Resolve Hosts

POST 
/api/v33.01/hosts/evaluate

x-prisma-cloud-target-env: {"permission":"monitorCI"}

Adds vulnerability data for the given host.

Request

application/json

Body

images object[]
Images is the list of image to resolve.
Array [
Secrets string (string)[]
Secrets are paths to embedded secrets inside the image Note: capital letter JSON annotation is kept to avoid converting all images for backward-compatibility support.
_id string
Image identifier (image ID or repo:tag).
agentless boolean
Agentless indicates that the host was scanned with the agentless scanner.
aisUUID string
AISUUID is the unique instance ID in the agentless instance scanning system.
allCompliance object
AllCompliance contains data regarding passed compliance checks
compliance object[]
Compliance are all the passed compliance checks.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
enabled boolean
Enabled indicates whether passed compliance checks is enabled by policy.
appEmbedded boolean
Indicates that this image was scanned by an App-Embedded Defender.
applications object[]
Products in the image.
Array [
installedFromPackage boolean
Indicates that the app was installed as an OS package.
knownVulnerabilities integer
Total number of vulnerabilities for this application.
layerTime int64
Image layer to which the application belongs - layer creation time.
name string
Name of the application.
originPackageName string
OriginPackageName is the name of the app origin package.
path string
Path of the detected application.
service boolean
Service indicates whether the application is installed as a service.
version string
Version of the application.
]
baseImage string
Image’s base image name. Used when filtering the vulnerabilities by base images.
binaries object[]
Binaries in the image.
Array [
altered boolean
Indicates if the binary was installed from a package manager and modified/replaced (true) or not (false).
cveCount integer
Total number of CVEs for this specific binary.
deps string (string)[]
Third-party package files which are used by the binary.
fileMode integer
Represents the file's mode and permission bits.
functionLayer string
ID of the serverless layer in which the package was discovered.
md5 string
Md5 hashset of the binary.
missingPkg boolean
Indicates if this binary is not related to any package (true) or not (false).
name string
Name of the binary.
path string
Path is the path of the binary.
pkgRootDir string
Path for searching packages used by the binary.
services string (string)[]
Names of services which use the binary.
version string
Version of the binary.
]
cloudMetadata object
CloudMetadata is the metadata for a cloud provider managed asset (e.g., as part of AWS/GCP/Azure/OCI)
accountID string
Cloud account ID.
awsExecutionEnv string
AWS execution environment (e.g. EC2/Fargate).
image string
The name of the image the cloud managed host or container is based on.
labels object[]
Cloud provider metadata labels.
Array [
key string
Label key.
sourceName string
Source name (e.g., for a namespace, the source name can be 'twistlock').
sourceType common.ExternalLabelSourceType (string)
Possible values: [namespace,deployment,aws,azure,gcp,oci]
ExternalLabelSourceType indicates the source of the labels
timestamp date-time
Time when the label was fetched.
value string
Value of the label.
]
name string
Resource name.
provider common.CloudProvider (string)
Possible values: [aws,azure,gcp,alibaba,oci,others]
CloudProvider specifies the cloud provider name
region string
Resource's region.
resourceID string
Unique ID of the resource.
resourceURL string
Server-defined URL for the resource.
type string
Instance type.
vmID string
Azure unique vm ID.
vmImageID string
VMImageID holds the VM instance's image ID.
clusterType common.ClusterType (string)
Possible values: [AKS,ECS,EKS,GKE,Kubernetes]
ClusterType is the cluster type
clusters string (string)[]
Cluster names.
collections string (string)[]
Collections to which this result applies.
complianceDistribution object
Distribution counts the number of vulnerabilities per type
critical integer
.
high integer
.
low integer
.
medium integer
.
total integer
.
complianceIssues object[]
All the compliance issues.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
complianceIssuesCount integer
Number of compliance issues.
complianceRiskScore float
Compliance risk score for the image.
compressed boolean
Compressed indicates if this image seems to be compressed - currently only relevant for buildah images.
compressedLayerTimes object
CompressedLayerTimes represent the compressed layer times of the image apps and pkgs
appTimes int64[]
.
pkgsTimes object[]
.
Array [
pkgTimes int64[]
.
pkgsType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
]
creationTime date-time
Specifies the time of creation for the latest version of the image.
csa boolean
CSA indicates the scan was performed by the CSA.
distro string
Full name of the distribution.
ecsClusterName string
ECS cluster name.
err string
Description of an error that occurred during image scan.
errCode agentless.ImageScanResultErrCode (integer)
ImageScanResultErrCode represents the asset status error
externalLabels object[]
Kubernetes external labels of all containers running this image.
Array [
key string
Label key.
sourceName string
Source name (e.g., for a namespace, the source name can be 'twistlock').
sourceType common.ExternalLabelSourceType (string)
Possible values: [namespace,deployment,aws,azure,gcp,oci]
ExternalLabelSourceType indicates the source of the labels
timestamp date-time
Time when the label was fetched.
value string
Value of the label.
]
files object[]
Files in the container.
Array [
md5 string
Hash sum of the file using md5.
path string
Path of the file.
sha1 string
Hash sum of the file using SHA-1.
sha256 string
Hash sum of the file using SHA256.
]
firewallProtection object
ProtectionStatus describes the status of the WAAS protection
enabled boolean
Enabled indicates if WAAS proxy protection is enabled (true) or not (false).
outOfBandMode waas.OutOfBandMode (string)
Possible values: [,Observation,Protection]
OutOfBandMode holds the app firewall out-of-band mode
ports int (integer)[]
Ports indicates http open ports associated with the container.
supported boolean
Supported indicates if WAAS protection is supported (true) or not (false).
tlsPorts int (integer)[]
TLSPorts indicates https open ports associated with the container.
unprotectedProcesses object[]
UnprotectedProcesses holds the processes that support HTTP/HTTPS without WAAS protection.
Array [
port integer
Port is the process port.
process string
Process is the process name.
tls boolean
TLS is the port TLS indication.
]
firstScanTime date-time
Specifies the time of the scan for the first version of the image. This time is preserved even after the version update.
foundSecrets object[]
FoundSecrets are secrets with metadata that were found in the secrets' scan. Requires json tag for reporting secrets from image scan.
Array [
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
]
history object[]
Docker image history.
Array [
baseLayer boolean
Indicates if this layer originated from the base image (true) or not (false).
created int64
Date/time when the image layer was created.
emptyLayer boolean
Indicates if this instruction didn't create a separate layer (true) or not (false).
id string
ID of the layer.
instruction string
Docker file instruction and arguments used to create this layer.
sizeBytes int64
Size of the layer (in bytes).
tags string (string)[]
Holds the image tags.
vulnerabilities object[]
Vulnerabilities which originated from this layer.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
]
hostDevices object[]
Map from host network device name to IP address.
Array [
ip string
Network device IPv4 address.
name string
Network device name.
]
hostRuntimeEnabled boolean
HostRuntimeEnabled indicates if any runtime rule applies to the host.
hostname string
Name of the host that was scanned.
hosts object
ImageHosts is a fast index for image scan results metadata per host
property name* shared.ImageHost
ImageHost holds information about image scan result per host
accountID string
AccountID is the cloud account ID the image is associated with.
agentless boolean
Agentless indicates if the image was scanned as part of an agentless scan.
agentlessScanID integer
AgentlessScanID is the ID of the agentless scan in which the result was received.
ais boolean
AIS indicates the scan was performed by AIS.
appEmbedded boolean
AppEmbedded indicates if the host is an app embedded host.
cluster string
Cluster is the cluster on which the image is deployed.
csa boolean
CSA indicates if the image was scanned by CSA.
modified date-time
Modified is the last scan time.
namespaces string (string)[]
Namespaces are the namespaces on which the image is deployed.
id string
Image ID.
image object
Image represents a container image
created date-time
Date/time when the image was created.
entrypoint string (string)[]
Combined entrypoint of the image (entrypoint + CMD).
env string (string)[]
Image environment variables.
healthcheck boolean
Indicates if health checks are enabled (true) or not (false).
history object[]
Holds the image history.
Array [
baseLayer boolean
Indicates if this layer originated from the base image (true) or not (false).
created int64
Date/time when the image layer was created.
emptyLayer boolean
Indicates if this instruction didn't create a separate layer (true) or not (false).
id string
ID of the layer.
instruction string
Docker file instruction and arguments used to create this layer.
sizeBytes int64
Size of the layer (in bytes).
tags string (string)[]
Holds the image tags.
vulnerabilities object[]
Vulnerabilities which originated from this layer.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
]
id string
ID of the image.
labels object
Image labels.
property name* string (string)
layers string (string)[]
Image filesystem layers.
os string
Image os type.
repoDigest string (string)[]
Image repo digests.
repoTags string (string)[]
Image repo tags.
user string
Image user.
workingDir string
Base working directory of the image.
installedProducts object
InstalledProducts contains data regarding products running in environment TODO #34713: Swarm support was deprecated in Joule, remove swarm node/manager boolean (and related compliance) in Lagrange
agentless boolean
Agentless indicates whether the scan was performed with agentless approach.
apache string
Apache indicates the apache server version, empty in case apache not running.
awsCloud boolean
AWSCloud indicates whether AWS cloud is used.
clusterType common.ClusterType (string)
Possible values: [AKS,ECS,EKS,GKE,Kubernetes]
ClusterType is the cluster type
crio boolean
CRI indicates whether the container runtime is CRI (and not docker).
docker string
Docker represents the docker daemon version.
