out about the available endpoints, see REST API Endpoints.
The endpoint for the IBM Cloud Security and Compliance Center Workload Protection API is in the format: https://cloud.ibm.com.security-compliance-secure.cloud.ibm.com/api For example, the API endpoint for Dallas is: https://us-south.security-compliance-secure.cloud.ibm.com/api
Example request to a Dallas endpoint:
curl -X GET https://us-south.security-compliance-secure.cloud.ibm.com/api/alerts/<ALERT_ID> -H "Authorization: $AUTH_TOKEN" -H "IBMInstanceID: $GUID" -H "TeamID: $TEAM_ID" -H "content-type: application/json"
Replace <ALERT_ID>, AUTH_TOKEN, GUID and TEAM_ID in this example with the values for your particular API call.
Example request to a Dallas endpoint
import os
import sys
sys.path.insert(0, os.path.join(os.path.dirname(os.path.realpath(sys.argv[0])), '..'))
from sdcclient import IbmAuthHelper, SdMonitorClient
# Parse arguments.
def usage():
print('usage: %s <ENDPOINT_URL> <API_KEY> <INSTANCE_GUID>' % sys.argv[0])
print('ENDPOINT_URL: IBM Cloud endpoint URL (e.g. https://us-south.security-compliance-secure.cloud.ibm.com')
print('API_KEY: IBM Cloud IAM API key. This key is used to retrieve an IAM access token.')
print('INSTANCE_GUID: GUID of an IBM Cloud Monitoring instance.')
sys.exit(1)
if len(sys.argv) != 4:
usage()
URL = sys.argv[1]
APIKEY = sys.argv[2]
GUID = sys.argv[3]
# Instantiate the client
ibm_headers = IbmAuthHelper.get_headers(URL, APIKEY, GUID)
sdclient = SdMonitorClient(sdc_url=URL, custom_headers=ibm_headers)
Authentication
Access to IBM Cloud Security and Compliance Center Workload Protection is controlled by using IBM Cloud Identity and Access Management (IAM), which provides a unified approach to managing user identities and access control across your IBM Cloud services and applications.
This API requires IBM Cloud Identity and Access Management (IAM) authentication. You must pass an IAM token in the Authorization header of the request. You can retrieve your IAM access token, which is prefixed with Bearer, by running the ibmcloud iam oauth-tokens command. You must also set the Account header to the unique ID for your IBM Cloud account. You can retrieve your Account ID by running the ibmcloud account show command.
To call each method, you must be assigned a role that includes the required IAM actions. Each method lists the associated action. For more information about IAM actions and how they map to roles, see Controlling access through IAM.
In a cURL command, add the following headers to authenticate with the IBM Cloud Security and Compliance Center Workload Protection service by using an IAM token:
-H "Authorization: $AUTH_TOKEN"
-H "IBMInstanceID: $GUID"
-H "TeamID: $TEAM_ID"
Where
-
IBMInstanceIDindicates the GUID of the IBM Cloud Security and Compliance Center Workload Protection instance that you want to target with the cURL command.To get the GUID of the monitoring instance, run the following command:
ibmcloud resource service-instance <NAME> --output json | jq -r '.[].guid' -
Authorizationindicates the IAM token that is used to authenticate with the IBM Cloud Monitoring service instance.To get the IAM
AUTH_TOKENtoken, run the following command:ibmcloud iam oauth-tokens | awk '{print $4}'For more information, see Getting the IAM API token.
-
TeamIDindicates the GUID of a team.To get the GUID, see Getting the ID of a team.
To use IBM Cloud IAM authentication with the Python client, you must specify an endpoint, an API key, and the GUID from your IBM Cloud Monitoring instance.
Complete the following steps from a terminal:
-
Get the GUID of your IBM Cloud Security and Compliance Center Workload Protection instance. Run the following command:
ibmcloud resource service-instance <NAME> --output json | jq -r '.[].guid' -
Get the API key. Run the following command to generate a user API key:
ibmcloud iam api-key-create KEY_NAME -
Get the endpoint for the region where the instance is available.
-
Add the following entries to your Python script:
from sdcclient import IbmAuthHelper, SdMonitorClient URL = <ENDPOINT> # For example: URL = 'https://us-south.security-compliance-secure.cloud.ibm.com' APIKEY = <IAM_APIKEY> GUID = <GUID> ibm_headers = IbmAuthHelper.get_headers(URL, APIKEY, GUID) sdclient = SdMonitorClient(sdc_url=URL, custom_headers=ibm_headers)Where
<ENDPOINT>must be replaced with the endpoint where the IBM Cloud Security and Compliance Center Workload Protection instance is available.<IAM_APIKEY>must be replaced with a valid IAM API key. Learn more.<GUID>must be replaced with the GUID of the IBM Cloud Security and Compliance Center Workload Protection instance that you obtain in the previous step.
You can now use the sdclient to perform actions that will be authenticated by using IAM.
If you get the error 400 Client Error: Bad Request for url: https://iam.cloud.ibm.com/identity/token, check the API key. The value that you are passing is not valid.
Auditing
You can monitor API activity within your account by using the IBM Cloud Activity Tracker service. Whenever an API method is called, an event is generated that you can then track and audit from within Activity Tracker. The specific event type is listed for each individual method. For more information about how to track IBM Cloud Security and Compliance Center Workload Protection activity, see Auditing the events for IBM Cloud Security and Compliance Center Workload Protection.
Error handling
The IBM Cloud Security and Compliance Center Workload Protection service uses standard HTTP response codes to indicate whether a method completed successfully.
- A
200response always indicates success. - A
400type response indicates a failure. - A
500type response usually indicates an internal system error.
| HTTP Error Code | Description |
|---|---|
200 |
Success |
201 |
Success |
400 |
Bad Request |
401 |
Unauthorized |
403 |
Forbidden |
404 |
Not Found |
422 |
Validation error, reason stated in the response body |
500 |
Internal Server Error |
Methods
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Fetches the customer's external id.
Fetches the customer's external id.
Response
The cloud account identifier
Example:
237944556329Friendly name to identify
Example:
sysdig-prodExample:
trueExample:
v0.14.2 - 2022-01-14T11:33:59ZExample:
2020-11-15T01:16:02.469729ZExample:
2021-11-15T01:16:02.469729ZExample:
cloud-connectorIndicates whether the service account provisioned for resource collection has been granted advanced permissions, specifically the Domain-wide delegation permission in GCP. This field is relevant only for GCP.
Example:
trueThe cloud provider's name
Example:
awsWhether the cloud account's provisioned role is enabled
The last time a role was successfully assumed
Example:
2020-11-15T01:16:02.469729ZThe role name associated with the Cloud Account
Example:
SysdigCloudBenchList of zones defined by a collection of scopes.
- zones
Example:
801711Example:
Entire Infrastructure
Status Code
OK
Account is forbidden (inactive/expired customer).
No Sample Response
Request
Query Parameters
Fetches the customer's external id.
Fetches the customer's external id.
Upserts the customer's cloud account.
Response
The cloud account identifier
Example:
237944556329Friendly name to identify
Example:
sysdig-prodExample:
trueExample:
v0.14.2 - 2022-01-14T11:33:59ZExample:
2020-11-15T01:16:02.469729ZExample:
2021-11-15T01:16:02.469729ZExample:
cloud-connectorIndicates whether the service account provisioned for resource collection has been granted advanced permissions, specifically the Domain-wide delegation permission in GCP. This field is relevant only for GCP.
Example:
trueThe cloud provider's name
Example:
awsWhether the cloud account's provisioned role is enabled
The last time a role was successfully assumed
Example:
2020-11-15T01:16:02.469729ZThe role name associated with the Cloud Account
Example:
SysdigCloudBenchList of zones defined by a collection of scopes.
- zones
Example:
801711Example:
Entire Infrastructure
The externalId of the Cloud Account
Example:
6152496c47126ba1079afd2a0b63645d
Status Code
Cloud Account is successfully created
The given request is invalid.
Account is forbidden (inactive/expired customer).
Cloud account already exists.
The server encountered an unexpected condition.
No Sample Response
Request
Cloud Account register request.
Example:
237944556329Example:
v0.14.1-3-gcb3c647 - 2022-01-12T11:12:02ZExample:
cloud-connectorExample:
awsExample:
us-west
Response
The cloud account identifier
Example:
237944556329Friendly name to identify
Example:
sysdig-prodExample:
trueExample:
v0.14.2 - 2022-01-14T11:33:59ZExample:
2020-11-15T01:16:02.469729ZExample:
2021-11-15T01:16:02.469729ZExample:
cloud-connectorIndicates whether the service account provisioned for resource collection has been granted advanced permissions, specifically the Domain-wide delegation permission in GCP. This field is relevant only for GCP.
Example:
trueThe cloud provider's name
Example:
awsWhether the cloud account's provisioned role is enabled
The last time a role was successfully assumed
Example:
2020-11-15T01:16:02.469729ZThe role name associated with the Cloud Account
Example:
SysdigCloudBenchList of zones defined by a collection of scopes.
- zones
Example:
801711Example:
Entire Infrastructure
Example:
-1Example:
683Example:
enterpriseExample:
-1Example:
-1Example:
v0npn8wfSFqZCOfJjDqm8d6t8fiBYE3SExample:
active
Status Code
Account is successfully registered
The given request is invalid.
Account is forbidden (inactive/expired customer).
The server encountered an unexpected condition.
No Sample Response
Get the Cloud Account.
Fetches a cloud account for a given customer and accountId.
GET /api/cloud/v2/accounts/{accountId}Request
Path Parameters
Query Parameters
Fetches the customer's external id.
Fetches the customer's external id.
Response
The cloud account identifier
Example:
237944556329Friendly name to identify
Example:
sysdig-prodExample:
trueExample:
v0.14.2 - 2022-01-14T11:33:59ZExample:
2020-11-15T01:16:02.469729ZExample:
2021-11-15T01:16:02.469729ZExample:
cloud-connectorIndicates whether the service account provisioned for resource collection has been granted advanced permissions, specifically the Domain-wide delegation permission in GCP. This field is relevant only for GCP.
Example:
trueThe cloud provider's name
Example:
awsWhether the cloud account's provisioned role is enabled
The last time a role was successfully assumed
Example:
2020-11-15T01:16:02.469729ZThe role name associated with the Cloud Account
Example:
SysdigCloudBenchList of zones defined by a collection of scopes.
- zones
Example:
801711Example:
Entire Infrastructure
The externalId of the Cloud Account
Example:
6152496c47126ba1079afd2a0b63645d
Status Code
OK
Invalid or missing auth token.
Account is forbidden (inactive/expired customer).
The cloud info could not be found.
The server encountered an unexpected condition.
No Sample Response
Update the alias, roleAvailable or roleName of a Cloud Account.
Edits the alias, role available status, or role name of a given cloud account. Updating the account alias, role availability status, or role name requires the cloud service provider information in the request body. Failing to include the provider in the request body will result in a 400 Bad Request error.
When you request to update the alias field and want to retain the current value for the roleAvailable and role name fields, you need to remember the existing values and supply that in the request. Otherwise, the default roleAvailable value (false) and roleName (empty) will be persisted in the system. Likewise, when you attempt to change the roleAvailable field and want to retain the current account alias and role name, you must supply the current account alias and roleName in the request. In a nutshell, it’s recommended that you supply the expected values for both alias, roleAvailable, and roleName fields in the request, even when the intention is to update either one, more than one, or all of them.
This API also respects the presence of includeExternalID or includeExternalId parameters in the request URL. If specified, the external ID associated with the cloud account will be included in the response. You need to specify either includeExternalID or includeExternalId parameter while sending the request. If you specify both, the server gives precedence to includeExternalId. But you might not notice the difference when seeing the response. The includeExternalID is still maintained for backward compatibility. It’s recommended to use includeExternalId if you want to see the external ID in the response.
PUT /api/cloud/v2/accounts/{accountId}Request
Path Parameters
Query Parameters
Fetches the customer's external id.
Fetches the customer's external id.
The friendly name of the cloud account.
Example:
sysdig-devThe cloud provider's name
Allowable values: [
aws,gcp,azure]Example:
awsWhether the cloud account's provisioned role is enabled
Example:
trueThe role name associated with the Cloud Account
Example:
SysdigCloudBench
Response
The cloud account identifier
Example:
237944556329Friendly name to identify
Example:
sysdig-prodExample:
trueExample:
v0.14.2 - 2022-01-14T11:33:59ZExample:
2020-11-15T01:16:02.469729ZExample:
2021-11-15T01:16:02.469729ZExample:
cloud-connectorIndicates whether the service account provisioned for resource collection has been granted advanced permissions, specifically the Domain-wide delegation permission in GCP. This field is relevant only for GCP.
Example:
trueThe cloud provider's name
Example:
awsWhether the cloud account's provisioned role is enabled
The last time a role was successfully assumed
Example:
2020-11-15T01:16:02.469729ZThe role name associated with the Cloud Account
Example:
SysdigCloudBenchList of zones defined by a collection of scopes.
- zones
Example:
801711Example:
Entire Infrastructure
The externalId of the Cloud Account
Example:
6152496c47126ba1079afd2a0b63645d
Status Code
OK
The given request is invalid.
Account is forbidden (inactive/expired customer).
The cloud info could not be found.
The server encountered an unexpected condition.
No Sample Response
List the Cloud Account's Datasources.
Lists the Cloud Account information with regions and clusters.
GET /api/cloud/v2/dataSources/accounts
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Free text filter. Searches on the following fields:
accountId,regionSort by column. Options:
accountId,alias,clustersConnected,platform. Default isaccountIdSort order. Options:
asc,desc
Response
Datasources Cloud Accounts get request.
The cloud account identifier
Example:
237944556329Example:
25The cloud provider's name
Possible values: [
aws,gcp,azure]Example:
awsA list of cloud regions where the cloud account is active.
- regions
Example:
10Example:
2020-11-15T01:16:02.469729ZThe cloud region identifier
Example:
us-west-2Example:
2020-11-15T01:16:02.469729ZWhether the region is active
Possible values: [
active,inactive]Example:
activeExample:
2
Example:
5
Status Code
OK
Account is forbidden (inactive/expired customer).
The cloud info could not be found.
The server encountered an unexpected condition.
No Sample Response
List the Cloud Account's Clusters.
Lists all clusters across a customer's accounts.
GET /api/cloud/v2/dataSources/clusters
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by account ID
Filter by connected status
Free text filter. Searches on the following fields:
name,regionSort by column. Options:
accountId,status,clusterName,region,platform,nodeCount,version,createdAt. Default isaccountIdSort order. Options:
asc,desc
Response
Datasources Clusters get request.
The cloud account identifier
Example:
237944556329string with credentials used for connecting agent
Example:
aws eks update-kubeconfigWhether the cluster has the agent installed
Example:
trueExample:
2020-04-21T16:08:08.845336507ZThe cluster name
Example:
us-west-2-clusterExample:
3node resource group for azure
Example:
node-groupThe cloud provider's name
Possible values: [
aws,gcp,azure]Example:
awsThe cluster region
Example:
us-west-2
Status Code
OK
Invalid or missing auth token.
Account is forbidden (inactive/expired customer).
The cloud info could not be found.
The server encountered an unexpected condition.
No Sample Response
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by group name
Filter by group ARN
Limit the amount of results to be fetched
Cursor is used for API pagination
Filter by risk labels
Allowable values: [
Admin,Inactive]Filter by profiling labels
Allowable values: [
Learning]Indicates whether to exclude identities that are still in learning mode from the results.
Filter by risk category
Allowable values: [
Critical,High,Medium,Low]Filter by access category
Allowable values: [
Empty Access,Admin,Write,Read]Filter by excessive risk category
Allowable values: [
Critical,High,Medium,Low]
Response
Groups paginated response.
- options
Example:
100
- data
Example:
WriteExample:
411112345678Example:
1Example:
CriticalExample:
arn:aws:iam::411112345678:group/sysdig-integrationExample:
Dev- labels
Example:
a year agoExample:
2022-01-24T07:30:16ZExample:
1Example:
10471Example:
trueExample:
101Example:
awsExample:
Low
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the list of policies attached to the specified group.
Fetches the list of policies attached to the specified group.
GET /api/cloud/v2/groups/policies
Get a policy suggestion by group.
Fetches the policy suggestion. Policy is based only on the action of the users in the group.
GET /api/cloud/v2/groups/policySuggestion
Request
Query Parameters
Allowable values: [
aws,gcp,azure]Filter by group name
Filter by group ARN
Specify whether to fill out the resource section of the policy suggestion or leave it as '*'
Allowable values: [
true,false]
Response
Example:
2022-01-24T07:30:16ZExample:
10471Example:
10471- policySuggestion
- Statment
Example:
Allow
Example:
2012-10-17T00:00:00.000Z
Status Code
OK
There is no information.
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the list of users attached to the specified group.
Fetches the list of users attached to the specified group.
GET /api/cloud/v2/groups/users
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by group name
Limit the amount of results to be fetched
Cursor is used for API pagination
Response
- data
The unique string that identifies the user member of this group.
Example:
arn:aws:iam::123456789012:user/AlfredBordenThe friendly name that identifies the user member of this group.
Example:
AlfredBordenThis boolean value indicates whether the actor has permissions which do not belong to any groups.
- labels
The last time the user member of this group was active.
Example:
2022-01-24T07:30:16ZThe relative date-time representation of the last time the user member of this group was active.
Example:
a year agoThis value represents the total number other groups the user belongs to.
Example:
4This value indicates the total number of permissions granted to the user.
Example:
6144This value indicates the total number of permissions that the user does not utilize.
Example:
3123
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the list of policies.
Fetches the list of policies based on Excessive Permissions.
GET /api/cloud/v2/policies
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by policy id
Filter by policy name
Limit the amount of results to be fetched
Cursor is used for API pagination
Filter by risk labels
Allowable values: [
No MFA,Admin,Root User,Inactive,Multiple Access Keys Active,Access Key 1 Not Rotated,Access Key 2 Not Rotated]Filter by profiling labels
Allowable values: [
Learning]Indicates whether to exclude the policies attached to the identities that are still in learning mode from the results.
Filter by type of policy
Allowable values: [
AWS Managed,Customer,Inline]Filter by risk category
Allowable values: [
Critical,High,Medium,Low]Filter by excessive risk category
Allowable values: [
Critical,High,Medium,Low]Filter by access category
Allowable values: [
Empty Access,Admin,Write,Read]
Response
Policies paginated response.
- options
Example:
100
- data
Example:
b5d949b9-a4bc-43fb-a518-93d8affed428Example:
WriteExample:
411112345678Example:
1Example:
CriticalExample:
true- labels
Example:
1Example:
10471Example:
trueExample:
101Example:
arn:aws:iam::aws:policy/AdministratorAccessExample:
AdministratorAccessExample:
AWSExample:
awsExample:
rohit.sriramExample:
UserExample:
Low
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the policy groups.
Fetches the list of groups for a given policy.
GET /api/cloud/v2/policies/groups
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by policy name
Limit the amount of results to be fetched
Cursor is used for API pagination
Response
- data
The unique string identifying the group to which this policy is attached.
Example:
arn:aws:iam::aws:group/FastPiratesThe friendly name that identifies the group to which this policy is attached.
Example:
FastPirates- labels
The total number of permissions specified in this policy.
Example:
10471The total number of permissions that the group members does not utilize from this policy.
Example:
10471The total number of users to which this policy is attached.
Example:
53
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the policy suggestion by policy.
Fetches the policy suggestion. Policy is based only on the action of the user.
GET /api/cloud/v2/policies/policySuggestion
Request
Query Parameters
Filter by actor name
Filter by provider
Allowable values: [
aws,gcp,azure]Specify the format. By default json is the format
Allowable values: [
terraform,json]Specify whether to fill out the resource section of the policy suggestion or leave it as '*'
Allowable values: [
true,false]
Response
Example:
411112345678Example:
arn:aws:iam::411112345678:user/sysdig-integrationExample:
userExample:
sysdig-integrationExample:
1Example:
10471Example:
10471Example:
10471Example:
10471Example:
arn:aws:iam::aws:policy/AdministratorAccessExample:
AdministratorAccessExample:
AWSExample:
awsExample:
rohit.sriramExample:
User
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Request
Query Parameters
Filter by actor name
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by kind
Allowable values: [
user,role]Filter by type of policy
Allowable values: [
AWS Managed,Customer,Inline]
Response
Example:
411112345678Example:
arn:aws:iam::411112345678:user/sysdig-integrationExample:
userExample:
sysdig-integrationExample:
1Example:
10471Example:
10471Example:
10471Example:
10471Example:
arn:aws:iam::aws:policy/AdministratorAccessExample:
AdministratorAccessExample:
AWSExample:
awsExample:
rohit.sriramExample:
User
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the Groups CSV Report.
Fetches the Groups Report in CSV format.
GET /api/cloud/v2/reports/groups/csv
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by group name
Filter by group ARN
Filter by access category
Allowable values: [
Empty Access,Admin,Write,Read]Filter by risk labels
Allowable values: [
Admin,Inactive]Filter by profiling labels
Allowable values: [
Learning]Indicates whether to exclude identities that are still in learning mode from the results.
Filter by risk category
Allowable values: [
Critical,High,Medium,Low]Filter by excessive risk category
Allowable values: [
Critical,High,Medium,Low]
Get the Policies CSV Report.
Fetches the Policies Report in CSV format.
GET /api/cloud/v2/reports/policies/csv
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by policy name
Filter by type of policy
Allowable values: [
AWS Managed,Customer,Inline]Filter by risk labels
Allowable values: [
No MFA,Admin,Root User,Inactive,Multiple Access Keys Active,Access Key 1 Not Rotated,Access Key 2 Not Rotated]Filter by profiling labels
Allowable values: [
Learning]Indicates whether to exclude the policies attached to the identities that are still in learning mode from the results.
Filter by risk category
Allowable values: [
Critical,High,Medium,Low]Filter by excessive risk category
Allowable values: [
Critical,High,Medium,Low]Filter by access category
Allowable values: [
Empty Access,Admin,Write,Read]
Get the Users CSV Report.
Fetches the Users Report in CSV format.
GET /api/cloud/v2/reports/users/csv
Request
Query Parameters
Filter by kind
Allowable values: [
user,role,serviceAccount]Filter by provider
Allowable values: [
aws,gcp,azure]Filter by actor name
Filter by risk labels
Allowable values: [
No MFA,Admin,Root User,Inactive,Lateral Movement,User Managed Key,Multiple Access Keys Active,Access Key 1 Not Rotated,Access Key 2 Not Rotated]Filter by profiling labels
Allowable values: [
Learning]Indicates whether to exclude identities that are still in learning mode from the results.
Filter by risk category
Allowable values: [
Critical,High,Medium,Low]Filter by excessive risk category
Allowable values: [
Critical,High,Medium,Low]Filter by access category
Allowable values: [
Empty Access,Admin,Write,Read]
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by kind
Allowable values: [
user,role,serviceAccount]Filter by actor name
Filter by actor id
Limit the amount of results to be fetched
Cursor is used for API pagination
Filter by risk labels
Allowable values: [
No MFA,Admin,Root User,Inactive,Lateral Movement,User Managed Key,Multiple Access Keys Active,Access Key 1 Not Rotated,Access Key 2 Not Rotated]Filter by profiling labels
Allowable values: [
Learning]Indicates whether to exclude identities that are still in learning mode from the results.
Filter by risk category
Allowable values: [
Critical,High,Medium,Low]Filter by excessive risk category
Allowable values: [
Critical,High,Medium,Low]Filter by access category
Allowable values: [
Empty Access,Admin,Write,Read]Sort by column. Options:
userName,lastActiveSort order. Options:
asc,desc
Response
Users paginated response.
- options
Example:
100Example:
100
- data
Example:
Empty AccessExample:
411112345678Example:
arn:aws:iam::411112345678:user/sysdig-integrationExample:
userExample:
sysdig-integrationExample:
1Example:
10471Example:
Critical- labels
Example:
2022-01-24T07:30:16ZExample:
a year agoExample:
1Example:
10471Example:
trueExample:
101Example:
awsExample:
LowExample:
Predefined
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the list of groups attached to a specified user.
Fetches the list of groups attached to a specified user (actor_id).
GET /api/cloud/v2/users/groups
Request
Query Parameters
Filter by provider
Allowable values: [
aws,gcp,azure]Filter by actor id
Limit the amount of results to be fetched
Cursor is used for API pagination
Response
- data
The unique string identifying the group to which this policy is attached.
Example:
arn:aws:iam::aws:group/FastPiratesThe friendly name that identifies this group.
Example:
FastPirates- labels
This total number of permissions granted to this group.
Example:
10471The total number of permissions that the group does not utilize.
Example:
10471The total number of users belongs to this group.
Example:
12
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get the policy information.
Fetches the policy information for a given user.
GET /api/cloud/v2/users/policyInfo
Response
Example:
411112345678Example:
arn:aws:iam::411112345678:user/sysdig-integrationExample:
userExample:
sysdig-integrationExample:
1Example:
10471Example:
10471Example:
10471Example:
10471Example:
arn:aws:iam::aws:policy/AdministratorAccessExample:
AdministratorAccessExample:
AWSExample:
awsExample:
rohit.sriramExample:
User
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Get a policy suggestion by user.
Fetches the policy suggestion. Policy is based only on the action of the user.
GET /api/cloud/v2/users/policySuggestion
Request
Query Parameters
Allowable values: [
aws,gcp,azure]Filter by actor name
Filter by actor id
Specify the format. By default json is the format
Allowable values: [
terraform,json]Specify whether to fill out the resource section of the policy suggestion or leave it as '*'
Allowable values: [
true,false]
Response
Example:
2022-01-24T07:30:16ZExample:
10471Example:
10471- policySuggestion
- Statment
Example:
Allow
Example:
2012-10-17T00:00:00.000Z
Status Code
OK
There is no information.
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Request
Query Parameters
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Account verbosity level:
VERBOSITY_UNSPECIFIED- default, same as DETAILVERBOSITY_IDENT- only indentifying information of the entityVERBOSITY_INFO- includes all fields of entity; excludes nested entities and collectionsVERBOSITY_FULL- includes all fields of entity and nested entities; excludes collectionsVERBOSITY_DETAIL- default; includes all fields of the entity, nested entities and collectionsVERBOSITY_DEBUG- debugging informationVERBOSITY_TRACE- all available information
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
- count
Status Code
OK
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Request
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Allowable values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Request
Path Parameters
Query Parameters
Account verbosity level:
VERBOSITY_UNSPECIFIED- default, same as DETAILVERBOSITY_IDENT- only indentifying information of the entityVERBOSITY_INFO- includes all fields of entity; excludes nested entities and collectionsVERBOSITY_FULL- includes all fields of entity and nested entities; excludes collectionsVERBOSITY_DETAIL- default; includes all fields of the entity, nested entities and collectionsVERBOSITY_DEBUG- debugging informationVERBOSITY_TRACE- all available information
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Request
Path Parameters
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Allowable values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Response
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Status Code
OK
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Request
Path Parameters
AccountComponent captures resourced deployed to a cloud
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Response
AccountComponent captures resourced deployed to a cloud
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Delete Account Component
DELETE /api/cloudauth/v1/accounts/{accountId}/components/{componentType}/{componentInstance}Get Account Component
GET /api/cloudauth/v1/accounts/{accountId}/components/{componentType}/{componentInstance}Request
Path Parameters
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_CRYPTO_KEY]
Response
AccountComponent captures resourced deployed to a cloud
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Status Code
OK
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Update Account Component
PUT /api/cloudauth/v1/accounts/{accountId}/components/{componentType}/{componentInstance}Request
Path Parameters
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_CRYPTO_KEY]
AccountComponent captures resourced deployed to a cloud
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Response
AccountComponent captures resourced deployed to a cloud
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Validate Component
POST /api/cloudauth/v1/accounts/{accountId}/components/{componentType}/{componentInstance}/validateResponse
AccountComponent captures resourced deployed to a cloud
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Status Code
OK
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Request
Path Parameters
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]
Response
AccountFeature captures a sysdig feature enabled on a cloud account
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Status Code
OK
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Update Account Feature
update/enable a feature
PUT /api/cloudauth/v1/accounts/{accountId}/feature/{featureType}Request
Path Parameters
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]
AccountFeature captures a sysdig feature enabled on a cloud account
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Response
AccountFeature captures a sysdig feature enabled on a cloud account
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Response
AccountFeature captures a sysdig feature enabled on a cloud account
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Status Code
OK
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Response
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Request
AccountComponent captures resourced deployed to a cloud
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
Response
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Status Code
OK
No Sample Response
Request
Query Parameters
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Organization verbosity level:
VERBOSITY_UNSPECIFIED- default, same as DETAILVERBOSITY_IDENT- only indentifying information of the entityVERBOSITY_INFO- includes all fields of entity; excludes nested entities and collectionsVERBOSITY_FULL- includes all fields of entity and nested entities; excludes collectionsVERBOSITY_DETAIL- default; includes all fields of the entity, nested entities and collectionsVERBOSITY_DEBUG- debugging informationVERBOSITY_TRACE- all available information
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
- count
CloudOrganization captures a metadata fields associated with a cloud/service provider organization.
- organizations
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- managementAccount
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The server encountered an unexpected condition.
No Sample Response
Request
CloudOrganization captures a metadata fields associated with a cloud/service provider organization.
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Allowable values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- managementAccount
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Allowable values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
CloudOrganization captures a metadata fields associated with a cloud/service provider organization.
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- managementAccount
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The result would create conflicting condition.
The method could not be performed on the resource because the requested action depended on another action, and that action failed
The server encountered an unexpected condition.
