Skip to main content

Download Deployed Defenders

GET 
/api/v33.01/defenders/download
x-prisma-cloud-target-env: {"permission":"manageDefenders"}

Downloads information about deployed Defenders in CSV format. Use the query parameters to filter what data is returned.

Note: The results contain "hostname" even if you don't specify a "hostname" in the "fields" query parameter.

cURL Request​

Refer to the following example cURL command:

$ curl -k \
  -u <USER> \
  -H 'Content-Type: text/csv' \
  -X GET -o <FILENAME> \
  https://<CONSOLE>/api/v<VERSION>/defenders/download

Request​

Query Parameters

    offset integer

    Offsets the result to a specific report count. Offset starts from 0.

    limit integer

    Limit is the amount to fix.

    sort string

    Sorts the result using a key.

    reverse boolean

    Sorts the result in reverse order.

    hostname string

    Hostname is a name of a specific Defender to retrieve.

    role string[]

    Roles are the defender api.Roles to filter.

    connected boolean

    Indicates whether to return only connected Defenders (true) or disconnected Defenders (false).

    type string[]

    Indicates the Defender types to return (e.g., docker, dockerWindows, cri, etc).

    latest boolean

    Indicates whether to return a list of Defenders that are running the latest version of Prisma Cloud (true) or defenders with older versions (false).

    supportedVersion boolean

    SupportedVersion indicates only Defenders of supported versions should be fetched.

    cluster string[]

    Scopes the query by cluster name.

    tasClusterIDs string[]

    Scopes the query by TAS cluster IDs.

    tasBlobstoreScanner boolean

    Scopes the query by TAS blobstore scanning only Defenders (true) or TAS full coverage Defenders (false).

    tasFoundations string[]

    Scopes the query by TAS foundations.

    usingOldCA boolean

    Scopes the query to defenders which are using old certificate.

    usingExpiredCA boolean

    Scopes the query to defenders which are using expired certificate.

    isARM64 boolean

    Scopes the query by provider type Indicates whether to return only defenders running on ARM64 architecture.

    isVPCObserver boolean

    Indicates whether to return only defenders running as VPC Observer.

Responses​

OK

Loading...