Scan Software Packages

Request an on-demand vulnerability assessment of your software packages to determine if the packages contain any common vulnerabilities and exposures. The response for detected CVEs includes CVE details. Only packages managed by a package manager for supported operating systems are reported.

Use the body parameter to specify the list of packages to scan for. In the package list, separate each package entry with a comma. Here is the list of supported OS types with some osVer examples:

• { "os": "alpine", "osVer": "v3.1" ... }
• { "os": "amzn", "osVer": "2" ... }
• { "os": "amzn", "osVer": "2018.03" ... }
• { "os": "centos", "osVer": "5" ... }
• { "os": "debian", "osVer": "unstable" ... }
• { "os": "debian", "osVer": "11" ... }
• { "os": "oracle", "osVer": "8" ... }
• { "os": "rhel", "osVer": "8" ... }
• { "os": "ubuntu", "osVer": "19.10" ... }

For more information about creating an API access key and token to run this operation and using this operation with organization resources, see https://docs.fortinet.com/document/forticnapp/latest/api-reference/932048/api-keys-and-access-tokens.

Usage Example:

curl -X POST -H 'Content-Type: application/json' -d '{ "osPkgInfoList": [ { "os":"Ubuntu", "osVer":"18.04", "pkg": "openssl","pkgVer": "1.1.1-1ubuntu2.1~18.04.5" } ] }' "https://YourAccount.lacework.net/api/v2/Vulnerabilities/SoftwarePackages/scan" -H "Authorization: Bearer YourAPIToken"

Note: Calls to this operation are rate limited to 10 calls per hour, per access key. If this rate limit is exceeded, an exception is thrown. Also, note that this operation is limited to 1k of packages per payload. If you require a payload larger than 1k, you must make multiple requests. For more information about creating an API access key and token to run this operation and using this operation with organization resources, see https://docs.fortinet.com/document/forticnapp/latest/api-reference/932048/api-keys-and-access-tokens.