No Sample Response
Request
Path Parameters
Query Parameters
Organization verbosity level:
VERBOSITY_UNSPECIFIED- default, same as DETAILVERBOSITY_IDENT- only indentifying information of the entityVERBOSITY_INFO- includes all fields of entity; excludes nested entities and collectionsVERBOSITY_FULL- includes all fields of entity and nested entities; excludes collectionsVERBOSITY_DETAIL- default; includes all fields of the entity, nested entities and collectionsVERBOSITY_DEBUG- debugging informationVERBOSITY_TRACE- all available information
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
CloudOrganization captures a metadata fields associated with a cloud/service provider organization.
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- managementAccount
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Request
Path Parameters
CloudOrganization captures a metadata fields associated with a cloud/service provider organization.
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Allowable values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- managementAccount
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Allowable values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Allowable values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Allowable values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Allowable values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]- validation
Allowable values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Allowable values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Response
CloudOrganization captures a metadata fields associated with a cloud/service provider organization.
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- managementAccount
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
The given request is invalid.
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Response
CloudOrganization captures a metadata fields associated with a cloud/service provider organization.
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- accounts
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
CloudAccount captures a snapshot of basic metadata fields associated with a cloud.
- managementAccount
AccountComponent captures resourced deployed to a cloud
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
- aws
- azure
- gcp
CloudLogsMetadata captures the metadata associated cloud logs component
- cloudLogsMetadata
- aws
- cloudtrailS3Bucket
CryptoKeyMetadata captures the metadata associated with a KMS Key
- cryptoKeyMetadata
- aws
- kms
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
- aws
- azure
- eventHubMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
- azure
captures a subset of fields from the Azure Active Directory Service Principal resource, useful when service_principal_type = "Application". For other service principle types, additional fields such as "key_credentials" might be needed. Add and flag for encryption as necessary.
- activeDirectoryServicePrincipal
- oauth2PermissionGrants
- gcp
- key
- workloadIdentityFederation
- okta
- oauthApp
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
- azure
- gcp
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_WEBHOOK_DATASOURCE,COMPONENT_CRYPTO_KEY,COMPONENT_CLOUD_LOGS]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
WebhookDatasourceMetadata captures the metadata associated with a webhook integration, segmented by provider type. a webhook integration is a event push model initiated by the provider over HTTP POST requests.
- webhookDatasourceMetadata
- gcp
- webhookDatasource
- github
- webhookDatasource
- okta
- webhookDatasource
- feature
AccountFeature captures a sysdig feature enabled on a cloud account
- monitorCloudMetrics
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureAgentlessScanning
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureConfigPosture
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureIdentityEntitlement
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
AccountFeature captures a sysdig feature enabled on a cloud account
- secureThreatDetection
- Examples:
{ "SCANNING_HOST_CONTAINER_ENABLED": "true" }- flags
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]Possible values: [
PROVIDER_PARTITION_UNSPECIFIED,PROVIDER_PARTITION_AWS_GOVCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Possible values: [
PROVIDER_UNSPECIFIED,PROVIDER_AWS,PROVIDER_AZURE,PROVIDER_GCP,PROVIDER_OKTA,PROVIDER_GITHUB,PROVIDER_IBMCLOUD]- validation
Possible values: [
VALIDATION_RESULT_UNSPECIFIED,VALIDATION_RESULT_UNKNOWN,VALIDATION_RESULT_SUCCESS,VALIDATION_RESULT_FAILURE,VALIDATION_RESULT_PARTIAL_FAILURE,VALIDATION_RESULT_UNIMPLEMENTED]- steps
Possible values: Value must match regular expression
^-?(?:0|[1-9][0-9]{0,11})(?:\.[0-9]{1,9})?s$- error
Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
Possible values: [
VERBOSITY_UNSPECIFIED,VERBOSITY_IDENT,VERBOSITY_INFO,VERBOSITY_FULL,VERBOSITY_DETAIL,VERBOSITY_DEBUG,VERBOSITY_TRACE]
Status Code
OK
Invalid or missing auth token.
The requested entity was not found.
The server encountered an unexpected condition.
No Sample Response
Cloud Resources
Gets the list of cloud resources and their compliance data for a specific control
GET /api/cspm/v1/cloud/resources
Request
Query Parameters
Control ID
Example:
21Provider type to retrieve resources for (AWS, GCP or Azure)
Example:
AWSResource kind
Example:
AWS_S3_BUCKETQuery language expression for filtering results. Operators:
and,orandnotlogical operators=,!=incontainsandstartsWithto check partial values of attributes
List of supported fields:
zones.id- Type: integer
- Example:
zones.id=1 - Description: Evaluated zone ID.
zoneName- Type: string
- Description: Zone name
policyId- Type: integer
- Example:
policyId=1 - Description: Evaluated policy ID.
policyName- Type: string
- Description: Policy name
pass- Type: boolean
- Example:
pass=true - Description: Passing status of resource.
accepted- Type: boolean
- Example:
accepted=true - Description: Return accepted resources.
name- Type: string
- Description: Resource name.
account- Type: string
- Description: Cloud Account that this resource belongs to.
location- Type: string
- Description: Region where this resource is located.
organization- Type: string
- Description: Organization that this resource belongs to.
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
pass=false or accepted=truePage number. Defaults to 1.
Example:
1Page size. Defaults to 50.
Example:
50
Response
- data
Risk acceptance data
- acceptance
Acceptance period in days
Example:
30Acceptance date in unix timestamp (milliseconds)
Example:
1660742030427Acceptance additional description
Example:
Jane - will take care of itAcceptance expiry date in unix timestamp (milliseconds)
Example:
1663361999999Acceptance ID
Example:
62fce98ebc19e98141f04f1fIs acceptance expired
Acceptance reason
Example:
Risk OwnedUser display name of the user that accepted the risk
Example:
Jane DoeUsername of the user that accepted the risk
Example:
jane.doe@myorg.com
Cloud account that this resource belongs to
Example:
316651456328Resource unique identifier
Example:
4e3e444e6e42e00c69e57e7119929eb1last time scan ended successfully for this resource (UNIX timestamp, milliseconds)
Example:
1660742138Region where this resource is located
Example:
us-east-2Resource name
Example:
acl-0ec898c5d834142edOrganization that this resource belongs to
Example:
o-tdkbj7rwhnIs resource passing for given control
Object type
Example:
Network ACLResource zones
- zones
Zone ID
Example:
1001Zone name
Example:
Entire Infrastructure
Total number of resources matching filter (limited to 1000)
Example:
5112
Status Code
Successfully returned CSPM v1 Cloud resources.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Cluster Analysis Resources
Gets the list of cluster analysis resources and their compliance data for a specific control
GET /api/cspm/v1/clusteranalysis/resources
Request
Query Parameters
Control ID
Example:
21Type of benchmark to retrieve resources for (0-Linux, 1-Docker, 2-Kubernetes). Defaults to 0.
Example:
1Resource kind ('host' or 'cluster')
Example:
hostQuery language expression for filtering results. Operators:
and,orandnotlogical operators=,!=incontainsandstartsWithto check partial values of attributes
List of supported fields:
zones.id- Type: integer
- Example:
zones.id=1 - Description: Evaluated zone ID.
zoneName- Type: string
- Description: Zone name
policyId- Type: integer
- Example:
policyId=1 - Description: Evaluated policy ID.
policyName- Type: string
- Description: Policy name
pass- Type: boolean
- Example:
pass=true - Description: Passing status of resource.
accepted- Type: boolean
- Example:
accepted=true - Description: Return accepted resources.
clusterName- Type: string
- Description: Cluster name.
name- Type: string
- Description: Host name.
nodeInfo.osName- Type: string
- Description: Host operating system.
nodeInfo.osImage- Type: string
- Description: Host operating system image.
distributionName- Type: string
- Description: Kubernetes Distribution Name.
- Example: distributionName in ("Vanilla")
distributionVersion- Type: string
- Description: Kubernetes Distribution Version.
- Example: distributionVersion in (1.23, 1.25)
platformAccountId- Type: string
- Description: Cloud Account ID
- Example: 012345678901
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
pass=false or accepted=truePage number. Defaults to 1.
Example:
1Page size. Defaults to 50.
Example:
50
Response
- data
Risk acceptance data
- acceptance
Acceptance period in days
Example:
30Acceptance date in unix timestamp (milliseconds)
Example:
1660742030427Acceptance additional description
Example:
Jane - will take care of itAcceptance expiry date in unix timestamp (milliseconds)
Example:
1663361999999Acceptance ID
Example:
62fce98ebc19e98141f04f1fIs acceptance expired
Acceptance reason
Example:
Risk OwnedUser display name of the user that accepted the risk
Example:
Jane DoeUsername of the user that accepted the risk
Example:
jane.doe@myorg.com
Cluster name
Example:
kspm-test-chen-4Configuration error occurred while checking the resource
Distribution Name
Example:
vanillaDistribution Version
Example:
1.23Resource unique identifier
Example:
4e3e444e6e42e00c69e57e7119929eb1last time scan ended successfully for this resource (UNIX timestamp, milliseconds)
Example:
1660742138Resource name
Example:
risky-redis-deploymentHost OS image
Example:
Ubuntu 20.04.2 LTSOS name
Example:
linuxIs resource passing for given control
Cloud Account ID
Example:
012345678901Object type
Example:
hostResource zones
- zones
Zone ID
Example:
1001Zone name
Example:
Entire Infrastructure
Total number of resources matching filter (limited to 1000)
Example:
5112
Status Code
Successfully returned CSPM v1 Cluster Analysis resources.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Compliance Results
Get the compliance results for a given filter.
GET /api/cspm/v1/compliance/requirements
Request
Query Parameters
Query language expression for filtering results. Operators:
and,orandnotlogical operators=,!=incontainsandstartsWithto check partial values of attributes
List of supported fields:
name- Type: string
- Example:
name in ("1.5 - Exposing HostPort") - Description: The compliance requirements that will be included in the results.
policy.name- Type: string
- Example:
policy.name in ("CIS Distribution Independent Linux Benchmark", "CIS Docker Benchmark") - Description: The compliance policies that will be included in the results.
zone.name- Type: string
- Example:
zone.name="Entire Infrastructure" - Description: The zones that will be included in the results.
pass- Type: boolean
- Example:
pass=false - Description: Show passing or failing requirements. If no value - will show both passing and failing requirements.
severity- Type: Integer
- Example:
severity in (3, 2) - Description: Requirement severity. (1=low, 2=medium, 3=high)
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
pass=false and policy.name in ("CIS Amazon Web Services Foundations Benchmark") and severity=3Page number. Defaults to 1.
Example:
1Page size. Defaults to 10.
Example:
50
Response
- data
Number of accepted resources
Example:
2- controls
Number of accepted resources.
Example:
1Control description.
Example:
Ensure a separate partition for containers has been createdControl ID.
Example:
5000Does control need to be checked manually.
Example:
trueControl name.
Example:
Separate partition for containers mountedNumber of failing resources.
Example:
5Is control passing.
API endpoint for listing the evaluated resources for this control.
Example:
/api/cspm/v1/kube/resources?controlId=32&resourceKind=workload&filter=policyId=100000 and zones.id=1Kind of resource evaluated by the control.
Example:
hostControl severity.
Example:
HighList of supported distributions of a specific control.
- supportedDistributions
Distribution max version.
Example:
1.25Distribution min version.
Example:
1.23Distribution name.
Example:
Vanilla
Requirement description
Example:
All Docker containers and their data and metadata is stored under '/var/lib/docker' directory. By default, '/var/lib/docker' should be mounted under either the '/' or '/var' partitions dependent on how the Linux operating system in use is configured.Number of failing controls
Example:
1Number of failing resources for high-severity controls
Example:
1Number of failing resources for low-severity controls
Example:
3Number of failing resources for medium-severity controls
Example:
5Requirement name
Example:
1.1.1 Ensure a separate partition for containers has been createdIs requirement passing
Policy ID
Example:
4Policy name
Example:
CIS Docker BenchmarkRequirement ID
Example:
5000Highest control severity
Example:
HighRequirement zone
- zone
Zone ID
Example:
1001Zone name
Example:
Entire Infrastructure
Total number of requirements matching filter (limited to 1000)
Example:
732
Status Code
Successfully returned CSPM v1 Compliance Results.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Compliance Views
Get the high-level compliance views for all zones.
GET /api/cspm/v1/compliance/views
Response
List of Compliance Views
- data
List of policies calculated in the View
- policies
Number of accepted resources
Example:
2Number of failing controls
Example:
58Policy ID
Example:
100066Policy name
Example:
My PolicyPercentage of passing requirements
Example:
55View result history (last 30 evaluations)
- requirementsHistory
Time of evaluation in unix timestamp (milliseconds)
Example:
1661430108Number of failing requirements
Example:
47Number of passing requirements
Example:
15Percentage of passing requirements
Example:
24
Counters of violated resources per severity
- resourceViolationSummary
Example:
930Example:
981Example:
806
Zone ID
Example:
1Zone name
Example:
Entire Infrastructure
Status Code
Successfully returned CSPM v1 Compliance Views.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Update favorite view
Add view to favorites or remove from favorites.
PUT /api/cspm/v1/compliance/views/favorite
Accept Posture Risk
Accept a Posture Risk by parameters
POST /api/cspm/v1/compliance/violations/acceptances
Request
Risk Accept Parameters
Posture Control ID to accept
Example:
1Acceptance additional description
Example:
Jane - will take care of itTime to expire the risk accept in unix timestamp (milliseconds), will not expire if not provided.
Example:
1660742030427Query language expression for filtering results.
Operators:
in
List of supported fields:
name- Type: string
- Example:
name in ("cf-templates-1s951ca3qbh1-us-west-2") - Description: The name of the resource to accept risk for
namespace- Type: string
- Example:
namespace in ("my-namespace") - Description: The namespace to accept risk for
kind- Type: string
- Example:
kind in ("AWS_S3_BUCKET") - Description: The resource kind to accept risk for
location- Type: string
- Example:
location in ("ap-southeast-2") - Description: The cloud location/region to accept risk for
providerType- Type: string
- Example:
providerType in ("AWS") - Description: The cloud provider to accept risk for (AWS/GCP/Azure)
Example:
location in ("us-west-2") and name in ("cf-templates-1s951ca3qbh1-us-west-2")Acceptance reason
Example:
Risk OwnedAccount ID/Cluster/Host to accept risk for
Example:
012345678901Zone ID to accept the risk in
Example:
7
Response
Risk acceptance data
Acceptance period in days
Example:
30Acceptance date in unix timestamp (milliseconds)
Example:
1660742030427Posture Control ID
Example:
1Acceptance additional description
Example:
Jane - will take care of itAcceptance expiry date in unix timestamp (milliseconds)
Example:
1663361999999Acceptance ID
Example:
62fce98ebc19e98141f04f1fIs acceptance expired
Acceptance reason
Example:
Risk OwnedAccount ID/Cluster/Host
User display name of the user that accepted the risk
Example:
Jane DoeUsername of the user that accepted the risk
Example:
jane.doe@myorg.comZone ID
Example:
7
Status Code
Successfully accepted a Posture Risk
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Kuberenetes Resources
Gets the list of Kubernetes resources and their compliance data for a specific control
GET /api/cspm/v1/kube/resources
Request
Query Parameters
Control ID
Example:
21Resource kind ('workload', 'subject', 'role' or 'group')
Example:
workloadQuery language expression for filtering results. Operators:
and,orandnotlogical operators=,!=incontainsandstartsWithto check partial values of attributes
List of supported fields:
zones.id- Type: integer
- Example:
zones.id=1 - Description: Evaluated zone ID.
zoneName- Type: string
- Description: Zone name
policyId- Type: integer
- Example:
policyId=1 - Description: Evaluated policy ID.
policyName- Type: string
- Description: Policy name
pass- Type: boolean
- Example:
pass=true - Description: Passing status of resource.
accepted- Type: boolean
- Example:
accepted=true - Description: Return accepted resources.
clusterName- Type: string
- Description: Cluster name.
name- Type: string
- Description: Resource name.
namespace- Type: string
- Description: Resource namespace.
type- Type: string
- Example:
type="DaemonSet" - Description: Resource k8s type.
labelValues- Type: string
- Description: Resource labels.
distributionName- Type: string
- Description: Kubernetes Distribution Name.
- Example: distributionName in ("Vanilla")
distributionVersion- Type: string
- Description: Kubernetes Distribution Version.
- Example: distributionVersion in (1.23, 1.25)
platformAccountId- Type: string
- Description: Cloud Account ID
- Example: 012345678901
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
pass=false or accepted=truePage number. Defaults to 1.
Example:
1Page size. Defaults to 50.
Example:
50
Response
- data
Risk acceptance data
- acceptance
Acceptance period in days
Example:
30Acceptance date in unix timestamp (milliseconds)
Example:
1660742030427Acceptance additional description
Example:
Jane - will take care of itAcceptance expiry date in unix timestamp (milliseconds)
Example:
1663361999999Acceptance ID
Example:
62fce98ebc19e98141f04f1fIs acceptance expired
Acceptance reason
Example:
Risk OwnedUser display name of the user that accepted the risk
Example:
Jane DoeUsername of the user that accepted the risk
Example:
jane.doe@myorg.com
Cluster name
Example:
kspm-test-chen-4Distribution Name.
Example:
vanillaDistribution Version.
Example:
1.23Resource unique identifier
Example:
4e3e444e6e42e00c69e57e7119929eb1Resource labels
last time scan ended successfully for this resource (UNIX timestamp, milliseconds)
Example:
1660742138Resource name
Example:
risky-redis-deploymentResource namespace
Example:
risky-redis-deploymentIs resource passing for given control
Cloud Account ID
Example:
012345678901Kubernetes object type
Example:
DeploymentList of container names violating the given control
Resource zones
- zones
Zone ID
Example:
1001Zone name
Example:
Entire Infrastructure
Total number of resources matching filter (limited to 1000)
Example:
5112
Status Code
Successfully returned CSPM v1 Kubernetes resources.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Request
Control description.
Example:
'.netrc' files may contain unencrypted passwords that may be used to attack other systems.Control id.
Example:
4e3e444e6e42e00c69e57e7119929eb1Control name.
Example:
"Users" .netrc files permissions 600 or more restrictiveControl rego.
Examples:package user_roles allowed_roles = {"admin", "user"} default risky = false risky { not input.role in allowed_roles }Control remediation details.
Examples:The user role is invalid. Please ensure that the user role is set to either 'admin' or 'user' to comply with the allowed roles policy.
Resource kind.
Example:
aws_userControl severity.
Example:
High
Response
- data
Control authors.
Example:
SysdigControl description.
Example:
'.netrc' files may contain unencrypted passwords that may be used to attack other systems.Control id.
Example:
4e3e444e6e42e00c69e57e7119929eb1Does control need to be checked manually.
Example:
trueIs control created by system.
Example:
trueControl name.
Example:
"Users" .netrc files permissions 600 or more restrictiveControl platform.
Example:
KubernetesControl remediation details.
Examples:1. Create a separate partition for containers. 2. Unmount the /var/lib/docker directory. 3. Mount the /var/lib/docker directory on a separate partition. 4. Update the /etc/fstab file.API endpoint for listing the evaluated resources for this control.
Example:
/api/cspm/v1/kube/resources?controlId=32&resourceKind=workload&filter=policyId=100000 and zones.id=1Control severity.
Example:
HighList of supported distributions of a specific control.
- supportedDistributions
Distribution max version.
Example:
1.25Distribution min version.
Example:
1.23Distribution name.
Example:
Vanilla
Status Code
Successfully saved control.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Get Resource Example
Get the resource example for a specific resource kind.
GET /api/cspm/v1/policy/controls/resource-template/view/{resource_kind}Response
Resource example.
Examples:{\"AccessKeys\":[{\"AccessKeyId\":\"string\",\"CreateDate\":\"string\",\"Status\":\"string\",\"UserName\":\"string\"}],\"Arn\":\"string\",\"CreateDate\":\"string\",\"InlinePolicies\":[\"string\"],\"InlinePoliciesAttributes\":[{\"PolicyDocument\":\"string\",\"PolicyName\":\"string\",\"ResultMetadata\":{},\"UserName\":\"string\"}],\"PasswordLastUsed\":null,\"Path\":\"string\",\"PermissionBoundaryPolicy\":[{\"AccountId\":\"string\",\"Arn\":\"string\",\"AttachmentCount\":2,\"CreateDate\":\"string\",\"DefaultVersionId\":\"string\",\"Description\":null,\"GroupPolicies\":[{\"GroupId\":\"string\",\"GroupName\":\"string\",\"PolicyArn\":\"string\"}],\"IsAttachable\":true,\"Path\":\"string\",\"PermissionsBoundaryUsageCount\":0,\"PolicyId\":\"string\",\"PolicyName\":\"string\",\"RolePolicies\":[{\"PolicyArn\":\"string\",\"RoleId\":\"string\",\"RoleName\":\"string\"}]}
Status Code
Successfully retrieved resource example.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Request
Query Parameters
Query language expression for filtering results. Operators:
and,orandnotlogical operators=,!=incontainsandstartsWithto check partial values of attributes
List of supported fields:
name- Type: string
- Description: Control name.
description- Type: string
- Description: Control description.
severity- Type: Integer
- Description: Requirement severity. (1=low, 2=medium, 3=high)
- Example:
severity in (3, 2)
type- Type: string
- Description: Host control type.
- Example:
type="Host"
target- Type: string
- Description: Control supported target. ("AKS", "AWS", "Azure", "Docker" ,"EKS", "Linux", "GCP", "GKE", "IKS", "MKE", "OCP4", "Vanilla")
- Example:
target in ("IKS")
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
type="host" and severity in (3, 2)Page number. Defaults to 1.
Example:
1Page size. Defaults to 50.
Example:
50
Response
- data
Control authors.
Example:
SysdigControl description.
Example:
'.netrc' files may contain unencrypted passwords that may be used to attack other systems.Control id.
Example:
4e3e444e6e42e00c69e57e7119929eb1Does control need to be checked manually.
Example:
trueIs control created by system.
Example:
trueControl name.
Example:
"Users" .netrc files permissions 600 or more restrictiveControl platform.
Example:
KubernetesControl remediation details.
Examples:1. Create a separate partition for containers. 2. Unmount the /var/lib/docker directory. 3. Mount the /var/lib/docker directory on a separate partition. 4. Update the /etc/fstab file.API endpoint for listing the evaluated resources for this control.
Example:
/api/cspm/v1/kube/resources?controlId=32&resourceKind=workload&filter=policyId=100000 and zones.id=1Control severity.
Example:
HighList of supported distributions of a specific control.
- supportedDistributions
Distribution max version.
Example:
1.25Distribution min version.
Example:
1.23Distribution name.
Example:
Vanilla
Total number of controls matching filter (limited to 1000)
Example:
5112
Status Code
Successfully returned CSPM v1 controls.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Request
Control rego.
Examples:package user_roles allowed_roles = {"admin", "user"} default risky = false risky { not input.role in allowed_roles }Resource kind.
Example:
aws_user
Response
Test rego error message.
Example:
error: rego_type_error: input.role must be a stringTest rego result.
Example:
true
Status Code
Successfully tested rego policy.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Get Control Configurations
Get control configurations for a specific control ID.
GET /api/cspm/v1/policy/controls/{controlId}/configurationResponse
- default
Control Sysdig severity. (1=low, 2=medium, 3=high)
Control Sysdig evaluation value, which may consist of multiple values.
- system
Control custom severity. (1=low, 2=medium, 3=high)
Control custom evaluation value, which may consist of multiple values.
Status Code
Successfully retrieved control configurations.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
{ "default": { "severity": 1, "violationValue": [ "644", "400" ] }, "system": { "severity": 3, "violationValue": [ "600" ] } }
Update Control Configurations
Update control configurations for a specific control ID.
PUT /api/cspm/v1/policy/controls/{controlId}/configurationRequest
{
"default": {
"severity": 1,
"violationValue": [
"600",
"400"
]
}
}- default
Control severity. (1=low, 2=medium, 3=high)
Control evaluation value, which may consist of multiple values.
Response
- default
Control Sysdig severity. (1=low, 2=medium, 3=high)
Control Sysdig evaluation value, which may consist of multiple values.
- system
Control custom severity. (1=low, 2=medium, 3=high)
Control custom evaluation value, which may consist of multiple values.
Status Code
Successfully updated control configurations.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
{ "default": { "severity": 1, "violationValue": [ "644", "400" ] }, "system": { "severity": 3, "violationValue": [ "600" ] } }
Response
- data
Policy authors
Example:
John DoePolicy description
Example:
CIS Docker BenchmarkPolicy ID
Example:
1001Policy is active
Example:
truePolicy is custom
Policy link
Policy maximum Kubernetes version
Example:
1.18Policy minimum Kubernetes version
Example:
1.16Policy name
Example:
CIS Docker BenchmarkPolicy platform
Example:
KubernetesPolicy published date
Example:
1588617600000Policy type - 0 - UNKNOWN - 1 - KUBERNETES - 2 - DOCKER - 3 - LINUX - 4 - AWS - 5 - GCP - 6 - AZURE
Possible values: [
0,1,2,3,4,5,6]Example:
2Policy version
Example:
1.0.0Policy zones
- zones
Zone ID
Example:
1001Zone name
Example:
Entire Infrastructure
Status Code
Successfully returned CSPM v1 policies.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Request
Query Parameters
Query language expression for filtering results.
Operators:
and,orandnotlogical operators=,!=>,>=,<,<=incontainsandstartsWithto check partial values of attributes
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
name in "zone1"Page number. Defaults to 1.
Example:
1Page size. Defaults to 50.
Example:
50
Response
- data
Zone author
Example:
john.doe@sysdig.comZone description
Example:
Zone groups AWS and Azure accountsZone ID
Example:
1001Is zone made by sysdig
Zone last modified by
Example:
john.doe@sysdig.comZone last updated
Example:
1687428854564Zone name
Example:
AWS and Azure accountsZone policies
- policies
Policy ID
Example:
1001Policy kind - 0 - None - 1 - BestPractice - 2 - Compliance - 3 - Corporate
Possible values: [
0,1,2,3]Example:
1Policy name
Example:
CIS Docker BenchmarkPolicy type - 0 - UNKNOWN - 1 - KUBERNETES - 2 - DOCKER - 3 - LINUX - 4 - AWS - 5 - GCP - 6 - AZURE
Possible values: [
0,1,2,3,4,5,6]Example:
2
Zone scopes
- scopes
Query language expression for filtering results.
Empty rule means no filtering.
Operators:
incontainsto check partial values of attributes
List of supported fields By Target Type:
aws:account- Type: string
- Description: AWS account ID
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: AWS organization ID
- Example query: "organization in ("o-1234567890")"
labels- Type: string
- Description: AWS account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: AWS account location
- Example query: "location in ("us-east-1")"
gcp:account- Type: string
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: GCP organization ID
- Example query: "organization in ("1234567890")"
labels- Type: string
- Description: GCP account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: GCP account location
- Example query: "location in ("us-east-1")"
azure:account- Type: string
- Description: Azure account ID
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: Azure organization ID
- Example query: "organization in ("1234567890")"
labels- Type: string
- Description: Azure account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: Azure account location
- Example query: "location in ("us-east-1")"
kubernetes:clusterId- Type: string
- Description: Kubernetes cluster ID
- Example query: "clusterId in ("cluster")"
namespace- Type: string
- Description: Kubernetes namespace
- Example query: "namespace in ("namespace")"
labelValues- Type: string
- Description: Kubernetes label values
- Example query: "labelValues in ("label1")"
distribution- Type: string
- Description: Kubernetes distribution
- Example query: "distribution in ("eks")"
host:clusterId- Type: string
- Description: Kubernetes cluster ID
- Example query: "clusterId in ("cluster")"
name- Type: string
- Description: Host name
- Example query: "name in ("host")"
image:registry- Type: string
- Description: Image registry
- Example query: "registry in ("registry")"
repository- Type: string
- Description: Image repository
- Example query: "repository in ("repository")"
git:gitIntegrationId- Type: string
- Description: Git integration ID
- Example query: "gitIntegrationId in ("gitIntegrationId")"
gitSourceId- Type: string
- Description: Git source ID
- Example query: "gitSourceId in ("gitSourceId")"
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
clusterId in (\"cluster\")Target type.
Supported target types:
- AWS -
aws - GCP -
gcp - Azure -
azure - Kubernetes -
kubernetes - Image -
image - Host -
host - Git -
git
Example:
aws- AWS -
Total number of zones matching filter (limited to 1000)
Example:
5112
Status Code
Successfully returned CSPM v1 zones.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Request
Zone to create
Zone description
Zone ID, if provided will update the existing Zone with the given ID.
Zone name
Zone policy IDs
Zone scopes
- scopes
Query language expression for filtering results.
Empty rule means no filtering.