dockerEnterprise boolean
DockerEnterprise indicates whether the enterprise version of Docker is installed.
hasPackageManager boolean
HasPackageManager indicates whether package manager is installed on the OS.
k8sApiServer boolean
K8sAPIServer indicates whether a kubernetes API server is running.
k8sControllerManager boolean
K8sControllerManager indicates whether a kubernetes controller manager is running.
k8sEtcd boolean
K8sEtcd indicates whether etcd is running.
k8sFederationApiServer boolean
K8sFederationAPIServer indicates whether a federation API server is running.
k8sFederationControllerManager boolean
K8sFederationControllerManager indicates whether a federation controller manager is running.
k8sKubelet boolean
K8sKubelet indicates whether kubelet is running.
k8sProxy boolean
K8sProxy indicates whether a kubernetes proxy is running.
k8sScheduler boolean
K8sScheduler indicates whether the kubernetes scheduler is running.
kubernetes string
Kubernetes represents the kubernetes version.
managedClusterVersion string
ManagedClusterVersion is the version of the managed Kubernetes service, e.g. AKS/EKS/GKE/etc.
openshift boolean
Openshift indicates whether openshift is deployed.
openshiftVersion string
OpenshiftVersion represents the running openshift version.
osDistro string
OSDistro specifies the os distribution.
serverless boolean
Serverless indicates whether evaluated on a serverless environment.
swarmManager boolean
SwarmManager indicates whether a swarm manager is running.
swarmNode boolean
SwarmNode indicates whether the node is part of an active swarm.
instances object[]
Details about each occurrence of the image (tag + host).
Array [
host string
.
image string
.
modified date-time
.
registry string
.
repo string
.
tag string
.
]
isARM64 boolean
IsARM64 indicates if the architecture of the image is aarch64.
k8sClusterAddr string
Endpoint of the Kubernetes API server.
labels string (string)[]
Image labels.
layers string (string)[]
Image's filesystem layers. Each layer is a SHA256 digest of the filesystem diff See: https://windsock.io/explaining-docker-image-ids/.
malwareAnalyzedTime date-time
MalwareAnalyzedTime is the WildFire evaluator analyzing time shown as progress in UI and cannot to be overwritten by a new scan result.
missingDistroVulnCoverage boolean
Indicates if the image OS is covered in the IS (true) or not (false).
namespaces string (string)[]
k8s namespaces of all the containers running this image.
osDistro string
Name of the OS distribution.
osDistroRelease string
OS distribution release.
osDistroVersion string
OS distribution version.
packageManager boolean
Indicates if the package manager is installed for the OS.
packages object[]
Packages which exist in the image.
Array [
pkgs object[]
List of packages.
Array [
author string
Author is the package's author.
binaryIdx int16 (integer)[]
Indexes of the top binaries which use the package.
binaryPkgs string (string)[]
Names of the distro binary packages (packages which are built on the source of the package).
cveCount integer
Total number of CVEs for this specific package.
defaultGem boolean
DefaultGem indicates this is a gem default package (and not a bundled package).
files object[]
List of package-related files and their hashes. Only included when the appropriate scan option is set.
Array [
md5 string
Hash sum of the file using md5.
path string
Path of the file.
sha1 string
Hash sum of the file using SHA-1.
sha256 string
Hash sum of the file using SHA256.
]
functionLayer string
ID of the serverless layer in which the package was discovered.
goPkg boolean
GoPkg indicates this is a Go package (and not module).
jarIdentifier string
JarIdentifier holds an additional identification detail of a JAR package.
layerTime int64
Image layer to which the package belongs (layer creation time).
license string
License information for the package.
name string
Name of the package.
originPackageName string
OriginPackageName is the name of the third-party origin package.
osPackage boolean
OSPackage indicates that a python/java package was installed as an OS package.
path string
Full package path (e.g., JAR or Node.js package path).
purl string
PURL is a package URL identifier for this package.
securityRepoPkg boolean
SecurityRepoPkg determines if this package is available in a security repository.
symbols string (string)[]
Symbols contains names of vulnerable functions that are linked in the executable binary, empty if the entire package is vulnerable.
version string
Package version.
]
pkgsType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
]
pullDuration int64
PullDuration is the time it took to pull the image.
pushTime date-time
PushTime is the image push time to the registry.
redHatNonRPMImage boolean
RedHatNonRPMImage indicates whether the image is a Red Hat image with non-RPM content.
registryNamespace string
IBM cloud namespace to which the image belongs.
registryTags string (string)[]
RegistryTags are the tags of the registry this image is stored.
registryType string
RegistryType indicates the registry type where the image is stored.
repoDigests string (string)[]
Digests of the image. Used for content trust (notary). Has one digest per tag.
repoTag object
ImageTag represents an image repository and its associated tag or registry digest
digest string
Image digest (requires V2 or later registry).
id string
ID of the image.
registry string
Registry name to which the image belongs.
repo string
Repository name to which the image belongs.
tag string
Image tag.
rhelRepos string (string)[]
RhelRepositories are the (RPM) repositories IDs from which the packages in this image were installed Used for matching vulnerabilities by Red Hat CPEs.
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
scanBuildDate string
Scanner build date that published the image.
scanDuration int64
ScanDuration is the total time it took to scan the image.
scanID integer
ScanID is the ID of the scan.
scanTime date-time
Specifies the time of the last scan of the image.
scanVersion string
Scanner version that published the image.
secretScanMetrics object
SecretScanMetrics represents metrics collected during secret scan
failedScans int64
FailedScans represents number of failed scans caused by scanner errors.
foundSecrets integer
FoundSecrets represents number of detected secrets.
scanTime int64
ScanTime represents cumulative secret scan time in microseconds.
scanTimeouts int64
ScanTimeouts represents number of failed scans caused by timeout.
scannedFileSize int64
ScannedFileSize represents accumulated size of scanned files.
scannedFiles int64
ScannedFiles represents number of text files scanned for secrets.
totalBytes int64
TotalBytes represents accumulated file size.
totalFiles int64
TotalFiles represents number of files read for secrets.
totalTime int64
TotalTime represents the total time in microseconds.
typesCount object
TypesCount represents distribution of secrets by its type.
property name* int (integer)
startupBinaries object[]
Binaries which are expected to run when the container is created from this image.
Array [
altered boolean
Indicates if the binary was installed from a package manager and modified/replaced (true) or not (false).
cveCount integer
Total number of CVEs for this specific binary.
deps string (string)[]
Third-party package files which are used by the binary.
fileMode integer
Represents the file's mode and permission bits.
functionLayer string
ID of the serverless layer in which the package was discovered.
md5 string
Md5 hashset of the binary.
missingPkg boolean
Indicates if this binary is not related to any package (true) or not (false).
name string
Name of the binary.
path string
Path is the path of the binary.
pkgRootDir string
Path for searching packages used by the binary.
services string (string)[]
Names of services which use the binary.
version string
Version of the binary.
]
stopped boolean
Stopped indicates whether the host was running during the agentless scan.
tags object[]
Tags associated with the given image.
Array [
digest string
Image digest (requires V2 or later registry).
id string
ID of the image.
registry string
Registry name to which the image belongs.
repo string
Repository name to which the image belongs.
tag string
Image tag.
]
topLayer string
SHA256 of the image's last layer that is the last element of the Layers field.
trustResult object
ImageResult represents an aggregated image trust result
groups object[]
Trust groups which apply to the image.
Array [
_id string
Name of the group.
disabled boolean
Indicates whether the rule is currently disabled. Values: true (disabled) or false (enabled).
images string (string)[]
Image names or IDs (e.g., docker.io/library/ubuntu:16.04 / SHA264@...).
layers string (string)[]
Filesystem layers. The image is trusted if its layers have a prefix of the trusted groups layer in the same order.
modified date-time
Specifies the date and time when the rule was last modified.
name string
Name of the rule.
notes string
Describes any noteworthy points for a rule. You can include any text.
owner string
User who created or last modified the rule.
previousName string
Previous name of the rule. Required for rule renaming.
]
hostsStatuses object[]
Image trust status on each host. Can be set to "trusted" or "untrusted".
Array [
host string
Host name.
status trust.Status (string)
Possible values: [trusted,untrusted]
Status is the trust status for an image
]
trustStatus trust.Status (string)
Possible values: [trusted,untrusted]
Status is the trust status for an image
twistlockImage boolean
Indicates if the image is a Twistlock image (true) or not (false).
type shared.ScanType (string)
Possible values: [image,ciImage,container,host,agentlessHost,registry,serverlessScan,ciServerless,vm,tas,ciTas,cloudDiscovery,serverlessRadar,serverlessAutoDeploy,hostAutoDeploy,codeRepo,ciCodeRepo]
ScanType displays the components for an ongoing scan
underlyingDistro string
UnderlyingDistro is used in cases OS an OS is built on top of another, and we need to know both.
underlyingDistroRelease string
UnderlyingDistroRelease is used in cases OS an OS is built on top of another, and we need to know both.
vulnerabilities object[]
CVE vulnerabilities of the image.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
vulnerabilitiesCount integer
Total number of vulnerabilities.
vulnerabilityDistribution object
Distribution counts the number of vulnerabilities per type
critical integer
.
high integer
.
low integer
.
medium integer
.
total integer
.
vulnerabilityRiskScore float
Image's CVE risk score.
wildFireUsage object
Usage holds wildfire usage stats, period for the usage varies with context
bytes int64
Bytes is the total number of bytes uploaded to the WildFire API.
queries int64
Queries is the number of queries to the WildFire API.
uploads int64
Uploads is the number of uploads to the WildFire API.
]

