Search K8s Pods

Search for Kubernetes pods in your environment. Get details such as the pod name, IP address assigned to the pod, and other pod statistics by invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/Entities/K8sPods/search

FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days. To use the current time as the end time, exclude the endTime field.

You can optionally filter the returned pods by machine ID, pod name, primary IP address, and more. For more information, see POD_SUMMARY_V View.

Here are some example body payloads:

• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}}
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "mid", "expression": "eq", "value": "12345" } ] }
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "mid", "expression": "eq", "value": "12345" }, { "field": "propsContainer.IMAGE_ID", "expression": "eq", "value": "sha256:9e862c010bf39766f9821926848754adccf58225aa652cc18a97fccba273df39" } ],
  "returns": [ "mid", "podName", "propsContainer" ] }

Within request bodies, nested field names that contain one or more special characters—e.g., dot ("."), colon (":"), or slash ("/")—must be enclosed in escaped double quotes. For example, the field name io.kubernetes.pod.namespace nested under the PROPS_LABEL of the propsContainer field would be rendered as follows:

"propsContainer.PROPS_LABEL.\"io.kubernetes.pod.namespace\""

In a filter, the example would appear as follows:

{ "field": "propsContainer.PROPS_LABEL.\"io.kubernetes.pod.namespace\"", "expression": "eq", "value": "codefresh" }