Operators:
incontainsto check partial values of attributes
List of supported fields By Target Type:
aws:account- Type: string
- Description: AWS account ID
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: AWS organization ID
- Example query: "organization in ("o-1234567890")"
labels- Type: string
- Description: AWS account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: AWS account location
- Example query: "location in ("us-east-1")"
gcp:account- Type: string
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: GCP organization ID
- Example query: "organization in ("1234567890")"
labels- Type: string
- Description: GCP account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: GCP account location
- Example query: "location in ("us-east-1")"
azure:account- Type: string
- Description: Azure account ID
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: Azure organization ID
- Example query: "organization in ("1234567890")"
labels- Type: string
- Description: Azure account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: Azure account location
- Example query: "location in ("us-east-1")"
kubernetes:clusterId- Type: string
- Description: Kubernetes cluster ID
- Example query: "clusterId in ("cluster")"
namespace- Type: string
- Description: Kubernetes namespace
- Example query: "namespace in ("namespace")"
labelValues- Type: string
- Description: Kubernetes label values
- Example query: "labelValues in ("label1")"
distribution- Type: string
- Description: Kubernetes distribution
- Example query: "distribution in ("eks")"
host:clusterId- Type: string
- Description: Kubernetes cluster ID
- Example query: "clusterId in ("cluster")"
name- Type: string
- Description: Host name
- Example query: "name in ("host")"
image:registry- Type: string
- Description: Image registry
- Example query: "registry in ("registry")"
repository- Type: string
- Description: Image repository
- Example query: "repository in ("repository")"
git:gitIntegrationId- Type: string
- Description: Git integration ID
- Example query: "gitIntegrationId in ("gitIntegrationId")"
gitSourceId- Type: string
- Description: Git source ID
- Example query: "gitSourceId in ("gitSourceId")"
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
clusterId in (\"cluster\")Target type.
Supported target types:
- AWS -
aws - GCP -
gcp - Azure -
azure - Kubernetes -
kubernetes - Image -
image - Host -
host - Git -
git
Example:
aws- AWS -
Response
- data
Zone author
Example:
john.doe@sysdig.comZone description
Example:
Zone groups AWS and Azure accountsZone ID
Example:
1001Is zone made by sysdig
Zone last modified by
Example:
john.doe@sysdig.comZone last updated
Example:
1687428854564Zone name
Example:
AWS and Azure accountsZone policies
- policies
Policy ID
Example:
1001Policy kind - 0 - None - 1 - BestPractice - 2 - Compliance - 3 - Corporate
Possible values: [
0,1,2,3]Example:
1Policy name
Example:
CIS Docker BenchmarkPolicy type - 0 - UNKNOWN - 1 - KUBERNETES - 2 - DOCKER - 3 - LINUX - 4 - AWS - 5 - GCP - 6 - AZURE
Possible values: [
0,1,2,3,4,5,6]Example:
2
Zone scopes
- scopes
Query language expression for filtering results.
Empty rule means no filtering.
Operators:
incontainsto check partial values of attributes
List of supported fields By Target Type:
aws:account- Type: string
- Description: AWS account ID
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: AWS organization ID
- Example query: "organization in ("o-1234567890")"
labels- Type: string
- Description: AWS account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: AWS account location
- Example query: "location in ("us-east-1")"
gcp:account- Type: string
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: GCP organization ID
- Example query: "organization in ("1234567890")"
labels- Type: string
- Description: GCP account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: GCP account location
- Example query: "location in ("us-east-1")"
azure:account- Type: string
- Description: Azure account ID
- Example query: "account in ("123456789012")"
organization- Type: string
- Description: Azure organization ID
- Example query: "organization in ("1234567890")"
labels- Type: string
- Description: Azure account labels
- Example query: "labels in ("label1")"
location- Type: string
- Description: Azure account location
- Example query: "location in ("us-east-1")"
kubernetes:clusterId- Type: string
- Description: Kubernetes cluster ID
- Example query: "clusterId in ("cluster")"
namespace- Type: string
- Description: Kubernetes namespace
- Example query: "namespace in ("namespace")"
labelValues- Type: string
- Description: Kubernetes label values
- Example query: "labelValues in ("label1")"
distribution- Type: string
- Description: Kubernetes distribution
- Example query: "distribution in ("eks")"
host:clusterId- Type: string
- Description: Kubernetes cluster ID
- Example query: "clusterId in ("cluster")"
name- Type: string
- Description: Host name
- Example query: "name in ("host")"
image:registry- Type: string
- Description: Image registry
- Example query: "registry in ("registry")"
repository- Type: string
- Description: Image repository
- Example query: "repository in ("repository")"
git:gitIntegrationId- Type: string
- Description: Git integration ID
- Example query: "gitIntegrationId in ("gitIntegrationId")"
gitSourceId- Type: string
- Description: Git source ID
- Example query: "gitSourceId in ("gitSourceId")"
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
clusterId in (\"cluster\")Target type.
Supported target types:
- AWS -
aws - GCP -
gcp - Azure -
azure - Kubernetes -
kubernetes - Image -
image - Host -
host - Git -
git
Example:
aws- AWS -
Status Code
Successfully created or updated CSPM v1 zone.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Request
Query Parameters
Query language expression for filtering results.
Operators:
and,orandnotlogical operators=,!=>,>=,<,<=incontainsandstartsWithto check partial values of attributes
List of supported fields:
type- Type: string
- Description: Task type.
- Kubernetes Host Scan - Scans and evaluates the Linux, Docker, and Kubernetes configurations on Kubernetes hosts.
- Kubernetes Scan - Scans and evaluates Kubernetes resource manifests.
- Git Integration Scan - Scans and evaluates Infrastructure-as-Code (IAC) files from a Git integration.
- Init Cloud Scan - Initiates Cloud Scan tasks for connected cloud accounts.
- Cloud Scan - Scans and evaluates cloud resources.
- Host Benchmark Scan - Scans and evaluates Linux and Docker configurations on a Linux host.
- Supported operators:
=,!=,in,not in - Example:
type="kuberenetes scan"
parameters:- Type: string
- Description: Task parameters:
- Benchmark Type
Description: The type of requested scan - 0=Linux, 1=Docker, 2=Kubernetes. A benchmark scan collects Linux\Docker\Kubernetes configuration per this parameter.
Related Task Types: Kubernetes Host Scan, Kubernetes Scan, Host Benchmark Scan - Cluster
Description: The kubernetes cluster name.
Related Task Types: Kubernetes Host Scan, Kubernetes Scan - Host
Description: The linux host name to run Linux\Docker benchmark scan on.
Related Task Types: Host Benchmark Scan - GitIntegration:
Description: The Git Integration Id to run a scan on.
Related Task Types: Git Integration Scan - Account
Description: The Cloud Account Id. Related Task Types: Init Cloud Scan, Cloud Scan - ProviderType
Description: The Cloud Account provider type. Possible values are "AWS", "GCP", or "Azure". Related Task Types: Init Cloud Scan, Cloud Scan
- Benchmark Type
- example:
parameters contains 'providertype: aws'
startDate- Type: string
- Description: Task created at in UTC. Format: "YYYY-MM-DD HH:mm:ss"
- Supported operators:
=,!=,>,>=,<,<= - Example:
startDate > "2023-05-28 10:00:00"
endDate- Type: string
- Description: Task ended at in UTC. Format: "YYYY-MM-DD HH:mm:ss"
- Supported operators:
=,!=,>,>=,<,<= - Example:
endDate <= "2023-05-28 10:00:00"
status- Type: string
- Description: Task status.
- Pending
- Running
- Completed
- Failed
- Canceled
- CompletedWithWarning
- Supported operators:
=,!=,in,not in - Example:
status in ("running", "pending")
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
type="Cloud Scan" and status in ("pending", "running")Page number. Defaults to 1.
Example:
1Page size. Defaults to 20.
Example:
20
Response
- data
Task when the task ended in UTC.
Example:
2023-05-28T10:33:38.475633ZTask ID.
Example:
23Task parameter.
- Benchmark Type
Description: The type of requested scan - 0=Linux, 1=Docker, 2=Kubernetes. A benchmark scan collects Linux\Docker\Kubernetes configuration per this parameter.
Related Task Types: Kubernetes Host Scan, Kubernetes Scan, Host Benchmark Scan - Cluster
Description: The kubernetes cluster name.
Related Task Types: Kubernetes Host Scan, Kubernetes Scan - Host
Description: The linux host name to run Linux\Docker benchmark scan on.
Related Task Types: Host Benchmark Scan - GitIntegration:
Description: The Git Integration Id to run a scan on.
Related Task Types: Git Integration Scan - Account
Description: The Cloud Account Id. Related Task Types: Init Cloud Scan, Cloud Scan - ProviderType
Description: The Cloud Account provider type. Possible values are "AWS", "GCP", or "Azure".
Related Task Types: Init Cloud Scan, Cloud Scan
- Benchmark Type
Time when the task created in UTC.
Example:
2023-05-28T10:33:28.996252ZTask status.
- Pending
- Running
- Completed
- Failed
- Canceled
- CompletedWithWarning
Example:
PendingTask type.
- Kubernetes Host Scan - Scans and evaluates the Linux, Docker, and Kubernetes configurations on Kubernetes hosts.
- Kubernetes Scan - Scans and evaluates Kubernetes resource manifests.
- Git Integration Scan - Scans and evaluates Infrastructure-as-Code (IAC) files from a Git integration.
- Init Cloud Scan - Initiates Cloud Scan tasks for connected cloud accounts.
- Cloud Scan - Scans and evaluates cloud resources.
- Host Benchmark Scan - Scans and evaluates Linux and Docker configurations on a Linux host.
Example:
Init Cloud Scan
Total number of tasks matching filter (limited to 1000)
Example:
123
Status Code
Successfully returned CSPM v1 tasks.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Response
Task when the task ended in UTC.
Example:
2023-05-28T10:33:38.475633ZTask ID.
Example:
23- logs
Time log created in UTC.
Example:
2023-05-28T10:14:38.377540ZLog deatils.
Example:
Failed to start task: get account for task: missing account parameterTask type. (Info, Warning, Error)
Example:
Error
Task parameter:
- Benchmark Type
Description: The type of requested scan - 0=Linux, 1=Docker, 2=Kubernetes. A benchmark scan collects Linux\Docker\Kubernetes configuration per this parameter.
Related Task Types: Kubernetes Host Scan, Kubernetes Scan, Host Benchmark Scan - Cluster
Description: The kubernetes cluster name.
Related Task Types: Kubernetes Host Scan, Kubernetes Scan - Host
Description: The linux host name to run Linux\Docker benchmark scan on.
Related Task Types: Host Benchmark Scan - GitIntegration:
Description: The Git Integration Id to run a scan on.
Related Task Types: Git Integration Scan - Account
Description: The Cloud Account Id.
Related Task Types: Init Cloud Scan, Cloud Scan - ProviderType
Description: The Cloud Account provider type. Possible values are "AWS", "GCP", or "Azure".
Related Task Types: Init Cloud Scan, Cloud Scan"
- Benchmark Type
Time when the task created in UTC.
Example:
2023-05-28T10:33:28.996252ZTask status.
- Pending
- Running
- Completed
- Failed
- Canceled
- CompletedWithWarning
Example:
PendingTask type.
- Kubernetes Host Scan - Scans and evaluates the Linux, Docker, and Kubernetes configurations on Kubernetes hosts.
- Kubernetes Scan - Scans and evaluates Kubernetes resource manifests.
- Git Integration Scan - Scans and evaluates Infrastructure-as-Code (IAC) files from a Git integration.
- Init Cloud Scan - Initiates Cloud Scan tasks for connected cloud accounts.
- Cloud Scan - Scans and evaluates cloud resources.
- Host Benchmark Scan - Scans and evaluates Linux and Docker configurations on a Linux host.
Example:
Init Cloud Scan
Status Code
Successfully returned CSPM v1 tasks.
Invalid or missing auth token.
Forbidden access to CSPM v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Search and list Inventory Resources
Search for Inventory Resources based on a given filter.
GET /api/cspm/v1/inventory/resources
Request
Query Parameters
Query language expression for filtering results. Operators:
and,orandnotlogical operators=,!=incontainsandstartsWithto check partial values of attributesexiststo check if a field exists and not empty
List of supported fields:
account- Type: string
- Example:
account in ("285211435247") - Description: The account that will be included in the results.
cluster- Type: string
- Example:
cluster in ("cluster1") - Description: The kubernetes cluster that will be included in the results.
externalDNS- Type: string
- Example:
externalDNS in ("ec2-103-34-15-23.compute-1.amazonaws.com") - Description: The external DNS that will be included in the results.
distribution- Type: string
- Example:
distribution in ("gke", "vanilla") - Description: The kubernetes distribution that will be included in the results.
integrationName- Type: string
- Example:
integrationName = "github-integration" - Description: The name of the integration an IaC resource belongs to.
labels- Type: string
- Example:
not labels exists - Description: The resource labels that will be included in the results.
location- Type: string
- Example:
location starts with "https://bitbucket.org/organizations-workspace/teams-repository/src" - Description: The web address of an IaC Manifest.
name- Type: string
- Example:
name starts with "acl" - Description: The names that will be included in the results.
namespace- Type: string
- Example:
namespace contains "production" - Description: The namespace that will be included in the results.
nodeType- Type: string
- Example:
nodeType="Worker" - Description: The nodeType that will be included in the results.
osName- Type: string
- Example:
osName != "linux" - Description: The operating system that will be included in the results.
osImage- Type: string
- Example:
osImage = "Ubuntu 18.04.6 LTS" - Description: The operating system image that will be included in the results.
organization- Type: string
- Example:
organization = "s-xqe92dwe61" - Description: The organization that will be included in the results.
platform- Type: string
- Example:
platform = "AWS" - Description: The platform that will be included in the results.
control.accepted- Type: string
- Example:
control.accepted exists - Description: Include (or Exclude) only resources with accepted results. Supported operators: exists and not exists.
policy- Type: string
- Example:
policy in (“CIS Docker Benchmark”) - Description: Include resources that applied the selected policies. Supported operators: in, not in, exists, not exists.
control.severity- Type: string
- Example:
control.severity in ("High") - Description: Include resources that have violated risks in the selected severities. Supported operators: in, not in.
control.failed- Type: string
- Example:
control.failed in ("/etc/default/docker owned by root:root") - Description: Include resources that have violated the selected risks. Supported operators: in, not in, exists, not exists.
policy.failed- Type: string
- Example:
policy.failed in ("PCI DSS (Payment Card Industry Data Security Standard) v3.2.1") - Description: Include resources that failed the selected policies. Supported operators: in, not in, exists, not exists.
policy.passedin ("CIS Kubernetes V1.20 Benchmark")- Type: string
- Example:
policy.passed in ("CIS Kubernetes V1.20 Benchmark") - Description: Include resources that passed the selected policies. Supported operators: in, not in, exists, not exists.
project- Type: string
- Example:
project = "project1" - Description: The project that will be included in the results.
region- Type: string
- Example:
region in ("europe-west1") - Description: The regions that will be included in the results.
repository- Type: string
- Example:
repository in ("e2e-repo") - Description: The Repository an IaC resource belongs to.
resourceOrigin- Type: string
- Example:
resourceOrigin = "Code" - Description: Origin of the resource. Supported values: Code, Deployed.
type- Type: string
- Example:
type = "Account" - Description: The resource types that will be included in the results.
subscription- Type: string
- Example:
subscription = "Azure subscription 1" - Description: The Azure subscriptions that will be included in the results.
sourceType- Type: string
- Example:
sourceType = "YAML" - Description: The source type of an IaC resource. Supported values: YAML, Kustomize, Terraform, Helm.
version- Type: string
- Example:
version = "1.1" - Description: The versions that will be included in the results.
zone- Type: string
- Example:
zone in ("zone1") - Description: The zones that will be included in the results.
category- Type: string
- Example:
category in ("Compute", "IAM") - Description: The category that will be included in the results.
Note: Whenever filtering for values with special characters, the values need to be encoded. When “ or \ are the special characters, they need to be escaped with \ and then encoded.
Example:
platform = "AWS" and policy.failed in ("CIS Amazon Web Services Foundations Benchmark")Page number. Defaults to 1.
Example:
1Page size. Defaults to 20.
Example:
20The desired fields to be returned from the query. Defaults to
hash,name,platform,type,configapiendpoint,labels,lastseen,metadata,zones,posturepolicysummary,resourceorigin,category. Fields that are not specified will return empty (even if they have values).Example:
name,platform,posturecontrolsummary
Response
Inventory resources
- data
The category the resource belongs to
Example:
NetworkingLink that provides the resource configuration
Example:
/api/cspm/v1/kube/resource?resourceHash=62e348b71acd7be14a4bdfcc&resourceKind=DaemonSetResource hash
Example:
62e348b71acd7be14a4bdfccThe resource labels
Last scan date as unix timestamp
Example:
1660742138The resource metadata
Examples:{ "Account": "746213592136", "Organization": "o-k53g78fd13e9", "Region": "us-east-1" }Resource name
Example:
aws-bucket1The resource platform (AWS, GCP, Kubernetes, Azure, etc.)
Example:
AWSDetailed breakdown of controls per Posture policy
- postureControlSummary
Number of accepted controls
Example:
3Number of failed controls
Example:
5The Posture policy name
Example:
CIS Amazon Web Services Foundations BenchmarkPolicy Id
Example:
15
The posture policy summary
- posturePolicySummary
Percentage of policies passing
Example:
50The policies list
- policies
Policy Id
Example:
15Policy Name
Example:
CIS Amazon Web Services Foundations BenchmarkTrue for passed, false for failed
Where a resource was collected (Code, Deployed)
Example:
DeployedThe resource type
Example:
AWS_S3_BUCKET_ACLResource zones
- zones
The zone identifier
Example:
1The zone name
Example:
Entire Infrastructure
Total number of resources matching filter (limited to 1000)
Example:
5112
Status Code
Successfully returned Inventory v1 resources.
Invalid or missing auth token.
Forbidden access to Inventory v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Retrieve a single Inventory Resource by its hash
Retrieve an Inventory Resource by its hash
GET /api/cspm/v1/inventory/resources/{hash}Request
Path Parameters
The resource’s hash
Example:
62e348b71acd7be14a4bdfcc
Query Parameters
The desired fields to be returned from the query. Defaults to
hash,name,platform,type,configapiendpoint,labels,lastseen,metadata,zones,posturepolicysummary,resourceorigin,category. Fields that are not specified will return empty (even if they have values).Example:
name,platform,posturecontrolsummary
Response
- data
The category the resource belongs to
Example:
NetworkingLink that provides the resource configuration
Example:
/api/cspm/v1/kube/resource?resourceHash=62e348b71acd7be14a4bdfcc&resourceKind=DaemonSetResource hash
Example:
62e348b71acd7be14a4bdfccThe resource labels
Last scan date as unix timestamp
Example:
1660742138The resource metadata
Examples:{ "Account": "746213592136", "Organization": "o-k53g78fd13e9", "Region": "us-east-1" }Resource name
Example:
aws-bucket1The resource platform (AWS, GCP, Kubernetes, Azure, etc.)
Example:
AWSDetailed breakdown of controls per Posture policy
- postureControlSummary
Number of accepted controls
Example:
3Number of failed controls
Example:
5The Posture policy name
Example:
CIS Amazon Web Services Foundations BenchmarkPolicy Id
Example:
15
The posture policy summary
- posturePolicySummary
Percentage of policies passing
Example:
50The policies list
- policies
Policy Id
Example:
15Policy Name
Example:
CIS Amazon Web Services Foundations BenchmarkTrue for passed, false for failed
Where a resource was collected (Code, Deployed)
Example:
DeployedThe resource type
Example:
AWS_S3_BUCKET_ACLResource zones
- zones
The zone identifier
Example:
1The zone name
Example:
Entire Infrastructure
Status Code
Successfully returned an Inventory v1 resource.
Invalid or missing auth token.
Forbidden access to Inventory v1.
The server encountered an unexpected condition that prevented it from fulfilling the request.
Service is unavailable.
No Sample Response
Retrieve a group of all rules matching a list of given names
Retrieve a group of all rules matching a list of given names. This is used to show how a base rule is modified by later rules that override/append to the rule. This API would be faster than making calls to "#/api/secure/rules/groups" with one rule name at a time
GET /api/policies/v3/rules/groups
Response
Status Code
A wrapper object containing array of rule groups, where outside array size will be the same size as the valid rule names passed in query params and these will be sorted by the name. Each rule group will contain base rule followed by appends and will be ordered by rule origin ["Secure UI", "Sysdig", "Profiling", "Tuner"]
Indicates the names field is either missing or is empty
No Sample Response
Request
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Allowable values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Allowable values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Allowable values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Possible values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Possible values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Status Code
The saved rule
The provided rule is not valid
No Sample Response
Retrieve a group of all rules having a given name
Retrieve a group of all rules having the given name. This is used to show how a base rule is modified by later rules that override/append to the rule. If there are multiple rules with the same name of different types, rule type must be specified.
GET /api/secure/rules/groups
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Possible values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Possible values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Status Code
An array of rules
No Sample Response
Retrieve a map of rule names to their corresponding policies that use them
Retrieve a map of rule names to their corresponding policies that use them. The accept header will include "lite" to indicate the lightweight response of the endpoint should be returned e.g. 'application/xhtml+xml; lite' and return the full representation if not requested
GET /api/secure/rules/policyMappings
Request
Query Parameters
A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI
Response
- policies
True if the policy should be considered
Example:
trueUnique identifier representing a specific policy.
Example:
1A short name for the policy
Example:
Check filesystem activity
policy type of the policies corresponding to this rule
Example:
aws_cloudtrailthe name of a runtime policy rule
Example:
shell_in_container
Status Code
An array of policies
No Sample Response
Retrieve a list of summary rule information, grouped by rule name
Returns the list of rules in the system. These are grouped by name and do not necessarily represent individual rule objects, as multiple rules can have the same name.
GET /api/secure/rules/summaries
Request
Query Parameters
A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Allowable values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]
Response
The specific object ids having this name
Examples:[ 6, 17, 21 ]A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA set of (origin,versionId) pairs for all the objects sharing this name.
- publishedBys
A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIA string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCOThe number of rules that refer to this object (macro/list) OR the number of policies that refer to this rule
The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702738265
Status Code
An array of rules grouped by name.
No Sample Response
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Possible values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Possible values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Status Code
The rule that was deleted
No Sample Response
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Possible values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Possible values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Status Code
The rule with the given id
No Sample Response
Request
Path Parameters
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Allowable values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Allowable values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Allowable values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Possible values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Possible values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Status Code
The rule with the given id
The provided rule is not valid
Resource with the specified ID could not be found. More information about 404 can be found at https://httpstatuses.com/404
The user must first perform a GET request to get the current version of the resource. The user must then compare the remote version with the local expected version and merge any updates from remote if needed and then update the local version to match the remote version. More information about 409 can be found at https://httpstatuses.com/409
No Sample Response
Request
Path Parameters
The data domain of the report. The only supported value is
scanningAllowable values: [
scanning]Example:
scanning
Response
Schedule and configuration definition for a report generation
Configuration of a report generation
- configuration
The columns to be included in the generated report, in the order desired
Examples:[ "vulnId", "severity", "package" ]Filter the results based on the given scope
- scope
restrict the report generation on the given image ID
Example:
sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9fDocker registry
Example:
docker.ioDocker image repository
Example:
debianwhether the report should be filtered using a runtime scope
Example:
trueAn AND-composed string of predicates that restrict the scope of the generated report
Docker image tag
Example:
stable
Sorting criteria
- sorting
The column identifier chosen for sorting
Example:
vulnIdThe sorting order (ascending or descending) for the given column
Possible values: [
asc,desc]Example:
asc
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "severity": { "comparison": ">=", "value": "high" }, "vulnType": { "value": "os" } }- queryFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>]Filter value
Whether the report generation is active or not
Example:
trueUnique opaque identifier of the report generation schedule.
Example:
schedule-1hDkklCWc5UtuFhwCaZkbFNY5ZVThe title for the generated reports.
Example:
Weekly vulnerability reportA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
0 9 * * 1The timestamp when the schedule was defined the first time
Example:
1602672997A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
Notification channels where to notify the generation of a new report along with the chosen report format
- notificationChannels
Format of the generated report
Possible values: [
csv,json,pdf]Example:
csvID of notification channel where the generation of new reports is notified
Example:
12456
Whether the on-demand report generation is enabled or not
The kind of report to generate
Possible values: [
vulnerabilities,policies]Example:
vulnerabilitiesThe download link of the last generated report for each configured format
Examples:{ "csv": "api/reporting/v1/my-domain/reports/my-file-id-1234" }- resources
Schedule, start and completion timestamps for the latest report
- status
The timestamp when the generation of the scheduled report completed the last time
Example:
1602674554The timestamp when a new generation of the scheduled report was last queued
Example:
1602674500The timestamp when the generation of the scheduled report started the last time
Example:
1602674521
The timestamp when the schedule was last updated
Example:
1602673124
Status Code
The list of all saved schedules for report generation
No Sample Response
Request
Path Parameters
The data domain of the report. The only supported value is
scanningAllowable values: [
scanning]Example:
scanning
Schedule and configuration definition for a report generation
Configuration of a report generation
- configuration
The columns to be included in the generated report, in the order desired
Examples:[ "vulnId", "severity", "package" ]Filter the results based on the given scope
- scope
restrict the report generation on the given image ID
Example:
sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9fDocker registry
Example:
docker.ioDocker image repository
Example:
debianwhether the report should be filtered using a runtime scope
Example:
trueAn AND-composed string of predicates that restrict the scope of the generated report
Docker image tag
Example:
stable
Sorting criteria
- sorting
The column identifier chosen for sorting
Example:
vulnIdThe sorting order (ascending or descending) for the given column
Allowable values: [
asc,desc]Example:
asc
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "severity": { "comparison": ">=", "value": "high" }, "vulnType": { "value": "os" } }- queryFilters
- any property
Comparison operator to be applied with the chosen filter value
Allowable values: [
<,<=,=,>=,>]Filter value
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
0 9 * * 1A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
Notification channels where to notify the generation of a new report along with the chosen report format
- notificationChannels
Format of the generated report
Allowable values: [
csv,json,pdf]Example:
csvID of notification channel where the generation of new reports is notified
Example:
12456
Whether the on-demand report generation is enabled or not
The kind of report to generate
Allowable values: [
vulnerabilities,policies]Example:
vulnerabilities
Response
Schedule and configuration definition for a report generation
Configuration of a report generation
- configuration
The columns to be included in the generated report, in the order desired
Examples:[ "vulnId", "severity", "package" ]Filter the results based on the given scope
- scope
restrict the report generation on the given image ID
Example:
sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9fDocker registry
Example:
docker.ioDocker image repository
Example:
debianwhether the report should be filtered using a runtime scope
Example:
trueAn AND-composed string of predicates that restrict the scope of the generated report
Docker image tag
Example:
stable
Sorting criteria
- sorting
The column identifier chosen for sorting
Example:
vulnIdThe sorting order (ascending or descending) for the given column
Possible values: [
asc,desc]Example:
asc
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "severity": { "comparison": ">=", "value": "high" }, "vulnType": { "value": "os" } }- queryFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>]Filter value
Whether the report generation is active or not
Example:
trueUnique opaque identifier of the report generation schedule.
Example:
schedule-1hDkklCWc5UtuFhwCaZkbFNY5ZVThe title for the generated reports.
Example:
Weekly vulnerability reportA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
0 9 * * 1The timestamp when the schedule was defined the first time
Example:
1602672997A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
Notification channels where to notify the generation of a new report along with the chosen report format
- notificationChannels
Format of the generated report
Possible values: [
csv,json,pdf]Example:
csvID of notification channel where the generation of new reports is notified
Example:
12456
Whether the on-demand report generation is enabled or not
The kind of report to generate
Possible values: [
vulnerabilities,policies]Example:
vulnerabilitiesThe download link of the last generated report for each configured format
Examples:{ "csv": "api/reporting/v1/my-domain/reports/my-file-id-1234" }- resources
Schedule, start and completion timestamps for the latest report
- status
The timestamp when the generation of the scheduled report completed the last time
Example:
1602674554The timestamp when a new generation of the scheduled report was last queued
Example:
1602674500The timestamp when the generation of the scheduled report started the last time
Example:
1602674521
The timestamp when the schedule was last updated
Example:
1602673124
Status Code
The created schedule for report generation
Bad Request
Invalid report configuration
Remove the requested schedule for report generation
DELETE /api/reporting/v1/{domain}/schedules/{scheduleId}Get the configuration of the requested schedule for report generation
GET /api/reporting/v1/{domain}/schedules/{scheduleId}Request
Path Parameters
The data domain of the report. The only supported value is
scanningAllowable values: [
scanning]Example:
scanningThe ID of the schedule for report generation
Example:
schedule-1hDkklCWc5UtuFhwCaZkbFNY5ZV
Response
Schedule and configuration definition for a report generation
Configuration of a report generation
- configuration
The columns to be included in the generated report, in the order desired
Examples:[ "vulnId", "severity", "package" ]Filter the results based on the given scope
- scope
restrict the report generation on the given image ID
Example:
sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9fDocker registry
Example:
docker.ioDocker image repository
Example:
debianwhether the report should be filtered using a runtime scope
Example:
trueAn AND-composed string of predicates that restrict the scope of the generated report
Docker image tag
Example:
stable
Sorting criteria
- sorting
The column identifier chosen for sorting
Example:
vulnIdThe sorting order (ascending or descending) for the given column
Possible values: [
asc,desc]Example:
asc
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "severity": { "comparison": ">=", "value": "high" }, "vulnType": { "value": "os" } }- queryFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>]Filter value
Whether the report generation is active or not
Example:
trueUnique opaque identifier of the report generation schedule.
Example:
schedule-1hDkklCWc5UtuFhwCaZkbFNY5ZVThe title for the generated reports.
