Skip to main content

Get Asset

POST 
/uai/v1/asset

Returns detailed information for the asset with the given id.

The data field in the response object contains the raw JSON blob as returned by the source cloud service provider API for the given asset.

Only the rrn parameter in the request body is used for this API. Ignore the timelineItemId and findingType fields.

Ensure to add the required parameters for the asset query parameter with type as follows:

TypeConditionally Required Query Parameters
external_finding
  • findingType
  • riskFactors
alertsalertIds
attack_pathattackPathIds
package_info
  • vulnerabilityInfoTypeId
  • filters
labelsfilters
vulnerability_aggregatesfilters
process_infofilters
vulnerabilities_group_by_type
  • vulnerabilityInfoTypeId
  • filters
asset_cwp_vulns
  • vulnerabilityInfoTypeId
  • vulnerabilityInfoType
  • filters

Request​

Body

required
    assetId stringrequired

    Unified Asset Id or RRN (Restricted Resource Name)

    type stringrequired

    Possible values: [external_finding, asset, asset_lite, alerts, alerts_counts, alert_summary, finding_summary, attack_path, attack_path_summary, raw_config, network, timeline, external_integration, asset_data_indicators, relationships, findings, vulnerabilities, permissions, package_info, labels, vulnerability_aggregates, process_info, vulnerabilities_group_by_type, asset_cwp_vulns, app_contexts, attributes, data_security, data_security_summary]

    Asset Domain Service query type.

    findingType object[]

    External Finding Types

  • Array [
    • oneOf

    string

    Possible values: [COMPLIANCE_CIS, GUARD_DUTY_HOST, GUARD_DUTY_IAM, INSPECTOR_RBA, INSPECTOR_SBP, NETWORK_REACHABILITY, AZURE_SECURITY_CENTER_ALERTS, UNCLASSIFIED, COMMAND_AND_CONTROL, CREDENTIAL_ACCESS, CROSS_ACCOUNT_TRUST, DATA_EXFILTRATION, DEFENSE_EVASION, DISCOVERY, HIGH_PRIVILEGED_ROLE, INITIAL_ACCESS, INTERNET_EXPOSURE, KEYS_AND_SECRETS, LATERAL_MOVEMENT, MALWARE, MFA, MISCONFIGURATION, NETWORK_ANOMALY, PRIVILEGE_ESCALATION, RECONNAISSANCE, RESOURCE_HIJACKING, SSH_BRUTE_FORCE, UNAUTHORIZED_ACCESS, UNENCRYPTED_DATA, UNUSED_PRIVILEGES, USER_ANOMALY, WEAK_PASSWORD, SENSITIVE_DATA_EXPOSURE, INJECTIONS, VULNERABILITY_SCANNING, SHELLSHOCK, KNOWN_BOTS, UNKNOWN_BOTS, VIRTUAL_PATCHES, WEB_ATTACK, BOT_ACTIVITY, WEB_SCRAPING, CUSTOM, VULNERABILITY]

  • ]
    • riskFactors string[]

    Possible values: [CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS]

    External finding risk factors

    timelineItemId string

    Timeline Item ID

    alertIds string[]

    List of Alert Ids

    attackPathIds object[]

    List of Attack Path Ids

  • Array [
    • id string
    type string

    Possible values: [ALERT_ID]

  • ]
    • limit int32

    Limit number of records

    permissionType string

    Permissions Type

    pageToken string

    Next Page Token

    prismaCloudFindingsOnly boolean

    Filter Hyperion Findings

    vulnerabilityInfoTypeId string

    CVE Id, or Package Id or Layer Id. The value needs to be fetched from one of the group by api calls

    vulnerabilityInfoType string

    Possible values: [CVE, PACKAGE, LAYER]

    Supported Vuln Info Types: Package, layer and CVE

    filters object

    Filters applied to CWP Vulns

    offset integer
    nextPageToken string
    limit integer
    search string
    sort string
    reverse boolean
    type string
    path string
    riskFactors string[]
    funnelStage string
    patchable boolean
    vulnerable boolean
    severity string
    packageInUse boolean

