Skip to main content

Download Deployed Defenders

GET 
/api/v30.00/defenders/download
x-prisma-cloud-target-env: {"permission":"manageDefenders","saas":true,"self-hosted":true}
x-public: true

Downloads information about deployed Defenders in CSV format. Use the query parameters to filter what data is returned.

Note: The results contain "hostname" even if you don't specify a "hostname" in the "fields" query parameter.

cURL Request​

Refer to the following example cURL command:

$ curl -k \
  -u <USER> \
  -H 'Content-Type: text/csv' \
  -X GET -o <FILENAME> \
  https://<CONSOLE>/api/v<VERSION>/defenders/download

Request​

Query Parameters

    offset integer

    Offsets the result to a specific report count. Offset starts from 0.

    limit integer

    Number of reports to retrieve in a page. For PCCE, the maximum limit is 250. For PCEE, the maximum limit is 50. The default value is 50.

    search string

    Retrieves the result for a search term.

    sort string

    Sorts the result using a key. Refer to the columns in the relevant Prisma Cloud Compute user interface to use them as sort keys.

    reverse boolean

    Sorts the result in reverse order.

    collections string[]

    Filters the result based on collection names that you have defined in Prisma Cloud Compute.

    provider string[]

    Scopes the query by cloud provider.

    accountIDs string[]

    Filters the result based on cloud account IDs.

    resourceIDs string[]

    Scopes the query by resource ID.

    region string[]

    Scopes the query by cloud region.

    fields string[]

    Retrieves the fields that you need in a report. Use the list of fields you want to retrieve. By default, the result shows all fields of data.

    hostname string

    Hostname is a name of a specific Defender to retrieve.

    role string[]

    Roles are the defender api.Roles to filter.

    connected boolean

    Indicates whether to return only connected Defenders (true) or disconnected Defenders (false).

    type string[]

    Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).

    latest boolean

    Indicates whether to return a list of Defenders that are running the latest version of Prisma Cloud (true) or defenders with older versions (false).

    supportedVersion boolean

    SupportedVersion indicates only Defenders of supported versions should be fetched.

    cluster string[]

    Scopes the query by cluster name.

    tasClusterIDs string[]

    Scopes the query by TAS cluster IDs.

    tasBlobstoreScanner boolean

    Scopes the query by TAS blobstore scanning only Defenders (true) or TAS full coverage Defenders (false).

    tasFoundations string[]

    Scopes the query by TAS foundations.

    usingOldCA boolean

    Scopes the query to defenders which are using old certificate.

    usingExpiredCA boolean

    Scopes the query to defenders which are using expired certificate.

    isARM64 boolean

    Indicates whether to return only defenders running on ARM64 architecture.

    isVPCObserver boolean

    Indicates whether to return only defenders running as VPC Observer.

Responses​

OK

Loading...