List Container Runtime Insights
curl --request GET \
--url https://api.prd.rad.security/accounts/{account_id}/container_runtime_insightsimport requests
url = "https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"entries": [
{
"accountID": "<string>",
"analysis": [
{
"accountID": "<string>",
"action": "<string>",
"category": "<string>",
"clusterID": "<string>",
"createdAt": "<string>",
"deletedAt": "<string>",
"description": "<string>",
"falsePositive": true,
"falsePositiveMatchedRules": [
"<string>"
],
"falsePositiveReason": "<string>",
"id": "<string>",
"insightID": "<string>",
"insightIDs": [
"<string>"
],
"llmProvider": "<string>",
"maliciousProcessIDs": [
"<string>"
],
"mitreAttackTactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
],
"mitreAttackTechniques": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>",
"tactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
]
}
],
"model": "<string>",
"partial": true,
"prompt": "<string>",
"promptDigest": "<string>",
"refs": [
"<string>"
],
"remediation": "<string>",
"severity": "<string>",
"stale": true,
"status": "<string>",
"totalRequests": 123,
"triggeredBy": "<string>",
"updatedAt": "<string>"
}
],
"baseline": {
"apiVersion": "<string>",
"containers": [
{
"id": "<string>",
"imageDigest": "<string>",
"imageName": "<string>",
"name": "<string>",
"processes": [
{
"children": "<array>",
"connections": [
{
"address": "<string>",
"drift": true,
"hostname": "<string>",
"k8sName": "<string>",
"k8sNamespace": "<string>",
"port": 123,
"timestamp": "<string>",
"trustedCIDR": "<string>"
}
],
"drift": true,
"files": [
{
"drift": true,
"path": "<string>",
"timestamp": "<string>"
}
],
"gid": 123,
"id": "<string>",
"parentId": "<string>",
"programs": [
{
"args": [
"<string>"
],
"comm": "<string>",
"drift": true,
"hasPattern": true,
"sampleArgs": [
[
"<string>"
]
],
"timestamp": "<string>"
}
],
"repetition": {
"execCount": 123,
"recentTimestamp": "<string>"
},
"timestamp": "<string>",
"trustedIPPrefixes": [
{
"cidr": "<string>",
"name": "<string>",
"port": 123
}
],
"uid": 123
}
]
}
],
"kind": "<string>",
"metadata": {
"creationTimestamp": "<string>"
}
},
"baselineCaptured": true,
"baselineID": "<string>",
"clusterID": "<string>",
"createdAt": "<string>",
"deletedAt": "<string>",
"hasDrift": true,
"id": "<string>",
"llmAnalysis": {
"accountID": "<string>",
"action": "<string>",
"category": "<string>",
"clusterID": "<string>",
"createdAt": "<string>",
"deletedAt": "<string>",
"description": "<string>",
"falsePositive": true,
"falsePositiveMatchedRules": [
"<string>"
],
"falsePositiveReason": "<string>",
"id": "<string>",
"insightID": "<string>",
"insightIDs": [
"<string>"
],
"llmProvider": "<string>",
"maliciousProcessIDs": [
"<string>"
],
"mitreAttackTactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
],
"mitreAttackTechniques": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>",
"tactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
]
}
],
"model": "<string>",
"partial": true,
"prompt": "<string>",
"promptDigest": "<string>",
"refs": [
"<string>"
],
"remediation": "<string>",
"severity": "<string>",
"stale": true,
"status": "<string>",
"totalRequests": 123,
"triggeredBy": "<string>",
"updatedAt": "<string>"
},
"malicious": true,
"ongoing": {
"apiVersion": "<string>",
"containers": [
{
"id": "<string>",
"imageDigest": "<string>",
"imageName": "<string>",
"name": "<string>",
"processes": [
{
"children": "<array>",
"connections": [
{
"address": "<string>",
"drift": true,
"hostname": "<string>",