Responses​

Successful Operation

Schema
    data object

    Asset Domain Service Object type.

    asset object

    Asset Domain Service Object type.

    problem object[]
  • Array [
    • title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
  • ]
    • id string
    prismaId string
    appName string[]
    externalAssetId string
    assetTypeId int32
    cloudType string

    Possible values: [all, aws, azure, gcp, alibaba_cloud, oci, other, ibm]

    createdTs int64
    insertTs int64
    data object
    dynamicData object
    riskGrade string
    stateId string
    name string
    regionId string
    regionName string
    altAssetId string[]
    url string
    vpcId string
    vpcExternalAssetId string
    vpcName string
    tags object
    relationshipCounts int64
    vulnerabilityCounts object
    accountGroup stringdeprecated

    'accountGroup' is deprecated.

    accountName string
    assetType string
    serviceName string
    resourceType string
    deleted booleanrequired
    assetClassId string
    assetClass string
    attributes object
    property name* object
    packageInfo object
    vulnerabilityAggregates object
    alertsCount object[]
  • Array [
    • severity string
    count int32
  • ]
    • alerts object[]
  • Array [
    • problem object
    title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
    id string
    severity string
    policyId string
    isHyperionPolicy booleanrequired
    policyType string
    policyName string
    policyDescription string
    alertTime int64
  • ]
    • relationships object[]
  • Array [
    • assetId string
    relationshipType string
    assetTypeId int32required
    assetType string
    assetName string
    externalAssetId string
    cloudId string
    cloudName string
    pseudoAsset booleanrequired
    region string
    cloudAccountId string
    assetClassId string
    assetClass string
    alertsCount object[]
  • Array [
    • severity string
    count int32
  • ]
    • alertCountBySeverity object[]
  • Array [
    • severity string
    count int32
  • ]
    • vulnerabilityCounts object
    problem object[]required
  • Array [
    • title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
  • ]
  • ]
    • finding object[]
  • Array [
    • problem object[]
  • Array [
    • title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
  • ]
    • accountId string
    count string
    createdOn int64
    customerId int64
    cveId string
    description string
    externalId integer
    id string
    normalizedName string
    normalizedNames string[]
    nvdUrl string
    link string
    rawData string
    regionId string
    resourceCloudId string
    resourceId int64
    resourceUrl string
    riskFactors string[]

    Possible values: [CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS]

    rlUpdatedOn int64
    scanId string
    score string
    severity string

    Possible values: [informational, low, medium, high, critical, error, warning, info]

    source string

    Possible values: [aws_inspector, aws_guard_duty, tenable, qualys, prisma_cloud, azure_security_center, prismacloud, inspector, guardduty, azuresecuritycenter]

    sourceData object
    status string

    Possible values: [pending, no_error, error, enabled, disabled, open, dismissed, resolved, descoped, risk_scoring_error, active, closed, suppressed]

    title string
    type string
    packageName string
    updatedOn int64
  • ]
    • findings object[]
  • Array [
    • problem object[]
  • Array [
    • title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
  • ]
    • accountId string
    count string
    createdOn int64
    customerId int64
    cveId string
    description string
    externalId integer
    id string
    normalizedName string
    normalizedNames string[]
    nvdUrl string
    link string
    rawData string
    regionId string
    resourceCloudId string
    resourceId int64
    resourceUrl string
    riskFactors string[]

    Possible values: [CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS]

    rlUpdatedOn int64
    scanId string
    score string
    severity string

    Possible values: [informational, low, medium, high, critical, error, warning, info]

    source string

    Possible values: [aws_inspector, aws_guard_duty, tenable, qualys, prisma_cloud, azure_security_center, prismacloud, inspector, guardduty, azuresecuritycenter]

    sourceData object
    status string

    Possible values: [pending, no_error, error, enabled, disabled, open, dismissed, resolved, descoped, risk_scoring_error, active, closed, suppressed]

    title string
    type string
    packageName string
    updatedOn int64
  • ]
    • vulnerabilities object[]
  • Array [
    • problem object[]
  • Array [
    • title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
  • ]
    • accountId string
    count string
    createdOn int64
    customerId int64
    cveId string
    description string
    externalId integer
    id string
    normalizedName string
    normalizedNames string[]
    nvdUrl string
    link string
    rawData string
    regionId string
    resourceCloudId string
    resourceId int64
    resourceUrl string
    riskFactors string[]