Responses

200

ResolveImagesResp represents the images resolution API output

application/json

Schema

Schema

images object[]
Images is the list of images that were resolved.
Array [
Secrets string (string)[]
Secrets are paths to embedded secrets inside the image Note: capital letter JSON annotation is kept to avoid converting all images for backward-compatibility support.
_id string
Image identifier (image ID or repo:tag).
agentless boolean
Agentless indicates that the host was scanned with the agentless scanner.
aisUUID string
AISUUID is the unique instance ID in the agentless instance scanning system.
allCompliance object
AllCompliance contains data regarding passed compliance checks
compliance object[]
Compliance are all the passed compliance checks.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
enabled boolean
Enabled indicates whether passed compliance checks is enabled by policy.
appEmbedded boolean
Indicates that this image was scanned by an App-Embedded Defender.
applications object[]
Products in the image.
Array [
installedFromPackage boolean
Indicates that the app was installed as an OS package.
knownVulnerabilities integer
Total number of vulnerabilities for this application.
layerTime int64
Image layer to which the application belongs - layer creation time.
name string
Name of the application.
originPackageName string
OriginPackageName is the name of the app origin package.
path string
Path of the detected application.
service boolean
Service indicates whether the application is installed as a service.
version string
Version of the application.
]
baseImage string
Image’s base image name. Used when filtering the vulnerabilities by base images.
binaries object[]
Binaries in the image.
Array [
altered boolean
Indicates if the binary was installed from a package manager and modified/replaced (true) or not (false).
cveCount integer
Total number of CVEs for this specific binary.
deps string (string)[]
Third-party package files which are used by the binary.
fileMode integer
Represents the file's mode and permission bits.
functionLayer string
ID of the serverless layer in which the package was discovered.
md5 string
Md5 hashset of the binary.
missingPkg boolean
Indicates if this binary is not related to any package (true) or not (false).
name string
Name of the binary.
path string
Path is the path of the binary.
pkgRootDir string
Path for searching packages used by the binary.
services string (string)[]
Names of services which use the binary.
version string
Version of the binary.
]
cloudMetadata object
CloudMetadata is the metadata for a cloud provider managed asset (e.g., as part of AWS/GCP/Azure/OCI)
accountID string
Cloud account ID.
awsExecutionEnv string
AWS execution environment (e.g. EC2/Fargate).
image string
The name of the image the cloud managed host or container is based on.
labels object[]
Cloud provider metadata labels.
Array [
key string
Label key.
sourceName string
Source name (e.g., for a namespace, the source name can be 'twistlock').
sourceType common.ExternalLabelSourceType (string)
Possible values: [namespace,deployment,aws,azure,gcp,oci]
ExternalLabelSourceType indicates the source of the labels
timestamp date-time
Time when the label was fetched.
value string
Value of the label.
]
name string
Resource name.
provider common.CloudProvider (string)
Possible values: [aws,azure,gcp,alibaba,oci,others]
CloudProvider specifies the cloud provider name
region string
Resource's region.
resourceID string
Unique ID of the resource.
resourceURL string
Server-defined URL for the resource.
type string
Instance type.
vmID string
Azure unique vm ID.
vmImageID string
VMImageID holds the VM instance's image ID.
clusterType common.ClusterType (string)
Possible values: [AKS,ECS,EKS,GKE,Kubernetes]
ClusterType is the cluster type
clusters string (string)[]
Cluster names.
collections string (string)[]
Collections to which this result applies.
complianceDistribution object
Distribution counts the number of vulnerabilities per type
critical integer
.
high integer
.
low integer
.
medium integer
.
total integer
.
complianceIssues object[]
All the compliance issues.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
complianceIssuesCount integer
Number of compliance issues.
complianceRiskScore float
Compliance risk score for the image.
compressed boolean
Compressed indicates if this image seems to be compressed - currently only relevant for buildah images.
compressedLayerTimes object
CompressedLayerTimes represent the compressed layer times of the image apps and pkgs
appTimes int64[]
.
pkgsTimes object[]
.
Array [
pkgTimes int64[]
.
pkgsType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
]
creationTime date-time
Specifies the time of creation for the latest version of the image.
csa boolean
CSA indicates the scan was performed by the CSA.
distro string
Full name of the distribution.
ecsClusterName string
ECS cluster name.
err string
Description of an error that occurred during image scan.
errCode agentless.ImageScanResultErrCode (integer)
ImageScanResultErrCode represents the asset status error
externalLabels object[]
Kubernetes external labels of all containers running this image.
Array [
key string
Label key.
sourceName string
Source name (e.g., for a namespace, the source name can be 'twistlock').
sourceType common.ExternalLabelSourceType (string)
Possible values: [namespace,deployment,aws,azure,gcp,oci]
ExternalLabelSourceType indicates the source of the labels
timestamp date-time
Time when the label was fetched.
value string
Value of the label.
]
files object[]
Files in the container.
Array [
md5 string
Hash sum of the file using md5.
path string
Path of the file.
sha1 string
Hash sum of the file using SHA-1.
sha256 string
Hash sum of the file using SHA256.
]
firewallProtection object
ProtectionStatus describes the status of the WAAS protection
enabled boolean
Enabled indicates if WAAS proxy protection is enabled (true) or not (false).
outOfBandMode waas.OutOfBandMode (string)
Possible values: [,Observation,Protection]
OutOfBandMode holds the app firewall out-of-band mode
ports int (integer)[]
Ports indicates http open ports associated with the container.
supported boolean
Supported indicates if WAAS protection is supported (true) or not (false).
tlsPorts int (integer)[]
TLSPorts indicates https open ports associated with the container.
unprotectedProcesses object[]
UnprotectedProcesses holds the processes that support HTTP/HTTPS without WAAS protection.
Array [
port integer
Port is the process port.
process string
Process is the process name.
tls boolean
TLS is the port TLS indication.
]
firstScanTime date-time
Specifies the time of the scan for the first version of the image. This time is preserved even after the version update.
foundSecrets object[]
FoundSecrets are secrets with metadata that were found in the secrets' scan. Requires json tag for reporting secrets from image scan.
Array [
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
]
history object[]
Docker image history.
Array [
baseLayer boolean
Indicates if this layer originated from the base image (true) or not (false).
created int64
Date/time when the image layer was created.
emptyLayer boolean
Indicates if this instruction didn't create a separate layer (true) or not (false).
id string
ID of the layer.
instruction string
Docker file instruction and arguments used to create this layer.
sizeBytes int64
Size of the layer (in bytes).
tags string (string)[]
Holds the image tags.
vulnerabilities object[]
Vulnerabilities which originated from this layer.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
]
hostDevices object[]
Map from host network device name to IP address.
Array [
ip string
Network device IPv4 address.
name string
Network device name.
]
hostRuntimeEnabled boolean
HostRuntimeEnabled indicates if any runtime rule applies to the host.
hostname string
Name of the host that was scanned.
hosts object
ImageHosts is a fast index for image scan results metadata per host
property name* shared.ImageHost
ImageHost holds information about image scan result per host
accountID string
AccountID is the cloud account ID the image is associated with.
agentless boolean
Agentless indicates if the image was scanned as part of an agentless scan.
agentlessScanID integer
AgentlessScanID is the ID of the agentless scan in which the result was received.
ais boolean
AIS indicates the scan was performed by AIS.
appEmbedded boolean
AppEmbedded indicates if the host is an app embedded host.
cluster string
Cluster is the cluster on which the image is deployed.
csa boolean
CSA indicates if the image was scanned by CSA.
modified date-time
Modified is the last scan time.
namespaces string (string)[]
Namespaces are the namespaces on which the image is deployed.
id string
Image ID.
image object
Image represents a container image
created date-time
Date/time when the image was created.
entrypoint string (string)[]
Combined entrypoint of the image (entrypoint + CMD).
env string (string)[]
Image environment variables.
