Get Runtime Container Profiles
GET/api/v32.07/profiles/container
x-prisma-cloud-target-env: {"permission":"monitorRuntimeContainers"}
Retrieves the details and state of all runtime models.
cURL Request
Refer to the following example cURL command that lists all runtime models in a system:
$ curl -k \
-u <USER> \
-H 'Content-Type: application/json' \
-X GET \
https://<CONSOLE>/api/v<VERSION>/profiles/container
Request
Query Parameters
Offsets the result to a specific report count. Offset starts from 0.
Limit is the amount to fix.
Sorts the result using a key.
Sorts the result in reverse order.
IDs is the runtime profile id filter.
OS is the service runtime profile OS filter.
States is the runtime profile state filter.
ImageIDs is the runtime profile image id filter.
Images is the runtime profile image filter.
Hosts is the runtime profile hostname filter.
Namespaces is the runtime profile k8s namespace filter.
Clusters is the runtime profile k8s cluster filter.
Responses
- 200
- default
- application/json
- Schema
- Example (from schema)
Schema
- Array [
- Array [
- ]
- Array [
- ]
- Array [
- ]
- Array [
- Array [
- ]
- Array [
- ]
- ]
- Array [
- Array [
- ]
- Array [
- ]
- ]
- Array [
- ]
- Array [
- Array [
- ]
- ]
- Array [
- ]
- Array [
- ]
- Array [
- Array [
- ]
- ]
- Array [
- ]
- Array [
- ]
- ]
ID is the profile ID.
AccountIDs are the cloud account IDs associated with the container runtime profile.
Archive indicates whether this profile is archived.
capabilities object
ContainerCapabilities are a set of static capabilities for a given container
CI indicates the container allowed to write binaries to disk and run them.
CloudMetadata indicates the given container can query cloud metadata api.
DNSCache are DNS services that are used by all the pods in the cluster.
DynamicDNSQuery indicates capped behavioral dns queries.
DynamicFileCreation indicates capped behavioral filesystem paths.
DynamicProcessCreation indicates capped behavioral processes.
Kubernetes indicates the given container can perform k8s networking tasks (e.g., contact to api server).
Proxy indicates the container can listen on any port and perform multiple outbound connection.
PullImage indicates that the container is allowed pull images (might include files with high entropy).
Sshd indicates whether the container can run sshd process.
Unpacker indicates the container is allowed to write shared libraries to disk.
Cluster is the provided cluster name.
Collections are collections to which this profile applies.
Created is the profile creation time.
Entrypoint is the image entrypoint.
events object[]
Events are the last historical interactive process events for this profile, they are updated in a designated flow.
ID is the history event entity.
Command is the process that was executed.
Hostname is the hostname on which the command was invoked.
Time is the time of the event.
filesystem object
ProfileFilesystem defines the filesystem features profile
behavioral object[]
Behavioral is filesystem data learned from behavioral analysis.
Mount indicates whether the given folder is a mount.
Path is the file path.
Process is the process that accessed the file.
Time is the time in which the file was added.
static object[]
Static is filesystem data learned from static analysis.
Mount indicates whether the given folder is a mount.
Path is the file path.
Process is the process that accessed the file.
Time is the time in which the file was added.
ProfileHash represents the profile hash It is allowed to contain up to uint32 numbers, and represented by int64 since mongodb does not support unsigned data types
HostNetwork whether the instance share the network namespace with the host.
HostPid indicates whether the instance share the pid namespace with the host.
Image is the image name that represents the image.
ImageID is the profile's image ID.
InfraContainer indicates this is an infrastructure container.
Istio states whether it is an istio-monitored profile.
k8s object
ProfileKubernetesData holds Kubernetes data
clusterRoles object[]
ClusterRoles are the cluster roles of the associated service account.
labels object[]
Labels are the labels associated with the role.
Key is the key of the label.
Value is the value of the label.
Name is the kubernetes role name.
RoleBinding is the name of the role binding used for display.
rules object[]
Rules are the policy rules associated with the role.
.
.
.
.
.
Version is the resource version of the role object maintained by Kubernetes.
roles object[]
Roles are the roles of the associated service account.
labels object[]
Labels are the labels associated with the role.
Key is the key of the label.
Value is the value of the label.
Name is the role name.
Namespace is the namespace associated with the role.
RoleBinding is the name of the role binding used for display.
rules object[]
Rules are the list of rules associated with the cluster role.
.
.
.
.
.
Version is the resource version of the role object maintained by Kubernetes.
ServiceAccount is the service account used to access Kubernetes apiserver This field will be empty if the container is not running inside of a Pod.
Label is the profile's label.
Modified is the last time when this profile was modified.
LearnedStartup indicates that startup events were learned.
Namespace is the k8s deployment namespace.
network object
ProfileNetwork represents networking data that is learned
behavioral object
ProfileNetworkBehavioral represents the behavioral data learned for networking
dnsQueries object[]
DNSQueries is the learned DNS queries.
DomainName is the queried domain name.
DomainType is the queried domain type.
listeningPorts object[]
Listening is the learned listening ports.
App is the name of the app.
portsData object
ProfilePortData represents a runtime profile ports data
All indicates that this port data represents any arbitrary ports.
ports object[]
Ports is the list of profile runtime ports.
Port is the port number.
Time is the learning timestamp of this port.
outboundPorts object
ProfilePortData represents a runtime profile ports data
All indicates that this port data represents any arbitrary ports.
ports object[]
Ports is the list of profile runtime ports.
Port is the port number.
