Search Image Vulnerability Observations

Search for vulnerability observations that occur in images (containers), including risk scores, observation statuses, and detailed statistics.

Query the current state of vulnerabilities across images with the following endpoint:

POST https://YourAccount.lacework.net/api/v2/VulnerabilityObservations/Images/search

Use this endpoint to search for vulnerabilities based on the current state, reflecting the most recent observations rather than historical evaluations. A time range is not required.

Filtering

Optionally filter the returned vulnerabilities by severity, vulnerability ID, machine ID, and more.

Use the rlike and not_rlike operators to filter results by regular expression. For example, the following expression limits results to those that have python in the packageName field:

"filters": [ { "expression": "rlike", "field": "packageName", "value": ".*python.*" } ]

Additional example body payloads:

• { "filters": [ { "field": "vulnId", "expression": "eq", ", "value": "CVE-2018-7169" } ] }
• { "filters": [ { "field": "imageId", "expression": "eq", "value": "sha256:2e05f1f668367c1fc0f1c9c02ee87521ed66541e6ebf0a31905b8cdd78d22611" }, { "field": "severity", "expression": "eq", "value": 4 } ] }

To search for container vulnerabilities of only online machines, use the hasActiveContainers filter:

• { "filters": [ { "field": "hasActiveContainers", "expression": "eq", "value": "true" } ] }