Example:
Weekly vulnerability reportA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
0 9 * * 1The timestamp when the schedule was defined the first time
Example:
1602672997A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
Notification channels where to notify the generation of a new report along with the chosen report format
- notificationChannels
Format of the generated report
Possible values: [
csv,json,pdf]Example:
csvID of notification channel where the generation of new reports is notified
Example:
12456
Whether the on-demand report generation is enabled or not
The kind of report to generate
Possible values: [
vulnerabilities,policies]Example:
vulnerabilitiesThe download link of the last generated report for each configured format
Examples:{ "csv": "api/reporting/v1/my-domain/reports/my-file-id-1234" }- resources
Schedule, start and completion timestamps for the latest report
- status
The timestamp when the generation of the scheduled report completed the last time
Example:
1602674554The timestamp when a new generation of the scheduled report was last queued
Example:
1602674500The timestamp when the generation of the scheduled report started the last time
Example:
1602674521
The timestamp when the schedule was last updated
Example:
1602673124
Status Code
Configuration for the requested schedule for report generation
Requested report generation schedule not found
Report generation schedule not found
Edit the configuration of the requested schedule for report generation
PUT /api/reporting/v1/{domain}/schedules/{scheduleId}Request
Path Parameters
The data domain of the report. The only supported value is
scanningAllowable values: [
scanning]Example:
scanningThe ID of the schedule for report generation
Example:
schedule-1hDkklCWc5UtuFhwCaZkbFNY5ZV
Schedule and configuration definition for a report generation
Configuration of a report generation
- configuration
The columns to be included in the generated report, in the order desired
Examples:[ "vulnId", "severity", "package" ]Filter the results based on the given scope
- scope
restrict the report generation on the given image ID
Example:
sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9fDocker registry
Example:
docker.ioDocker image repository
Example:
debianwhether the report should be filtered using a runtime scope
Example:
trueAn AND-composed string of predicates that restrict the scope of the generated report
Docker image tag
Example:
stable
Sorting criteria
- sorting
The column identifier chosen for sorting
Example:
vulnIdThe sorting order (ascending or descending) for the given column
Allowable values: [
asc,desc]Example:
asc
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "severity": { "comparison": ">=", "value": "high" }, "vulnType": { "value": "os" } }- queryFilters
- any property
Comparison operator to be applied with the chosen filter value
Allowable values: [
<,<=,=,>=,>]Filter value
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
0 9 * * 1A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
Notification channels where to notify the generation of a new report along with the chosen report format
- notificationChannels
Format of the generated report
Allowable values: [
csv,json,pdf]Example:
csvID of notification channel where the generation of new reports is notified
Example:
12456
Whether the on-demand report generation is enabled or not
The kind of report to generate
Allowable values: [
vulnerabilities,policies]Example:
vulnerabilities
Response
Schedule and configuration definition for a report generation
Configuration of a report generation
- configuration
The columns to be included in the generated report, in the order desired
Examples:[ "vulnId", "severity", "package" ]Filter the results based on the given scope
- scope
restrict the report generation on the given image ID
Example:
sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9fDocker registry
Example:
docker.ioDocker image repository
Example:
debianwhether the report should be filtered using a runtime scope
Example:
trueAn AND-composed string of predicates that restrict the scope of the generated report
Docker image tag
Example:
stable
Sorting criteria
- sorting
The column identifier chosen for sorting
Example:
vulnIdThe sorting order (ascending or descending) for the given column
Possible values: [
asc,desc]Example:
asc
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "severity": { "comparison": ">=", "value": "high" }, "vulnType": { "value": "os" } }- queryFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>]Filter value
Whether the report generation is active or not
Example:
trueUnique opaque identifier of the report generation schedule.
Example:
schedule-1hDkklCWc5UtuFhwCaZkbFNY5ZVThe title for the generated reports.
Example:
Weekly vulnerability reportA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
0 9 * * 1The timestamp when the schedule was defined the first time
Example:
1602672997A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
Notification channels where to notify the generation of a new report along with the chosen report format
- notificationChannels
Format of the generated report
Possible values: [
csv,json,pdf]Example:
csvID of notification channel where the generation of new reports is notified
Example:
12456
Whether the on-demand report generation is enabled or not
The kind of report to generate
Possible values: [
vulnerabilities,policies]Example:
vulnerabilitiesThe download link of the last generated report for each configured format
Examples:{ "csv": "api/reporting/v1/my-domain/reports/my-file-id-1234" }- resources
Schedule, start and completion timestamps for the latest report
- status
The timestamp when the generation of the scheduled report completed the last time
Example:
1602674554The timestamp when a new generation of the scheduled report was last queued
Example:
1602674500The timestamp when the generation of the scheduled report started the last time
Example:
1602674521
The timestamp when the schedule was last updated
Example:
1602673124
Status Code
Updated configuration for the requested schedule for report generation
Bad Request
Requested report generation schedule not found
Invalid report configuration
Report generation schedule not found
Generate an on-demand report using the configuration of the requested schedule
POST /api/reporting/v1/{domain}/schedules/{scheduleId}/runRequest
Path Parameters
The data domain of the report. The only supported value is
scanningAllowable values: [
scanning]Example:
scanningThe ID of the schedule for report generation
Example:
schedule-1hDkklCWc5UtuFhwCaZkbFNY5ZV
Response
Status Code
Generation of requested report accepted
Bad Request
Generation of requested report is either forbidden or disabled
Requested report generation schedule not found
Report generation is either already running or will be running shortly
Invalid request payload
Report generation forbidden or disabled
Report generation schedule not found
Report generation already running
Get all the options available to define a report configuration
GET /api/reporting/v1/{domain}/{reportType}/configRequest
Path Parameters
The data domain of the report. The only supported value is
scanningAllowable values: [
scanning]Example:
scanningThe kind of report to generate
Allowable values: [
vulnerabilities,policies]Example:
vulnerabilities
Response
The available columns that can be chosen and included in a generated report
- availableColumns
Column identifier
Example:
severityWhether the columns must be included when specifying a report configuration
Example:
trueHuman-readable name for the column
Example:
Severity
The available conditions that can be set to filter the results in a generated report
- availableFilters
Full list of the allowed values for the filter
- allowedValues
Human-readable label for the filter value
Example:
HighOne of the allowed value for the filter
Example:
high
Optional list of comparison operators which can be used when applying the filter
Examples:[ ">=", "<=" ]Human-readable label for the filter
Example:
SeverityHuman-readable suffix for the filter value
Example:
sev.Maximum allowed value for filters with type number
Example:
10Minimum allowed value for filters with type number
Filter identifier
Example:
severityData type for the filter values
Possible values: [
string,number,boolean,stringarray]Example:
string
Status Code
Options available to define a report configuration
No Sample Response
Get a result preview of a report with the given configuration
POST /api/reporting/v1/{domain}/{reportType}/previewRequest
Path Parameters
The data domain of the report. The only supported value is
scanningAllowable values: [
scanning]Example:
scanningThe kind of report to generate
Allowable values: [
vulnerabilities,policies]Example:
vulnerabilities
Configuration of a report generation
The columns to be included in the generated report, in the order desired
Examples:[ "vulnId", "severity", "package" ]Filter the results based on the given scope
- scope
restrict the report generation on the given image ID
Example:
sha256:b6fa739cedf5ea12a620a439402b6004d057da800f91c7524b5086a5e4749c9fDocker registry
Example:
docker.ioDocker image repository
Example:
debianwhether the report should be filtered using a runtime scope
Example:
trueAn AND-composed string of predicates that restrict the scope of the generated report
Docker image tag
Example:
stable
Sorting criteria
- sorting
The column identifier chosen for sorting
Example:
vulnIdThe sorting order (ascending or descending) for the given column
Allowable values: [
asc,desc]Example:
asc
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "severity": { "comparison": ">=", "value": "high" }, "vulnType": { "value": "os" } }- queryFilters
- any property
Comparison operator to be applied with the chosen filter value
Allowable values: [
<,<=,=,>=,>]Filter value
List all the saved schedules for report generation
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/schedules
Response
Schedule and configuration definition for a report generation
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
00 09 * * *The timestamp when the schedule was defined the first time
Example:
2022-02-23T16:26:31.152ZA human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
The kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sFilters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
ID of the schedule linked to the report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVNotification channels where to notify the generation of a new report
- notificationChannels
ID of notification channel where the generation of new reports is notified
Example:
12456Type of notification channel where the generation of new reports is notified
Possible values: [
SLACK,WEBHOOK,EMAIL,TEAM_EMAIL]Example:
SLACK
The timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when the schedule was last updated
Example:
2022-02-23T16:26:31.152Z
Status Code
The list of all saved schedules for report generation
No Sample Response
Create a new schedule for report generation
Note This API is compatible only with new scanning engine
POST /api/scanning/reporting/v2/schedules
Request
Schedule and configuration definition for a report generation
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportFormat of the generated report
Allowable values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Allowable values: [
vulnerabilities]Example:
vulnerabilitiesA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
00 09 * * *A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
The kind of entity the report is generated from
Allowable values: [
k8s,host,registry,pipeline,container]Default:
k8sExample:
k8sFilters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Allowable values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
Notification channels where to notify the generation of a new report
- notificationChannels
ID of notification channel where the generation of new reports is notified
Example:
12456Type of notification channel where the generation of new reports is notified
Allowable values: [
SLACK,WEBHOOK,EMAIL,TEAM_EMAIL]Example:
SLACK
Response
Schedule and configuration definition for a report generation
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
00 09 * * *The timestamp when the schedule was defined the first time
Example:
2022-02-23T16:26:31.152ZA human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
The kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sFilters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
ID of the schedule linked to the report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVNotification channels where to notify the generation of a new report
- notificationChannels
ID of notification channel where the generation of new reports is notified
Example:
12456Type of notification channel where the generation of new reports is notified
Possible values: [
SLACK,WEBHOOK,EMAIL,TEAM_EMAIL]Example:
SLACK
The timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when the schedule was last updated
Example:
2022-02-23T16:26:31.152Z
Status Code
The created schedule for report generation
Bad Request
Invalid report configuration
Disable all schedules for a given customer
Note This API is compatible only with new scanning engine
POST /api/scanning/reporting/v2/schedules/disable
Remove the requested schedule for report generation
Note This API is compatible only with new scanning engine
DELETE /api/scanning/reporting/v2/schedules/{scheduleId}Get the configuration of the requested schedule for report generation
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/schedules/{scheduleId}Request
Path Parameters
The ID of the schedule for report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZV
Response
Schedule and configuration definition for a report generation
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
00 09 * * *The timestamp when the schedule was defined the first time
Example:
2022-02-23T16:26:31.152ZA human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
The kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sFilters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
ID of the schedule linked to the report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVNotification channels where to notify the generation of a new report
- notificationChannels
ID of notification channel where the generation of new reports is notified
Example:
12456Type of notification channel where the generation of new reports is notified
Possible values: [
SLACK,WEBHOOK,EMAIL,TEAM_EMAIL]Example:
SLACK
The timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when the schedule was last updated
Example:
2022-02-23T16:26:31.152Z
Status Code
Configuration for the requested schedule for report generation
Requested report generation schedule not found
Report generation schedule not found
Edit the configuration of the requested schedule for report generation
Note This API is compatible only with new scanning engine
PUT /api/scanning/reporting/v2/schedules/{scheduleId}Request
Path Parameters
The ID of the schedule for report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZV
Schedule and configuration definition for a report generation
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportFormat of the generated report
Allowable values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Allowable values: [
vulnerabilities]Example:
vulnerabilitiesA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
00 09 * * *A human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
The kind of entity the report is generated from
Allowable values: [
k8s,host,registry,pipeline,container]Default:
k8sExample:
k8sFilters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Allowable values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
Notification channels where to notify the generation of a new report
- notificationChannels
ID of notification channel where the generation of new reports is notified
Example:
12456Type of notification channel where the generation of new reports is notified
Allowable values: [
SLACK,WEBHOOK,EMAIL,TEAM_EMAIL]Example:
SLACK
Response
Schedule and configuration definition for a report generation
Whether the report generation is active or not
Example:
trueThe title for the generated reports.
Example:
Weekly vulnerability reportFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesA cron-like expression representing the generation frequency of the reports.
Possible values: Value must match regular expression
^[0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+ [0-9*/,-]+$Example:
00 09 * * *The timestamp when the schedule was defined the first time
Example:
2022-02-23T16:26:31.152ZA human-readable description for the report content.
Examples:Weekly report for package vulnerabilities fount in the Production environment. Required for compliance needs.
The kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sFilters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Possible values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
ID of the schedule linked to the report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVNotification channels where to notify the generation of a new report
- notificationChannels
ID of notification channel where the generation of new reports is notified
Example:
12456Type of notification channel where the generation of new reports is notified
Possible values: [
SLACK,WEBHOOK,EMAIL,TEAM_EMAIL]Example:
SLACK
The timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZThe timestamp when the schedule was last updated
Example:
2022-02-23T16:26:31.152Z
Status Code
Updated configuration for the requested schedule for report generation
Bad Request
Requested report generation schedule not found
Invalid report configuration
Report generation schedule not found
Download the last generated report of the given schedule
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/schedules/{scheduleId}/downloadReturn headers of the download request
Note This API is compatible only with new scanning engine
HEAD /api/scanning/reporting/v2/schedules/{scheduleId}/downloadGet the list of reports generated by a schedule
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/schedules/{scheduleId}/reportsRequest
Path Parameters
The ID of the schedule for report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZV
Response
Generated report for a given reporting schedule
ID of the generated report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVID of the schedule that generated the report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVThe timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sError message
Example:
invalid team scopeFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZStatus of the current report execution
Possible values: [
scheduled,progress,completed,error]Example:
completed
Status Code
Configuration for the requested schedule for report generation
Requested schedule not found
Report schedule not found
Get a specific report
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/schedules/{scheduleId}/reports/{reportId}Request
Path Parameters
The ID of the schedule for report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVThe ID of the report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZV
Response
Generated report for a given reporting schedule
ID of the generated report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVID of the schedule that generated the report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVThe timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sError message
Example:
invalid team scopeFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZStatus of the current report execution
Possible values: [
scheduled,progress,completed,error]Example:
completed
Status Code
Configuration for the requested schedule for report generation
Requested schedule not found
Report not found
Download a specific report
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/schedules/{scheduleId}/reports/{reportId}/downloadGet the download headers
Note This API is compatible only with new scanning engine
HEAD /api/scanning/reporting/v2/schedules/{scheduleId}/reports/{reportId}/downloadGenerate an on-demand report using the configuration of the requested schedule
Note This API is compatible only with new scanning engine
POST /api/scanning/reporting/v2/schedules/{scheduleId}/runRequest
Path Parameters
The ID of the schedule for report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZV
Response
Status Code
Generation of requested report accepted
Bad Request
Generation of requested report is either forbidden or disabled
Requested report generation schedule not found
Report generation is either already running or will be running shortly
Invalid request payload
Report generation forbidden or disabled
Report generation schedule not found
Report generation already running
Get the status of the current and last completed reports generated by the schedule
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/schedules/{scheduleId}/statusRequest
Path Parameters
The ID of the schedule for report generation
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZV
Response
Schedule and configuration definition for a report generation
ID of the schedule that generated the report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVStatus of a given report
- currentReport
ID of the generated report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVThe timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sError message
Example:
invalid team scopeFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZStatus of the current report execution
Possible values: [
scheduled,progress,completed,error]Example:
completed
Status of a given report
- lastCompletedReport
ID of the generated report
Example:
1hDklCWc5UtuFhwCaZkbFNY5ZVThe timestamp when the generation of the scheduled report completed the last time
Example:
2022-02-23T16:26:31.152ZThe kind of entity the report is generated from
Possible values: [
k8s,host,registry,pipeline,container]Example:
k8sError message
Example:
invalid team scopeFormat of the generated report
Possible values: [
csv,ndjson,json]Example:
csvThe kind of data the report contains
Possible values: [
vulnerabilities]Example:
vulnerabilitiesThe timestamp when a new generation of the scheduled report was last queued
Example:
2022-02-23T16:26:31.152ZThe timestamp when the generation of the scheduled report started the last time
Example:
2022-02-23T16:26:31.152ZStatus of the current report execution
Possible values: [
scheduled,progress,completed,error]Example:
completed
Status Code
Status of a given schedule
Requested report generation schedule not found
Schedule not found
Get all the options available to define a report configuration
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/{reportType}/configRequest
Path Parameters
The kind of data the report contains
Allowable values: [
vulnerabilities]Example:
vulnerabilities
Response
The available conditions that can be set to filter the results in a generated report
- availableConditionFilters
Full list of the allowed values for the filter
- allowedValues
Human-readable label for the filter value
Example:
HighOne of the allowed value for the filter
Example:
High
Optional list of comparison operators which can be used when applying the filter
Examples:[ ">=", "<=" ]Human-readable label for the filter
Example:
SeverityHuman-readable suffix for the filter value
Maximum allowed value for filters with type number
Example:
10Minimum allowed value for filters with type number
Filter identifier
Example:
vulnSeverityData type for the filter values
Possible values: [
string,number,boolean,stringarray]Example:
string
The available scope filters that can be used to select the scope
- availableScopeFilters
Scope filter key
Example:
kubernetes.namespace.name
Status Code
Options available to define a report configuration
No Sample Response
Get all the options available to define a report configuration
Note This API is compatible only with new scanning engine
GET /api/scanning/reporting/v2/{reportType}/entities/{entityType}/configRequest
Path Parameters
The kind of data the report contains
Allowable values: [
vulnerabilities]Example:
vulnerabilitiesThe kind of entity the report is generated from
Allowable values: [
k8s,host,registry,pipeline,container]Example:
k8s
Response
The available conditions that can be set to filter the results in a generated report
- availableConditionFilters
Full list of the allowed values for the filter
- allowedValues
Human-readable label for the filter value
Example:
HighOne of the allowed value for the filter
Example:
High
Optional list of comparison operators which can be used when applying the filter
Examples:[ ">=", "<=" ]Human-readable label for the filter
Example:
SeverityHuman-readable suffix for the filter value
Maximum allowed value for filters with type number
Example:
10Minimum allowed value for filters with type number
Filter identifier
Example:
vulnSeverityData type for the filter values
Possible values: [
string,number,boolean,stringarray]Example:
string
The available scope filters that can be used to select the scope
- availableScopeFilters
Scope filter key
Example:
kubernetes.namespace.name
Status Code
Options available to define a report configuration
No Sample Response
Get a result preview of a report with the given configuration
Note This API is compatible only with new scanning engine
POST /api/scanning/reporting/v2/{reportType}/entities/{entityType}/previewRequest
Path Parameters
The kind of data the report contains
Allowable values: [
vulnerabilities]Example:
vulnerabilitiesThe kind of entity the report is generated from
Allowable values: [
k8s,host,registry,pipeline,container]Example:
k8s
Query Parameters
Possible values: 1 ≤ value ≤ 1000
Default:
100
Filters for the report
Filters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Allowable values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
Get a result preview of a report with the given configuration
Note This API is compatible only with new scanning engine
POST /api/scanning/reporting/v2/{reportType}/previewRequest
Path Parameters
The kind of data the report contains
Allowable values: [
vulnerabilities]Example:
vulnerabilities
Query Parameters
Possible values: 1 ≤ value ≤ 1000
Default:
100
Filters for the report
Filters for the report.
To retrieve available filters for a given report type, please call the config endpoint first.- filters
Set of additional filter conditions on the generated reports. Filters are defined as map with filter names as key.
Examples:{ "fixAvailable": { "value": false }, "packageType": { "value": [ "os" ] }, "vulnSeverity": { "comparison": ">=", "value": "high" } }- conditionFilters
- any property
Comparison operator to be applied with the chosen filter value
Allowable values: [
<,<=,=,>=,>,contains,startswith]Filter value
Scope Filters for the Report
Example:
kubernetes.cluster.name in ("prod", "stg")
Request
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]Example:
true
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The saved falco list
The provided falco list is not valid
No Sample Response
Retrieve a group of falco lists having a given name
Retrieve a group of all falco lists having the given name. This is used to show how a base list is modified by later lists that override/append to the list.
GET /api/secure/falco/lists/groups
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
An array of lists
No Sample Response
Retrieve a list of summary falco list information, grouped by list name
Returns the list of falco lists in the system. These are grouped by name and do not necessarily represent individual falco list objects, as multiple falco lists can have the same name.
GET /api/secure/falco/lists/summaries
Response
The specific object ids having this name
Examples:[ 6, 17, 21 ]A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA set of (origin,versionId) pairs for all the objects sharing this name.
- publishedBys
A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIA string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
The number of rules that refer to this object (macro/list) OR the number of policies that refer to this rule
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702738265
Status Code
An array of falco lists grouped by name.
No Sample Response
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The falco list that was just deleted
No Sample Response
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The falco list with the given id
No Sample Response
Request
Path Parameters
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]Example:
true
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The falco list with the given id
The provided falcolist is not valid
Resource with the specified ID could not be found. More information about 404 can be found at https://httpstatuses.com/404
The user must first perform a GET request to get the current version of the resource. The user must then compare the remote version with the local expected version and merge any updates from remote if needed and then update the local version to match the remote version. More information about 409 can be found at https://httpstatuses.com/409
No Sample Response
Update multiple default falco lists
Updates multiple default falco lists
PUT /api/settings/falco/lists
Request
Path Parameters
{
"items": [
"/bin/bash",
"/bin/ksh"
]
}If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The saved falco list
The provided falco list is not valid
No Sample Response
Request
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]Example:
true
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The saved FalcoMacro
The provided FalcoMacro was invalid
No Sample Response
Retrieve a group of all falco macros having a given name
Retrieve a group of all falco macros having the given name. This is used to show how a base macro is modified by later macros that override/append to the macro.
GET /api/secure/falco/macros/groups
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
An array of macros
No Sample Response
Retrieve a list of summary macro information, grouped by macro name
Returns the list of macros in the system. These are grouped by name and do not necessarily represent individual macro objects, as multiple macros can have the same name.
GET /api/secure/falco/macros/summaries
Response
The specific object ids having this name
Examples:[ 6, 17, 21 ]A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA set of (origin,versionId) pairs for all the objects sharing this name.
- publishedBys
A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIA string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
The number of rules that refer to this object (macro/list) OR the number of policies that refer to this rule
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702738265
Status Code
An array of macros grouped by name.
No Sample Response
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The macro that was just deleted
No Sample Response
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The macro with the given id
No Sample Response
Request
Path Parameters
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]Example:
true
Response
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
The macro with the given id
The updated macro is not valid
Resource with the specified ID could not be found. More information about 404 can be found at https://httpstatuses.com/404
The user must first perform a GET request to get the current version of the resource. The user must then compare the remote version with the local expected version and merge any updates from remote if needed and then update the local version to match the remote version. More information about 409 can be found at https://httpstatuses.com/409
No Sample Response
Response
String representation of a canonical list.
- lists
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
Structure representing comparison between 2 lists.
No Sample Response
Response
- versions
String representation of a canonical list.
- lists
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- items
an array containing the broken-up components of this falco list's items field
- components
- undefined
Any sort of text that might make sense to put in a list
Example:
item 1
the array of items as represented in the yaml List
Examples:[ "bash", "\"sh -c node -e \\\"require('nan')\\\"\"", "monitored_directories" ]
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
Structure representing latest version of a list.
No Sample Response
Response
- versions
String representation of a canonical macro.
- macros
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
Structure representing comparison between 2 macros.
No Sample Response
Response
- versions
String representation of a canonical macro.
- macros
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
If true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
true
Status Code
Structure representing latest version of a rule.
No Sample Response
Response
- versions
String representation of a canonical rule.
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Status Code
Structure representing comparison between 2 rules.
No Sample Response
Response
- versions
String representation of a canonical rule.
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Status Code
Structure representing latest version of a rule.
No Sample Response
Get the connection status
Gets the connection status (cloud account or agent installation) based on the user's primary environment selection.
GET /api/secure/onboarding/v2/connectionStatus/{environment}Skips the onboarding feature per customer
Skips the onboarding feature per customer which results in hiding the first two screen of first time onboarding.
PUT /api/secure/onboarding/v2/feature/customer/skip
Response
Customer Id of the connected user
Example:
100If Falco Cloud Betaflows are enabled for the customer
Example:
trueIf Falco Cloud is enabled for the customer
Example:
trueIf new onboarding wizard is enabled for the customer
Example:
trueIf onboarding is enabled for the customer/setup
Example:
trueIf onboarding is to be skipped for the customer
Example:
true
Status Code
OK
Account is forbidden (inactive/expired customer).
The server encountered an unexpected condition.
No Sample Response
Check the onboarding feature status
Checks the feature status for the user/customer.
GET /api/secure/onboarding/v2/feature/status
Response
Customer Id of the connected user
Example:
100If Falco Cloud Betaflows are enabled for the customer
Example:
trueIf Falco Cloud is enabled for the customer
Example:
trueIf new onboarding wizard is enabled for the customer
Example:
trueIf onboarding is enabled for the customer/setup
Example:
trueIf onboarding is to be skipped for the customer
Example:
true
Status Code
OK
Account is forbidden (inactive/expired customer).
The server encountered an unexpected condition.
No Sample Response
Get the list of compliance frameworks.
Gets the compliance frameworks for the specified environment.
GET /api/secure/onboarding/v2/frameworks/{environment}Response
- commonComplianceFrameworks
Represents the readable name of a framework
Example:
CIS Kubernetes BenchmarkRepresents a grouping of standards
Example:
kube_benchExample:
true
- industryBestPractice
Represents the readable name of a framework
Example:
CIS Kubernetes BenchmarkRepresents a grouping of standards
Example:
kube_benchExample:
true
- requiredFrameworks
Represents the readable name of a framework
Example:
CIS Kubernetes BenchmarkRepresents a grouping of standards
Example:
kube_benchExample:
true
Status Code
OK
The given request is invalid.
No Sample Response
Create compliance tasks
Creates the set of compliance tasks for the specified environment.
POST /api/secure/onboarding/v2/frameworks/{environment}Get the install action.
Gets the appropriate install action for the specified installation type.
GET /api/secure/onboarding/v2/installActions/{installType}Request
Path Parameters
Allowable values: [
AWS,GCP,Azure,Kubernetes,Linux,Docker,AdmissionController]
Query Parameters
Cloud provider account type. Only applies to AWS, GCP, or Azure.
Allowable values: [
single,org,multi]Default:
singleInstall option for agent. Only applies to Kubernetes, Linux, or Docker.
Allowable values: [
helm,values]Default:
helm
Response
Possible values: [
AWS,GCP,Azure,Kubernetes,Linux,Docker]Possible values: [
Jenkins,Gitlab,AWS CodePipeline,Azure Pipeline,Circle CI,Tekton Pipelines]Possible values: [
GitHub,GitLab,Bitbucket,Azure DevOps,I don't use IAC]Possible values: [
Email,Slack,Amazon SNS Topic,Microsoft Teams,Pager Duty,Other]Example:
trueExample:
AWSExample:
100
Status Code
OK
Account is forbidden (inactive/expired customer).
The cloud info could not be found.
No Sample Response
Get the install action.
Gets the appropriate install action for the specified installation type and environment.
GET /api/secure/onboarding/v3/environments/{environment}/installActions/{installType}Request
Path Parameters
Environment in which you are planning to install
Allowable values: [
AWS,GCP,Azure]Installation type via Terraform or CFT (AWS only).
Allowable values: [
Terraform,CFT]
Query Parameters
Cloud provider account type, indicating a single account or org account install.
Allowable values: [
single,org]The Sysdig features to install. Multiple features are specified as repeated instances of this query parameter
Allowable values: [
FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_SECURE_AGENTLESS_SCANNING]The regions to install during a multi region deploy. Multiple regions are specified as repeated instances of this query parameter
Default:
Examples:[ "us-east-1", "eu-central-1" ]
Response
- accountConfig
AccountComponent captures a cloud resource within an account
- components
CloudConnectorMetadata captures the metadata associated with a cloud connector deployment, segmented by provider type
- cloudConnectorMetadata
CryptoKeyMetadata captures the metadata associated with a crypto key, segmented by provider type
- cryptoKeyMetadata
EventBridgeMetadata captures the metadata associated with an event bridge, segmented by provider type
- eventBridgeMetadata
ServicePrincipalMetadata captures the metadata associated with a service principal, segmented by provider type
- servicePrincipalMetadata
TrustedRoleMetadata captures the metadata associated with a trusted role resource, segmented by provider type
- trustedRoleMetadata
- aws
Possible values: [
COMPONENT_UNSPECIFIED,COMPONENT_CLOUD_CONNECTOR,COMPONENT_TRUSTED_ROLE,COMPONENT_EVENT_BRIDGE,COMPONENT_SERVICE_PRINCIPAL,COMPONENT_CRYPTO_KEY]
AccountFeature captures a sysdig feature enabled on a cloud account
- features
Possible values: [
FEATURE_UNSPECIFIED,FEATURE_SECURE_THREAT_DETECTION,FEATURE_SECURE_CONFIG_POSTURE,FEATURE_SECURE_IDENTITY_ENTITLEMENT,FEATURE_MONITOR_CLOUD_METRICS,FEATURE_SECURE_AGENTLESS_SCANNING]
- tokens
Possible values: [
INPUT,TAG]
- values
Status Code
OK
The given request is invalid.
The server encountered an unexpected condition.
No Sample Response
Get the custom falco rules files
Get the custom falco rules files e.g. the set of falco rules managed by a customer.
GET /api/settings/falco/customRulesFiles
Response
- customFalcoRulesFiles
A list of files that comprise the set of rules files
- files
A name for this file. Should be used in UI to distinguish between files.
Example:
falco_rules.yamlAn array of alternate versions for the given file. An agent should choose the highest version that is compatible with its included falco engine.
- variants
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The minimum falco engine version that can read this rules file variant.
An externally provided version identifier (e.g. git tag) that can be used to uniquely identify this set of files.