"k8sName": "<string>",
"k8sNamespace": "<string>",
"port": 123,
"timestamp": "<string>",
"trustedCIDR": "<string>"
}
],
"drift": true,
"files": [
{
"drift": true,
"path": "<string>",
"timestamp": "<string>"
}
],
"gid": 123,
"id": "<string>",
"parentId": "<string>",
"programs": [
{
"args": [
"<string>"
],
"comm": "<string>",
"drift": true,
"hasPattern": true,
"sampleArgs": [
[
"<string>"
]
],
"timestamp": "<string>"
}
],
"repetition": {
"execCount": 123,
"recentTimestamp": "<string>"
},
"timestamp": "<string>",
"trustedIPPrefixes": [
{
"cidr": "<string>",
"name": "<string>",
"port": 123
}
],
"uid": 123
}
]
}
],
"kind": "<string>",
"metadata": {
"creationTimestamp": "<string>"
}
},
"severity": "<string>",
"state": "<string>",
"summary": {
"container_meta": {
"container_id": "<string>",
"container_image_digest": "<string>",
"container_image_name": "<string>",
"container_name": "<string>",
"runtime_name": "<string>"
},
"createdAt": "<string>",
"deletedAt": "<string>",
"kube_meta": {
"cluster_id": "<string>",
"container_name": "<string>",
"namespace": "<string>",
"node_name": "<string>",
"pod_name": "<string>"
}
},
"updatedAt": "<string>"
}
],
"page": 123,
"page_count": 123,
"page_size": 123,
"total_count": 123
}{
"status": 123,
"code": "<string>",
"request_id": "<string>",
"validation_details": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"param": "<string>"
}
]
}Fingerprints
List Container Runtime Insights
GET
/
accounts
/
{account_id}
/
container_runtime_insights
List Container Runtime Insights
curl --request GET \
--url https://api.prd.rad.security/accounts/{account_id}/container_runtime_insightsimport requests
url = "https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.prd.rad.security/accounts/{account_id}/container_runtime_insights")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"entries": [
{
"accountID": "<string>",
"analysis": [
{
"accountID": "<string>",
"action": "<string>",
"category": "<string>",
"clusterID": "<string>",
"createdAt": "<string>",
"deletedAt": "<string>",
"description": "<string>",
"falsePositive": true,
"falsePositiveMatchedRules": [
"<string>"
],
"falsePositiveReason": "<string>",
"id": "<string>",
"insightID": "<string>",
"insightIDs": [
"<string>"
],
"llmProvider": "<string>",
"maliciousProcessIDs": [
"<string>"
],
"mitreAttackTactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
],
"mitreAttackTechniques": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>",
"tactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
]
}
],
"model": "<string>",
"partial": true,
"prompt": "<string>",
"promptDigest": "<string>",
"refs": [
"<string>"
],
"remediation": "<string>",
"severity": "<string>",
"stale": true,
"status": "<string>",
"totalRequests": 123,
"triggeredBy": "<string>",
"updatedAt": "<string>"
}
],
"baseline": {
"apiVersion": "<string>",
"containers": [
{
"id": "<string>",
"imageDigest": "<string>",
"imageName": "<string>",
"name": "<string>",
"processes": [
{
"children": "<array>",
"connections": [
{
"address": "<string>",
"drift": true,
"hostname": "<string>",
"k8sName": "<string>",
"k8sNamespace": "<string>",
"port": 123,
"timestamp": "<string>",
"trustedCIDR": "<string>"
}
],
"drift": true,
"files": [
{
"drift": true,
"path": "<string>",
"timestamp": "<string>"
}
],
"gid": 123,
"id": "<string>",
"parentId": "<string>",
"programs": [
{
"args": [
"<string>"
],
"comm": "<string>",
"drift": true,
"hasPattern": true,
"sampleArgs": [
[
"<string>"
]
],
"timestamp": "<string>"
}
],
"repetition": {
