---
title: "Search Host Vulnerabilities"
method: POST
path: "/api/v2/Vulnerabilities/Hosts/search"
tags: ["Vulnerabilities"]
---

# Search Host Vulnerabilities

`POST /api/v2/Vulnerabilities/Hosts/search`

Search the scan (assessment), including the risk score and scan status, vulnerabilities found in the scan, and statistics about those vulnerabilities by invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/Vulnerabilities/Hosts/search` 

 FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days. 

 Optionally filter the returned vulnerabilities by severity, vulnerability ID, machine ID, and more. For more information, see [HOST_VULN_DETAILS_V View](https://docs.fortinet.com/document/forticnapp/latest/administration-guide/604250/host-vuln-details-v-view). 

 The `rlike` and `not_rlike` operators are useful for filtering results. For example, the following expression limits results to those that have `python` in their `featureKey` name field:

 > `"filters": [ {  "expression": "rlike", "field": "featureKey.name", "value": ".*python.*" } ]` 

 Here are some additional example `body` payloads: 
 * `{ "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"},` 
 `"filters": [ { "field": "vulnId", "expression": "eq", "value": "CVE-2018-7169" } ] }` 
 * `{ "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"},` 
 `"filters": [ { "field": "evalGuid", "expression": "eq", "value": "1234567a89012b34567890123cd56e78" } ] }` 
 * `{ "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"},`
 `"filters": [ { "field": "machineTags.AmiId", "expression": "eq", "value": "ami-0d9ef0d809e365a36" }, { "field": "severity", "expression": "eq", "value": "Medium" } ],`  
 `"returns": [ "mid", "props", "severity", "status", "vulnId", "evalCtx", "fixInfo", "featureKey", "machineTags" ] }` 


 Within request bodies, nested field names that contain one or more special characters—e.g., dot ("."), colon (":"), or slash ("/")—mus be enclosed in **escaped double quotes**. For example, the field name `aws:ec2launchtemplate:version` nested under the `machineTags` field would be rendered as follows: 

 `"machineTags.\"aws:ec2launchtemplate:version\""` 

 In a filter, the example would appear as follows: 

 `{ "field": "machineTags.\"aws:ec2launchtemplate:version\"", "expression": "eq", "value": "3" }` 

 In addition, forward slash characters within field names must be escaped with a backslash, as in the following example: 

 `"machineTags.\"kubernetes.io\/cluster\/prod1\""` 

To search for host vulnerabilities of only online machines, first use the "Search Machines" endpoint to get a list of online machines. Then call "Search Host Vulnerabilities", passing the machine IDs from the "Search Machines" results as a filter with the `in` filter type.

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- GETDATAREQUESTBODYTIMEFILTERS
  - `timeFilter` object — The date/time range during which actions occurred.
    - `startTime` string — Returns only recorded actions that occurred after this timestamp.
    - `endTime` string — Returns only recorded actions that occurred before this timestamp. If empty or missing, the current time is used.
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of Host Vulnerabilities)

- object
  - `paging` PagingSchema — Details of the response's pagination
    - `rows` number — The number of rows displayed on each page
    - `totalRows` number — The number of rows returned from the query
    - `urls` object — Pagination-related URLs
      - `nextPage` string — The next page's URL
  - `data` VulnerabilitiesHostsResponseSchema[]
    - `startTime` string
    - `endTime` string
    - `vulnId` string
    - `mid` string
    - `machineTags` object
    - `evalCtx` object
    - `evalGuid` string
    - `featureKey` object
    - `packageStatus` string
    - `severity` string
    - `fixInfo` object
    - `status` string
    - `cveProps` object
    - `props` object
    - `riskScore` number
    - `riskInfo` object
    - `cveRiskScore` number
    - `cveRiskInfo` object
    - `hostRiskScore` number
    - `hostRiskInfo` object

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)