Example:
v0.1.2Version of the object. Incremented on each update and used for optimistic locking
A list of reference policies that can be created from the provided falco rules. Used by the /v2/policies/default endpoint.
- defaultPolicies
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of TemplateRule objects
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]
Status Code
The custom falco rules files.
No Sample Response
Set the custom rules files e.g. the set of falco rules managed by a customer.
Set the current custom falco rules files. This content is always validated by passing the current default rules files plus the submitted customer rules files and any Secure UI generated rules to the open source falco executable to verify that falco can read the combination of files. The backend should choose the variant that has the greatest required_engine_version for each file, and then run open source falco with the -d option to verify the files. As knowing the current value of the version field is required to successfully update the rules file, in order to update the rules content you must first do a GET and update the content property. The version property in the response will be incremented on success.
PUT /api/settings/falco/customRulesFiles
Request
- customFalcoRulesFiles
A list of files that comprise the set of rules files
- files
A name for this file. Should be used in UI to distinguish between files.
Example:
falco_rules.yamlAn array of alternate versions for the given file. An agent should choose the highest version that is compatible with its included falco engine.
- variants
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The minimum falco engine version that can read this rules file variant.
An externally provided version identifier (e.g. git tag) that can be used to uniquely identify this set of files.
Example:
v0.1.2Version of the object. Incremented on each update and used for optimistic locking
A list of reference policies that can be created from the provided falco rules. Used by the /v2/policies/default endpoint.
- defaultPolicies
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Allowable values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Allowable values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of TemplateRule objects
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Allowable values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]
Response
- customFalcoRulesFiles
A list of files that comprise the set of rules files
- files
A name for this file. Should be used in UI to distinguish between files.
Example:
falco_rules.yamlAn array of alternate versions for the given file. An agent should choose the highest version that is compatible with its included falco engine.
- variants
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The minimum falco engine version that can read this rules file variant.
An externally provided version identifier (e.g. git tag) that can be used to uniquely identify this set of files.
Example:
v0.1.2Version of the object. Incremented on each update and used for optimistic locking
A list of reference policies that can be created from the provided falco rules. Used by the /v2/policies/default endpoint.
- defaultPolicies
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of TemplateRule objects
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]
Status Code
The custom falco rules files
The provided falco rules content was either not falco compliant, causes a rule to be deleted that is still used by a policy, or has non null default policies
The user must first perform a GET request to get the current version of the resource. The user must then compare the remote version with the local expected version and merge any updates from remote if needed and then update the local version to match the remote version. More information about 409 can be found at https://httpstatuses.com/409
No Sample Response
Delete the specified falco rules file
Delete the specified falco rules file
DELETE /api/settings/falco/customRulesFiles/{filename}Response
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The name of a Falco rules file
Example:
falco_rules_local.yamlVersion of the corresponding CustomRulesFiles object to which the specific file belongs
Status Code
The deleted policy
Resource with the specified ID could not be found. More information about 404 can be found at https://httpstatuses.com/404
The user must first perform a GET request to get the current version of the resource. The user must then compare the remote version with the local expected version and merge any updates from remote if needed and then update the local version to match the remote version. More information about 409 can be found at https://httpstatuses.com/409
No Sample Response
Get the custom falco rules file matching the filename
Get the custom falco rules file matching the filename
GET /api/settings/falco/customRulesFiles/{filename}Response
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The name of a Falco rules file
Example:
falco_rules_local.yamlVersion of the corresponding CustomRulesFiles object to which the specific file belongs
Status Code
The custom falco rules file
Resource with the specified ID could not be found. More information about 404 can be found at https://httpstatuses.com/404
No Sample Response
Update the custom falco rules file matching the filename
Update the custom falco rules file matching the filename
PUT /api/settings/falco/customRulesFiles/{filename}Request
Path Parameters
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The name of a Falco rules file
Example:
falco_rules_local.yamlVersion of the corresponding CustomRulesFiles object to which the specific file belongs
Response
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The name of a Falco rules file
Example:
falco_rules_local.yamlVersion of the corresponding CustomRulesFiles object to which the specific file belongs
Status Code
The custom falco rules file
The provided falco rules content was either not falco compliant, causes a rule to be deleted that is still used by a policy, or has non null default policies
The user must first perform a GET request to get the current version of the resource. The user must then compare the remote version with the local expected version and merge any updates from remote if needed and then update the local version to match the remote version. More information about 409 can be found at https://httpstatuses.com/409
No Sample Response
Get the default falco rules files
Get the default falco rules files e.g. the set of falco rules managed by sysdig.
GET /api/settings/falco/defaultRulesFiles
Response
- defaultFalcoRulesFiles
A list of files that comprise the set of rules files
- files
A name for this file. Should be used in UI to distinguish between files.
Example:
falco_rules.yamlAn array of alternate versions for the given file. An agent should choose the highest version that is compatible with its included falco engine.
- variants
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The minimum falco engine version that can read this rules file variant.
An externally provided version identifier (e.g. git tag) that can be used to uniquely identify this set of files.
Example:
v0.1.2Version of the object. Incremented on each update and used for optimistic locking
A list of reference policies that can be created from the provided falco rules. Used by the /v2/policies/default endpoint.
- defaultPolicies
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of TemplateRule objects
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]
Status Code
The default falco rules files.
No Sample Response
Get the newest default falco rules files
Get the newest default falco rules files e.g. the set of falco rules managed by sysdig.
GET /api/settings/falco/newestDefaultRulesFiles
Response
- newestDefaultFalcoRulesFiles
A list of files that comprise the set of rules files
- files
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
A name for this file. Should be used in UI to distinguish between files.
Example:
falco_rules.yamlThe minimum falco engine version that can read this rules file variant.
An externally provided version identifier (e.g. git tag) that can be used to uniquely identify this set of files.
Example:
v0.1.2Version of the object. Incremented on each update and used for optimistic locking
Status Code
The newest falco rules files.
No Sample Response
View the available falco filters for a customer
Returns what falco filters are available to customer to configure falco rules
GET /api/settings/falco/filters
Request
Query Parameters
when provided only falco filters corresponding to the specified event source will be included in the response
Allowable values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Response
Provides additional context about the filter such as when it evaluates to true or false and the range of potential evaluation values
Example:
The container's health check. Will be the null value if no healthcheck configured, NONE if configured but explicitly not created, and the healthcheck command line otherwiseIndicates what the falco filter is called
Example:
container.healthcheck
Status Code
The falco filters available to customer to configure falco rules
No Sample Response
Get all integration.
Fetch all integrations for a customer.
GET /api/ticketing/v1/integrations/{provider}Response
Jira cloud url.
Example:
https://sysdig.atlassian.netcreation time of the integration.
Example:
2022-06-29T22:46:25.043ZEmail of the authorized user to access Jira.
Example:
sam@sysdig.comIntegration index.
Example:
10updated time of the integration.
Example:
2022-06-29T22:46:25.043ZName of your integration.
Example:
DevOps-IntegWhether we can connect to jira using this integration.
Example:
active
Status Code
List of all integrations for a customer.
Invalid credentials or missing auth token.
Invalid provider specified.
The server encountered an unexpected condition.
No Sample Response
Create a new Integration
Creates a new Integration for a customer.
POST /api/ticketing/v1/integrations/{provider}Request
Path Parameters
The ticket management provider.
Example:
jira
Access Token to use to call Jira API.
Example:
XHAGSTOEGV47NH36510E6VBJD6Jira cloud Url
Example:
https://sysdig.atlassian.netEmail of the authorized user to access Jira.
Example:
Sam@sysdig.comName of your integration.
Example:
DevOps-Integ
Response
Jira cloud url.
Example:
https://sysdig.atlassian.netcreation time of the integration.
Example:
2022-06-29T22:46:25.043ZEmail of the authorized user to access Jira.
Example:
sam@sysdig.comIntegration index.
Example:
10updated time of the integration.
Example:
2022-06-29T22:46:25.043ZName of your integration.
Example:
DevOps-IntegWhether we can connect to jira using this integration.
Example:
active
Status Code
Integration is successfully created.
Invalid input, integration could not be created.
Invalid credentials or missing auth token.
Account is forbidden (inactive/expired customer).
Invalid provider specified.
Integration already exists.
The server encountered an unexpected condition.
No Sample Response
Delete an Integration.
Delete an Integration for a customer.
DELETE /api/ticketing/v1/integrations/{provider}/{integration_id}Response
Jira cloud url.
Example:
https://sysdig.atlassian.netcreation time of the integration.
Example:
2022-06-29T22:46:25.043ZEmail of the authorized user to access Jira.
Example:
sam@sysdig.comIntegration index.
Example:
10updated time of the integration.
Example:
2022-06-29T22:46:25.043ZName of your integration.
Example:
DevOps-IntegWhether we can connect to jira using this integration.
Example:
inactive
Status Code
Integration is successfully deleted.
Invalid credentials or missing auth token.
Integration could not be found.
The server encountered an unexpected condition.
No Sample Response
Get an Integration.
Fetch a single integration Information by id.
GET /api/ticketing/v1/integrations/{provider}/{integration_id}Response
Jira cloud url.
Example:
https://sysdig.atlassian.netcreation time of the integration.
Example:
2022-06-29T22:46:25.043ZEmail of the authorized user to access Jira.
Example:
sam@sysdig.comIntegration index.
Example:
10updated time of the integration.
Example:
2022-06-29T22:46:25.043ZName of your integration.
Example:
DevOps-IntegWhether we can connect to jira using this integration.
Example:
active
Status Code
Description of a specific integration.
Invalid credentials or missing auth token.
Integration could not be found.
The server encountered an unexpected condition.
No Sample Response
Update an Integration.
Update an Integration for a customer.
PUT /api/ticketing/v1/integrations/{provider}/{integration_id}Request
Path Parameters
The ticket management provider.
Example:
jira
Access Token to use to call Jira API.
Example:
XHAGSTOEGV47NH36510E6VBJD6Jira cloud Url
Example:
https://sysdig.atlassian.netEmail of the authorized user to access Jira.
Example:
Sam@sysdig.comName of your integration.
Example:
DevOps-Integ
Response
Jira cloud url.
Example:
https://sysdig.atlassian.netcreation time of the integration.
Example:
2022-06-29T22:46:25.043ZEmail of the authorized user to access Jira.
Example:
sam@sysdig.comIntegration index.
Example:
10updated time of the integration.
Example:
2022-06-29T22:46:25.043ZName of your integration.
Example:
DevOps-IntegWhether we can connect to jira using this integration.
Example:
active
Status Code
Integration is successfully updated.
Integration could not be modified.
Invalid credentials or missing auth token.
Integration could not be found.
The server encountered an unexpected condition.
No Sample Response
Pull all jira project metadata.
Fetches the projects information needed for creating a ticket. The list of assignable and issue types users are fetched to help create a ticket.
GET /api/ticketing/v1/integrations/{provider}/{integration_id}/project/{project_id}/projectMetaRequest
Path Parameters
The ticket management provider.
Example:
jiraindex of the integration
index of jira project id
Query Parameters
A query string that is matched against user attributes, such as displayName, and emailAddress, to find relevant assignable users.
Response
- assignableUsers
Account ID.
Example:
1234567890Wheither the user is active
Example:
trueDisplay name.
Example:
Jira User NameUser email address.
Example:
jira@sysdig.com
- issueTypes
Issue type description.
Example:
Bug descriptionIssue type ID.
Example:
1000Issue type name.
Example:
Bug
Example:
1234
Status Code
Project metadata
Project could not be fetched.
Account is forbidden (inactive/expired customer).
Integration could not be found.
The server encountered an unexpected condition.
No Sample Response
Pull all jira projects.
Fetches the projects information needed for creating a ticket. The projectIDs, issueIDs, and list of assignable users are fetched for a valid integration.
GET /api/ticketing/v1/integrations/{provider}/{integration_id}/projectsResponse
Jira project object
Example:
1000Example:
ENDPTExample:
ENDPOINT
Status Code
List all jira projects for an integration.
Project could not be fetched.
Account is forbidden (inactive/expired customer).
Integration could not be found.
The server encountered an unexpected condition.
No Sample Response
Request
Query Parameters
Represents the id of a particular capture. Can be used multiple times in the same request to delete multiple captures
Indicates that only captures belonging to either the monitor or secure product should be considered for deletion. Defaults to SDC if not specified
Allowable values: [
sdc,sds]Indicates that only captures with a particular status should be considered for deletion. Can be used multiple times in the same request
Allowable values: [
requested,filtering,capturing,done,error,uploading,uploadingError,uploaded]
Request
Query Parameters
Represents the id of a particular capture. Can be used multiple times in the same request to fetch multiple captures
Indicates the distance between the true starting point and the index of the first returned capture
An enum of allowable fields to sort a list of captures
Allowable values: [
date_requested,duration,name,size,status]An enum of ways to order a sorted collection of values
Allowable values: [
asc,desc]Unix time of when to start looking for captures in microseconds
Unix time of when to stop looking for captures in microseconds
An enum of Sysdig products
Allowable values: [
sdc,sds]Limit the results to only captures matching a scope expression
Example:
kubernetes.cluster.name != null- Examples:
[ "host.mac", "host.hostName", "container.id", "container.name", "container.image" ] - Examples:
[ "host.mac", "host.hostName", "container.id", "container.name", "container.image" ] Uniquely identifies a capture and correlates the capture to a request. Must match the following regex ([a-z0-9]){8}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){12}
Example:
960d9da0-cc79-4079-932a-544e193ab385
Response
A list of captures and associated metadata
Indicates whether the number of captures returned had some limit applied
Contains system calls and other operating system events
- captures
Describes a Sysdig agent running on a machine
- agent
- attributes
The ID of a particular customer
The name of the host the agent is running on
Example:
ip-10-2-157-201Uniquely identifies an agent
Example:
34688Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0b
A map of assorted metadata
- annotations
The name of the s3 bucket to which the capture will be saved. May be null
Uniquely identifies a container
Example:
8883164eb9bfThe range in time from when the capture began to when it ended in seconds. The maximum value is 86400
Example:
30A way to only capture a subset of the data
Example:
proc.name=viThe name of a folder in an s3 bucket
Example:
/A way to reference a capture. Must not be empty
Example:
my_capture.scapAn enum of Sysdig products
Possible values: [
sdc,sds]The key that allows an agent to communicate with a collector
The number of bytes the Sysdig backend has received from the agent
Example:
87335540The number of bytes the Sysdig backend has pushed to a storage provider
Example:
87335540The unx timestamp of when the Sysdig backend received the capture from the agent in milliseconds
Example:
1625783881254The unix timestamp of when the capture was requested in milliseconds
Example:
1625783854265The url to download the capture
Example:
/api/v1/captures/1327048/downloaduniquely identifies the capture
Example:
1327048Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0bThe maximum number of bytes allowed to be in this capture
Example:
104857600A list of metrics
The range in time from when the capture began to when the event that triggered the capture occurred in seconds. The maximum value is 86400
Example:
3The amount of bytes in the capture that occurred in the pastDuration interval
A scope expression that limits where the capture could have been taken
Example:
host.hostName = 'ip-10-2-157-201'The number of bytes in the capture
Example:
87335540An enum of the different statuses a capture can have
Possible values: [
requested,filtering,capturing,done,error,uploading,uploadingError,uploaded]Uniquely identifies a storage configuration
Example:
153Uniquely identifies a capture and correlates the capture to a request. Must match the following regex ([a-z0-9]){8}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){12}
Example:
960d9da0-cc79-4079-932a-544e193ab385An enum of the different types of storage to which captures can be saved
Possible values: [
local,s3,agent,provided,cassandra]
Indicates the distance between the true starting point and the index of the first returned capture. Corresponds to the offset query param that was provided in the original request.
Indicates how many captures would have been returned if no limit query param was specified. It does not represent the number of captures returned in the request.
Status Code
The array representing the captures
Indicates a query param was invalid
No Sample Response
Request
Metadata to create a capture
Describes a Sysdig agent running on a machine
- agent
- attributes
The ID of a particular customer
The name of the host the agent is running on
Example:
ip-10-2-157-201Uniquely identifies an agent
Example:
34688Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0b
A map of assorted metadata
- annotations
The name of the s3 bucket to which the capture will be saved. May be null
Uniquely identifies a container
Example:
8883164eb9bfThe range in time from when the capture began to when it ended in seconds. The maximum value is 86400
Example:
30A way to only capture a subset of the data
Example:
proc.name=viThe name of a folder in an s3 bucket
Example:
/A way to reference a capture. Must not be empty
Example:
my_capture.scapAn enum of Sysdig products
Allowable values: [
sdc,sds]
Response
Contains system calls and other operating system events
- capture
Describes a Sysdig agent running on a machine
- agent
- attributes
The ID of a particular customer
The name of the host the agent is running on
Example:
ip-10-2-157-201Uniquely identifies an agent
Example:
34688Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0b
A map of assorted metadata
- annotations
The name of the s3 bucket to which the capture will be saved. May be null
Uniquely identifies a container
Example:
8883164eb9bfThe range in time from when the capture began to when it ended in seconds. The maximum value is 86400
Example:
30A way to only capture a subset of the data
Example:
proc.name=viThe name of a folder in an s3 bucket
Example:
/A way to reference a capture. Must not be empty
Example:
my_capture.scapAn enum of Sysdig products
Possible values: [
sdc,sds]The key that allows an agent to communicate with a collector
The number of bytes the Sysdig backend has received from the agent
Example:
87335540The number of bytes the Sysdig backend has pushed to a storage provider
Example:
87335540The unx timestamp of when the Sysdig backend received the capture from the agent in milliseconds
Example:
1625783881254The unix timestamp of when the capture was requested in milliseconds
Example:
1625783854265The url to download the capture
Example:
/api/v1/captures/1327048/downloaduniquely identifies the capture
Example:
1327048Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0bThe maximum number of bytes allowed to be in this capture
Example:
104857600A list of metrics
The range in time from when the capture began to when the event that triggered the capture occurred in seconds. The maximum value is 86400
Example:
3The amount of bytes in the capture that occurred in the pastDuration interval
A scope expression that limits where the capture could have been taken
Example:
host.hostName = 'ip-10-2-157-201'The number of bytes in the capture
Example:
87335540An enum of the different statuses a capture can have
Possible values: [
requested,filtering,capturing,done,error,uploading,uploadingError,uploaded]Uniquely identifies a storage configuration
Example:
153Uniquely identifies a capture and correlates the capture to a request. Must match the following regex ([a-z0-9]){8}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){12}
Example:
960d9da0-cc79-4079-932a-544e193ab385An enum of the different types of storage to which captures can be saved
Possible values: [
local,s3,agent,provided,cassandra]
Status Code
Successfully created a capture
Indicates the request body was invalid
No Sample Response
Response
Contains system calls and other operating system events
- capture
Describes a Sysdig agent running on a machine
- agent
- attributes
The ID of a particular customer
The name of the host the agent is running on
Example:
ip-10-2-157-201Uniquely identifies an agent
Example:
34688Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0b
A map of assorted metadata
- annotations
The name of the s3 bucket to which the capture will be saved. May be null
Uniquely identifies a container
Example:
8883164eb9bfThe range in time from when the capture began to when it ended in seconds. The maximum value is 86400
Example:
30A way to only capture a subset of the data
Example:
proc.name=viThe name of a folder in an s3 bucket
Example:
/A way to reference a capture. Must not be empty
Example:
my_capture.scapAn enum of Sysdig products
Possible values: [
sdc,sds]The key that allows an agent to communicate with a collector
The number of bytes the Sysdig backend has received from the agent
Example:
87335540The number of bytes the Sysdig backend has pushed to a storage provider
Example:
87335540The unx timestamp of when the Sysdig backend received the capture from the agent in milliseconds
Example:
1625783881254The unix timestamp of when the capture was requested in milliseconds
Example:
1625783854265The url to download the capture
Example:
/api/v1/captures/1327048/downloaduniquely identifies the capture
Example:
1327048Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0bThe maximum number of bytes allowed to be in this capture
Example:
104857600A list of metrics
The range in time from when the capture began to when the event that triggered the capture occurred in seconds. The maximum value is 86400
Example:
3The amount of bytes in the capture that occurred in the pastDuration interval
A scope expression that limits where the capture could have been taken
Example:
host.hostName = 'ip-10-2-157-201'The number of bytes in the capture
Example:
87335540An enum of the different statuses a capture can have
Possible values: [
requested,filtering,capturing,done,error,uploading,uploadingError,uploaded]Uniquely identifies a storage configuration
Example:
153Uniquely identifies a capture and correlates the capture to a request. Must match the following regex ([a-z0-9]){8}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){12}
Example:
960d9da0-cc79-4079-932a-544e193ab385An enum of the different types of storage to which captures can be saved
Possible values: [
local,s3,agent,provided,cassandra]
Status Code
Successfully retrieved a capture
The capture could not be found
No Sample Response
Request
Path Parameters
Contains system calls and other operating system events
Describes a Sysdig agent running on a machine
- agent
- attributes
The ID of a particular customer
The name of the host the agent is running on
Example:
ip-10-2-157-201Uniquely identifies an agent
Example:
34688Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0b
A map of assorted metadata
- annotations
The name of the s3 bucket to which the capture will be saved. May be null
Uniquely identifies a container
Example:
8883164eb9bfThe range in time from when the capture began to when it ended in seconds. The maximum value is 86400
Example:
30A way to only capture a subset of the data
Example:
proc.name=viThe name of a folder in an s3 bucket
Example:
/A way to reference a capture. Must not be empty
Example:
my_capture.scapAn enum of Sysdig products
Allowable values: [
sdc,sds]The key that allows an agent to communicate with a collector
The number of bytes the Sysdig backend has received from the agent
Example:
87335540The number of bytes the Sysdig backend has pushed to a storage provider
Example:
87335540The unx timestamp of when the Sysdig backend received the capture from the agent in milliseconds
Example:
1625783881254The unix timestamp of when the capture was requested in milliseconds
Example:
1625783854265The url to download the capture
Example:
/api/v1/captures/1327048/downloaduniquely identifies the capture
Example:
1327048Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0bThe maximum number of bytes allowed to be in this capture
Example:
104857600A list of metrics
The range in time from when the capture began to when the event that triggered the capture occurred in seconds. The maximum value is 86400
Example:
3The amount of bytes in the capture that occurred in the pastDuration interval
A scope expression that limits where the capture could have been taken
Example:
host.hostName = 'ip-10-2-157-201'The number of bytes in the capture
Example:
87335540An enum of the different statuses a capture can have
Allowable values: [
requested,filtering,capturing,done,error,uploading,uploadingError,uploaded]Uniquely identifies a storage configuration
Example:
153Uniquely identifies a capture and correlates the capture to a request. Must match the following regex ([a-z0-9]){8}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){12}
Example:
960d9da0-cc79-4079-932a-544e193ab385An enum of the different types of storage to which captures can be saved
Allowable values: [
local,s3,agent,provided,cassandra]
Response
Contains system calls and other operating system events
Describes a Sysdig agent running on a machine
- agent
- attributes
The ID of a particular customer
The name of the host the agent is running on
Example:
ip-10-2-157-201Uniquely identifies an agent
Example:
34688Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0b
A map of assorted metadata
- annotations
The name of the s3 bucket to which the capture will be saved. May be null
Uniquely identifies a container
Example:
8883164eb9bfThe range in time from when the capture began to when it ended in seconds. The maximum value is 86400
Example:
30A way to only capture a subset of the data
Example:
proc.name=viThe name of a folder in an s3 bucket
Example:
/A way to reference a capture. Must not be empty
Example:
my_capture.scapAn enum of Sysdig products
Possible values: [
sdc,sds]The key that allows an agent to communicate with a collector
The number of bytes the Sysdig backend has received from the agent
Example:
87335540The number of bytes the Sysdig backend has pushed to a storage provider
Example:
87335540The unx timestamp of when the Sysdig backend received the capture from the agent in milliseconds
Example:
1625783881254The unix timestamp of when the capture was requested in milliseconds
Example:
1625783854265The url to download the capture
Example:
/api/v1/captures/1327048/downloaduniquely identifies the capture
Example:
1327048Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0bThe maximum number of bytes allowed to be in this capture
Example:
104857600A list of metrics
The range in time from when the capture began to when the event that triggered the capture occurred in seconds. The maximum value is 86400
Example:
3The amount of bytes in the capture that occurred in the pastDuration interval
A scope expression that limits where the capture could have been taken
Example:
host.hostName = 'ip-10-2-157-201'The number of bytes in the capture
Example:
87335540An enum of the different statuses a capture can have
Possible values: [
requested,filtering,capturing,done,error,uploading,uploadingError,uploaded]Uniquely identifies a storage configuration
Example:
153Uniquely identifies a capture and correlates the capture to a request. Must match the following regex ([a-z0-9]){8}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){12}
Example:
960d9da0-cc79-4079-932a-544e193ab385An enum of the different types of storage to which captures can be saved
Possible values: [
local,s3,agent,provided,cassandra]
Status Code
Successfully updated a capture
Indicates the request body was invalid
No Sample Response
Response
Contains system calls and other operating system events
- capture
Describes a Sysdig agent running on a machine
- agent
- attributes
The ID of a particular customer
The name of the host the agent is running on
Example:
ip-10-2-157-201Uniquely identifies an agent
Example:
34688Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0b
A map of assorted metadata
- annotations
The name of the s3 bucket to which the capture will be saved. May be null
Uniquely identifies a container
Example:
8883164eb9bfThe range in time from when the capture began to when it ended in seconds. The maximum value is 86400
Example:
30A way to only capture a subset of the data
Example:
proc.name=viThe name of a folder in an s3 bucket
Example:
/A way to reference a capture. Must not be empty
Example:
my_capture.scapAn enum of Sysdig products
Possible values: [
sdc,sds]The key that allows an agent to communicate with a collector
The number of bytes the Sysdig backend has received from the agent
Example:
87335540The number of bytes the Sysdig backend has pushed to a storage provider
Example:
87335540The unx timestamp of when the Sysdig backend received the capture from the agent in milliseconds
Example:
1625783881254The unix timestamp of when the capture was requested in milliseconds
Example:
1625783854265The url to download the capture
Example:
/api/v1/captures/1327048/downloaduniquely identifies the capture
Example:
1327048Uniquely identifies a machine
Example:
12:dd:fe:e0:17:0bThe maximum number of bytes allowed to be in this capture
Example:
104857600A list of metrics
The range in time from when the capture began to when the event that triggered the capture occurred in seconds. The maximum value is 86400
Example:
3The amount of bytes in the capture that occurred in the pastDuration interval
A scope expression that limits where the capture could have been taken
Example:
host.hostName = 'ip-10-2-157-201'The number of bytes in the capture
Example:
87335540An enum of the different statuses a capture can have
Possible values: [
requested,filtering,capturing,done,error,uploading,uploadingError,uploaded]Uniquely identifies a storage configuration
Example:
153Uniquely identifies a capture and correlates the capture to a request. Must match the following regex ([a-z0-9]){8}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){4}-([a-z0-9]){12}
Example:
960d9da0-cc79-4079-932a-544e193ab385An enum of the different types of storage to which captures can be saved
Possible values: [
local,s3,agent,provided,cassandra]
Status Code
Successfully stopped the capture
The capture could not be found
No Sample Response
Retrieve a list of integrations for the customer.
Retrieves a list of forwarding integrations for the customer making the request.
GET /api/v1/eventsForwarding/integrations
Response
Represents a command execution.
The channels for which the integration must forward data from.
Possible values: [
POLICY_EVENTS]- connectionInfo
Possible values: [
RFC_3164,RFC_5424,RFC_5425]Possible values: [
tcp,udp,tls]Possible values: [
JSON,LEEF,CEF]
The integration type.
Possible values: [
SYSLOG,SPLUNK,MCM,QRADAR]
Status Code
The list of integrations.
The request is invalid.
No Sample Response
Create an integration for the customer.
Creates a forwarding integration for the customer.
POST /api/v1/eventsForwarding/integrations
Request
The content of the integration to create.
{
"channels": [
"POLICY_EVENTS"
],
"connectionInfo": {
"ServicePort": 514,
"ServiceURL": "syslog-address"
},
"enabled": true,
"name": "Forward to Syslog",
"type": "SYSLOG"
}The channels for which the integration must forward data from.
Allowable values: [
POLICY_EVENTS]- connectionInfo
Allowable values: [
RFC_3164,RFC_5424,RFC_5425]Allowable values: [
tcp,udp,tls]Allowable values: [
JSON,LEEF,CEF]
The integration type.
Allowable values: [
SYSLOG,SPLUNK,MCM,QRADAR]Default:
false
Retrieve an integration given its id.
Retrieves a forwarding rule given its id.
GET /api/v1/eventsForwarding/integrations/{integrationId}Response
Represents a command execution.
The channels for which the integration must forward data from.
Possible values: [
POLICY_EVENTS]- connectionInfo
Possible values: [
RFC_3164,RFC_5424,RFC_5425]Possible values: [
tcp,udp,tls]Possible values: [
JSON,LEEF,CEF]
The integration type.
Possible values: [
SYSLOG,SPLUNK,MCM,QRADAR]
Status Code
The forwarding integration with a given id.
The integration could not be found.
{ "channels": [ "POLICY_EVENTS" ], "connectionInfo": { "ServicePort": 514, "ServiceURL": "syslog-address" }, "customerId": 1, "enabled": true, "id": 1, "name": "Forward to Syslog", "type": "syslog" }
Update an integration given its id.
Updates an integration given its id. The PATCH payload can be any
combination of the following fields having the value to change.
None of the connectionInfo fields are required for patching.
PATCH /api/v1/eventsForwarding/integrations/{integrationId}Request
Path Parameters
The forwarding integration id.
