Search Host Vulnerability Observations

Search for vulnerability observations that occur in hosts, including risk scores, observation statuses, and detailed statistics.

Query the current state of vulnerabilities across hosts with the following endpoint:

POST https://YourAccount.lacework.net/api/v2/VulnerabilityObservations/Hosts/search

Use this endpoint to search for vulnerabilities based on the current state of the host, reflecting the most recent observations rather than historical evaluations. A time range is not required.

Filtering

Filter the returned vulnerabilities by severity, vulnerability ID, machine ID, and more.

Use the rlike and not_rlike operators to filter results by regular expression. For example, the following expression limits results to those that have python in the packageName field:

"filters": [ { "expression": "rlike", "field": "packageName", "value": ".*python.*" } ]

Additional example body payloads:

• { "filters": [ { "field": "vulnId", "expression": "eq", " value": "CVE-2018-7169" } ] }
• { "filters": [ { "field": "machineImage", "expression": "eq", "value": "ami-0d9ef0d809e365a36" }, { "field": "severity", "expression": "eq", "value": 4 } ] }

In request bodies, nested field names that contain one or more special characters, such as dot ("."), colon (":"), or slash ("/"), must be enclosed in escaped double quotes. For example, the field name aws:ec2launchtemplate:version nested under the machineTags field would be rendered as follows:

"machineTags.\"aws:ec2launchtemplate:version\""

In a filter, use this as follows:

{ "field": "machineTags.\"aws:ec2launchtemplate:version\"", "expression": "eq", "value": "3" }

Escape forward slash characters within field names with a backslash:

"machineTags.\"kubernetes.io\/cluster\/prod1\""

To search for host vulnerabilities of only online machines, use the "Search Machines" endpoint to get a list of online machines, then call "Search Host Vulnerabilities", passing the machine IDs from the "Search Machines" results as a filter with the in filter type.