healthcheck boolean
Indicates if health checks are enabled (true) or not (false).
history object[]
Holds the image history.
Array [
baseLayer boolean
Indicates if this layer originated from the base image (true) or not (false).
created int64
Date/time when the image layer was created.
emptyLayer boolean
Indicates if this instruction didn't create a separate layer (true) or not (false).
id string
ID of the layer.
instruction string
Docker file instruction and arguments used to create this layer.
sizeBytes int64
Size of the layer (in bytes).
tags string (string)[]
Holds the image tags.
vulnerabilities object[]
Vulnerabilities which originated from this layer.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
]
id string
ID of the image.
labels object
Image labels.
property name* string (string)
layers string (string)[]
Image filesystem layers.
os string
Image os type.
repoDigest string (string)[]
Image repo digests.
repoTags string (string)[]
Image repo tags.
user string
Image user.
workingDir string
Base working directory of the image.
installedProducts object
InstalledProducts contains data regarding products running in environment TODO #34713: Swarm support was deprecated in Joule, remove swarm node/manager boolean (and related compliance) in Lagrange
agentless boolean
Agentless indicates whether the scan was performed with agentless approach.
apache string
Apache indicates the apache server version, empty in case apache not running.
awsCloud boolean
AWSCloud indicates whether AWS cloud is used.
clusterType common.ClusterType (string)
Possible values: [AKS,ECS,EKS,GKE,Kubernetes]
ClusterType is the cluster type
crio boolean
CRI indicates whether the container runtime is CRI (and not docker).
docker string
Docker represents the docker daemon version.
dockerEnterprise boolean
DockerEnterprise indicates whether the enterprise version of Docker is installed.
hasPackageManager boolean
HasPackageManager indicates whether package manager is installed on the OS.
k8sApiServer boolean
K8sAPIServer indicates whether a kubernetes API server is running.
k8sControllerManager boolean
K8sControllerManager indicates whether a kubernetes controller manager is running.
k8sEtcd boolean
K8sEtcd indicates whether etcd is running.
k8sFederationApiServer boolean
K8sFederationAPIServer indicates whether a federation API server is running.
k8sFederationControllerManager boolean
K8sFederationControllerManager indicates whether a federation controller manager is running.
k8sKubelet boolean
K8sKubelet indicates whether kubelet is running.
k8sProxy boolean
K8sProxy indicates whether a kubernetes proxy is running.
k8sScheduler boolean
K8sScheduler indicates whether the kubernetes scheduler is running.
kubernetes string
Kubernetes represents the kubernetes version.
managedClusterVersion string
ManagedClusterVersion is the version of the managed Kubernetes service, e.g. AKS/EKS/GKE/etc.
openshift boolean
Openshift indicates whether openshift is deployed.
openshiftVersion string
OpenshiftVersion represents the running openshift version.
osDistro string
OSDistro specifies the os distribution.
serverless boolean
Serverless indicates whether evaluated on a serverless environment.
swarmManager boolean
SwarmManager indicates whether a swarm manager is running.
swarmNode boolean
SwarmNode indicates whether the node is part of an active swarm.
instances object[]
Details about each occurrence of the image (tag + host).
Array [
host string
.
image string
.
modified date-time
.
registry string
.
repo string
.
tag string
.
]
isARM64 boolean
IsARM64 indicates if the architecture of the image is aarch64.
k8sClusterAddr string
Endpoint of the Kubernetes API server.
labels string (string)[]
Image labels.
layers string (string)[]
Image's filesystem layers. Each layer is a SHA256 digest of the filesystem diff See: https://windsock.io/explaining-docker-image-ids/.
malwareAnalyzedTime date-time
MalwareAnalyzedTime is the WildFire evaluator analyzing time shown as progress in UI and cannot to be overwritten by a new scan result.
missingDistroVulnCoverage boolean
Indicates if the image OS is covered in the IS (true) or not (false).
namespaces string (string)[]
k8s namespaces of all the containers running this image.
osDistro string
Name of the OS distribution.
osDistroRelease string
OS distribution release.
osDistroVersion string
OS distribution version.
packageManager boolean
Indicates if the package manager is installed for the OS.
packages object[]
Packages which exist in the image.
Array [
pkgs object[]
List of packages.
Array [
author string
Author is the package's author.
binaryIdx int16 (integer)[]
Indexes of the top binaries which use the package.
binaryPkgs string (string)[]
Names of the distro binary packages (packages which are built on the source of the package).
cveCount integer
Total number of CVEs for this specific package.
defaultGem boolean
DefaultGem indicates this is a gem default package (and not a bundled package).
files object[]
List of package-related files and their hashes. Only included when the appropriate scan option is set.
Array [
md5 string
Hash sum of the file using md5.
path string
Path of the file.
sha1 string
Hash sum of the file using SHA-1.
sha256 string
Hash sum of the file using SHA256.
]
functionLayer string
ID of the serverless layer in which the package was discovered.
goPkg boolean
GoPkg indicates this is a Go package (and not module).
jarIdentifier string
JarIdentifier holds an additional identification detail of a JAR package.
layerTime int64
Image layer to which the package belongs (layer creation time).
license string
License information for the package.
name string
Name of the package.
originPackageName string
OriginPackageName is the name of the third-party origin package.
osPackage boolean
OSPackage indicates that a python/java package was installed as an OS package.
path string
Full package path (e.g., JAR or Node.js package path).
purl string
PURL is a package URL identifier for this package.
securityRepoPkg boolean
SecurityRepoPkg determines if this package is available in a security repository.
symbols string (string)[]
Symbols contains names of vulnerable functions that are linked in the executable binary, empty if the entire package is vulnerable.
version string
Package version.
]
pkgsType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
]
pullDuration int64
PullDuration is the time it took to pull the image.
pushTime date-time
PushTime is the image push time to the registry.
redHatNonRPMImage boolean
RedHatNonRPMImage indicates whether the image is a Red Hat image with non-RPM content.
registryNamespace string
IBM cloud namespace to which the image belongs.
registryTags string (string)[]
RegistryTags are the tags of the registry this image is stored.
registryType string
RegistryType indicates the registry type where the image is stored.
repoDigests string (string)[]
Digests of the image. Used for content trust (notary). Has one digest per tag.
repoTag object
ImageTag represents an image repository and its associated tag or registry digest
digest string
Image digest (requires V2 or later registry).
id string
ID of the image.
registry string
Registry name to which the image belongs.
repo string
Repository name to which the image belongs.
tag string
Image tag.
rhelRepos string (string)[]
RhelRepositories are the (RPM) repositories IDs from which the packages in this image were installed Used for matching vulnerabilities by Red Hat CPEs.
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
scanBuildDate string
Scanner build date that published the image.
scanDuration int64
ScanDuration is the total time it took to scan the image.
scanID integer
ScanID is the ID of the scan.
scanTime date-time
Specifies the time of the last scan of the image.
scanVersion string
Scanner version that published the image.
secretScanMetrics object
SecretScanMetrics represents metrics collected during secret scan
failedScans int64
FailedScans represents number of failed scans caused by scanner errors.
foundSecrets integer
FoundSecrets represents number of detected secrets.
scanTime int64
ScanTime represents cumulative secret scan time in microseconds.
scanTimeouts int64
ScanTimeouts represents number of failed scans caused by timeout.
scannedFileSize int64
ScannedFileSize represents accumulated size of scanned files.
scannedFiles int64
ScannedFiles represents number of text files scanned for secrets.
totalBytes int64
TotalBytes represents accumulated file size.
totalFiles int64
TotalFiles represents number of files read for secrets.
totalTime int64
TotalTime represents the total time in microseconds.
typesCount object
TypesCount represents distribution of secrets by its type.
property name* int (integer)
startupBinaries object[]
Binaries which are expected to run when the container is created from this image.
Array [
altered boolean
Indicates if the binary was installed from a package manager and modified/replaced (true) or not (false).
cveCount integer
Total number of CVEs for this specific binary.