Example:
1
The content of the integration to update.
{
"enabled": true
}The channels for which the integration must forward data from.
Allowable values: [
POLICY_EVENTS]- connectionInfo
Allowable values: [
RFC_3164,RFC_5424,RFC_5425]Allowable values: [
tcp,udp,tls]Allowable values: [
JSON,LEEF,CEF]
Enable/disable the integration.
Change the name of the integration.
Creates a Kubernetes Network Policy
Creates a Kubernetes Network Policy
POST /api/v1/networkSecurity/namespaces/{namespaceName}/simulatedPoliciesRequest
Path Parameters
The name of a kubernetes namespace
- spec
List of egress rules to be applied to the selected pods
- egress
List of destination ports for outgoing traffic
- ports
port on the pod
The protocol by which traffic must match. Defaults to TCP if not specified. In the future UDP and SCTP may be supported.
Allowable values: [
TCP]
List of destinations for outgoing traffic of pods selected for this rule
- to
Defines policy on a particular IPBlock
- ipBlock
Represents an IP Block
Example:
192.168.1.1/24CIDRs that should not be included within an IP Block
Matches all pods in all namespaces selected by this label selector
- namespaceSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Selects all matching pods in the namespace
- podSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
List of ingress rules to be applied to the selected pods
- ingress
List of sources which should be able to access the pods selected for this rule
- from
Defines policy on a particular IPBlock
- ipBlock
Represents an IP Block
Example:
192.168.1.1/24CIDRs that should not be included within an IP Block
Matches all pods in all namespaces selected by this label selector
- namespaceSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Selects all matching pods in the namespace
- podSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
List of ports which should be made accessible on the pods selected for this rule
- ports
port on the pod
The protocol by which traffic must match. Defaults to TCP if not specified. In the future UDP and SCTP may be supported.
Allowable values: [
TCP]
Selects the pods to which this NetworkPolicy object applies. An empty podSelector matches all pods in this namespace.
- podSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
List of rule types that the NetworkPolicy relates to
Allowable values: [
Ingress,Egress]
Response
The text of a proposed Kubernetes Network Policy
Status Code
Indicates the requested KNP was successfully created
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Creates a communication topology graph around the specified owner
Creates a communication topology graph around the specified owner; if KNP spec is provided, marks communication edges as 'blocked' if they are blocked by the KNP
POST /api/v1/networkSecurity/networkPolicyOverlayOwnerTopology
Request
Query Parameters
The name of a kubernetes namespace
The name of a kubernetes cluster
The name of a pod owner
Specifies how to group pods
Allowable values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
- spec
List of egress rules to be applied to the selected pods
- egress
List of destination ports for outgoing traffic
- ports
port on the pod
The protocol by which traffic must match. Defaults to TCP if not specified. In the future UDP and SCTP may be supported.
Allowable values: [
TCP]
List of destinations for outgoing traffic of pods selected for this rule
- to
Defines policy on a particular IPBlock
- ipBlock
Represents an IP Block
Example:
192.168.1.1/24CIDRs that should not be included within an IP Block
Matches all pods in all namespaces selected by this label selector
- namespaceSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Selects all matching pods in the namespace
- podSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
List of ingress rules to be applied to the selected pods
- ingress
List of sources which should be able to access the pods selected for this rule
- from
Defines policy on a particular IPBlock
- ipBlock
Represents an IP Block
Example:
192.168.1.1/24CIDRs that should not be included within an IP Block
Matches all pods in all namespaces selected by this label selector
- namespaceSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Selects all matching pods in the namespace
- podSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
List of ports which should be made accessible on the pods selected for this rule
- ports
port on the pod
The protocol by which traffic must match. Defaults to TCP if not specified. In the future UDP and SCTP may be supported.
Allowable values: [
TCP]
Selects the pods to which this NetworkPolicy object applies. An empty podSelector matches all pods in this namespace.
- podSelector
A list of label selector requirements. The requirements are ANDed.
- matchExpressions
The label key that the selector applies to.
Represents a key's relationship to a set of values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
Allowable values: [
In,NotIn,Exists,DoesNotExist]A list of operands
A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
List of rule types that the NetworkPolicy relates to
Allowable values: [
Ingress,Egress]
Response
Owner communication topology graph
Communication topology graph
- graph
A directed edge, indicates a relationship between two vertices
- edges
ID of the destination vertex
Metadata, could be attached to a graph, an edge, or a vertex
- metadata
ID of the source vertex
Type of edge relationship
Possible values: [
endpoints,communication]
Metadata, could be attached to a graph, an edge, or a vertex
- metadata
- vertices
Pod Owner
- any property
Vertex ID
Metadata, could be attached to a graph, an edge, or a vertex
- metadata
Pod Owner name
Namespace vertex ID; required for all pod owner types except 'namespace' and 'unresolvedip'
Vertex type
Possible values: [
service,deployment,statefulset,daemonset,namespace,unresolvedip]
Status Code
Indicates the requested topology graph is sucessfully created
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns all cluster names for the customer
Returns all cluster names for the customer
GET /api/v1/networkTopology/clusters
Request
Query Parameters
A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
Cluster names
Status Code
Indicates the requested cluster names were successfully returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns an overview of egress networking traffic
Returns an overview of egress networking traffic
GET /api/v1/networkTopology/egressSummaries
Request
Query Parameters
The name of a kubernetes cluster
The name of a kubernetes namespace
The name of a pod owner
Specifies how to group pods
Allowable values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
- connections
The process on the client
Example:
nginx- serverNamespace
the name of the cluster
Owner type
Possible values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]For pod owners, the labels are used to identify the pods related to the deployment/job/etc. For services, the labels are used to identify the endpoints for the service. For namespaces, the labels will be put in any knp generated based on objects in this namespace.
name of the object
- serverOwner
the name of the cluster
Owner type
Possible values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]For pod owners, the labels are used to identify the pods related to the deployment/job/etc. For services, the labels are used to identify the endpoints for the service. For namespaces, the labels will be put in any knp generated based on objects in this namespace.
name of the object
the name of the namespace that the pod owner belongs to
Kubernetes labels of the pod controller. If the pod owner is a service, the labels are for the pod owner of the service’s endpoint.
The port on the server
- metadata
The from parameter after being normalized to fit the closest approximate available time range
The to parameter after being normalized to fit the closest approximate available time range
Status Code
Indicates the requested overview of egress networking traffic was successfully returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns the unresolved ips for a time range and pod owner
Returns the unresolved ips for a time range and pod owner
GET /api/v1/networkTopology/egressUnresolvedIps
Request
Query Parameters
The name of a kubernetes cluster
The name of a kubernetes namespace
The name of a pod owner
Specifies how to group pods
Allowable values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
If false, the FE will display the warning “Cluster subnet list is incomplete. IPs not mapping to known subnets will be marked as external”.
Collection of unresolved ingress IPs
- unresolveds
- clientIPMetadata
Unresolved IP address
IP origin
Possible values: [
internal,external]
- serverPort
port on the pod
The protocol by which traffic must match. Defaults to TCP if not specified. In the future UDP and SCTP may be supported.
Possible values: [
TCP]
The process on the server
Status Code
Indicates the requested egress unresolved ips were successfully returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns an overview of ingress networking traffic
Returns an overview of ingress networking traffic
GET /api/v1/networkTopology/ingressSummaries
Request
Query Parameters
The name of a kubernetes cluster
The name of a kubernetes namespace
The name of a pod owner
Specifies how to group pods
Allowable values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
- connections
- clientNamespace
the name of the cluster
Owner type
Possible values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]For pod owners, the labels are used to identify the pods related to the deployment/job/etc. For services, the labels are used to identify the endpoints for the service. For namespaces, the labels will be put in any knp generated based on objects in this namespace.
name of the object
- clientOwner
the name of the cluster
Owner type
Possible values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]For pod owners, the labels are used to identify the pods related to the deployment/job/etc. For services, the labels are used to identify the endpoints for the service. For namespaces, the labels will be put in any knp generated based on objects in this namespace.
name of the object
the name of the namespace that the pod owner belongs to
Kubernetes labels of the pod controller. If the pod owner is a service, the labels are for the pod owner of the service’s endpoint.
The port on the server
The process on the server
Example:
nginx
- metadata
The from parameter after being normalized to fit the closest approximate available time range
The to parameter after being normalized to fit the closest approximate available time range
Status Code
Indicates the requested overview of ingress networking traffic was successfully returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns the unresolved ips for a time range and pod owner
Returns the unresolved ips for a time range and pod owner
GET /api/v1/networkTopology/ingressUnresolvedIps
Request
Query Parameters
The name of a kubernetes cluster
The name of a kubernetes namespace
The name of a pod owner
Specifies how to group pods
Allowable values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
If false, the FE will display the warning “Cluster subnet list is incomplete. IPs not mapping to known subnets will be marked as external”.
Collection of unresolved egress IPs
- unresolveds
The process on the client
- serverIPMetadata
Unresolved IP address
IP origin
Possible values: [
internal,external]
- serverPort
port on the pod
The protocol by which traffic must match. Defaults to TCP if not specified. In the future UDP and SCTP may be supported.
Possible values: [
TCP]
Status Code
Indicates the requested ingress unresolved ips were successfully returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns sorted list of unique namespace label key values
Returns sorted list of unique namespace label key values
GET /api/v1/networkTopology/namespaceLabelKeys
Response
Array of kubernetes labels
Status Code
Indicates the requested list was returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns all namespace names for the cluster
Returns all namespace names for the cluster
GET /api/v1/networkTopology/namespaces
Request
Query Parameters
The name of a kubernetes cluster
A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
the name of the cluster
Owner type
Possible values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]For pod owners, the labels are used to identify the pods related to the deployment/job/etc. For services, the labels are used to identify the endpoints for the service. For namespaces, the labels will be put in any knp generated based on objects in this namespace.
name of the object
Status Code
Indicates the requested namespaces were successfully returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Creates a communication topology graph around the specified owner
Creates a communication topology graph around the specified owner
GET /api/v1/networkTopology/ownerTopology
Request
Query Parameters
The name of a kubernetes namespace
The name of a kubernetes cluster
The name of a pod owner
Specifies how to group pods
Allowable values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
Owner communication topology graph
Communication topology graph
- graph
A directed edge, indicates a relationship between two vertices
- edges
ID of the destination vertex
Metadata, could be attached to a graph, an edge, or a vertex
- metadata
ID of the source vertex
Type of edge relationship
Possible values: [
endpoints,communication]
Metadata, could be attached to a graph, an edge, or a vertex
- metadata
- vertices
Pod Owner
- any property
Vertex ID
Metadata, could be attached to a graph, an edge, or a vertex
- metadata
Pod Owner name
Namespace vertex ID; required for all pod owner types except 'namespace' and 'unresolvedip'
Vertex type
Possible values: [
service,deployment,statefulset,daemonset,namespace,unresolvedip]
Status Code
Indicates the requested topology graph is sucessfully created
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns all pod owners for a cluster, namespace, and time range
Returns a map of owner type to a list of owner selectors
GET /api/v1/networkTopology/owners
Request
Query Parameters
The name of a kubernetes cluster
The name of a kubernetes namespace
A unix timestamp in seconds of specifying the initial time of a range
A unix timestamp in seconds of specifying the end time of a range
Response
the name of the cluster
Owner type
Possible values: [
Service,Deployment,StatefulSet,DaemonSet,Pod,Namespace]For pod owners, the labels are used to identify the pods related to the deployment/job/etc. For services, the labels are used to identify the endpoints for the service. For namespaces, the labels will be put in any knp generated based on objects in this namespace.
name of the object
the name of the namespace that the pod owner belongs to
Kubernetes labels of the pod controller. If the pod owner is a service, the labels are for the pod owner of the service’s endpoint.
Status Code
Indicates the requested map of owner type to a list of owner selectors were successfully returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Returns sorted list of unique workload label key values
Returns sorted list of unique workload label key values
GET /api/v1/networkTopology/workloadLabelKeys
Response
Array of kubernetes labels
Status Code
Indicates the requested list was returned
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The user successfully authenticated but has insufficient permissions. More information about 403 can be found at https://httpstatuses.com/403
No Sample Response
Get info about profile groups for a customer
This endpoint returns the profile groups for a customer
GET /api/v1/profiling/profileGroups
Response
List of metrics used to identify the entity to be profiles (e.g. ["container.image"].
Identifier of this profile group.
Number of profiles computed within the profileGroup.
Specify whether the profile engine aggregates data at the container or host level.
Possible values: [
AT_HOSTS,AT_CONTAINERS]List of metrics used to identify a sub-entity inside an entity (e.g. ["container.id"].
Status Code
An array of profile groups for a customer
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
No Sample Response
Get info about a profile group with a specific id for a customer
This endpoint returns the profile group given a id for a customer
GET /api/v1/profiling/profileGroups/{profileGroupId}Response
List of metrics used to identify the entity to be profiles (e.g. ["container.image"].
Identifier of this profile group.
Number of profiles computed within the profileGroup.
Specify whether the profile engine aggregates data at the container or host level.
Possible values: [
AT_HOSTS,AT_CONTAINERS]List of metrics used to identify a sub-entity inside an entity (e.g. ["container.id"].
Status Code
The profile group for the given profileGroupId
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
No Sample Response
Get all profiles for a given profileGroupId
This endpoint returns the profiles for a given profileGroupId
GET /api/v1/profiling/profileGroups/{profileGroupId}/profilesRequest
Path Parameters
The id of the profile group
Query Parameters
If specified, only profiles with a confidence score at least this amount will be retrieved. Defaults to
0A comma-separated list of statuses. If specified, only profiles with these statuses will be retrieved. Defaults to
['FINALIZED','LEARNING']Allowable values: [
FINALIZED,LEARNING]If specified, filter to only include profiles where the profile name or image name (registry/repository:tag@hash) contains this string. Defaults to empty string
Field used to sort. Defaults to
score. Profiles withstatus:'FINALIZED'will always appear abovestatus:'LEARNING', for all values ofsortByexceptsortBy:'status', sortMethod:'asc'.Allowable values: [
score,profileName,status,createdOn]If specified, a limit on the number of entries retrieved. If any filters are also specified, the limit will be applied on the filtered list.
limitmust be >=1and if it overflows the list all entries will be retrieved. Defaults to length of listIf specified, a 0-based index on the profiles list. Only entries >=
offsetwill be retrieved. Defaults to0. If any filters are also specified, this index will be applied on the filtered list. An empty list will be retrieved if this index overflows the list.Sorting method. Defaults to
desc.Allowable values: [
desc,asc]
Response
True if more results can be fetched.
The limit used. 0 for no limit.
The start offset used
The profiles retrieved
- profiles
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
Value from 0 to 1000 representing the score of the category or subcategory.
- containerImagesProposal
A category has at least one subcategory. Each subcategory refers to one rule and has its own score and status.
Example:
The category `fileSystemProposal` will have an `items` array with subcategories such as "files rw" which refers to a single rule.- subcategories
Short description of the subcategory.
Example:
files rwName of the rule object.
Example:
Unexpected spawned process postgres in image a1b2c3d4e5f6Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCOValue from 0 to 1000 representing the score of the category or subcategory.
Value from 0 to 1000 representing the score of the category or subcategory.
- fileSystemProposal
A category has at least one subcategory. Each subcategory refers to one rule and has its own score and status.
Example:
The category `fileSystemProposal` will have an `items` array with subcategories such as "files rw" which refers to a single rule.- subcategories
Short description of the subcategory.
Example:
files rwName of the rule object.
Example:
Unexpected spawned process postgres in image a1b2c3d4e5f6Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCOValue from 0 to 1000 representing the score of the category or subcategory.
Value from 0 to 1000 representing the score of the category or subcategory.
- networkProposal
A category has at least one subcategory. Each subcategory refers to one rule and has its own score and status.
Example:
The category `fileSystemProposal` will have an `items` array with subcategories such as "files rw" which refers to a single rule.- subcategories
Short description of the subcategory.
Example:
files rwName of the rule object.
Example:
Unexpected spawned process postgres in image a1b2c3d4e5f6Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCOValue from 0 to 1000 representing the score of the category or subcategory.
Value from 0 to 1000 representing the score of the category or subcategory.
- processesProposal
A category has at least one subcategory. Each subcategory refers to one rule and has its own score and status.
Example:
The category `fileSystemProposal` will have an `items` array with subcategories such as "files rw" which refers to a single rule.- subcategories
Short description of the subcategory.
Example:
files rwName of the rule object.
Example:
Unexpected spawned process postgres in image a1b2c3d4e5f6Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCOValue from 0 to 1000 representing the score of the category or subcategory.
Value from 0 to 1000 representing the score of the category or subcategory.
Identifier of the profile group.
Status of the model (learning or finalized).
Possible values: [
LEARNING,FINALIZED]- syscallProposal
A category has at least one subcategory. Each subcategory refers to one rule and has its own score and status.
Example:
The category `fileSystemProposal` will have an `items` array with subcategories such as "files rw" which refers to a single rule.- subcategories
Short description of the subcategory.
Example:
files rwName of the rule object.
Example:
Unexpected spawned process postgres in image a1b2c3d4e5f6Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCOValue from 0 to 1000 representing the score of the category or subcategory.
Value from 0 to 1000 representing the score of the category or subcategory.
Status Code
The profiles for a given profileGroupId
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
No Sample Response
Get profile matching given profileId
This endpoint returns the profile matching a given profileId
GET /api/v1/profiling/profiles/{profileId}Response
UUID of this profile.
Values for the ProfileGroup.aggregationKeys.
Name of the profile inside the profileGroup.
Identifier of the related profile group.
keep track of the life of an entity
- profileLifeTracker
- proposedPolicy
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Array of rules referred to by the proposed policy in
proposedPolicy, that have not yet been created. Each of theruleNamesinproposedPolicymust refer to a rule'snameof either a proposed rule in this array or a rule that already exists.- proposedRules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Name of the file in which the rule is defined. For Default Falco rules, this should come from the name property of the FalcoRulesFile object that contained this rule. For other falco rules, the filename should be "falco_rules.local.yaml". For non-falco rules, the filename should be "fast_rules.local.yaml".
Example:
falco_rules.local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Possible values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Possible values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Status Code
The profile for a given profileId
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
The requested resource was not found. More information about 404 can be found at https://httpstatuses.com/404
Generic error from API
No Sample Response
Remove a profile given the profileId
This endpoint can be used to remove a profile given a profileId
POST /api/v1/profiling/profiles/{profileId}/actions/removeResponse
Profile reset action response
Status Code
The ActionsProfileResponse containing time when profile was removed
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
Generic error from API
No Sample Response
Reset a profile given the profileId
This endpoint can be used to reset a profile given a profileId
POST /api/v1/profiling/profiles/{profileId}/actions/resetResponse
Profile reset action response
Status Code
The ActionsProfileResponse containing time when profile was reset
Indicates a parameter, header or another quality of the request was malformed. More information about 400 can be found at https://httpstatuses.com/400
The user failed to authenticate. More information about 401 can be found at https://httpstatuses.com/401
Generic error from API
No Sample Response
The policy tuner service records this customer as disabled such that a tune will not be run for this customer during the next run cycle
The policy tuner service records this customer as disabled such that a tune will not be run for this customer during the next run cycle
POST /api/v1/secure/policyTuner/disable
Returns a list of exceptions to exclude the events matching a set of parameters
Returns a list of exceptions to exclude the events matching a set of parameters
POST /api/v1/secure/policyTuner/excludeEvents
Request
Query Parameters
The timestamp in seconds in which the events to be excluded begin
The timestamp in seconds in which the events to be excluded end
The number of suggested exclusion proposals to return in the responses. The request will be rejected if it is greater than 10 or less than 1.
Response
- exclusionProposals
- exceptionName
- comps
- fields
- values
- tuples
- items
Status Code
Indicates the service was able to successfully find a list of exceptions to exclude the provided events
Returned if the start param occurs after the end or if the parameters are of the wrong data type or the limit is out of range
No Sample Response
The policy tuner immediately runs tuning for the customer
The policy tuner immediately runs tuning for the customer
POST /api/v1/secure/policyTuner/tuneNow
Response
A name for this file. Should be used in UI to distinguish between files.
Example:
falco_rules.yamlAn array of alternate versions for the given file. An agent should choose the highest version that is compatible with its included falco engine.
- variants
A string containing the yaml contents of a falco rules file variant.
Examples:- macro: open_write condition: something
The minimum falco engine version that can read this rules file variant.
Status Code
The generated tuner FalcoRulesFile
Sysdig has not enabled tuning for this customer
No Sample Response
Retrieves a secure events feed
Retrieves the list of events that match a filter given a specified
time range or cursor.
The pair from and to and the cursor parameter are mutually
exclusive. If you supply a from and to you must not supply a
cursor and vice-versa.
If you supply a cursor then the prev field inside the response is
set if and only if there are events before the first event returned, while
the next field inside the response is set if and only if there are
events after the last event returned. If, instead, you supply the from
and to pair then the prev and next fields inside the response are
always set, because in that case there is no efficient way for the backend
to verify if next and prev events actually exist. For this reason, the
best way to use this API is to supply the from and to pair at the
first request and then use the prev and next cursors to fetch events
before and after the events returned.
Please, do note that if you supply from and to and receive the prev
and next cursors, any subsequent request made by supplying that next
or prev cursor will return results that are not filtered by the from
and to you provided in the first request.
Finally, the difference between from and to cannot be greater than
2 weeks.
GET /api/v1/secureEvents
Request
Query Parameters
From, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000To, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000Cursor is a string used to retrieve data given a specific context. The context can either be events feed before a certain event, after it or its surrounding. See the
prev,nextandcursorfields inside the response for further details.Example:
LTltNGUybXIwdWkzZThhMjE1bjRnQuery language expression for filtering results. It is a subset of the full metrics query language used in monitoring. Operators:
and,orandnotlogical operators (i.e.pid = 1 and ppid = 2)=,!=,>,>=,<and<=comparison operators (i.e.pid = 1)into check inclusion in a list of values (i.e.pid in (1, 2)orclientipv4 in ("127.0.0.1", "192.168.0.1")) This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each audit events type. The list of supported fields can be retrieved through theapi/v1/secureEvents/scopeFiltersendpoint. In addition to those fields, also these fields are supported:severityas numeric value in the[0, 7]rangecategoryas string valueoriginatoras string value (eitherpolicyorscanning)nameas string valuefreeTextas string valuesourceas string valueagentIdas numeric valuecontainerIdas string valuemachineIdas string valueruleNameas string valueruleTypeas numeric valueruleSubTypeas numeric valuepolicyIdas numeric valuealertNameas string valuetriggeras string valueimage.idas string valueimage.registryas string valueimage.repoas string valueimage.tagas string valueimage.digestas string value
Example:
agent.id=1Limit the number of events to return.
Possible values: 1 ≤ value ≤ 999
Default:
100Example:
50How to handle special events categories, like the policy simulation (advisor).
exclude_simulationexcludes events with categorysimulationonly_simulationreturns only events with categorysimulation
Allowable values: [
exclude_simulation,only_simulation]Default:
exclude_simulationExample:
exclude_simulation
Response
- data
- actions
Capture action performed once the event happened.
- undefined
Capture action type.
Possible values: [
capture]Period of time to capture after event in nanoseconds.
Example:
18000000000Period of time to capture before event in nanoseconds.
Example:
5000000000When
successful == false, details on why the action failed.Whether or not the action was completed successfully.
Token that can be related to later messages.
Example:
4f24c92e-48f5-45ab-84a5-c394f07e855e
The event category.
Possible values: [
runtime,simulation]Example:
runtimeThe cursor that can be used to fetch a set of events surrounding this same event. By providing this value as
cursorin a GETsecureEventsrequest, you will get the set of events surrounding this current event.Example:
LTltNGUybXIwdWkzZThhMjE1bjRnThe customer id.
Example:
1The event description.
Examples:Identify a container being created with privileged=trueThe event id.
Example:
15cbf54e34df95404caad1c988cf7c42The machine id (i.e. hostname).
Example:
02:37:22:86:ce:53The event name.
Example:
Launch Privileged ContainerType of the event (i.e. policy, scanning etc.).
Example:
policyThe event severity.
Possible values: 0 ≤ value ≤ 7
Example:
4Source of the event.
Example:
k8s_auditTimestamp the event occured.
Example:
2020-04-21T16:08:08.845336507ZThe agent id.
Example:
1The container id.
Example:
df5f83c5d5e5Body of the specific event. It contains fields that are specific to a single event and are not shared among different event types.
- content
Attribute fields of the policy event.
Output of the policy event.
Examples:File below a known binary directory opened for writing...
Policy ID.
Example:
2Rule name.
Example:
Terminal shell in containerRule subtype.
Rule tags.
Examples:[ "mitre_credential_access", "mitre_discovery", "filesystem" ]Rule type.
Example:
6
Key value pairs of labels.
- label
- page
The number of events returned. This number is always less or equal the limit specified in the request.
Example:
10The cursor that can be used to fetch a set of events after the last event returned in the
dataarray. If this value is unset, then there are no events after the last event returned in thedataarray. By providing this value ascursorin a GETsecureEventsrequest, you will get the set of events after the last event returned in thedataarray.Example:
KzltNGUybXIwdWkzZThhMjE1bjRnThe cursor that can be used to fetch a set of events before the first event returned in the
dataarray. If this value is unset, then there are no events before the first event returned in thedataarray. By providing this value ascursorin a GETsecureEventsrequest, you will get the set of events that precede the first event returned in thedataarray.Example:
LTltNGUybXIwdWkzZThhMjE1bjRn
Status Code
The secure events feed.
The request is invalid.
Attempting to retrieve a secure events feed by using a filter that contains unsupported metrics.
The server encountered an unexpected condition that prevented it from fulfilling the request.
No Sample Response
Retrieves the supported events feed scope filters
Retrieves the whitelist of supported secure events scope filters that can
be used inside the filter parameter while retrieving the secure events
feed.
GET /api/v1/secureEvents/filters
Response
List of supported scope filters
- Examples:
[ { "id": "container.image.repo", "type": "string" }, { "id": "container.image.tag", "type": "string" }, { "id": "container.name", "type": "string" }, { "id": "container.label", "type": "string" }, { "id": "container.label.io.kubernetes.container.name", "type": "string" }, { "id": "container.label.io.kubernetes.pod.name", "type": "string" }, { "id": "container.label.io.kubernetes.pod.namespace", "type": "string" }, { "id": "container.label.maintainer", "type": "string" }, { "id": "host.hostName", "type": "string" }, { "id": "host.ip.private", "type": "ip" }, { "id": "host.ip.public", "type": "ip" }, { "id": "host.mac", "type": "string" }, { "id": "kubernetes.cluster.name", "type": "string" }, { "id": "kubernetes.daemonSet.name", "type": "string" }, { "id": "kubernetes.namespace.name", "type": "string" }, { "id": "kubernetes.workload.name", "type": "string" }, { "id": "kubernetes.pod.name", "type": "string" }, { "id": "kubernetes.replicaSet.name", "type": "string" }, { "id": "kubernetes.statefulSet.name", "type": "string" }, { "id": "azure.subscriptionId", "type": "string" } ]- labelDescriptors
The supported scope filter key.
Type of the scope filter value.
Possible values: [
string,number,date,ip]
Status Code
The supported secure events scope filters.
The server encountered an unexpected condition that prevented it from fulfilling the request.
No Sample Response
Verify presence of old events
Verify if there are new/legacy events in the store.
GET /api/v1/secureEvents/hasEvents
Response
This is
trueif and only if there are no new events (i.e. events in the new indices) in the time range from 30 days ago to 29 days ago. This assumes that once the Secure Events feature is deployed, all the events are written in the new indices only; therefore, there are legacy events only if there are no events in the new indices for that time range.This is
trueif and only if there is at least a new event in the time range from 1 day ago to now.Example:
true
Status Code
Whether or not there are new/legacy events.
The server encountered an unexpected condition that prevented it from fulfilling the request.
No Sample Response
Retrieves an event given its id
Retrieves an event with a given id.
GET /api/v1/secureEvents/{eventId}Response
- actions
Capture action performed once the event happened.
- undefined
Capture action type.
Possible values: [
capture]Period of time to capture after event in nanoseconds.
Example:
18000000000Period of time to capture before event in nanoseconds.
Example:
5000000000When
successful == false, details on why the action failed.Whether or not the action was completed successfully.
Token that can be related to later messages.
Example:
4f24c92e-48f5-45ab-84a5-c394f07e855e
The event category.
Possible values: [
runtime,simulation]Example:
runtimeThe cursor that can be used to fetch a set of events surrounding this same event. By providing this value as
cursorin a GETsecureEventsrequest, you will get the set of events surrounding this current event.Example:
LTltNGUybXIwdWkzZThhMjE1bjRnThe customer id.
Example:
1The event description.
Examples:Identify a container being created with privileged=trueThe event id.
Example:
15cbf54e34df95404caad1c988cf7c42The machine id (i.e. hostname).
Example:
02:37:22:86:ce:53The event name.
Example:
Launch Privileged ContainerType of the event (i.e. policy, scanning etc.).
Example:
policyThe event severity.
Possible values: 0 ≤ value ≤ 7
Example:
4Source of the event.
Example:
k8s_auditTimestamp the event occured.
Example:
2020-04-21T16:08:08.845336507ZThe agent id.
Example:
1The container id.
Example:
df5f83c5d5e5Body of the specific event. It contains fields that are specific to a single event and are not shared among different event types.
- content
Attribute fields of the policy event.
Output of the policy event.
Examples:File below a known binary directory opened for writing...
