Get Discovered VMs
GET/api/v30.00/cloud/discovery/vms
x-prisma-cloud-target-env: {"permission":"monitorCloud","saas":true,"self-hosted":true}
x-public: true
Returns the discovered cloud VM instances.
cURL Request
Refer to the following example cURL command that retrieves all the discovered cloud VM instances:
$ curl -k \
-u <USER> \
-H 'Content-Type: application/json' \
-X GET \
'https://<CONSOLE>/api/v<VERSION>/cloud/discovery/vms'
Request
Query Parameters
Offsets the result to a specific report count. Offset starts from 0.
Number of reports to retrieve in a page. For PCCE, the maximum limit is 250. For PCEE, the maximum limit is 50. The default value is 50.
Retrieves the result for a search term.
Sorts the result using a key. Refer to the columns in the relevant Prisma Cloud Compute user interface to use them as sort keys.
Sorts the result in reverse order.
Filters the result based on collection names that you have defined in Prisma Cloud Compute.
Scopes the query by cloud provider.
Filters the result based on cloud account IDs.
Scopes the query by resource ID.
Scopes the query by cloud region.
Retrieves the fields that you need in a report. Use the list of fields you want to retrieve. By default, the result shows all fields of data.
HasDefender indicates only VMs with or without a defender should return.
Responses
- 200
- default
- application/json
- Schema
- Example (from schema)
Schema
- Array [
- Array [
- ]
- ]
ID is the instance id. E.g. "i-5cd23551".
AccountID is the cloud provider account ID.
Architecture is the architecture of the image.
The Amazon Resource Name (ARN) assigned to the instance.
AWSSubnetID is the ID of the subnet associated with the VM (AWS only).
AWSVPCID is the ID of the VPC associated with the VM (AWS only).
Cluster is the cluster name that is associated with the vm.
Collections is a list of the matched collections.
CreatedAt is the time when the instance was launched.
FQDN is the host's fully qualified domain name . E.g. "ip-192-0-2-0.us-east-2.compute.internal".
HasDefender indicates that the instance has a defender installed on it.
Hostname is the hostname. E.g. "ip-192-0-2-0" or "custom".
ImageID is the ID of the AMI used to launch the instance. E.g. "ami-35501205".
ImageName is the name of the AMI used to launch the instance.
Name is the instance name.
OS is the Operating System installed on the instance.
osInfo object
OSDistroInfo represents information regarding the OS distribution
Distro is the OS distro name (e.g. ubuntu).
DistroRelease is the OS distro release (e.g. willy).
FullName is the full name of the distro (e.g. Ubuntu 19.10).
Version is the OS release numeric version (e.g. 19.10).
Possible values: [aws,azure,gcp,alibaba,oci,others
]
CloudProvider represents the cloud provider
Region is the region the VM is located at.
tags object[]
Tags are the tags of the VM instance.
Label key.
Source name (e.g., for a namespace, the source name can be 'twistlock').
Possible values: [namespace,deployment,aws,azure,gcp,oci
]
ExternalLabelSourceType indicates the source of the labels
Time when the label was fetched.
Value of the label.
Timestamp is the time in which the instance info was fetched.
[
{
"_id": "string",
"accountID": "string",
"architecture": "string",
"arn": "string",
"awsSubnetID": "string",
"awsVPCID": "string",
"cluster": "string",
"collections": [
"string"
],
"createdAt": "2023-11-20T16:36:43.938Z",
"fqdn": "string",
"hasDefender": true,
"hostname": "string",
"imageID": "string",
"imageName": "string",
"name": "string",
"os": "string",
"osInfo": {
"distro": "string",
"distroRelease": "string",
"fullName": "string",
"version": "string"
},
"provider": [
"aws",
"azure",
"gcp",
"alibaba",
"oci",
"others"
],
"region": "string",
"tags": [
{
"key": "string",
"sourceName": "string",
"sourceType": [
"namespace",
"deployment",
"aws",
"azure",
"gcp",
"oci"
],
"timestamp": "2023-11-20T16:36:43.938Z",
"value": "string"
}
],
"timestamp": "2023-11-20T16:36:43.938Z"
}
]