Get CNNS Container Audit Events
Retrieves all Cloud Native Network Segmentation (CNNS) container audit events.
For more information, see the Cloud Native Network Segmentation (CNNS)
For containers, rules are defined between:
- Image to image.
- Image to an external network not protected by Prisma Cloud.
- Image to DNS domain.
Refer to the following example cURL command:
$ curl -k \
-u <USER> \
-H 'Content-Type: application/json' \
-X GET \
"msg": "Unexpected connection to ip 127.0.0.1"
- offset integer
Offsets the result to a specific report count. Offset starts from 0.
- limit integer
Number of reports to retrieve in a page. For PCCE, the maximum limit is 250. For PCEE, the maximum limit is 50. The default value is 50.
- search string
Retrieves the result for a search term.
- sort string
Sorts the result using a key. Refer to the columns in the relevant Prisma Cloud Compute user interface to use them as sort keys.
- reverse boolean
Sorts the result in reverse order.
- collections string
Filters the result based on collection names that you have defined in Prisma Cloud Compute.
- provider string
Scopes the query by cloud provider.
- accountIDs string
Filters the result based on cloud account IDs.
- resourceIDs string
Scopes the query by resource ID.
- region string
Scopes the query by cloud region.
- fields string
Retrieves the fields that you need in a report. Use the list of fields you want to retrieve. By default, the result shows all fields of data.
- from date-time
From is an optional minimum time constraints for the audits.
- to date-time
To is an optional maximum time constraints for the audits.
- srcImageName string
SrcImages are the source images filter.
- dstImageName string
DstImages are the destination images filter.
- block string
Block is the block/audit filter.
- Example (from schema)
- Array [
- _id string
ProfileID is the runtime profile ID.
Audits is a map from the audit sub-type to the audit events list.
property name* object (shared.ContainerNetworkFirewallSubtypeAudits)
ContainerNetworkFirewallSubtypeAudits represents the container network firewall sub type audits per profile
Audits are the container network firewall audits associated with the sub-type, limited to the determined capacity.Array [block boolean
Block indicates whether the connection was blocked.count integer
Count is the event occurrences count.dstContainerName string
DstContainerName is the destination container name.dstDomain string
DstDomain is the destination domain that was queried.dstImageName string
DstImage is the destination image name.dstPort integer
DstPort is the connection destination port.dstProfileHash int64
ProfileHash represents the profile hash It is allowed to contain up to uint32 numbers, and represented by int64 since mongodb does not support unsigned data typesdstProfileID string
DstProfileID is the destination profile ID.dstSubnet string
DstSubnet is the destination subnet.
Labels are the custom labels associated with the target container.
property name*stringmsg string
Message is the event message.ruleID cnnf.RuleID
RuleID represents the ID of each container network firewall policy rulesrcContainerName string
SrcContainerName is the source container name.srcImageName string
SrcImage is the source image name.srcProfileHash int64
ProfileHash represents the profile hash It is allowed to contain up to uint32 numbers, and represented by int64 since mongodb does not support unsigned data typessrcProfileID string
SrcProfileID is the source profile ID.time date-time
Time is the UTC time of the audit event.type cnnf.NetworkFirewallAttackType
Possible values: [
NetworkFirewallAttackType is the network firewall type of attack]count integer
Count is the total count of the sub-type audits.
- cluster string
Cluster is the cluster from which the audit originated.
- collections string
Collections are collections to which this audit applies.
- imageName string
ImageName is the container image name.
- label string
Label represents the container deployment label.
- os string
OS is the operating system distribution.
RuntimeResource represents on which resource in the system a rule applies (e.g., specific host or image) Empty resource or wildcard (*) represents all resources of a given typeaccountIDs string
List of account IDs.appIDs string
List of application IDs.clusters string
List of Kubernetes cluster names.codeRepos string
List of code repositories.containers string
List of containers.functions string
List of functions.hosts string
List of hosts.images string
List of images.labels string
List of labels.namespaces string
List of Kubernetes namespaces.
- time date-time
Time is the UTC time of the last audit event.
- total integer
Total is the total count of audits per runtime profile.