Skip to main content

Get CNNS Host Audit Events

GET 
/api/v33.01/audits/firewall/network/host
x-prisma-cloud-target-env: {"permission":"monitorCNNF"}

Retrieves all Cloud Native Network Segmentation (CNNS) host audits.

For hosts, rules are defined between:

  • Host to host.
  • Host to an external network not protected by Prisma Cloud

cURL Request​

Refer to the following example cURL command:

$ curl -k \
  -u <USER> \
  -H 'Content-Type: application/json' \
  -X GET \
  "https://<CONSOLE>/api/v<VERSION>/audits/firewall/network/host"

cURL Response​

{
   "_id": "john-photon-v3-0811t165011-host-def-pre-lngcon230",
   "time": "2022-11-08T20:22:52.207Z",
   "total": 4,
   "resource": {
     "hosts": [
       "john-cen8-cons-dock-0811t160649-cons-ssugandh-lngcon230.c.twistlock-test-247119.internal",
       "john-photon-v3-0811t165011-host-def-pre-lngcon230"
     ],
     "accountIDs": [
       "twistlock-test-247119"
     ]
   },
   "collections": [
     "All",
     "registry_scan_container_cen8-container_22_11_384_piu",
     "photon-v3-host_crn",
     "compliance_photon_etz",
     "cnnf_cen8_client_itu",
     "cnnf_photon_server_fsr"
   ],
   "audits": {
     "unexpectedConnection": {
       "count": 4,
       "audits": [
         {
           "ruleID": 15,
           "time": "2022-11-08T20:22:52.207Z",
           "type": "unexpectedConnection",
           "srcHostname": "john-cen8-cons-dock-0811t160649-cons-ssugandh-lngcon230.c.twistlock-test-247119.internal",
           "dstHostname": "john-photon-v3-0811t165011-host-def-pre-lngcon230",
           "dstPort": 80,
           "block": false,
           "count": 1,
           "accountID": "twistlock-test-247119"
         },
         {
           "ruleID": 15,
           "time": "2022-11-08T20:22:48.175Z",
           "type": "unexpectedConnection",
           "srcHostname": "john-cen8-cons-dock-0811t160649-cons-ssugandh-lngcon230.c.twistlock-test-247119.internal",
           "dstHostname": "john-photon-v3-0811t165011-host-def-pre-lngcon230",
           "dstPort": 80,
           "block": false,
           "count": 1,
           "accountID": "twistlock-test-247119"
         },
         {
           "ruleID": 15,
           "time": "2022-11-08T20:22:46.127Z",
           "type": "unexpectedConnection",
           "srcHostname": "john-cen8-cons-dock-0811t160649-cons-ssugandh-lngcon230.c.twistlock-test-247119.internal",
           "dstHostname": "john-photon-v3-0811t165011-host-def-pre-lngcon230",
           "dstPort": 80,
           "block": false,
           "count": 1,
           "accountID": "twistlock-test-247119"
         },
         {
           "ruleID": 15,
           "time": "2022-11-08T20:22:45.122Z",
           "type": "unexpectedConnection",
           "srcHostname": "john-cen8-cons-dock-0811t160649-cons-ssugandh-lngcon230.c.twistlock-test-247119.internal",
           "dstHostname": "john-photon-v3-0811t165011-host-def-pre-lngcon230",
           "dstPort": 80,
           "block": false,
           "count": 1,
           "accountID": "twistlock-test-247119"
         }
       ]
     }
   }
 }

Request​

Query Parameters

    offset integer

    Offsets the result to a specific report count. Offset starts from 0.

    limit integer

    Limit is the amount to fix.

    sort string

    Sorts the result using a key.

    reverse boolean

    Sorts the result in reverse order.

    from date-time

    From is an optional minimum time constraints for the audits.

    to date-time

    To is an optional maximum time constraints for the audits.

    srcHostnames string[]

    SrcHostname are the source hostnames filter.

    dstHostnames string[]

    DstHostname are the destination hostnames filter.

Responses​

Schema
  • Array [
    • _id string

    ProfileID is the runtime profile ID.

    audits object

    Audits is a map from the audit sub-type to the audit events list.

    property name* shared.HostNetworkFirewallSubtypeAudits

    HostNetworkFirewallSubtypeAudits represents the host network firewall sub type audits per profile

    audits object[]

    Audits are the host network firewall audits associated with the sub-type, limited to the determined capacity.

  • Array [
    • accountID string

    AccountID is the host account ID.

    block boolean

    Block indicates whether the connection was blocked.

    cluster string

    Cluster is the cluster from which the audit originated.

    count integer

    Count is the event occurrences count.

    dstHostname string

    DstHostname is the destination hostname.

    dstPort integer

    DstPort is the connection destination port.

    dstSubnet string

    DstSubnet is the destination subnet.

    msg string

    Message is the event message.

    ruleID cnnf.RuleID (integer)

    RuleID represents the ID of each container network firewall policy rule

    srcHash int64

    ProfileHash represents the profile hash It is allowed to contain up to uint32 numbers, and represented by int64 since mongodb does not support unsigned data types

    srcHostname string

    SrcHostname is the source hostname.

    srcSubnet string

    SrcSubnet is the source subnet.

    time date-time

    Time is the UTC time of the audit event.

    type cnnf.NetworkFirewallAttackType (string)

    Possible values: [unexpectedConnection]

    NetworkFirewallAttackType is the network firewall type of attack

  • ]
    • count integer

    Count is the total count of the sub-type audits.

    cluster string

    Cluster is the cluster from which the audit originated.

    collections string (string)[]

    Collections are collections to which this audit applies.

    imageName string

    ImageName is the container image name.

    label string

    Label represents the container deployment label.

    os string

    OS is the operating system distribution.

    resource object

    RuntimeResource represents on which resource in the system a rule applies (e.g., specific host or image) Empty resource or wildcard (*) represents all resources of a given type

    accountIDs string (string)[]

    List of account IDs.

    appIDs string (string)[]

    List of application IDs.

    clusters string (string)[]

    List of Kubernetes cluster names.

    containers string (string)[]

    List of containers.

    functions string (string)[]

    List of functions.

    hosts string (string)[]

    List of hosts.

    images string (string)[]

    List of images.

    labels string (string)[]

    List of labels.

    namespaces string (string)[]

    List of Kubernetes namespaces.

    time date-time

    Time is the UTC time of the last audit event.

    total integer

    Total is the total count of audits per runtime profile.

  • ]
Loading...