    Possible values: [CRITICAL_SEVERITY, HIGH_SEVERITY, MEDIUM_SEVERITY, HAS_FIX, REMOTE_EXECUTION, DOS, RECENT_VULNERABILITY, EXPLOIT_EXISTS, ATTACK_COMPLEXITY_LOW, ATTACK_VECTOR_NETWORK, REACHABLE_FROM_THE_INTERNET, LISTENING_PORTS, CONTAINER_IS_RUNNING_AS_ROOT, NO_MANDATORY_SECURITY_PROFILE_APPLIED, RUNNING_AS_PRIVILEGED_CONTAINER, PACKAGE_IN_USE, DOS_LOW, DOS_HIGH, EXPLOIT_EXISTS_IN_THE_WILD, EXPLOIT_EXISTS_POC, SENSITIVE_INFORMATION, ROOT_MOUNT, RUNTIME_SOCKET, HOST_ACCESS]

    rlUpdatedOn int64
    scanId string
    score string
    severity string

    Possible values: [informational, low, medium, high, critical, error, warning, info]

    source string

    Possible values: [aws_inspector, aws_guard_duty, tenable, qualys, prisma_cloud, azure_security_center, prismacloud, inspector, guardduty, azuresecuritycenter]

    sourceData object
    status string

    Possible values: [pending, no_error, error, enabled, disabled, open, dismissed, resolved, descoped, risk_scoring_error, active, closed, suppressed]

    title string
    type string
    packageName string
    updatedOn int64
  • ]
    • externalIntegration object[]
  • Array [
    • problem object
    title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
    id string
    name string
    firstSeen int64
    lastSeen int64
    rlUpdatedOn int64
    source string
    hasAgent boolean
    tags object[]
  • ]
    • network object[]
  • Array [
    • problem object
    title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
    id int64
    access string
    direction string
    ips string
    ports string
    protocol string
    priority int64
  • ]
    • renderAttribute object
    assetId string
    appName string[]
    allowDrillDown booleanrequired
    hasNetwork booleanrequired
    hasExternalFinding booleanrequired
    hasExternalIntegration booleanrequired
    hasExtFindingRiskFactors booleanrequired
    alertsCount object[]required
  • Array [
    • severity string
    count int32
  • ]
    • findingTypes string[]required
    relatedImages object
    assetCategory string
    dataSecurityServiceProviderId string
    problem object[]required
  • Array [
    • title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
  • ]
    • ipAddresses string[]
    timeline object[]
  • Array [
    • problem object
    title string
    status object
    statusCode int32
    reasonPhrase string
    detail string
    instance uri
    type uri
    parameters object
    property name* object
    id string
    eventName string
    eventType string
    type string

    Possible values: [state_change, event, vulnerability]

    timestamp int64
    alertIds string[]
    firstState boolean
    similarSince int64
    similarStateCount int32
    user string
    vulnerabilities object[]
  • Array [
    • id string
    url string
  • ]
    • previousStateId string
    discoveredTs int64
  • ]
    • trueInternetExposure string
    dataSecurity object
    property name* object
    errors object[]
  • Array [
    • message stringrequired
    path object[]required
    locations object[]required
    extensions object
    errorType string

    Possible values: [UNKNOWN, INTERNAL, NOT_FOUND, UNAUTHENTICATED, PERMISSION_DENIED, BAD_REQUEST, UNAVAILABLE, FAILED_PRECONDITION]

    errorDetail string
    origin stringrequired
    debugInfo objectrequired
    subquery stringrequired
    variables objectrequired
    property name* object
    classification objectrequired
    pathAsString stringrequired
  • ]
Loading...