deps string (string)[]
Third-party package files which are used by the binary.
fileMode integer
Represents the file's mode and permission bits.
functionLayer string
ID of the serverless layer in which the package was discovered.
md5 string
Md5 hashset of the binary.
missingPkg boolean
Indicates if this binary is not related to any package (true) or not (false).
name string
Name of the binary.
path string
Path is the path of the binary.
pkgRootDir string
Path for searching packages used by the binary.
services string (string)[]
Names of services which use the binary.
version string
Version of the binary.
]
stopped boolean
Stopped indicates whether the host was running during the agentless scan.
tags object[]
Tags associated with the given image.
Array [
digest string
Image digest (requires V2 or later registry).
id string
ID of the image.
registry string
Registry name to which the image belongs.
repo string
Repository name to which the image belongs.
tag string
Image tag.
]
topLayer string
SHA256 of the image's last layer that is the last element of the Layers field.
trustResult object
ImageResult represents an aggregated image trust result
groups object[]
Trust groups which apply to the image.
Array [
_id string
Name of the group.
disabled boolean
Indicates whether the rule is currently disabled. Values: true (disabled) or false (enabled).
images string (string)[]
Image names or IDs (e.g., docker.io/library/ubuntu:16.04 / SHA264@...).
layers string (string)[]
Filesystem layers. The image is trusted if its layers have a prefix of the trusted groups layer in the same order.
modified date-time
Specifies the date and time when the rule was last modified.
name string
Name of the rule.
notes string
Describes any noteworthy points for a rule. You can include any text.
owner string
User who created or last modified the rule.
previousName string
Previous name of the rule. Required for rule renaming.
]
hostsStatuses object[]
Image trust status on each host. Can be set to "trusted" or "untrusted".
Array [
host string
Host name.
status trust.Status (string)
Possible values: [trusted,untrusted]
Status is the trust status for an image
]
trustStatus trust.Status (string)
Possible values: [trusted,untrusted]
Status is the trust status for an image
twistlockImage boolean
Indicates if the image is a Twistlock image (true) or not (false).
type shared.ScanType (string)
Possible values: [image,ciImage,container,host,agentlessHost,registry,serverlessScan,ciServerless,vm,tas,ciTas,cloudDiscovery,serverlessRadar,serverlessAutoDeploy,hostAutoDeploy,codeRepo,ciCodeRepo]
ScanType displays the components for an ongoing scan
underlyingDistro string
UnderlyingDistro is used in cases OS an OS is built on top of another, and we need to know both.
underlyingDistroRelease string
UnderlyingDistroRelease is used in cases OS an OS is built on top of another, and we need to know both.
vulnerabilities object[]
CVE vulnerabilities of the image.
Array [
applicableRules string (string)[]
Rules applied on the package.
binaryPkgs string (string)[]
Names of the distro binary package names (packages which are built from the source of the package).
block boolean
Indicates if the vulnerability has a block effect (true) or not (false).
cause string
Additional information regarding the root cause for the vulnerability.
cri boolean
Indicates if this is a CRI-specific vulnerability (true) or not (false).
custom boolean
Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).
cve string
CVE ID of the vulnerability (if applied).
cvss float
CVSS score of the vulnerability.
description string
Description of the vulnerability.
discovered date-time
Specifies the time of discovery for the vulnerability.
exploit vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
exploits object[]
Exploits represents the exploits data found for a CVE
Array [
kind vulnerability.ExploitKind (string)
Possible values: [poc,in-the-wild]
ExploitKind represents the kind of the exploit
link string
Link is a link to information about the exploit.
source vulnerability.ExploitType (string)
Possible values: [,exploit-db,exploit-windows,cisa-kev]
ExploitType represents the source of an exploit
]
fixDate int64
Date/time when the vulnerability was fixed (in Unix time).
fixLink string
Link to the vendor's fixed-version information.
functionLayer string
Specifies the serverless layer ID in which the vulnerability was discovered.
gracePeriodDays integer
Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.
id integer
ID of the violation.
layerTime int64
Date/time of the image layer to which the CVE belongs.
link string
Vendor link to the CVE.
packageName string
Name of the package that caused the vulnerability.
packageType packages.Type (string)
Possible values: [nodejs,gem,python,jar,package,windows,binary,nuget,go,app,unknown]
Type describes the package type
packageVersion string
Version of the package that caused the vulnerability (or null).
published int64
Date/time when the vulnerability was published (in Unix time).
riskFactors object
RiskFactors maps the existence of vulnerability risk factors
property name* string (string)
secret object
Secret represents a secret found on the scanned workload
group string
Group is a group name or ID of owner the file metadata containing the secret.
locationInFile string
LocationInFile is the line and offset in the file where the secret was found.
metadataModifiedTime int64
MetadataModifiedTime is the modification time of the file metadata containing the secret.
modifiedTime int64
ModifiedTime is the modification time of the file containing the secret.
path string
Path is the path of the file in which the secret was found.
permissions string
Permissions are permission bits of the file metadata containing the secret.
secretID string
SecretID is the SHA1 of the secret content.
size int64
Size is the size in bytes of the file in which the secret was found.
snippet string
Snippet is the partial plain secret.
type vuln.SecretType (string)
Possible values: [AWS Access Key ID,AWS Secret Key,AWS MWS Auth Token,Azure Storage Account Access Key,Azure Service Principal,GCP Service Account Auth Key,Private Encryption Key,Public Encryption Key,PEM X509 Certificate Header,SSH Authorized Keys,Artifactory API Token,Artifactory Password,Basic Auth Credentials,Mailchimp Access Key,NPM Token,Slack Token,Slack Webhook,Square OAuth Secret,Notion Integration Token,Airtable API Key,Atlassian Oauth2 Keys,CircleCI Personal Token,Databricks Authentication Token,GitHub Token,GitLab Token,Google API key,Grafana Token,Python Package Index Key (PYPI),Typeform API Token,Scalr Token,Braintree Access Token,Braintree Payments Key,Paypal Token Key,Braintree Payments ID,Datadog Client Token,ClickUp Personal API Token,OpenAI API Key,Java DB Connectivity (JDBC),MongoDB,.Net SQL Server]
SecretType represents a secret type
user string
User is a username or ID of owner the file metadata containing the secret.
severity string
Textual representation of the vulnerability's severity.
status string
Vendor status for the vulnerability.
templates vuln.ComplianceTemplate (string)[]
Possible values: [PCI,HIPAA,NIST SP 800-190,GDPR,DISA STIG]
List of templates with which the vulnerability is associated.
text string
Description of the violation.
title string
Compliance title.
twistlock boolean
Indicates if this is a Twistlock-specific vulnerability (true) or not (false).
type vulnerability.Type (string)
Possible values: [container,image,host_config,daemon_config,daemon_config_files,security_operations,k8s_master,k8s_worker,k8s_federation,linux,windows,istio,serverless,custom,docker_stig,openshift_master,openshift_worker,application_control_linux,gke_worker,image_malware,host_malware,aks_worker,eks_worker,image_secret,host_secret]
Type represents the vulnerability type
vecStr string
Textual representation of the metric values used to score the vulnerability.
vulnTagInfos object[]
Tag information for the vulnerability.
Array [
color common.Color (string)
Color is a hexadecimal representation of color code value
comment string
Tag comment in a specific vulnerability context.
name string
Name of the tag.
]
wildfireMalware object
WildFireMalware holds the data for WildFire malicious MD5
md5 string
MD5 is the hash of the malicious binary.
path string
Path is the path to malicious binary.
verdict string
Verdict is the malicious source like grayware, malware and phishing.
]
vulnerabilitiesCount integer
Total number of vulnerabilities.
vulnerabilityDistribution object
Distribution counts the number of vulnerabilities per type
critical integer
.
high integer
.
low integer
.
medium integer
.
total integer
.
vulnerabilityRiskScore float
Image's CVE risk score.
wildFireUsage object
Usage holds wildfire usage stats, period for the usage varies with context
bytes int64
Bytes is the total number of bytes uploaded to the WildFire API.
queries int64
Queries is the number of queries to the WildFire API.
uploads int64
Uploads is the number of uploads to the WildFire API.
]

