---
title: "Search Host Vulnerability Observations"
method: POST
path: "/api/v2/VulnerabilityObservations/Hosts/search"
tags: ["VulnerabilityObservations"]
---

# Search Host Vulnerability Observations

`POST /api/v2/VulnerabilityObservations/Hosts/search`

Search for vulnerability observations that occur in hosts,  including risk scores, observation statuses, and detailed statistics.  

Query the current state of vulnerabilities across hosts with the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/VulnerabilityObservations/Hosts/search`
  
Use this endpoint to search for vulnerabilities based on the  current state of the host, reflecting the most recent observations  rather than historical evaluations. A time range is not required.

### Filtering

Filter the returned vulnerabilities by severity, vulnerability ID,  machine ID, and more.
  
Use the `rlike` and `not_rlike` operators to filter results by  regular expression. For example, the following expression limits  results to those that have `python` in the  `packageName` field:

  > `"filters": [ {  "expression": "rlike", "field": "packageName", "value": ".*python.*" } ]` 
  
Additional example `body` payloads:

* `{ "filters": [ { "field": "vulnId", "expression": "eq", " value": "CVE-2018-7169" } ] }`
* `{ "filters": [ { "field": "machineImage", "expression": "eq", "value": "ami-0d9ef0d809e365a36" }, { "field": "severity", "expression": "eq", "value": 4 } ] 
 }`  

In request bodies, nested field names that contain one or more  special characters, such as dot ("."), colon (":"), or slash  ("/"), must be enclosed in **escaped double quotes**. For example,  the field name `aws:ec2launchtemplate:version` nested under the  `machineTags` field would be rendered as follows:

  `"machineTags.\"aws:ec2launchtemplate:version\""`  

In a filter, use this as follows:

  `{ "field": "machineTags.\"aws:ec2launchtemplate:version\"", "expression": "eq", "value": "3" }`
  
Escape forward slash characters within field names with a backslash:

  `"machineTags.\"kubernetes.io\/cluster\/prod1\""` 
  
To search for host vulnerabilities of only online machines, use the  "Search Machines" endpoint to get a list of online machines, then   call "Search Host Vulnerabilities", passing the machine IDs from  the "Search Machines" results as a filter with the `in` filter type.

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- VulnerabilityObservationsHostsSearchRequestBody — unresolved $ref

## Response `200`

No Error (List of VulnerabilityObservations_Hosts)

- object
  - `paging` PagingSchema — Details of the response's pagination
    - `rows` number — The number of rows displayed on each page
    - `totalRows` number — The number of rows returned from the query
    - `urls` object — Pagination-related URLs
      - `nextPage` string — The next page's URL
  - `data` VulnerabilityObservationsHostsResponseSchema[]
    - `hostMachineId` string
    - `hostFirstDiscoveredTime` number
    - `hostLastDiscoveredTime` number
    - `agentLastDiscoveredTime` number
    - `agentlessLastDiscoveredTime` number
    - `hostName` string
    - `hostRiskScore` number
    - `osNamespace` string
    - `osName` string
    - `osVersion` string
    - `osType` string
    - `osOutOfDate` number
    - `osUpdatesDisabled` number
    - `osRebootRequired` number
    - `osEolDate` string
    - `externalIp` string
    - `internalIp` string
    - `publicFacing` number
    - `internetExposed` number
    - `internetExposedLastUpdated` number
    - `zone` string
    - `machineImage` string
    - `machineTags` string
    - `coverageType` string
    - `avdEnabled` number
    - `hostLastEvalTime` number
    - `accountId` string
    - `accountAlias` string
    - `organizationId` string
    - `cloudProvider` string
    - `packageLastActiveTime` number
    - `observationFixedTime` number
    - `observationVulnerableSinceTime` number
    - `vulnId` string
    - `packageName` string
    - `packageNamespace` string
    - `packageVersion` string
    - `packagePath` string
    - `fixable` number
    - `fixVersion` string
    - `observationFirstDiscoveredTime` number
    - `observationLastDiscoveredTime` number
    - `vulnLink` string
    - `cvssExploitabilityScore` number
    - `cvssImpactScore` number
    - `cvssScore` number
    - `cvssVectorString` string
    - `cvssVersion` string
    - `cvssAttackVector` string
    - `cvssAttackComplexity` string
    - `cvssPrivilegesRequired` string
    - `cvssAuthentication` string
    - `cvssUserInteraction` string
    - `cvssScope` string
    - `cvssConfidentiality` string
    - `cvssIntegrity` string
    - `cvssAvailability` string
    - `vulnPublicExploitDate` number
    - `vulnPublicExploitAvailable` number
    - `machineStatus` string
    - `observationStatus` string
    - `observationStatusCategory` string
    - `packageStatus` string
    - `severity` string

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)