Policy ID.
Example:
2Rule name.
Example:
Terminal shell in containerRule subtype.
Rule tags.
Examples:[ "mitre_credential_access", "mitre_discovery", "filesystem" ]Rule type.
Example:
6
Key value pairs of labels.
- label
Status Code
Event with the given id.
The event could not be found.
The server encountered an unexpected condition that prevented it from fulfilling the request.
No Sample Response
Retrieves bubbleChart stats of runtime policy events and vulnerabilities with severities.
Retrieves bubbleChart stats which are useful for understanding events and vulnerabilities with their severity. They that match a filter, specified time range (from <= to), and number of rows to return for all columns.
Parameters from, to, and metric are required.
GET /api/vi/secureEvents/bubbleChart
Request
Query Parameters
From, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000To, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring. Operators:
and,orandnotlogical operators (i.e.pid = 1 and ppid = 2)=,!=,>,>=,<and<=comparison operators (i.e.pid = 1)into check inclusion in a list of values (i.e.pid in (1, 2)orclientipv4 in ("127.0.0.1", "192.168.0.1")) This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each audit events type. The list of supported fields can be retrieved through theapi/v1/secureEvents/scopeFiltersendpoint. In addition to those fields, also these fields are supported:severityas numeric value in the[0, 7]rangecategoryas string valueoriginatoras string value (eitherpolicyorscanning)nameas string valuefreeTextas string valuesourceas string valueagentIdas numeric valuecontainerIdas string valuemachineIdas string valueruleNameas string valueruleTypeas numeric valueruleSubTypeas numeric valuepolicyIdas numeric valuealertNameas string valuetriggeras string valueimage.idas string valueimage.registryas string valueimage.repoas string valueimage.tagas string valueimage.digestas string value
Example:
agent.id=1
Response
- data
Example:
netsec-load-data- countBySeverity
Example:
7788Example:
1
Example:
netsec1Example:
netsec-102Example:
deployment
Status Code
The bubbleChart stats of runtime policy events and vulnerabilities with severities.
The query parameters are missing or invalid
The provided access token is invalid
No Sample Response
Retrieves the count of scanning and policy events.
Retrieves the count of events that match a filter given a specified time range (from <= to). Parameters from and to are required.
GET /api/vi/secureEvents/count
Request
Query Parameters
From, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000To, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring. Operators:
and,orandnotlogical operators (i.e.pid = 1 and ppid = 2)=,!=,>,>=,<and<=comparison operators (i.e.pid = 1)into check inclusion in a list of values (i.e.pid in (1, 2)orclientipv4 in ("127.0.0.1", "192.168.0.1")) This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each audit events type. The list of supported fields can be retrieved through theapi/v1/secureEvents/scopeFiltersendpoint. In addition to those fields, also these fields are supported:severityas numeric value in the[0, 7]rangecategoryas string valueoriginatoras string value (eitherpolicyorscanning)nameas string valuefreeTextas string valuesourceas string valueagentIdas numeric valuecontainerIdas string valuemachineIdas string valueruleNameas string valueruleTypeas numeric valueruleSubTypeas numeric valuepolicyIdas numeric valuealertNameas string valuetriggeras string valueimage.idas string valueimage.registryas string valueimage.repoas string valueimage.tagas string valueimage.digestas string value
Example:
agent.id=1
Response
- policyEvents
The count of events separatelly for each severity level.
Examples:{ "1": 0, "2": 0, "3": 0, "4": 0, "5": 0, "6": 0, "7": 0 }
- profilingDetectionEvents
The count of events separately for each severity level.
Examples:{ "1": 0, "2": 0, "3": 0, "4": 0, "5": 0, "6": 0, "7": 0 }
- scanningEvents
The count of events separatelly for each severity level.
Examples:{ "1": 0, "2": 0, "3": 0, "4": 0, "5": 0, "6": 0, "7": 0 }
Status Code
The scanning and secure events count by severity.
The query parameters are missing or invalid
The provided access token is invalid
No Sample Response
Retrieves timeseries counts of events by severity or user.
Retrieves the top column value and counts of policy events that match a filter, specified time range (from <= to), and number of rows to return for all columns.
Parameters from, to, and metric are required.
GET /api/vi/secureEvents/timeSeries
Request
Query Parameters
The metric to query timeseries for. Valid values are either
userorseverity.Example:
severityFrom, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000To, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring. Operators:
and,orandnotlogical operators (i.e.pid = 1 and ppid = 2)=,!=,>,>=,<and<=comparison operators (i.e.pid = 1)into check inclusion in a list of values (i.e.pid in (1, 2)orclientipv4 in ("127.0.0.1", "192.168.0.1")) This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each audit events type. The list of supported fields can be retrieved through theapi/v1/secureEvents/scopeFiltersendpoint. In addition to those fields, also these fields are supported:severityas numeric value in the[0, 7]rangecategoryas string valueoriginatoras string value (eitherpolicyorscanning)nameas string valuefreeTextas string valuesourceas string valueagentIdas numeric valuecontainerIdas string valuemachineIdas string valueruleNameas string valueruleTypeas numeric valueruleSubTypeas numeric valuepolicyIdas numeric valuealertNameas string valuetriggeras string valueimage.idas string valueimage.registryas string valueimage.repoas string valueimage.tagas string valueimage.digestas string value
Example:
agent.id=1Describes how many rows of counts should be returned for each column category. Will be either 5 or 10.
Possible values: value ≥ 5
Default:
5Example:
10
Response
- data
Array of the count of events per severity and segmented.
Examples:[ { "counts": [ [ 1652890200000000000, 0 ], [ 1652890800000000000, 50 ], [ 1652891400000000000, 12 ], [ 1652892000000000000, 0 ], [ 1652892600000000000, 69 ] ], "key": "1" }, { "counts": [ [ 1652890200000000000, 385 ], [ 1652890800000000000, 400 ], [ 1652891400000000000, 425 ], [ 1652892000000000000, 480 ], [ 1652892600000000000, 100 ] ], "key": "2" }, { "counts": [ [ 1652890200000000000, 450 ], [ 1652890800000000000, 308 ], [ 1652891400000000000, 342 ], [ 1652892000000000000, 50 ], [ 1652892600000000000, 14 ] ], "key": "3" }, { "counts": [ [ 1652890200000000000, 0 ], [ 1652890800000000000, 0 ], [ 1652891400000000000, 0 ], [ 1652892000000000000, 0 ], [ 1652892600000000000, 0 ] ], "key": "4" }, { "counts": [ [ 1652890200000000000, 0 ], [ 1652890800000000000, 0 ], [ 1652891400000000000, 0 ], [ 1652892000000000000, 0 ], [ 1652892600000000000, 0 ] ], "key": "5" }, { "counts": [ [ 1652890200000000000, 5 ], [ 1652890800000000000, 3 ], [ 1652891400000000000, 5 ], [ 1652892000000000000, 5 ], [ 1652892600000000000, 5 ] ], "key": "6" }, { "counts": [ [ 1652890200000000000, 0 ], [ 1652890800000000000, 0 ], [ 1652891400000000000, 0 ], [ 1652892000000000000, 0 ], [ 1652892600000000000, 0 ] ], "key": "7" } ]- severity
Array of the counts of events, segmented into buckets.
Examples:[ [ 1652890200000000000, 0 ], [ 1652890800000000000, 50 ], [ 1652891400000000000, 12 ], [ 1652892000000000000, 0 ], [ 1652892600000000000, 69 ] ]String key value
Example:
Cloud Trail
Array of the count of events per user and segmented.
Examples:[ { "counts": [ [ 1652890200000000000, 4 ], [ 1652890800000000000, 5 ], [ 1652891400000000000, 10 ], [ 1652892000000000000, 8 ], [ 1652892600000000000, 4 ] ], "key": "CloudTrail" }, { "counts": [ [ 1652890200000000000, 49 ], [ 1652890800000000000, 50 ], [ 1652891400000000000, 17 ], [ 1652892000000000000, 8 ], [ 1652892600000000000, 29 ] ], "key": "alvaro.iradier@sysdig.com" } ]- user
Array of the counts of events, segmented into buckets.
Examples:[ [ 1652890200000000000, 0 ], [ 1652890800000000000, 50 ], [ 1652891400000000000, 12 ], [ 1652892000000000000, 0 ], [ 1652892600000000000, 69 ] ]String key value
Example:
Cloud Trail
This is the distance between points from and to in values expressed in nanoseconds.
Example:
600000000000
Status Code
The time series stats of runtime policy events for the specified columns.
The query parameters are missing or invalid
The provided access token is invalid
No Sample Response
Retrieves top column value and counts of events by cluster, compliance, mitre, namespace, node, rule name, workload.
Retrieves the top column value and counts of policy events that match a filter, specified time range (from <= to), and number of rows to return for all columns.
Parameters from and to are required.
GET /api/vi/secureEvents/topStats
Request
Query Parameters
From, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000To, expressed in nanoseconds. The difference between
fromandtocannot be greater than 2 weeks.Possible values: value ≥ 0
Example:
1546300800000000000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring. Operators:
and,orandnotlogical operators (i.e.pid = 1 and ppid = 2)=,!=,>,>=,<and<=comparison operators (i.e.pid = 1)into check inclusion in a list of values (i.e.pid in (1, 2)orclientipv4 in ("127.0.0.1", "192.168.0.1")) This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each audit events type. The list of supported fields can be retrieved through theapi/v1/secureEvents/scopeFiltersendpoint. In addition to those fields, also these fields are supported:severityas numeric value in the[0, 7]rangecategoryas string valueoriginatoras string value (eitherpolicyorscanning)nameas string valuefreeTextas string valuesourceas string valueagentIdas numeric valuecontainerIdas string valuemachineIdas string valueruleNameas string valueruleTypeas numeric valueruleSubTypeas numeric valuepolicyIdas numeric valuealertNameas string valuetriggeras string valueimage.idas string valueimage.registryas string valueimage.repoas string valueimage.tagas string valueimage.digestas string value
Example:
agent.id=1Describes how many rows of counts should be returned for each column category. Will be either 5 or 10.
Possible values: value ≥ 5
Default:
5Example:
10
Response
Array of the count of events per compliance tag, sorted by count.
Examples:[ { "count": 43, "key": "quay.io/sysdig/dev", "label": "container.image.repo" }, { "count": 23, "key": "quay.io/elastic", "label": "container.image.repo" }, { "count": 13, "key": "docker.io/ubuntu", "label": "container.image.repo" }, { "count": 12, "key": "quay.io/sysdig/policies", "label": "container.image.repo" }, { "count": 2, "key": "docker.io/nginx", "label": "container.image.repo" } ]- container.image.repo
Integer value representing count of events.
Example:
543String key value
Example:
NISTString label value that represents the field
Example:
kubernetes.deployment.name
Array of the count of events per cluster, sorted by count.
Examples:[ { "count": 100, "key": "dev2", "label": "kubernetes.cluster.name" }, { "count": 40, "key": "staging", "label": "kubernetes.cluster.name" }, { "count": 35, "key": "dev", "label": "kubernetes.cluster.name" }, { "count": 20, "key": "qa", "label": "kubernetes.cluster.name" }, { "count": 3, "key": "prod", "label": "kubernetes.cluster.name" } ]- kubernetes.cluster.name
Integer value representing count of events.
Example:
543String key value
Example:
NISTString label value that represents the field
Example:
kubernetes.deployment.name
Array of the count of events per namespace, sorted by count.
Examples:[ { "count": 10, "key": "default", "label": "kubernetes.namespace.name" }, { "count": 4, "key": "sysdigcloud", "label": "kubernetes.namespace.name" }, { "count": 3, "key": "sysdig-agent", "label": "kubernetes.namespace.name" }, { "count": 2, "key": "sysdig", "label": "kubernetes.namespace.name" }, { "count": 0, "key": "test", "label": "kubernetes.namespace.name" } ]- kubernetes.namespace.name
Integer value representing count of events.
Example:
543String key value
Example:
NISTString label value that represents the field
Example:
kubernetes.deployment.name
Array of the count of nodes, sorted by count.
Examples:[ { "count": 43, "key": "ip-432-43-217-754", "label": "kubernetes.node.name" }, { "count": 23, "key": "ip-132-43-115-754", "label": "kubernetes.node.name" }, { "count": 13, "key": "ip-112-43-217-254", "label": "kubernetes.node.name" }, { "count": 12, "key": "ip-115-23-112-724", "label": "kubernetes.node.name" }, { "count": 2, "key": "ip-109-43-217-354", "label": "kubernetes.node.name" } ]- kubernetes.node.name
Integer value representing count of events.
Example:
543String key value
Example:
NISTString label value that represents the field
Example:
kubernetes.deployment.name
Array of the count of events per mitre sub-tag, sorted by count.
Examples:[ { "count": 233, "key": "Initial access", "label": "ruleTags" }, { "count": 219, "key": "Execution", "label": "ruleTags" }, { "count": 3, "key": "Persistence", "label": "ruleTags" } ]- mitre
Integer value representing count of events.
Example:
543String key value
Example:
NISTString label value that represents the field
Example:
kubernetes.deployment.name
Array of the count of events per rule name, sorted by count.
Examples:[ { "count": 43, "key": "Launch Suspicious Network Tool", "label": "ruleName" }, { "count": 23, "key": "Write below root", "label": "ruleName" }, { "count": 13, "key": "Write below etc", "label": "ruleName" }, { "count": 12, "key": "Modify binary dirs", "label": "ruleName" }, { "count": 2, "key": "Clear log activities", "label": "ruleName" } ]- ruleName
Integer value representing count of events.
Example:
543String key value
Example:
NISTString label value that represents the field
Example:
kubernetes.deployment.name
Array of the count of workloads per workload type and name, sorted by count.
Examples:[ { "count": 43, "key": "sysdig-agent", "label": "kubernetes.daemonSet.name" }, { "count": 23, "key": "sysdigcloud-api", "label": "kubernetes.deployment.name" }, { "count": 13, "key": "sysdigcloud-netsec-ingest", "label": "kubernetes.statefulset.name" }, { "count": 12, "key": "sysdigcloud-netsec-janitor", "label": "kubernetes.cronJob.name" }, { "count": 2, "key": "sysdigcloud-policies-init-job", "label": "kubernetes.job.name" } ]- workload
Integer value representing count of events.
Example:
543String key value
Example:
NISTString label value that represents the field
Example:
kubernetes.deployment.name
Status Code
The count stats of policy events for all columns.
The query parameters are missing or invalid
The provided access token is invalid
No Sample Response
Retrieves a list of audit events
Retrieves a list of audit events in a time range filters.
The pair from and to and the cursor parameter are mutually
exclusive. If you supply a from and to you must not supply a
cursor and vice-versa.
GET /api/v2/activityAudit/events
Request
Query Parameters
From, expressed in nanoseconds.
Example:
1546300800000000000To, expressed in nanoseconds.
Example:
1546300800000000000Cursor is a string used to retrieve data given a specific context. The context can either be audit events before a certain event, after it or its surrounding.
Example:
LTltNGUybXIwdWkzZThhMjE1bjRnLimit the number of results to return.
Possible values: 1 ≤ value ≤ 9999
Default:
100Example:
100Metrics query language expression for filtering results based on the scope. In order the events to be filtered by this attributes, this attributes should be present on the labels field of the event. If the attributes are not present, it will not be possible to filter the event.
This are the supported scope filters where applicable are:
agent.tag.*container.image.idcontainer.image.repocontainer.image.tagcontainer.image.digestcontainer.label.io.kubernetes.container.namecontainer.label.io.kubernetes.pod.namecontainer.label.io.kubernetes.pod.namespacecontainer.label.maintainercontainer.namehost.hostNamehost.mackubernetes.workload.namekubernetes.workload.typekubernetes.cluster.namekubernetes.cronJob.namekubernetes.daemonSet.namekubernetes.deployment.namekubernetes.job.namekubernetes.namespace.label.field.cattle.io/projectIdkubernetes.namespace.label.projectkubernetes.namespace.namekubernetes.node.namekubernetes.pod.namekubernetes.replicaSet.namekubernetes.service.namekubernetes.statefulSet.nameaws.regionaws.fargate.task.arnaws.fargate.cluster.arnaws.availabilityZoneaws.accountIdaws.usergcp.usergcp.projectId
Example:
host.hostName="ip-127-0-0-1"Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Operators:
and,orandnotlogical operators (i.e.pid = 1 and ppid = 2)=,!=,>,>=,<and<=comparison operators (i.e.pid = 1)into check inclusion in a list of values (i.e.pid in (1, 2)orclientipv4 in ("127.0.0.1", "192.168.0.1"))
This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each audit events type.
These are the supported fields:
idagentidclientipv4clientportcmdlinecommcommandcontainercontaineridcontainer.idcountcwddirectiondirectoryerrorcodefilenamegroupsl4protocolloginshelldistanceloginshellidnamenamespacepermissionspidppidprocessnameresourcerxtimestampserveripv4serverportsourceaddressesstagessubresourcetimestampttyuiduseruseragentanomaly
Example:
pid=1The event types to filter. A comma separated list of one or more of the following supported values:
- kubernetes
- commands
- connections
- fileaccesses
Example:
commands,connections
Response
- data
Represents a command execution.
- undefined
The agent id.
Example:
1The customer id.
Example:
1The audit event id.
Example:
15cbf54e34df95404caad1c988cf7c42Timestamp the command was received, expressed in nanoseconds.
Example:
1546300800000000000Timestamp the audit event occured, expressed in nanoseconds.
Example:
1546300800000000000Possible values: [
command,connection,fileaccess,kubernetes]Full command line
Example:
pg_isready --host 10.32.0.8The name of the command.
Example:
pg_isreadyCount of commands.
commandis ever greater than1only when commands are grouped together.Example:
1Level of nesting from the parent shell.
Process id of the shell.
The name of the parent command.
Example:
sshdProcess ID.
Example:
31135Parent process ID.
Example:
31132If command can be traced.
TTY number.
User ID
List of metrics associated to the audit event.
Examples:[ "ip-127-0-0-1", "f8d4f71ab80b" ]The container id.
containerIdis present only if the audit event was collected in a container context.Example:
f8d4f71ab80bCommand working directory.
Example:
/The Kubernetes hostname.
Example:
ip-127-0-0-1Key value pairs of labels.
- labels
- page
The continuation token used to fetch a set of audit events after the current one.
Example:
KzltNGUybXIwdWkzZThhMjE1bjRnThe continuation token used to fetch a set of audit events before the current one.
Example:
LTltNGUybXIwdWkzZThhMjE1bjRnThe number of audit events returned. This number is always less or equal the limit specified in the request. This field is always present if any result is returned.
Example:
10The number of events that match the provided filter. If the cursor is used, this field is omitted.
Example:
10
Status Code
The list of audit events.
The request is invalid.
No Sample Response
Retrieves an audit event given its type and id
Retrieves an audit event of a specified type with a given id.
GET /api/v2/activityAudit/events/{type}/{eventId}Request
Path Parameters
The event type.
Allowable values: [
commands,connections,fileaccesses,kubernetes]Example:
commandThe audit event id.
Example:
15cbf54e34df95404caad1c988cf7c42
Query Parameters
JSON list of metrics used to enrich results. If no
metricsis passed the audit events returned will not have ametricsfield populated. The metrics attributes are directly fetched from the metadata service, so please refer to it for the full list of supported metrics.Example:
["host.hostName","container.id"]
Response
Represents a command execution.
The agent id.
Example:
1The customer id.
Example:
1The audit event id.
Example:
15cbf54e34df95404caad1c988cf7c42Timestamp the command was received, expressed in nanoseconds.
Example:
1546300800000000000Timestamp the audit event occured, expressed in nanoseconds.
Example:
1546300800000000000Possible values: [
command,connection,fileaccess,kubernetes]Full command line
Example:
pg_isready --host 10.32.0.8The name of the command.
Example:
pg_isreadyCount of commands.
commandis ever greater than1only when commands are grouped together.Example:
1Level of nesting from the parent shell.
Process id of the shell.
The name of the parent command.
Example:
sshdProcess ID.
Example:
31135Parent process ID.
Example:
31132If command can be traced.
TTY number.
User ID
List of metrics associated to the audit event.
Examples:[ "ip-127-0-0-1", "f8d4f71ab80b" ]The container id.
containerIdis present only if the audit event was collected in a container context.Example:
f8d4f71ab80bCommand working directory.
Example:
/The Kubernetes hostname.
Example:
ip-127-0-0-1Key value pairs of labels.
- labels
Status Code
Audit event with the given type and id.
The event could not be found.
No Sample Response
Retrieves the trace of an audit event
Retrieves a trace of all the audit events related to the traceable event in case it is a long running task. The audit events returned are all the commands, connections etc collected during the duration of the traceable event. If the event has not completed yet, the time range considered is up until the current time.
GET /api/v2/activityAudit/events/{type}/{eventId}/traceRequest
Path Parameters
The event type.
Allowable values: [
commands,connections,fileaccesses,kubernetes]Example:
commandThe audit event id.
Example:
15cbf54e34df95404caad1c988cf7c42
Query Parameters
Limit the number of results to return.
Possible values: 1 ≤ value ≤ 9999
Default:
100Example:
100The zones to apply as an additional filter. It is a comma separated list of zone ids
Example:
123,456
Response
- data
Represents a command execution.
- undefined
The agent id.
Example:
1The customer id.
Example:
1The audit event id.
Example:
15cbf54e34df95404caad1c988cf7c42Timestamp the command was received, expressed in nanoseconds.
Example:
1546300800000000000Timestamp the audit event occured, expressed in nanoseconds.
Example:
1546300800000000000Possible values: [
command,connection,fileaccess,kubernetes]Full command line
Example:
pg_isready --host 10.32.0.8The name of the command.
Example:
pg_isreadyCount of commands.
commandis ever greater than1only when commands are grouped together.Example:
1Level of nesting from the parent shell.
Process id of the shell.
The name of the parent command.
Example:
sshdProcess ID.
Example:
31135Parent process ID.
Example:
31132If command can be traced.
TTY number.
User ID
List of metrics associated to the audit event.
Examples:[ "ip-127-0-0-1", "f8d4f71ab80b" ]The container id.
containerIdis present only if the audit event was collected in a container context.Example:
f8d4f71ab80bCommand working directory.
Example:
/The Kubernetes hostname.
Example:
ip-127-0-0-1Key value pairs of labels.
- labels
- page
The continuation token used to fetch a set of audit events after the current one.
Example:
KzltNGUybXIwdWkzZThhMjE1bjRnThe continuation token used to fetch a set of audit events before the current one.
Example:
LTltNGUybXIwdWkzZThhMjE1bjRnThe number of audit events returned. This number is always less or equal the limit specified in the request. This field is always present if any result is returned.
Example:
10The number of events that match the provided filter. If the cursor is used, this field is omitted.
Example:
10
Status Code
All the events associated with this traceable event.
The request is invalid.
The event could not be found.
The audit event requested does not support tracing.
No Sample Response
Retrieve a summary of the audit events
Retrieves a summary of the audit events in a time range grouped by a series of metrics.
GET /api/v2/activityAudit/summary
Request
Query Parameters
From, expressed in nanoseconds.
Example:
1546300800000000000To, expressed in nanoseconds.
Example:
1546300800000000000Metrics query language expression for filtering results based on the scope. In order the events to be filtered by this attributes, this attributes should be present on the labels field of the event. If the attributes are not present, it will not be possible to filter the event.
This are the supported scope filters where applicable are:
agent.tag.*container.image.idcontainer.image.repocontainer.image.tagcontainer.image.digestcontainer.label.io.kubernetes.container.namecontainer.label.io.kubernetes.pod.namecontainer.label.io.kubernetes.pod.namespacecontainer.label.maintainercontainer.namehost.hostNamehost.mackubernetes.workload.namekubernetes.workload.typekubernetes.cluster.namekubernetes.cronJob.namekubernetes.daemonSet.namekubernetes.deployment.namekubernetes.job.namekubernetes.namespace.label.field.cattle.io/projectIdkubernetes.namespace.label.projectkubernetes.namespace.namekubernetes.node.namekubernetes.pod.namekubernetes.replicaSet.namekubernetes.service.namekubernetes.statefulSet.nameaws.regionaws.fargate.task.arnaws.fargate.cluster.arnaws.availabilityZoneaws.accountIdaws.usergcp.usergcp.projectId
Example:
host.hostName="ip-127-0-0-1"Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Operators:
and,orandnotlogical operators (i.e.pid = 1 and ppid = 2)=,!=,>,>=,<and<=comparison operators (i.e.pid = 1)into check inclusion in a list of values (i.e.pid in (1, 2)orclientipv4 in ("127.0.0.1", "192.168.0.1"))
This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each audit events type.
These are the supported fields:
idagentidclientipv4clientportcmdlinecommcommandcontainercontaineridcontainer.idcountcwddirectiondirectoryerrorcodefilenamegroupsl4protocolloginshelldistanceloginshellidnamenamespacepermissionspidppidprocessnameresourcerxtimestampserveripv4serverportsourceaddressesstagessubresourcetimestampttyuiduseruseragentanomaly
Example:
pid=1The event types to filter. A comma separated list of one or more of the following supported values:
- kubernetes
- commands
- connections
- fileaccesses
Example:
commands,connectionsThe zones to apply as an additional filter. It is a comma separated list of zone ids
Example:
123,456Whether or not to segment the results with a distance between points depending on the distance between
fromandto.Default:
false
Response
If segmented data has been requested, the distance between points in values expressed in nanoseconds.
- values
Series of tuples containing timestamp and values for a specific point in time for the metric. Only present if there are elements matching the metric.
Series of tuples containing timestamp and values for a specific point in time for the metric. Only present if there are elements matching the metric.
Series of tuples containing timestamp and values for a specific point in time for the metric. Only present if there are elements matching the metric.
Series of tuples containing timestamp and values for a specific point in time for the metric. Only present if there are elements matching the metric.
Status Code
The summary of audit events.
The request is invalid.
[ { "step": 60000000000, "values": { "command": [ [ 1569065400000000000, 36 ], [ 1569065460000000000, 36 ], [ 1569065520000000000, 36 ], [ 1569065580000000000, 36 ] ], "connection": [ [ 1569065400000000000, 36 ], [ 1569065460000000000, 36 ], [ 1569065520000000000, 36 ], [ 1569065580000000000, 36 ] ], "fileaccess": [ [ 1569065400000000000, 36 ], [ 1569065460000000000, 36 ], [ 1569065520000000000, 36 ], [ 1569065580000000000, 36 ] ], "kubernetes": [ [ 1569065400000000000, 36 ], [ 1569065460000000000, 36 ], [ 1569065520000000000, 36 ], [ 1569065580000000000, 36 ] ] } } ]
Retrieve security policies
Returns information about policies configured by the current customer. Policies can be filtered by priority and scope.
GET /api/v2/policies
Request
Query Parameters
Example:
10string to look for in policy names/descriptions
Example:
Write belowfinds policies that correspond to a numeric value representing a severity. The query param can be repeated to look for multiple severities
Example:
3finds policies of a certain type
Allowable values: [
list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,syscall,azure_platformlogs,drift,machine_learning,awscloudtrail,okta,github,aws_machine_learning,malware,windows]Example:
list_matchingfinds policies and rulesets that are managed by Sysdig. Returns custom policies when set to false
Possible values: allows empty value
allows filtering by managed type - managed_policy/managed_ruleset/custom_policy
Allowable values: [
managed_policy,managed_ruleset,custom_policy]Example:
policy
Response
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Status Code
An array of policies
No Sample Response
Request
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Allowable values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Allowable values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Allowable values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Response
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Status Code
The newly created policy
The submitted policy was invalid
No Sample Response
Create a new security policy and rules in a transaction
Save a new security policy and rules in a transaction. If the policy or any of the rules fail validation, the operation is canceled (no policy or rule is created) and an error response is returned.
POST /api/v2/policies/batch
Request
- policy
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Allowable values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Allowable values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Allowable values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Array of rules to create. If no rules need to be created, this will be an empty array
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Allowable values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Allowable values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Allowable values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Allowable values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Response
- policy
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Array of newly created rules. If no rules were created, this will be an empty array
- rules
A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177The name of a Falco rules file
Example:
falco_rules_local.yamlA unique identifier representing a specific rule
Example:
1A timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A name for this object. For Falco rules/macros/lists, should exactly be the value of the "rule"/"macro"/"list" property of the yaml object.
Example:
Write Below Binary DirA string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UIThe version is incremented when the update is successful.
Example:
5A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3The set of tags
Examples:[ "Kubernetes", "CIS Compliance", "File Integrity" ]A description of this rule. No newlines/formatting.
Example:
an attempt to write to any file below a set of binary directories- details
Indicates the rule type
Possible values: [
PROCESS,CONTAINER,FILESYSTEM,NETWORK,SYSCALL,FALCO]Example:
FALCO- condition
an array containing the broken-up components of this falco rule's condition field
- components
- undefined
An opaque hunk of condition text. May contain a mix of fields, relational operators, etc. Basically anything between Macro/List references.
Example:
evt.type in (open, openat) and
the full condition text exactly as represented in the yaml file
Example:
evt.type in (open, openat) and bin_dir and fd.name in (monitored_directories)
A string describing the output string to generate when this rule matches an event. Should exactly match the output property of the rule's output field
Example:
File below a known binary directory opened for writing (user=%user.name command=%proc.cmdline file=%fd.name)A string describing the falco rule's priority. This is only included so the resulting rule can be converted back to yaml easily. For the purposes of policy events, the policy's severity should be used instead of this value.