Example (from schema)

{
  "images": [
    {
      "Secrets": [
        "string"
      ],
      "_id": "string",
      "agentless": true,
      "aisUUID": "string",
      "allCompliance": {
        "compliance": [
          {
            "applicableRules": [
              "string"
            ],
            "binaryPkgs": [
              "string"
            ],
            "block": true,
            "cause": "string",
            "cri": true,
            "custom": true,
            "cve": "string",
            "cvss": 0,
            "description": "string",
            "discovered": "2024-07-29T15:51:28.071Z",
            "exploit": [
              "",
              "exploit-db",
              "exploit-windows",
              "cisa-kev"
            ],
            "exploits": [
              {
                "kind": [
                  "poc",
                  "in-the-wild"
                ],
                "link": "string",
                "source": [
                  "",
                  "exploit-db",
                  "exploit-windows",
                  "cisa-kev"
                ]
              }
            ],
            "fixDate": 0,
            "fixLink": "string",
            "functionLayer": "string",
            "gracePeriodDays": 0,
            "id": 0,
            "layerTime": 0,
            "link": "string",
            "packageName": "string",
            "packageType": [
              "nodejs",
              "gem",
              "python",
              "jar",
              "package",
              "windows",
              "binary",
              "nuget",
              "go",
              "app",
              "unknown"
            ],
            "packageVersion": "string",
            "published": 0,
            "riskFactors": {},
            "secret": {
              "group": "string",
              "locationInFile": "string",
              "metadataModifiedTime": 0,
              "modifiedTime": 0,
              "path": "string",
              "permissions": "string",
              "secretID": "string",
              "size": 0,
              "snippet": "string",
              "type": [
                "AWS Access Key ID",
                "AWS Secret Key",
                "AWS MWS Auth Token",
                "Azure Storage Account Access Key",
                "Azure Service Principal",
                "GCP Service Account Auth Key",
                "Private Encryption Key",
                "Public Encryption Key",
                "PEM X509 Certificate Header",
                "SSH Authorized Keys",
                "Artifactory API Token",
                "Artifactory Password",
                "Basic Auth Credentials",
                "Mailchimp Access Key",
                "NPM Token",
                "Slack Token",
                "Slack Webhook",
                "Square OAuth Secret",
                "Notion Integration Token",
                "Airtable API Key",
                "Atlassian Oauth2 Keys",
                "CircleCI Personal Token",
                "Databricks Authentication Token",
                "GitHub Token",
                "GitLab Token",
                "Google API key",
                "Grafana Token",
                "Python Package Index Key (PYPI)",
                "Typeform API Token",
                "Scalr Token",
                "Braintree Access Token",
                "Braintree Payments Key",
                "Paypal Token Key",
                "Braintree Payments ID",
                "Datadog Client Token",
                "ClickUp Personal API Token",
                "OpenAI API Key",
                "Java DB Connectivity (JDBC)",
                "MongoDB",
                ".Net SQL Server"
              ],
              "user": "string"
            },
            "severity": "string",
            "status": "string",
            "templates": [
              [
                "PCI",
                "HIPAA",
                "NIST SP 800-190",
                "GDPR",
                "DISA STIG"
              ]
            ],
            "text": "string",
            "title": "string",
            "twistlock": true,
            "type": [
              "container",
              "image",
              "host_config",
              "daemon_config",
              "daemon_config_files",
              "security_operations",
              "k8s_master",
              "k8s_worker",
              "k8s_federation",
              "linux",
              "windows",
              "istio",
              "serverless",
              "custom",
              "docker_stig",
              "openshift_master",
              "openshift_worker",
              "application_control_linux",
              "gke_worker",
              "image_malware",
              "host_malware",
              "aks_worker",
              "eks_worker",
              "image_secret",
              "host_secret"
            ],
            "vecStr": "string",
            "vulnTagInfos": [
              {
                "color": "string",
                "comment": "string",
                "name": "string"
              }
            ],
            "wildfireMalware": {
              "md5": "string",
              "path": "string",
              "verdict": "string"
            }
          }
        ],
        "enabled": true
      },
      "appEmbedded": true,
      "applications": [
        {
          "installedFromPackage": true,
          "knownVulnerabilities": 0,
          "layerTime": 0,
          "name": "string",
          "originPackageName": "string",
          "path": "string",
          "service": true,
          "version": "string"
        }
      ],
      "baseImage": "string",
      "binaries": [
        {
          "altered": true,
          "cveCount": 0,
          "deps": [
            "string"
          ],
          "fileMode": 0,
          "functionLayer": "string",
          "md5": "string",
          "missingPkg": true,
          "name": "string",
          "path": "string",
          "pkgRootDir": "string",
          "services": [
            "string"
          ],
          "version": "string"
        }
      ],
      "cloudMetadata": {
        "accountID": "string",
        "awsExecutionEnv": "string",
        "image": "string",
        "labels": [
          {
            "key": "string",
            "sourceName": "string",
            "sourceType": [
              "namespace",
              "deployment",
              "aws",
              "azure",
              "gcp",
              "oci"
            ],
            "timestamp": "2024-07-29T15:51:28.071Z",
            "value": "string"
          }
        ],
        "name": "string",
        "provider": [
          "aws",
          "azure",
          "gcp",
          "alibaba",
          "oci",
          "others"
        ],
        "region": "string",
        "resourceID": "string",
        "resourceURL": "string",
        "type": "string",
        "vmID": "string",
        "vmImageID": "string"
      },
      "clusterType": [
        "AKS",
        "ECS",
        "EKS",
        "GKE",
        "Kubernetes"
      ],
      "clusters": [
        "string"
      ],
      "collections": [
        "string"
      ],
      "complianceDistribution": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "total": 0
      },
      "complianceIssues": [
        {
          "applicableRules": [
            "string"
          ],
          "binaryPkgs": [
            "string"
          ],
          "block": true,
          "cause": "string",
          "cri": true,
          "custom": true,
          "cve": "string",
          "cvss": 0,
          "description": "string",
          "discovered": "2024-07-29T15:51:28.071Z",
          "exploit": [
            "",
            "exploit-db",
            "exploit-windows",
            "cisa-kev"
          ],
          "exploits": [
            {
              "kind": [
                "poc",
                "in-the-wild"
              ],
              "link": "string",
              "source": [
                "",
                "exploit-db",
                "exploit-windows",
                "cisa-kev"
              ]
            }
          ],
          "fixDate": 0,
          "fixLink": "string",
          "functionLayer": "string",
          "gracePeriodDays": 0,
          "id": 0,
          "layerTime": 0,
          "link": "string",
          "packageName": "string",
          "packageType": [
            "nodejs",
            "gem",
            "python",
            "jar",
            "package",
            "windows",
            "binary",
            "nuget",
            "go",
            "app",
            "unknown"
          ],
          "packageVersion": "string",
          "published": 0,
          "riskFactors": {},
          "secret": {
            "group": "string",
            "locationInFile": "string",
            "metadataModifiedTime": 0,
            "modifiedTime": 0,
            "path": "string",
            "permissions": "string",
            "secretID": "string",
            "size": 0,
            "snippet": "string",
            "type": [
              "AWS Access Key ID",
              "AWS Secret Key",
              "AWS MWS Auth Token",
              "Azure Storage Account Access Key",
              "Azure Service Principal",
              "GCP Service Account Auth Key",
              "Private Encryption Key",
              "Public Encryption Key",
              "PEM X509 Certificate Header",
              "SSH Authorized Keys",
              "Artifactory API Token",
              "Artifactory Password",
              "Basic Auth Credentials",
              "Mailchimp Access Key",
              "NPM Token",
              "Slack Token",
              "Slack Webhook",
              "Square OAuth Secret",
              "Notion Integration Token",
              "Airtable API Key",
              "Atlassian Oauth2 Keys",
              "CircleCI Personal Token",
              "Databricks Authentication Token",
              "GitHub Token",
              "GitLab Token",
              "Google API key",
              "Grafana Token",
              "Python Package Index Key (PYPI)",
              "Typeform API Token",
              "Scalr Token",
              "Braintree Access Token",
              "Braintree Payments Key",
              "Paypal Token Key",
              "Braintree Payments ID",
              "Datadog Client Token",
              "ClickUp Personal API Token",
              "OpenAI API Key",
              "Java DB Connectivity (JDBC)",
              "MongoDB",
              ".Net SQL Server"
            ],
            "user": "string"
          },
          "severity": "string",
          "status": "string",
          "templates": [
            [
              "PCI",
              "HIPAA",
              "NIST SP 800-190",
              "GDPR",
              "DISA STIG"
            ]
          ],
          "text": "string",
          "title": "string",
          "twistlock": true,
          "type": [
            "container",
            "image",
            "host_config",
            "daemon_config",
            "daemon_config_files",
            "security_operations",
            "k8s_master",
            "k8s_worker",
            "k8s_federation",
            "linux",
            "windows",
            "istio",
            "serverless",
            "custom",
            "docker_stig",
            "openshift_master",
            "openshift_worker",
            "application_control_linux",
            "gke_worker",
            "image_malware",
            "host_malware",
            "aks_worker",
            "eks_worker",
            "image_secret",
            "host_secret"
          ],
          "vecStr": "string",
          "vulnTagInfos": [
            {
              "color": "string",
              "comment": "string",
              "name": "string"
            }
          ],
          "wildfireMalware": {
            "md5": "string",
            "path": "string",
            "verdict": "string"
          }
        }
      ],
      "complianceIssuesCount": 0,
      "complianceRiskScore": 0,
      "compressed": true,
      "compressedLayerTimes": {
        "appTimes": [
          0
        ],
        "pkgsTimes": [
          {
            "pkgTimes": [
              0
            ],
            "pkgsType": [
              "nodejs",
              "gem",
              "python",
              "jar",
              "package",
              "windows",
              "binary",
              "nuget",
              "go",
              "app",
              "unknown"
            ]
          }
        ]
      },
      "creationTime": "2024-07-29T15:51:28.071Z",
      "csa": true,
      "distro": "string",
      "ecsClusterName": "string",
      "err": "string",
      "errCode": 0,
      "externalLabels": [
        {
          "key": "string",
          "sourceName": "string",
          "sourceType": [
            "namespace",
