---
title: "Search Image Vulnerability Observations"
method: POST
path: "/api/v2/VulnerabilityObservations/Images/search"
tags: ["VulnerabilityObservations"]
---

# Search Image Vulnerability Observations

`POST /api/v2/VulnerabilityObservations/Images/search`

Search for vulnerability observations that occur in images (containers),   including risk scores, observation statuses, and detailed statistics.  

Query the current state of vulnerabilities across images with the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/VulnerabilityObservations/Images/search`

Use this endpoint to search for vulnerabilities based on the current state,   reflecting the most recent observations rather than historical evaluations.  A time range is not required.

### Filtering
Optionally filter the returned vulnerabilities by severity, vulnerability ID, machine ID, and more.

Use the `rlike` and `not_rlike` operators to filter results by  regular expression. For example, the following expression limits results to those that have `python` in the `packageName` field:

 > `"filters": [ {  "expression": "rlike", "field": "packageName", "value": ".*python.*" } ]`  

Additional example `body` payloads:  
* `{ "filters": [ { "field": "vulnId", "expression": "eq", ", "value": "CVE-2018-7169" } ] }`  
* `{ "filters": [ { "field": "imageId", "expression": "eq", "value": "sha256:2e05f1f668367c1fc0f1c9c02ee87521ed66541e6ebf0a31905b8cdd78d22611" }, { "field": "severity", "expression": "eq", "value": 4 } ] 
 }`  

To search for container vulnerabilities of only online machines, use the hasActiveContainers filter: 
* `{ "filters": [ { "field": "hasActiveContainers", "expression": "eq", "value": "true" } ] }`

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- VulnerabilityObservationsImagesSearchRequestBody — unresolved $ref

## Response `200`

No Error (List of VulnerabilityObservations_Images)

- object
  - `paging` PagingSchema — Details of the response's pagination
    - `rows` number — The number of rows displayed on each page
    - `totalRows` number — The number of rows returned from the query
    - `urls` object — Pagination-related URLs
      - `nextPage` string — The next page's URL
  - `data` VulnerabilityObservationsImagesResponseSchema[]
    - `imageId` string
    - `imageDigests` string
    - `imageNames` string
    - `os` string
    - `imageSize` number
    - `imageRegistries` string
    - `imageRepositories` string
    - `imageRiskScore` number
    - `internetExposed` number
    - `internetExposedLastUpdated` number
    - `imageLastScanTime` number
    - `imageCreatedTime` number
    - `imageType` string
    - `imageTags` string
    - `imageScanStatus` string
    - `imageScanErrorMessage` string
    - `imageLatestScanSuccessful` number
    - `imageLatestSuccessfulScanTime` number
    - `imageRequestSources` string
    - `imageFirstDiscoveredTime` number
    - `imageLastDiscoveredTime` number
    - `hasAvdEnabledContainers` number
    - `activeContainerCount` number
    - `hasActiveContainers` number
    - `packageLastActiveTime` number
    - `observationFixedTime` number
    - `observationVulnerableSinceTime` number
    - `vulnId` string
    - `packageName` string
    - `packageNamespace` string
    - `packageVersion` string
    - `packagePath` string
    - `fixable` number
    - `fixVersion` string
    - `observationFirstDiscoveredTime` number
    - `observationLastDiscoveredTime` number
    - `vulnLink` string
    - `cvssExploitabilityScore` number
    - `cvssImpactScore` number
    - `cvssScore` number
    - `cvssVectorString` string
    - `cvssVersion` string
    - `cvssAttackVector` string
    - `cvssAttackComplexity` string
    - `cvssPrivilegesRequired` string
    - `cvssAuthentication` string
    - `cvssUserInteraction` string
    - `cvssScope` string
    - `cvssConfidentiality` string
    - `cvssIntegrity` string
    - `cvssAvailability` string
    - `vulnPublicExploitDate` number
    - `vulnPublicExploitAvailable` number
    - `observationStatus` string
    - `observationStatusCategory` string
    - `packageStatus` string
    - `severity` string

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)