Search Host Vulnerabilities

Search the scan (assessment), including the risk score and scan status, vulnerabilities found in the scan, and statistics about those vulnerabilities by invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/Vulnerabilities/Hosts/search

FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days.

Optionally filter the returned vulnerabilities by severity, vulnerability ID, machine ID, and more. For more information, see HOST_VULN_DETAILS_V View.

The rlike and not_rlike operators are useful for filtering results. For example, the following expression limits results to those that have python in their featureKey name field:

"filters": [ { "expression": "rlike", "field": "featureKey.name", "value": ".*python.*" } ]

Here are some additional example body payloads:

• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "vulnId", "expression": "eq", "value": "CVE-2018-7169" } ] }
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "evalGuid", "expression": "eq", "value": "1234567a89012b34567890123cd56e78" } ] }
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "machineTags.AmiId", "expression": "eq", "value": "ami-0d9ef0d809e365a36" }, { "field": "severity", "expression": "eq", "value": "Medium" } ],
  "returns": [ "mid", "props", "severity", "status", "vulnId", "evalCtx", "fixInfo", "featureKey", "machineTags" ] }

Within request bodies, nested field names that contain one or more special characters—e.g., dot ("."), colon (":"), or slash ("/")—mus be enclosed in escaped double quotes. For example, the field name aws:ec2launchtemplate:version nested under the machineTags field would be rendered as follows:

"machineTags.\"aws:ec2launchtemplate:version\""

In a filter, the example would appear as follows:

{ "field": "machineTags.\"aws:ec2launchtemplate:version\"", "expression": "eq", "value": "3" }

In addition, forward slash characters within field names must be escaped with a backslash, as in the following example:

"machineTags.\"kubernetes.io\/cluster\/prod1\""

To search for host vulnerabilities of only online machines, first use the "Search Machines" endpoint to get a list of online machines. Then call "Search Host Vulnerabilities", passing the machine IDs from the "Search Machines" results as a filter with the in filter type.