            "deployment",
            "aws",
            "azure",
            "gcp",
            "oci"
          ],
          "timestamp": "2024-07-29T15:51:28.071Z",
          "value": "string"
        }
      ],
      "files": [
        {
          "md5": "string",
          "path": "string",
          "sha1": "string",
          "sha256": "string"
        }
      ],
      "firewallProtection": {
        "enabled": true,
        "outOfBandMode": [
          "",
          "Observation",
          "Protection"
        ],
        "ports": [
          0
        ],
        "supported": true,
        "tlsPorts": [
          0
        ],
        "unprotectedProcesses": [
          {
            "port": 0,
            "process": "string",
            "tls": true
          }
        ]
      },
      "firstScanTime": "2024-07-29T15:51:28.071Z",
      "foundSecrets": [
        {
          "group": "string",
          "locationInFile": "string",
          "metadataModifiedTime": 0,
          "modifiedTime": 0,
          "path": "string",
          "permissions": "string",
          "secretID": "string",
          "size": 0,
          "snippet": "string",
          "type": [
            "AWS Access Key ID",
            "AWS Secret Key",
            "AWS MWS Auth Token",
            "Azure Storage Account Access Key",
            "Azure Service Principal",
            "GCP Service Account Auth Key",
            "Private Encryption Key",
            "Public Encryption Key",
            "PEM X509 Certificate Header",
            "SSH Authorized Keys",
            "Artifactory API Token",
            "Artifactory Password",
            "Basic Auth Credentials",
            "Mailchimp Access Key",
            "NPM Token",
            "Slack Token",
            "Slack Webhook",
            "Square OAuth Secret",
            "Notion Integration Token",
            "Airtable API Key",
            "Atlassian Oauth2 Keys",
            "CircleCI Personal Token",
            "Databricks Authentication Token",
            "GitHub Token",
            "GitLab Token",
            "Google API key",
            "Grafana Token",
            "Python Package Index Key (PYPI)",
            "Typeform API Token",
            "Scalr Token",
            "Braintree Access Token",
            "Braintree Payments Key",
            "Paypal Token Key",
            "Braintree Payments ID",
            "Datadog Client Token",
            "ClickUp Personal API Token",
            "OpenAI API Key",
            "Java DB Connectivity (JDBC)",
            "MongoDB",
            ".Net SQL Server"
          ],
          "user": "string"
        }
      ],
      "history": [
        {
          "baseLayer": true,
          "created": 0,
          "emptyLayer": true,
          "id": "string",
          "instruction": "string",
          "sizeBytes": 0,
          "tags": [
            "string"
          ],
          "vulnerabilities": [
            {
              "applicableRules": [
                "string"
              ],
              "binaryPkgs": [
                "string"
              ],
              "block": true,
              "cause": "string",
              "cri": true,
              "custom": true,
              "cve": "string",
              "cvss": 0,
              "description": "string",
              "discovered": "2024-07-29T15:51:28.071Z",
              "exploit": [
                "",
                "exploit-db",
                "exploit-windows",
                "cisa-kev"
              ],
              "exploits": [
                {
                  "kind": [
                    "poc",
                    "in-the-wild"
                  ],
                  "link": "string",
                  "source": [
                    "",
                    "exploit-db",
                    "exploit-windows",
                    "cisa-kev"
                  ]
                }
              ],
              "fixDate": 0,
              "fixLink": "string",
              "functionLayer": "string",
              "gracePeriodDays": 0,
              "id": 0,
              "layerTime": 0,
              "link": "string",
              "packageName": "string",
              "packageType": [
                "nodejs",
                "gem",
                "python",
                "jar",
                "package",
                "windows",
                "binary",
                "nuget",
                "go",
                "app",
                "unknown"
              ],
              "packageVersion": "string",
              "published": 0,
              "riskFactors": {},
              "secret": {
                "group": "string",
                "locationInFile": "string",
                "metadataModifiedTime": 0,
                "modifiedTime": 0,
                "path": "string",
                "permissions": "string",
                "secretID": "string",
                "size": 0,
                "snippet": "string",
                "type": [
                  "AWS Access Key ID",
                  "AWS Secret Key",
                  "AWS MWS Auth Token",
                  "Azure Storage Account Access Key",
                  "Azure Service Principal",
                  "GCP Service Account Auth Key",
                  "Private Encryption Key",
                  "Public Encryption Key",
                  "PEM X509 Certificate Header",
                  "SSH Authorized Keys",
                  "Artifactory API Token",
                  "Artifactory Password",
                  "Basic Auth Credentials",
                  "Mailchimp Access Key",
                  "NPM Token",
                  "Slack Token",
                  "Slack Webhook",
                  "Square OAuth Secret",
                  "Notion Integration Token",
                  "Airtable API Key",
                  "Atlassian Oauth2 Keys",
                  "CircleCI Personal Token",
                  "Databricks Authentication Token",
                  "GitHub Token",
                  "GitLab Token",
                  "Google API key",
                  "Grafana Token",
                  "Python Package Index Key (PYPI)",
                  "Typeform API Token",
                  "Scalr Token",
                  "Braintree Access Token",
                  "Braintree Payments Key",
                  "Paypal Token Key",
                  "Braintree Payments ID",
                  "Datadog Client Token",
                  "ClickUp Personal API Token",
                  "OpenAI API Key",
                  "Java DB Connectivity (JDBC)",
                  "MongoDB",
                  ".Net SQL Server"
                ],
                "user": "string"
              },
              "severity": "string",
              "status": "string",
              "templates": [
                [
                  "PCI",
                  "HIPAA",
                  "NIST SP 800-190",
                  "GDPR",
                  "DISA STIG"
                ]
              ],
              "text": "string",
              "title": "string",
              "twistlock": true,
              "type": [
                "container",
                "image",
                "host_config",
                "daemon_config",
                "daemon_config_files",
                "security_operations",
                "k8s_master",
                "k8s_worker",
                "k8s_federation",
                "linux",
                "windows",
                "istio",
                "serverless",
                "custom",
                "docker_stig",
                "openshift_master",
                "openshift_worker",
                "application_control_linux",
                "gke_worker",
                "image_malware",
                "host_malware",
                "aks_worker",
                "eks_worker",
                "image_secret",
                "host_secret"
              ],
              "vecStr": "string",
              "vulnTagInfos": [
                {
                  "color": "string",
                  "comment": "string",
                  "name": "string"
                }
              ],
              "wildfireMalware": {
                "md5": "string",
                "path": "string",
                "verdict": "string"
              }
            }
          ]
        }
      ],
      "hostDevices": [
        {
          "ip": "string",
          "name": "string"
        }
      ],
      "hostRuntimeEnabled": true,
      "hostname": "string",
      "hosts": {},
      "id": "string",
      "image": {
        "created": "2024-07-29T15:51:28.071Z",
        "entrypoint": [
          "string"
        ],
        "env": [
          "string"
        ],
        "healthcheck": true,
        "history": [
          {
            "baseLayer": true,
            "created": 0,
            "emptyLayer": true,
            "id": "string",
            "instruction": "string",
            "sizeBytes": 0,
            "tags": [
              "string"
            ],
            "vulnerabilities": [
              {
                "applicableRules": [
                  "string"
                ],
                "binaryPkgs": [
                  "string"
                ],
                "block": true,
                "cause": "string",
                "cri": true,
                "custom": true,
                "cve": "string",
                "cvss": 0,
                "description": "string",
                "discovered": "2024-07-29T15:51:28.071Z",
                "exploit": [
                  "",
                  "exploit-db",
                  "exploit-windows",
                  "cisa-kev"
                ],
                "exploits": [
                  {
                    "kind": [
                      "poc",
                      "in-the-wild"
                    ],
                    "link": "string",
                    "source": [
                      "",
                      "exploit-db",
                      "exploit-windows",
                      "cisa-kev"
                    ]
                  }
                ],
                "fixDate": 0,
                "fixLink": "string",
                "functionLayer": "string",
                "gracePeriodDays": 0,
                "id": 0,
                "layerTime": 0,
                "link": "string",
                "packageName": "string",
                "packageType": [
                  "nodejs",
                  "gem",
                  "python",
                  "jar",
                  "package",
                  "windows",
                  "binary",
                  "nuget",
                  "go",
                  "app",
                  "unknown"
                ],
                "packageVersion": "string",
                "published": 0,
                "riskFactors": {},
                "secret": {
                  "group": "string",
                  "locationInFile": "string",
                  "metadataModifiedTime": 0,
                  "modifiedTime": 0,
                  "path": "string",
                  "permissions": "string",
                  "secretID": "string",
                  "size": 0,
                  "snippet": "string",
                  "type": [
                    "AWS Access Key ID",
                    "AWS Secret Key",
                    "AWS MWS Auth Token",
                    "Azure Storage Account Access Key",
                    "Azure Service Principal",
                    "GCP Service Account Auth Key",
                    "Private Encryption Key",
                    "Public Encryption Key",
                    "PEM X509 Certificate Header",
                    "SSH Authorized Keys",
                    "Artifactory API Token",
                    "Artifactory Password",
                    "Basic Auth Credentials",
                    "Mailchimp Access Key",
                    "NPM Token",
                    "Slack Token",
                    "Slack Webhook",
                    "Square OAuth Secret",
                    "Notion Integration Token",
                    "Airtable API Key",
                    "Atlassian Oauth2 Keys",
                    "CircleCI Personal Token",
                    "Databricks Authentication Token",
                    "GitHub Token",
                    "GitLab Token",
                    "Google API key",
                    "Grafana Token",
                    "Python Package Index Key (PYPI)",
                    "Typeform API Token",
                    "Scalr Token",
                    "Braintree Access Token",
                    "Braintree Payments Key",
                    "Paypal Token Key",
                    "Braintree Payments ID",
                    "Datadog Client Token",
                    "ClickUp Personal API Token",
                    "OpenAI API Key",
                    "Java DB Connectivity (JDBC)",
                    "MongoDB",
