Search Containers

Search for containers in your environment. Get details, such as the container name, pod name, tags, and so on, by invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/Entities/Containers/search

The results reflect containers that were active and processed by FortiCNAPP within the specified time frame. Containers that were not active and containers that have not been processed yet do not appear in the results.

FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days. To use the current time as the end time, exclude the endTime field.

Due to the to the hourly aggregation window for container rows, any time range less than 1 hour will return no results. The specified time range will filter container rows with aggregation windows that fall in the time range. For more information, see CONTAINER_SUMMARY_V View.

You can optionally filter the returned containers by the container name, pod name, tags, and more. For more information, see CONTAINER_SUMMARY_V View.

Here are some example body payloads:

• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}}
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "mid", "expression": "eq", "value": "12345" } ] }
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "mid", "expression": "eq", "value": "12345" }, { "field": "propsContainer.IMAGE_TAG", "expression": "eq", "value": "v1.7.0-eksbuild.1" } ],
  "returns": [ "containerName", "imageId", "podName", "propsContainer", "tags" ] }

Within request bodies, nested field names that contain one or more special characters—e.g., dot ("."), colon (":"), or slash ("/")—must be enclosed in escaped double quotes. For example, the field name io.codefresh.repo.name nested under the PROPS_LABEL of the propsContainer field would be rendered as follows:

"propsContainer.PROPS_LABEL.\"io.codefresh.repo.name\""

In a filter, the example would appear as follows:

{ "field": "propsContainer.PROPS_LABEL.\"io.codefresh.repo.name\"", "expression": "eq", "value": "modelservice" }