Get Runtime Host Profiles

GET 
/api/v32.07/profiles/host

x-prisma-cloud-target-env: {"permission":"monitorRuntimeHosts"}

Retrieves the details and state of each host service runtime model on a host-by-host basis. The returned JSON object has the following structure:

* host1:
  * service1: model
  * service2: model
* host2:
  * service1: model
  * service3: model

cURL Request

Refer to the following example cURL command:

$ curl -k \
  -u <USER> \
  -H 'Content-Type: application/json' \
  -X GET \
  https://<CONSOLE>/api/v<VERSION>/profiles/host

Request

Query Parameters

offset integer

Offsets the result to a specific report count. Offset starts from 0.

limit integer

Limit is the amount to fix.

sort string

Sorts the result using a key.

reverse boolean

Sorts the result in reverse order.

id string[]

IDs is the runtime profile id filter.

os string[]

OS is the service runtime profile OS filter.

state string[]

States is the runtime profile state filter.

imageID string[]

ImageIDs is the runtime profile image id filter.

image string[]

Images is the runtime profile image filter.

hostName string[]

Hosts is the runtime profile hostname filter.

namespace string[]

Namespaces is the runtime profile k8s namespace filter.

cluster string[]

Clusters is the runtime profile k8s cluster filter.

Responses

200

application/json

Schema

Schema

• Array [
_id string

ID is the profile ID (hostname).

accountID string

AccountID is the cloud account ID associated with the profile.

apps object[]
Apps are the host's apps metadata.
Array [
listeningPorts object[]
ListeningPorts represents the applications listening ports.
Array [
command string
Command represents the command that triggered the connection.
modified date-time
Modified is a timestamp of when the event occurred.
port integer
Port is the port number.
processPath string
ProcessPath represents the path to the process that uses the port.
]
name string
Name is the app name.
outgoingPorts object[]
OutgoingPorts represents the applications outgoing ports.
Array [
command string
Command represents the command that triggered the connection.
country string
Country is the country ISO code for the given IP address.
ip string
IP is the IP address captured over this port.
modified date-time
Modified is a timestamp of when the event occurred.
port integer
Port is the port number.
processPath string
ProcessPath represents the path to the process that uses the port.
]
processes object[]
Processes is a list of the app's descendant processes.
Array [
command string
Command is the executed command.
interactive boolean
Interactive indicates whether the process belongs to an interactive session.
md5 string
MD5 is the process binary MD5 sum.
modified boolean
Modified indicates the process binary was modified after the container has started.
path string
Path is the process binary path.
ppath string
PPath is the parent process path.
time date-time
Time is the time in which the process was added. If the process was modified, Time is the modification time.
user string
User represents the username that started the process.
]
startupProcess object
ProfileProcess represents a single process data
command string
Command is the executed command.
interactive boolean
Interactive indicates whether the process belongs to an interactive session.
md5 string
MD5 is the process binary MD5 sum.
modified boolean
Modified indicates the process binary was modified after the container has started.
path string
Path is the process binary path.
ppath string
PPath is the parent process path.
time date-time
Time is the time in which the process was added. If the process was modified, Time is the modification time.
user string
User represents the username that started the process.
]
collections string (string)[]

Collections is a list of collections to which this profile applies.

created date-time

Created is the profile creation time.

geoip object

ProfileNetworkGeoIP represents a cache of last ip-country pairs attached to each profile

countries object[]

Countries is a list of ip addresses with their corresponding country codes.

Array [

code string

Code is the country iso code.

ip string

IP is the ip address.

modified date-time

Modified is the last modified time of this entry.

]

modified date-time

Modified is the last modified time of the cache.

hash int64

ProfileHash represents the profile hash It is allowed to contain up to uint32 numbers, and represented by int64 since mongodb does not support unsigned data types

labels string (string)[]

Labels are the labels associated with the profile.

sshEvents object[]
SSHEvents represents a list SSH events occurred on the host.
Array [
command string
Command is the executed command.
country string
Country represents the SSH client's origin country.
interactive boolean
Interactive indicates whether the process belongs to an interactive session.
ip integer
IP address represents the connection client IP address.
loginTime int64
LoginTime represents the SSH login time.
md5 string
MD5 is the process binary MD5 sum.
modified boolean
Modified indicates the process binary was modified after the container has started.
path string
Path is the process binary path.
ppath string
PPath is the parent process path.
time date-time
Time is the time in which the process was added. If the process was modified, Time is the modification time.
user string
User represents the username that started the process.
]
time date-time

Time is the last time when this profile was modified.

• ]

Example (from schema)

[
  {
    "_id": "string",
    "accountID": "string",
    "apps": [
      {
        "listeningPorts": [
          {
            "command": "string",
            "modified": "2024-07-29T15:51:28.071Z",
            "port": 0,
            "processPath": "string"
          }
        ],
        "name": "string",
        "outgoingPorts": [
          {
            "command": "string",
            "country": "string",
            "ip": "string",
            "modified": "2024-07-29T15:51:28.071Z",
            "port": 0,
            "processPath": "string"
          }
        ],
        "processes": [
          {
            "command": "string",
            "interactive": true,
            "md5": "string",
            "modified": true,
            "path": "string",
            "ppath": "string",
            "time": "2024-07-29T15:51:28.071Z",
            "user": "string"
          }
        ],
        "startupProcess": {
          "command": "string",
          "interactive": true,
          "md5": "string",
          "modified": true,
          "path": "string",
          "ppath": "string",
          "time": "2024-07-29T15:51:28.071Z",
          "user": "string"
        }
      }
    ],
    "collections": [
      "string"
    ],
    "created": "2024-07-29T15:51:28.071Z",
    "geoip": {
      "countries": [
        {
          "code": "string",
          "ip": "string",
          "modified": "2024-07-29T15:51:28.071Z"
        }
      ],
      "modified": "2024-07-29T15:51:28.071Z"
    },
    "hash": 0,
    "labels": [
      "string"
    ],
    "sshEvents": [
      {
        "command": "string",
        "country": "string",
        "interactive": true,
        "ip": 0,
        "loginTime": 0,
        "md5": "string",
        "modified": true,
        "path": "string",
        "ppath": "string",
        "time": "2024-07-29T15:51:28.071Z",
        "user": "string"
      }
    ],
    "time": "2024-07-29T15:51:28.071Z"
  }
]

default

Loading...