                    ".Net SQL Server"
                  ],
                  "user": "string"
                },
                "severity": "string",
                "status": "string",
                "templates": [
                  [
                    "PCI",
                    "HIPAA",
                    "NIST SP 800-190",
                    "GDPR",
                    "DISA STIG"
                  ]
                ],
                "text": "string",
                "title": "string",
                "twistlock": true,
                "type": [
                  "container",
                  "image",
                  "host_config",
                  "daemon_config",
                  "daemon_config_files",
                  "security_operations",
                  "k8s_master",
                  "k8s_worker",
                  "k8s_federation",
                  "linux",
                  "windows",
                  "istio",
                  "serverless",
                  "custom",
                  "docker_stig",
                  "openshift_master",
                  "openshift_worker",
                  "application_control_linux",
                  "gke_worker",
                  "image_malware",
                  "host_malware",
                  "aks_worker",
                  "eks_worker",
                  "image_secret",
                  "host_secret"
                ],
                "vecStr": "string",
                "vulnTagInfos": [
                  {
                    "color": "string",
                    "comment": "string",
                    "name": "string"
                  }
                ],
                "wildfireMalware": {
                  "md5": "string",
                  "path": "string",
                  "verdict": "string"
                }
              }
            ]
          }
        ],
        "id": "string",
        "labels": {},
        "layers": [
          "string"
        ],
        "os": "string",
        "repoDigest": [
          "string"
        ],
        "repoTags": [
          "string"
        ],
        "user": "string",
        "workingDir": "string"
      },
      "installedProducts": {
        "agentless": true,
        "apache": "string",
        "awsCloud": true,
        "clusterType": [
          "AKS",
          "ECS",
          "EKS",
          "GKE",
          "Kubernetes"
        ],
        "crio": true,
        "docker": "string",
        "dockerEnterprise": true,
        "hasPackageManager": true,
        "k8sApiServer": true,
        "k8sControllerManager": true,
        "k8sEtcd": true,
        "k8sFederationApiServer": true,
        "k8sFederationControllerManager": true,
        "k8sKubelet": true,
        "k8sProxy": true,
        "k8sScheduler": true,
        "kubernetes": "string",
        "managedClusterVersion": "string",
        "openshift": true,
        "openshiftVersion": "string",
        "osDistro": "string",
        "serverless": true,
        "swarmManager": true,
        "swarmNode": true
      },
      "instances": [
        {
          "host": "string",
          "image": "string",
          "modified": "2024-07-29T15:51:28.071Z",
          "registry": "string",
          "repo": "string",
          "tag": "string"
        }
      ],
      "isARM64": true,
      "k8sClusterAddr": "string",
      "labels": [
        "string"
      ],
      "layers": [
        "string"
      ],
      "malwareAnalyzedTime": "2024-07-29T15:51:28.071Z",
      "missingDistroVulnCoverage": true,
      "namespaces": [
        "string"
      ],
      "osDistro": "string",
      "osDistroRelease": "string",
      "osDistroVersion": "string",
      "packageManager": true,
      "packages": [
        {
          "pkgs": [
            {
              "author": "string",
              "binaryIdx": [
                0
              ],
              "binaryPkgs": [
                "string"
              ],
              "cveCount": 0,
              "defaultGem": true,
              "files": [
                {
                  "md5": "string",
                  "path": "string",
                  "sha1": "string",
                  "sha256": "string"
                }
              ],
              "functionLayer": "string",
              "goPkg": true,
              "jarIdentifier": "string",
              "layerTime": 0,
              "license": "string",
              "name": "string",
              "originPackageName": "string",
              "osPackage": true,
              "path": "string",
              "purl": "string",
              "securityRepoPkg": true,
              "symbols": [
                "string"
              ],
              "version": "string"
            }
          ],
          "pkgsType": [
            "nodejs",
            "gem",
            "python",
            "jar",
            "package",
            "windows",
            "binary",
            "nuget",
            "go",
            "app",
            "unknown"
          ]
        }
      ],
      "pullDuration": 0,
      "pushTime": "2024-07-29T15:51:28.071Z",
      "redHatNonRPMImage": true,
      "registryNamespace": "string",
      "registryTags": [
        "string"
      ],
      "registryType": "string",
      "repoDigests": [
        "string"
      ],
      "repoTag": {
        "digest": "string",
        "id": "string",
        "registry": "string",
        "repo": "string",
        "tag": "string"
      },
      "rhelRepos": [
        "string"
      ],
      "riskFactors": {},
      "scanBuildDate": "string",
      "scanDuration": 0,
      "scanID": 0,
      "scanTime": "2024-07-29T15:51:28.071Z",
      "scanVersion": "string",
      "secretScanMetrics": {
        "failedScans": 0,
        "foundSecrets": 0,
        "scanTime": 0,
        "scanTimeouts": 0,
        "scannedFileSize": 0,
        "scannedFiles": 0,
        "totalBytes": 0,
        "totalFiles": 0,
        "totalTime": 0,
        "typesCount": {}
      },
      "startupBinaries": [
        {
          "altered": true,
          "cveCount": 0,
          "deps": [
            "string"
          ],
          "fileMode": 0,
          "functionLayer": "string",
          "md5": "string",
          "missingPkg": true,
          "name": "string",
          "path": "string",
          "pkgRootDir": "string",
          "services": [
            "string"
          ],
          "version": "string"
        }
      ],
      "stopped": true,
      "tags": [
        {
          "digest": "string",
          "id": "string",
          "registry": "string",
          "repo": "string",
          "tag": "string"
        }
      ],
      "topLayer": "string",
      "trustResult": {
        "groups": [
          {
            "_id": "string",
            "disabled": true,
            "images": [
              "string"
            ],
            "layers": [
              "string"
            ],
            "modified": "2024-07-29T15:51:28.071Z",
            "name": "string",
            "notes": "string",
            "owner": "string",
            "previousName": "string"
          }
        ],
        "hostsStatuses": [
          {
            "host": "string",
            "status": [
              "trusted",
              "untrusted"
            ]
          }
        ]
      },
      "trustStatus": [
        "trusted",
        "untrusted"
      ],
      "twistlockImage": true,
      "type": [
        "image",
        "ciImage",
        "container",
        "host",
        "agentlessHost",
        "registry",
        "serverlessScan",
        "ciServerless",
        "vm",
        "tas",
        "ciTas",
        "cloudDiscovery",
        "serverlessRadar",
        "serverlessAutoDeploy",
        "hostAutoDeploy",
        "codeRepo",
        "ciCodeRepo"
      ],
      "underlyingDistro": "string",
      "underlyingDistroRelease": "string",
      "vulnerabilities": [
        {
          "applicableRules": [
            "string"
          ],
          "binaryPkgs": [
            "string"
          ],
          "block": true,
          "cause": "string",
          "cri": true,
          "custom": true,
          "cve": "string",
          "cvss": 0,
          "description": "string",
          "discovered": "2024-07-29T15:51:28.071Z",
          "exploit": [
            "",
            "exploit-db",
            "exploit-windows",
            "cisa-kev"
          ],
          "exploits": [
            {
              "kind": [
                "poc",
                "in-the-wild"
              ],
              "link": "string",
              "source": [
                "",
                "exploit-db",
                "exploit-windows",
                "cisa-kev"
              ]
            }
          ],
          "fixDate": 0,
          "fixLink": "string",
          "functionLayer": "string",
          "gracePeriodDays": 0,
          "id": 0,
          "layerTime": 0,
          "link": "string",
          "packageName": "string",
          "packageType": [
            "nodejs",
            "gem",
            "python",
            "jar",
            "package",
            "windows",
            "binary",
            "nuget",
            "go",
            "app",
            "unknown"
          ],
          "packageVersion": "string",
          "published": 0,
          "riskFactors": {},
          "secret": {
            "group": "string",
            "locationInFile": "string",
            "metadataModifiedTime": 0,
            "modifiedTime": 0,
            "path": "string",
            "permissions": "string",
            "secretID": "string",
            "size": 0,
            "snippet": "string",
            "type": [
              "AWS Access Key ID",
              "AWS Secret Key",
              "AWS MWS Auth Token",
              "Azure Storage Account Access Key",
              "Azure Service Principal",
              "GCP Service Account Auth Key",
              "Private Encryption Key",
              "Public Encryption Key",
              "PEM X509 Certificate Header",
              "SSH Authorized Keys",
              "Artifactory API Token",
              "Artifactory Password",
              "Basic Auth Credentials",
              "Mailchimp Access Key",
              "NPM Token",
              "Slack Token",
              "Slack Webhook",
              "Square OAuth Secret",
              "Notion Integration Token",
              "Airtable API Key",
              "Atlassian Oauth2 Keys",
              "CircleCI Personal Token",
              "Databricks Authentication Token",
              "GitHub Token",
              "GitLab Token",
              "Google API key",
              "Grafana Token",
              "Python Package Index Key (PYPI)",
              "Typeform API Token",
              "Scalr Token",
              "Braintree Access Token",
              "Braintree Payments Key",
              "Paypal Token Key",
              "Braintree Payments ID",
              "Datadog Client Token",
              "ClickUp Personal API Token",
              "OpenAI API Key",
              "Java DB Connectivity (JDBC)",
              "MongoDB",
              ".Net SQL Server"
            ],
            "user": "string"
          },
          "severity": "string",
          "status": "string",
          "templates": [
            [
              "PCI",
              "HIPAA",
              "NIST SP 800-190",
              "GDPR",
              "DISA STIG"
            ]
          ],
          "text": "string",
          "title": "string",
          "twistlock": true,
          "type": [
            "container",
            "image",
            "host_config",
            "daemon_config",
            "daemon_config_files",
            "security_operations",
            "k8s_master",
            "k8s_worker",
            "k8s_federation",
            "linux",
            "windows",
            "istio",
            "serverless",
            "custom",
            "docker_stig",
            "openshift_master",
            "openshift_worker",
            "application_control_linux",
            "gke_worker",
            "image_malware",
            "host_malware",
            "aks_worker",
            "eks_worker",
            "image_secret",
            "host_secret"
          ],
          "vecStr": "string",
          "vulnTagInfos": [
            {
              "color": "string",
              "comment": "string",
              "name": "string"
            }
          ],
          "wildfireMalware": {
            "md5": "string",
            "path": "string",
            "verdict": "string"
          }
        }
      ],
      "vulnerabilitiesCount": 0,
      "vulnerabilityDistribution": {
        "critical": 0,
        "high": 0,
        "low": 0,
        "medium": 0,
        "total": 0
      },
      "vulnerabilityRiskScore": 0,
      "wildFireUsage": {
        "bytes": 0,
        "queries": 0,
        "uploads": 0
      }
    }
  ]
}

default

Loading...