Possible values: [
emergency,alert,critical,error,warning,notice,informational,debug]Example:
errorIf true, this object should be appended to an object with the same name that has already been loaded. Defaults to false if not present.
Possible values: [
true,false]Example:
trueAn event source through which Falco rules are evaluated. The enum syscall corresponds to the policy types falco and list_matching. The enum k8s_audit corresponds to the policy type k8s_audit
Possible values: [
syscall,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs]
Status Code
The newly created policy and rules
A submitted policy or rule was invalid
No Sample Response
Response
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Status Code
The deleted policy
No Sample Response
Response
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Status Code
The requested policy
No Sample Response
Request
Path Parameters
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Allowable values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Allowable values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Allowable values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Allowable values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Response
Functional behavior that can be enabled within a policy and should be performed if the condition of a policy is met. Certain actions may only make sense for policies of a particular type.
- actions
- undefined
period of time to capture after event in nanoseconds
period of time to capture before event in nanoseconds
identifies an s3 compliant bucket
specifies the subset to match
Example:
proc.name=cat or proc.name=vithe name of an s3 folder (enables the user to specify a bucket that is not in the default bucket root folder '/')
the name of the file in which the capture will be saved
specifies the id of a row in the file_storage table that corresponds to a FileStorageDetails.java object
specifies which strategy will be taken to store the capture
Possible values: [
LOCAL,S3,AGENT,PROVIDED,CASSANDRA]Possible values: [
POLICY_ACTION_CAPTURE]
Description of policy
Example:
Monitor all filesystem operations and look for suspicious or notable behaviorTrue if the policy should be considered
Example:
trueA short name for the policy
Example:
Check filesystem activityArray of rule names. (They must be names instead of ids, as the rules list view is by name, to account for multiple rules having the same name).
Examples:[ "Write below binary dir", "Write below root", "Write below monitored dir" ]Array of PolicyRules representing each Rule referenced by this policy
- rules
A timestamp (in milliseconds) of when the rules object associated with the policy was first created.
Example:
1553702738288A timestamp (in milliseconds) of when the rules object associated with the policy was last modified.
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was first created
Example:
1553702738288A timestamp (in milliseconds) of when the base rule was last modified
Example:
1553702738288
Where the policy is being applied- Container, Host etc..
Example:
container.image.repository = sysdig/agentHow severe is this policy when violated. Range from 0 to 7 included.
Example:
4A name for a non overlapping subset of policies that share common characteristics. The enums falco and list_matching correspond to the FalcoSource enum syscall, k8s_audit corresponds to k8s_audit, and the others will map to a future enum value once OSS Falco decides a name
Possible values: [
falco,list_matching,k8s_audit,aws_cloudtrail,gcp_auditlog,azure_platformlogs,drift,machine_learning,falco_cloud_awscloudtrail]A timestamp (in milliseconds) of when the rules object was first created.
Example:
1553702727177Unique identifier representing a specific policy.
Example:
1is this a default policy
Example:
trueA timestamp (in milliseconds) of when the rules object was last modified.
Example:
1553702738288A string naming the entity that created this rule. This, combined with the version identifier, corresponds to the "Published by" field in the UI. The origin should be "Secure UI" for objects created by the Secure UI, "Sysdig" for objects provided by Sysdig, and "Customer" for objects provided programmatically by the customer.
Possible values: [
Secure UI,Sysdig,Customer,Profiling,K8s Policy Advisor,Compliance,Tuner]Example:
Secure UI- profile
UUID of the image, based on a SHA256 of the image content.
Name of the image, as registry/repository:tag.
UUID of the profile, based on a SHA of (imageId + profileVersion).
Name of the profile, which includes registry/repository:tag@hash.
Version of the profile, incremented when the model is updated.
runbook url
Example:
https://runbook.comid of the template this policy was birthed from. For unmanaged policies this value is nil
Example:
2version of the template this policy was most recently updated from.
Example:
4Version of the object. Incremented on each update and used for optimistic locking
Example:
18A string representing the version of the file that contained this rule. This, combined with the origin, corresponds to the "Published by" field in the UI. For rules with origin == Sysdig/Customer, the version identifier should come from the version property of the FalcoRulesFiles object that originally contained the rule. For rules with origin == Secure UI, the version should be a constant string "current".
Example:
v1.2.3
Status Code
The requested policy
The updated policy was invalid
Resource with the specified ID could not be found. More information about 404 can be found at https://httpstatuses.com/404
The user must first perform a GET request to get the current version of the resource. The user must then compare the remote version with the local expected version and merge any updates from remote if needed and then update the local version to match the remote version. More information about 409 can be found at https://httpstatuses.com/409
No Sample Response
Get a list of pipeline scan results
Retrieves a list of scan results produced by pipelines that match a filter given a specified cursor. No sorting is supported.
GET /secure/vulnerability/v1beta1/pipeline-results
Request
Query Parameters
Cursor is a string used to retrieve a particular page of data. The page is composed of the vulnerabilities after a certain one. It is an opaque structure, and should not be mangled. It could be retrieved in the body of each request. If a response does not contain a cursor, it means that it's the last page.
Example:
LTltNGUybXIwdWkzZThhMjE1bjRnLimit sets the maximum quantity of vulnerabilities returned in the response. A page is never guaranteed to contain this exact number of vulnerabilities, but it will never contain more. The maximum value is 1000, and the minimum value is 1. The default value is 1000 because little calls are discouraged.
Default:
1000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Only the freeText parameter is supported:
freeTextas string value (note that it will search on the full image name)
Example:
freeText in ("whatever")
Response
- data
Identifier of the image (hash)
Name of the scanned image
Possible values: [
passed,failed,accepted]Identifier of the scan result
Number of vulnerabilities grouped by severity
- vulnTotalBySeverity
- page
Next cursor for pagination
Total of scans
Status Code
A successful response
Bad Request
Unauthorized
Forbidden
The requested resource could not be found
Conflict
Unprocessable entity
Too many requests
Internal error processing the request
The service is unavailable
No Sample Response
Get a list of registry scan results
Retrieves a list of registry scan results discovered by the registry scanner that match a filter given a specified cursor.
GET /secure/vulnerability/v1beta1/registry-results
Request
Query Parameters
Cursor is a string used to retrieve a particular page of data. The page is composed of the vulnerabilities after a certain one. It is an opaque structure, and should not be mangled. It could be retrieved in the body of each request. If a response does not contain a cursor, it means that it's the last page.
Example:
LTltNGUybXIwdWkzZThhMjE1bjRnLimit for pagination. The maximum value is 100, and the minimum value is 1. The default value is 1000.
Default:
1000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Operators:
-
and,orlogical operators (i.e.registry.vendor = "artifactory" and registry.name = "docker.internal.sysdig.tools") -
=and!=comparison operators (i.e.registry.vendor = "ecr")
This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each Scan Result type.
The list of supported fields is:
repository.nameas string valueregistry.vendoras string valuescopeas string value
Example:
repository.name=alpine and registry.vendor=ecr-
Response
- data
Date of the scan
Identifier of the image (hash)
Name of the scanned image
Identifier of the scan result
Number of vulnerabilities grouped by severity
- vulnTotalBySeverity
- page
Next cursor for pagination
Total of scans
Status Code
A successful response
Bad Request
Unauthorized
Forbidden
The requested resource could not be found
Conflict
Unprocessable entity
Too many requests
Internal error processing the request
The service is unavailable
No Sample Response
Get full scan result
Retrieve a full scan result produced by any scanner that match a given ID
GET /secure/vulnerability/v1beta1/results/{resultId}Request
Path Parameters
The ID of a single scan result. Could be retrieved by one of the listing endpoints.
Example:
176c77d16ee6bdd2f7482d4ec0fd0542
Response
- result
- metadata
Possible values: [
ppc64,386,amd64,arm,arm64,wasm,loong64,mips,mipsle,mips64,mips64le,ppc64le,riscv64,s390x]
- packages
Possible values: [
os,rust,java,ruby,javascript,python,php,golang,C#]Example:
sha256:55f2611539bc5c771a4848183bb3d29af95aa9ae66563e7e808b7501659f5c50- vulns
- cvssScore
- value
- severity
- acceptedRisks
- exploit
- Examples:
{ "nvd": "2021-01-01T00:00:00.000Z", "vulndb": "2021-01-02T00:00:00.000Z" }- publishDateByVendor
Possible values: [
dockerImage]- assetAcceptedRisks
- layers
Example:
sha256:55f2611539bc5c771a4848183bb3d29af95aa9ae66563e7e808b7501659f5c50Example:
COPY docker-entrypoint.sh- runningVulns
Example:
50- vulns
- policyEvaluations
Possible values: [
passed,failed,accepted,noPolicy,notApplicable]Possible values: [
standard,alwaysApply]- bundles
- rules
Possible values: [
pkgVulnFailure,imageConfigFailure]- predicates
Possible values: [
vulnSeverity,vulnSeverityEquals,vulnIsFixable,vulnIsFixableWithAge,vulnAge,vulnCVSS,vulnExploitable,vulnExploitableWithAge,vulnExploitableNoAdmin,vulnExploitableNoUser,vulnExploitableViaNetwork,denyCVE,imageConfigDefaultUserIsRoot,imageConfigDefaultUserIsNot,imageConfigLabelExists,imageConfigLabelNotExists,imageConfigLabelNotContains,imageConfigEnvVariableExists,imageConfigEnvVariableNotExists,imageConfigEnvVariableContains,imageConfigCreationDateWithAge,imageConfigInstructionNotRecommended,imageConfigSensitiveInformationAndSecrets,imageConfigInstructionIsPkgManager]
Possible values: [
imageConfigLabel,imageConfigDefaultUser,vulnDenyList,vulnSeverityAndThreats,imageConfigEnvVariable,imageConfigCreationDate,imageConfigInstructionNotRecommended,imageConfigInstructionIsPkgManager,imageConfigSensitiveInformationAndSecrets]- failures
- undefined
Example:
1234A
Possible values: [
predefined,custom]
- riskAcceptanceDefinitions
- context
Possible values: [
packageName,packageVersion,imageName,imagePrefix,imageSuffix,imageAssetToken,hostName,hostAssetToken]
Possible values: [
vulnerability,imageName,imagePrefix,imageSuffix,imageAssetToken,hostName,hostAssetToken,policyRule]Possible values: [
active,expired]
Status Code
A successful response
Bad Request
Unauthorized
Forbidden
The requested resource could not be found
Conflict
Unprocessable entity
Too many requests
Internal error processing the request
The service is unavailable
No Sample Response
Get a list of runtime scan results
Retrieves a list of runtime scan results discovered by the runtime scanner that match a filter given a specified cursor.
GET /secure/vulnerability/v1beta1/runtime-results
Request
Query Parameters
Cursor is a string used to retrieve a particular page of data. The page is composed of the vulnerabilities after a certain one. It is an opaque structure, and should not be mangled. It could be retrieved in the body of each request. If a response does not contain a cursor, it means that it's the last page.
Example:
LTltNGUybXIwdWkzZThhMjE1bjRnLimit for pagination. The maximum value is 1000, and the minimum value is 1. The default value is 1000.
Default:
1000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Operators:
-
and,orlogical operators (i.e.kubernetes.cluster.name=production and kubernetes.pod.container.name = docker.internal.sysdig.tools) -
=and!=comparison operators (i.e.kubernetes.cluster.name=staging)
This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each Scan Result type.
The list of supported fields is:
asset.typeas string valuekubernetes.cluster.nameas string valuekubernetes.namespace.nameas string valuekubernetes.workload.nameas string valuekubernetes.workload.typeas string valuekubernetes.pod.container.nameas string valueagent.tag.envas string valuehasRunningVulnsas boolean valuepolicyStatusas enum, allowed values arepassed,failed,acceptedandnoPolicyfreeTextas string value (note that it will search on the full image name)
Example:
kubernetes.namespace.name=testing and policyStatus=failed-
Allowed values for sorting are "vulnTotalBySeverity" and "runningVulnTotalBySeverity" the default is "vulnTotalBySeverity". Only one sorting at a time is supported Ordering is also supported along with sorting. Allowed values are "asc" and "desc", and the default value is "desc"
Example:
sort=runningVulnTotalBySeverity,asc
Response
- data
Wether risk spot light is enabled or not
Name of the scanned image
Result of the policy
Possible values: [
passed,failed,accepted,noPolicy]Identifier of the scan result
Number of vulnerabilities grouped by severity from packages that are currently in use
- runningVulnTotalBySeverity
Identifier of the sbom
Metadata about the asset in the cluster. The data is a map of strings that can change accordingly based on the asset type
- scope
Asset type, in this case it's workload
Kubernetes cluster name
Kubernetes namespace name
Kubernetes pod name
Kubernetes workload name
Kubernetes workload name (deployment, stateful set, etc..)
Number of vulnerabilities grouped by severity
- vulnTotalBySeverity
- page
Next cursor for pagination
Total of scans
Status Code
A successful response
Bad Request
Unauthorized
Forbidden
The requested resource could not be found
Conflict
Unprocessable entity
Too many requests
Internal error processing the request
The service is unavailable
No Sample Response
Request
Query Parameters
The ID of the asset for which we want to retrive the sbom. It's the imageId for container-image and the hostId for hosts Provide this with assetType if not providing bomIdentifier
Example:
sha256:6147d53c2a3a4d99b8343665430e5d420eb7ee65cb89995b6bea1af2595be53aThe type of the asset for which we want to retrive the sbom. Provide this with assetId if not providing bomIdentifier
Allowable values: [
container-image,host]The ID of a single sbom. Either provide this or both assetId and assetType
Example:
urn:uuid:6536eeee-b8f2-4865-b996-adc991c28202
Response
Possible values: [
CycloneDX]Possible values: [
1.5]- components
- compositions
Possible values: [
complete,incomplete,unknown,not_specified]
- dependencies
- metadata
- component
Possible values: [
post-build,operations]
Example:
urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79
Status Code
A successful response
Bad Request
Unauthorized
Forbidden
The required resource could not be found
Server can't produce a response in the content-type requested by the client
Too many requests
Internal error processing the request
The service is unavailable
application/vnd.cyclonedx+xml; version=1.4, application/vnd.cyclonedx+xml; version=1.3
Get a list of runtime scan results
Retrieves a list of runtime scan results discovered by the runtime scanner that match a filter given a specified cursor.
GET /secure/vulnerability/v1/runtime-results
Request
Query Parameters
Cursor is a string used to retrieve a particular page of data. It is an opaque structure, and should not be mangled. It could be retrieved in the body of each request. If a response does not contain a cursor, it means that it's the last page.
Possible values: length ≤ 300
Example:
MTI0MjM0Cg==Limit for pagination
Possible values: 1 ≤ value ≤ 1000
Default:
1000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Operators:
-
and,orlogical operators (i.e.kubernetes.cluster.name="production" and kubernetes.pod.container.name = "docker.internal.sysdig.tools") -
=and!=comparison operators (i.e.kubernetes.cluster.name="staging")
This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each Scan Result type.
The supported fields are the all the fields of the
Scope, plus:freeText,hasRunningVulnsandhasRunningVulns.Possible values: length ≤ 1024
Example:
kubernetes.cluster.name="staging" and kubernetes.pod.container.name="docker.internal.sysdig.tools"-
Field used to sort the results vulnTotalBySeverity: sort by total number of running vulnerabilities weighted by severity runningVulnTotalBySeverity: sort by total number of running vulnerabilities weighted by severity for running assets
Allowable values: [
vulnTotalBySeverity,runningVulnTotalBySeverity]Default:
vulnTotalBySeverityExample:
runningVulnTotalBySeverityOrdering of the results for the sort field
Allowable values: [
desc,asc]Default:
descExample:
asc
Response
runtime results response
Runtime result
Possible values: number of items ≤ 1000
API paging response
Status Code
A successful response
Operation failed due to invalid payload.
Access denied.
Not enough privileges to complete the action.
Conflict.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Forbidden", "type": "forbidden" }{ "details": [], "message": "Conflict", "type": "conflict" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
Get a list of registry scan results
Retrieves a list of registry scan results discovered by the registry scanner that match a filter given a specified cursor.
GET /secure/vulnerability/v1/registry-results
Request
Query Parameters
Cursor is a string used to retrieve a particular page of data. It is an opaque structure, and should not be mangled. It could be retrieved in the body of each request. If a response does not contain a cursor, it means that it's the last page.
Possible values: length ≤ 300
Example:
MTI0MjM0Cg==Limit for pagination
Possible values: 1 ≤ value ≤ 1000
Default:
1000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Operators:
-
and,orlogical operators (i.e.freeText = "alpine:latest" and vendor = "docker") -
=and!=comparison operators (i.e.vendor = "ecr")
This query language does not support the full set of metrics supported in the monitor query language, but instead supports a set of fields proper to each Scan Result type.
The supported fields are:
freeText,vendor.vendoras string valuefreeTextas string value (note that it will search on the full image name)
Possible values: length ≤ 1024
Example:
freeText = "alpine:latest" and vendor = "docker"-
Response
registry results response
Registry result
Possible values: number of items ≤ 1000
API paging response
Status Code
A successful response
Operation failed due to invalid payload.
Access denied.
Not enough privileges to complete the action.
Conflict.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Forbidden", "type": "forbidden" }{ "details": [], "message": "Conflict", "type": "conflict" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
Get a list of pipeline scan results
Retrieves a list of scan results produced by pipelines that match a filter given a specified cursor. No sorting is supported, the items are sorted in a stable way by their ID.
GET /secure/vulnerability/v1/pipeline-results
Request
Query Parameters
Cursor is a string used to retrieve a particular page of data. It is an opaque structure, and should not be mangled. It could be retrieved in the body of each request. If a response does not contain a cursor, it means that it's the last page.
Possible values: length ≤ 300
Example:
MTI0MjM0Cg==Limit for pagination
Possible values: 1 ≤ value ≤ 1000
Default:
1000Query language expression for filtering results. It is a subset of the full metrics query language used in monitoring.
Only the freeText parameter is supported:
freeTextas string value (note that it will search on the full image name)
Possible values: length ≤ 1024
Example:
freeText in ("nginx")
Response
pipeline results
pipeline result
Possible values: number of items ≤ 1000
API paging response
Status Code
A successful response
Operation failed due to invalid payload.
Access denied.
Not enough privileges to complete the action.
Conflict.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Forbidden", "type": "forbidden" }{ "details": [], "message": "Conflict", "type": "conflict" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
Get full scan result
Retrieve a full scan result produced by any scanner that match a given ID
GET /secure/vulnerability/v1/results/{resultId}Request
Path Parameters
The ID of a single scan result. Could be retrieved by one of the listing endpoints.
Possible values: length ≤ 255
Example:
176c77d16ee6bdd2f7482d4ec0fd0542
Response
scan result asset type
Possible values: [
containerImage,host]Example:
containerImagemetadata of the scan result
- metadata
image base os
Possible values: length ≤ 255
Example:
debianimage id
Possible values: length ≤ 255
Example:
sha256:77af4d6b9913e693e8d0b4b294fa62ade6054e6b2f1ffb617ac955dd63fb0182image os
Possible values: length ≤ 255
Example:
debianimage pull string
Possible values: length ≤ 2048
Example:
nginx:latestimage size in bytes
Possible values: 0 ≤ value ≤ 9223372036854776000
Example:
10240image architecture
Possible values: [
ppc64,386,amd64,arm,arm64,wasm,loong64,mips,mipsle,mips64,mips64le,ppc64le,riscv64,s390x]Example:
arm64image author
Possible values: length ≤ 255
Example:
sysdigimage digest
Possible values: length ≤ 255
Example:
sha256:77af4d6b9913e693e8d0b4b294fa62ade6054e6b2f1ffb617ac955dd63fb0182image labels
Examples:{ "key": "value" }
- Examples:
{ "2772f8a6c73fa17": { "isRemoved": true, "isRunning": true, "layerRef": "f95aa9ae66563e7e808b", "license": "MIT", "name": "openssl", "path": "/usr/local/bin/openssl", "suggestedFix": "1.2.3", "type": "os", "version": "1.2.3", "vulnerabilitiesRefs": [ "71af37c6a8f2772" ] } }- packages
scan result stage
Possible values: [
pipeline,runtime,registry]Example:
pipeline- Examples:
{ "a3ee5e6b4b0d3255bf": { "pullStrings": [ "alpine:latest" ] } }- baseImages
- Examples:
{ "f95aa9ae66563e7e808b": { "baseImagesRef": [ "a3ee5e6b4b0d3255bf" ], "command": "COPY docker-entrypoint.sh", "digest": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "size": 50 } }- layers
- Examples:
{ "e6b4b0d3255bfef": { "context": [ { "type": "imageName", "value": "nginx:latest" } ], "createdAt": "2024-01-22T08:51:46.016464Z", "description": "description", "entityType": "imageName", "entityValue": "nginx:latest", "expirationDate": "2021-07-01", "id": "550e8400-e29b", "reason": "RiskMitigated", "status": "active", "updatedAt": "2024-01-22T08:51:46.016464Z" } }- riskAccepts
- Examples:
{ "71af37c6a8f2772": { "cisaKev": { "dueDate": "2023-10-31", "knownRansomwareCampaignUse": "false", "publishDate": "2023-12-06" }, "cvssScore": { "score": 1, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "disclosureDate": "2021-01-02", "exploit": { "links": [ "https://sysdig-example.com/exploits/12345" ], "publicationDate": "2024-01-22T08:51:46.00Z" }, "exploitable": true, "fixVersion": "1.2.3", "mainProvider": "vulndb", "name": "CVE-2021-1234", "packageRef": "2772f8a6c73fa17", "providersMetadata": { "nvd": {} }, "riskAcceptRefs": [ "e6b4b0d3255bfef" ], "severity": "high", "solutionDate": "2021-01-02" } }- vulnerabilities
Status Code
A successful response
Operation failed due to invalid payload.
Access denied.
Not enough privileges to complete the action.
Conflict.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Forbidden", "type": "forbidden" }{ "details": [], "message": "Conflict", "type": "conflict" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
List Zones
Retrieve a paginated list of Zones.
Required permissions: zones.read or teams.edit
GET /platform/v1/zones
Request
Query Parameters
Filters to apply in the form of
key:value.
Multiple filters can be applied by repeating thefilterparameter:
&filter=key1:value1&filter=key2:value2Possible values: number of items ≤ 4, length ≤ 512
Default:
[]The number of items to return
Possible values: 1 ≤ value ≤ 200
Default:
25Example:
25The offset number of items to start with
Possible values: 0 ≤ value ≤ 2147483647
Default:
0Example:
30Ordering to apply in the form of
field:directionwheredirectioncan either beascordesc.
Multiple orderings can be applied by repeating theorderbyparameter:
&orderby=key1:direction1&orderby=key2:direction2Possible values: number of items ≤ 4, length ≤ 256
Response
Paginated data.
Possible values: number of items ≤ 200
- data
Email of the user who created this Zone
Possible values: length ≤ 512
Example:
SysdigThe description of the Zone
Possible values: length ≤ 8192
Example:
Production EnvironmentPossible values: value ≥ 0
Example:
1Boolean value indicating if the Zone is a System one
Email of the user who last modified the Zone
Possible values: length ≤ 512
Example:
john_doe@sysdig.comTimestamp indicating the moment the Zone has been last updated.
It is expressed in milliseconds elapsed since January 1, 1970 UTC.Possible values: value ≥ 0
Example:
1The name of the Zone
Possible values: length ≤ 512
Example:
ProductionAttached Zone Scopes
Possible values: number of items ≤ 8192
Page information.
- page
Possible values: length ≤ 8192
Example:
30Possible values: length ≤ 8192
Example:
10Possible values: value ≥ 0
Example:
1
Status Code
A list of Zones
Operation failed due to invalid payload.
Access denied.
Server was unable to process the request.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Unprocessable content", "type": "unprocessable_content" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
Request
Request body for creating a new Zone
The name of the Zone. It must be unique
Possible values: length ≤ 255
Example:
ProductionZone attached scopes
Possible values: 1 ≤ number of items ≤ 512
The Zone description. It can be useful for adding extra information
Possible values: length ≤ 1024
Example:
Production environment
Response
Email of the user who created this Zone
Possible values: length ≤ 512
Example:
SysdigThe description of the Zone
Possible values: length ≤ 8192
Example:
Production EnvironmentPossible values: value ≥ 0
Example:
1Boolean value indicating if the Zone is a System one
Email of the user who last modified the Zone
Possible values: length ≤ 512
Example:
john_doe@sysdig.comTimestamp indicating the moment the Zone has been last updated.
It is expressed in milliseconds elapsed since January 1, 1970 UTC.Possible values: value ≥ 0
Example:
1The name of the Zone
Possible values: length ≤ 512
Example:
ProductionAttached Zone Scopes
Possible values: number of items ≤ 8192
Status Code
A Single Zone
Operation failed due to invalid payload.
Access denied.
Conflict.
Server was unable to process the request.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Conflict", "type": "conflict" }{ "details": [], "message": "Unprocessable content", "type": "unprocessable_content" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
Delete Zone
Delete a Zone by its ID.
Required permissions: zones.edit
DELETE /platform/v1/zones/{zoneId}Response
Status Code
Zone successfully deleted
Operation failed due to invalid payload.
Access denied.
Zone not found
Conflict.
Server was unable to process the request.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Conflict", "type": "conflict" }{ "details": [], "message": "Unprocessable content", "type": "unprocessable_content" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
Get Zone
Retrieve a single Zone by ID.
Required permissions: zones.read
GET /platform/v1/zones/{zoneId}Response
Email of the user who created this Zone
Possible values: length ≤ 512
Example:
SysdigThe description of the Zone
Possible values: length ≤ 8192
Example:
Production EnvironmentPossible values: value ≥ 0
Example:
1Boolean value indicating if the Zone is a System one
Email of the user who last modified the Zone
Possible values: length ≤ 512
Example:
john_doe@sysdig.comTimestamp indicating the moment the Zone has been last updated.
It is expressed in milliseconds elapsed since January 1, 1970 UTC.Possible values: value ≥ 0
Example:
1The name of the Zone
Possible values: length ≤ 512
Example:
ProductionAttached Zone Scopes
Possible values: number of items ≤ 8192
Status Code
A Single Zone
Operation failed due to invalid payload.
Access denied.
Zone not found
Server was unable to process the request.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Unprocessable content", "type": "unprocessable_content" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
Update Zone
Update an existing Zone by its ID.
Required permissions: zones.edit
PUT /platform/v1/zones/{zoneId}Request
Path Parameters
ID of the Zone
Possible values: value ≥ 0
Example:
1
Request body for editing an existing zone
The name of the Zone. It must be unique
Possible values: length ≤ 255
Example:
ProductionZone attached scopes
Possible values: 1 ≤ number of items ≤ 512
The Zone description. It can be useful for adding extra information
Possible values: length ≤ 1024
Example:
Production environment
Response
Email of the user who created this Zone
Possible values: length ≤ 512
Example:
SysdigThe description of the Zone
Possible values: length ≤ 8192
Example:
Production EnvironmentPossible values: value ≥ 0
Example:
1Boolean value indicating if the Zone is a System one
Email of the user who last modified the Zone
Possible values: length ≤ 512
Example:
john_doe@sysdig.comTimestamp indicating the moment the Zone has been last updated.
It is expressed in milliseconds elapsed since January 1, 1970 UTC.Possible values: value ≥ 0
Example:
1The name of the Zone
Possible values: length ≤ 512
Example:
ProductionAttached Zone Scopes
Possible values: number of items ≤ 8192
Status Code
A Single Zone
Operation failed due to invalid payload.
Access denied.
Server was unable to process the request.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Unprocessable content", "type": "unprocessable_content" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
List Report Schedules
Retrieve a paginated list of Report Schedules.
Required permissions: platform.reporting.schedules.read
GET /platform/reporting/v1/schedules
Response
List of Schedules.
Possible values: number of items ≤ 10000
Status Code
List of Report schedules
Operation failed due to invalid payload.
Access denied.
Server was unable to process the request.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Unprocessable content", "type": "unprocessable_content" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }
List Report Job Runs
Retrieve a list of Report Job runs.
Required permissions: platform.reporting.report-downloads.read
GET /platform/reporting/v1/jobs
Request
Query Parameters
ID of the Schedule
Possible values: length ≤ 512
Example:
2pUnGeLvrOo5qoWuvXg5H9nEH2gID of the Report
Possible values: 0 ≤ value ≤ 1000000
Example:
1Indicates whether the report is a template.
Allowable values: [
true,false]Example:
trueDate the job was completed in epoch milliseconds.
Possible values: value ≥ 0
Example:
1Type of the job.
Allowable values: [
ON_DEMAND,SCHEDULED]Example:
SCHEDULEDStatus of the job.
Allowable values: [
RUNNING,COMPLETED,FAILED,CREATED]Example:
COMPLETEDKind of the report.
Allowable values: [
compliance_readiness,vulnerability_management]Example:
compliance_readinessList of policy IDs in string format.
Possible values: length ≤ 8192
Example:
[1,2,3]List of zone IDs in string format.
Possible values: length ≤ 8192
Example:
[1,2,3]
Response
List of Jobs.
Possible values: number of items ≤ 10000
Status Code
List of Report job runs.
Operation failed due to invalid payload.
Access denied.
Server was unable to process the request.
Too many requests.
Internal server error.
{ "details": [], "message": "Bad request", "type": "bad_request" }{ "details": [], "message": "Unauthorized", "type": "unauthorized" }{ "details": [], "message": "Unprocessable content", "type": "unprocessable_content" }{ "details": [], "message": "Too many requests", "type": "too_many_requests" }{ "details": [], "message": "Internal server error", "type": "internal_server_error" }