Time is the learning timestamp of this port.
geoip object
ProfileNetworkGeoIP represents a cache of last ip-country pairs attached to each profile
countries object[]
Countries is a list of ip addresses with their corresponding country codes.
Code is the country iso code.
IP is the ip address.
Modified is the last modified time of this entry.
Modified is the last modified time of the cache.
static object
ProfileNetworkStatic represent the static section of the networking profile
listeningPorts object[]
Listening are the listening ports learned by static analysis.
App is the name of the app.
portsData object
ProfilePortData represents a runtime profile ports data
All indicates that this port data represents any arbitrary ports.
ports object[]
Ports is the list of profile runtime ports.
Port is the port number.
Time is the learning timestamp of this port.
OS is the profile image OS.
processes object
ProfileProcesses represents the process data that is learned for a specific image
behavioral object[]
Behavioral are process details learned from behavioral analysis.
Command is the executed command.
Interactive indicates whether the process belongs to an interactive session.
MD5 is the process binary MD5 sum.
Modified indicates the process binary was modified after the container has started.
Path is the process binary path.
PPath is the parent process path.
Time is the time in which the process was added. If the process was modified, Time is the modification time.
User represents the username that started the process.
static object[]
Static are process details learned from static analysis.
Command is the executed command.
Interactive indicates whether the process belongs to an interactive session.
MD5 is the process binary MD5 sum.
Modified indicates the process binary was modified after the container has started.
Path is the process binary path.
PPath is the parent process path.
Time is the time in which the process was added. If the process was modified, Time is the modification time.
User represents the username that started the process.
RelearningCause is a string that describes the reasoning for a profile to enter the learning mode after being activated.
RemainingLearningDurationSec represents the total time left that the system need to finish learning this image.
Possible values: [learning,dryRun,learningExtended,manualLearning,manualRelearning,active,manualActive
]
RuntimeProfileState represents the state of an image profile
[
{
"_id": "string",
"accountIDs": [
"string"
],
"archived": true,
"capabilities": {
"ci": true,
"cloudMetadata": true,
"dnsCache": true,
"dynamicDNSQuery": true,
"dynamicFileCreation": true,
"dynamicProcessCreation": true,
"k8s": true,
"proxy": true,
"pullImage": true,
"sshd": true,
"unpacker": true
},
"cluster": "string",
"collections": [
"string"
],
"created": "2024-07-29T15:51:28.071Z",
"entrypoint": "string",
"events": [
{
"_id": "string",
"command": "string",
"hostname": "string",
"time": "2024-07-29T15:51:28.071Z"
}
],
"filesystem": {
"behavioral": [
{
"mount": true,
"path": "string",
"process": "string",
"time": "2024-07-29T15:51:28.071Z"
}
],
"static": [
{
"mount": true,
"path": "string",
"process": "string",
"time": "2024-07-29T15:51:28.071Z"
}
]
},
"hash": 0,
"hostNetwork": true,
"hostPid": true,
"image": "string",
"imageID": "string",
"infra": true,
"istio": true,
"k8s": {
"clusterRoles": [
{
"labels": [
{
"key": "string",
"value": "string"
}
],
"name": "string",
"roleBinding": "string",
"rules": [
{
"apiGroups": [
"string"
],
"nonResourceURLs": [
"string"
],
"resourceNames": [
"string"
],
"resources": [
"string"
],
"verbs": [
"string"
]
}
],
"version": "string"
}
],
"roles": [
{
"labels": [
{
"key": "string",
"value": "string"
}
],
"name": "string",
"namespace": "string",
"roleBinding": "string",
"rules": [
{
"apiGroups": [
"string"
],
"nonResourceURLs": [
"string"
],
"resourceNames": [
"string"
],
"resources": [
"string"
],
"verbs": [
"string"
]
}
],
"version": "string"
}
],
"serviceAccount": "string"
},
"label": "string",
"lastUpdate": "2024-07-29T15:51:28.071Z",
"learnedStartup": true,
"namespace": "string",
"network": {
"behavioral": {
"dnsQueries": [
{
"domainName": "string",
"domainType": "string"
}
],
"listeningPorts": [
{
"app": "string",
"portsData": {
"all": true,
"ports": [
{
"port": 0,
"time": "2024-07-29T15:51:28.071Z"
}
]
}
}
],
"outboundPorts": {
"all": true,
"ports": [
{
"port": 0,
"time": "2024-07-29T15:51:28.071Z"
}
]
}
},
"geoip": {
"countries": [
{
"code": "string",
"ip": "string",
"modified": "2024-07-29T15:51:28.071Z"
}
],
"modified": "2024-07-29T15:51:28.071Z"
},
"static": {
"listeningPorts": [
{
"app": "string",
"portsData": {
"all": true,
"ports": [
{
"port": 0,
"time": "2024-07-29T15:51:28.071Z"
}
]
}
}
]
}
},
"os": "string",
"processes": {
"behavioral": [
{
"command": "string",
"interactive": true,
"md5": "string",
"modified": true,
"path": "string",
"ppath": "string",
"time": "2024-07-29T15:51:28.071Z",
"user": "string"
}
],
"static": [
{
"command": "string",
"interactive": true,
"md5": "string",
"modified": true,
"path": "string",
"ppath": "string",
"time": "2024-07-29T15:51:28.071Z",
"user": "string"
}
]
},
"relearningCause": "string",
"remainingLearningDurationSec": 0,
"state": [
"learning",
"dryRun",
"learningExtended",
"manualLearning",
"manualRelearning",
"active",
"manualActive"
]
}
]