"execCount": 123,
"recentTimestamp": "<string>"
},
"timestamp": "<string>",
"trustedIPPrefixes": [
{
"cidr": "<string>",
"name": "<string>",
"port": 123
}
],
"uid": 123
}
]
}
],
"kind": "<string>",
"metadata": {
"creationTimestamp": "<string>"
}
},
"baselineCaptured": true,
"baselineID": "<string>",
"clusterID": "<string>",
"createdAt": "<string>",
"deletedAt": "<string>",
"hasDrift": true,
"id": "<string>",
"llmAnalysis": {
"accountID": "<string>",
"action": "<string>",
"category": "<string>",
"clusterID": "<string>",
"createdAt": "<string>",
"deletedAt": "<string>",
"description": "<string>",
"falsePositive": true,
"falsePositiveMatchedRules": [
"<string>"
],
"falsePositiveReason": "<string>",
"id": "<string>",
"insightID": "<string>",
"insightIDs": [
"<string>"
],
"llmProvider": "<string>",
"maliciousProcessIDs": [
"<string>"
],
"mitreAttackTactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
],
"mitreAttackTechniques": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>",
"tactics": [
{
"id": "<string>",
"link": "<string>",
"name": "<string>"
}
]
}
],
"model": "<string>",
"partial": true,
"prompt": "<string>",
"promptDigest": "<string>",
"refs": [
"<string>"
],
"remediation": "<string>",
"severity": "<string>",
"stale": true,
"status": "<string>",
"totalRequests": 123,
"triggeredBy": "<string>",
"updatedAt": "<string>"
},
"malicious": true,
"ongoing": {
"apiVersion": "<string>",
"containers": [
{
"id": "<string>",
"imageDigest": "<string>",
"imageName": "<string>",
"name": "<string>",
"processes": [
{
"children": "<array>",
"connections": [
{
"address": "<string>",
"drift": true,
"hostname": "<string>",
"k8sName": "<string>",
"k8sNamespace": "<string>",
"port": 123,
"timestamp": "<string>",
"trustedCIDR": "<string>"
}
],
"drift": true,
"files": [
{
"drift": true,
"path": "<string>",
"timestamp": "<string>"
}
],
"gid": 123,
"id": "<string>",
"parentId": "<string>",
"programs": [
{
"args": [
"<string>"
],
"comm": "<string>",
"drift": true,
"hasPattern": true,
"sampleArgs": [
[
"<string>"
]
],
"timestamp": "<string>"
}
],
"repetition": {
"execCount": 123,
"recentTimestamp": "<string>"
},
"timestamp": "<string>",
"trustedIPPrefixes": [
{
"cidr": "<string>",
"name": "<string>",
"port": 123
}
],
"uid": 123
}
]
}
],
"kind": "<string>",
"metadata": {
"creationTimestamp": "<string>"
}
},
"severity": "<string>",
"state": "<string>",
"summary": {
"container_meta": {
"container_id": "<string>",
"container_image_digest": "<string>",
"container_image_name": "<string>",
"container_name": "<string>",
"runtime_name": "<string>"
},
"createdAt": "<string>",
"deletedAt": "<string>",
"kube_meta": {
"cluster_id": "<string>",
"container_name": "<string>",
"namespace": "<string>",
"node_name": "<string>",
"pod_name": "<string>"
}
},
"updatedAt": "<string>"
}
],
"page": 123,
"page_count": 123,
"page_size": 123,
"total_count": 123
}{
"status": 123,
"code": "<string>",
"request_id": "<string>",
"validation_details": [
{
"code": "<string>",
"field": "<string>",
"message": "<string>",
"param": "<string>"
}
]
}Path Parameters
Account id
Query Parameters
Cluster ids
Kubernetes namespaces
Kubernetes Pod names
Container names
Container image digests
Only return insights with drift
Comma-separated insight states to include. One of: no_data, capturing_baseline, baseline_captured, drift_detected
Comma-separated insight states to exclude. Takes priority over include_states. One of: no_data, capturing_baseline, baseline_captured, drift_detected
Only return insights for Running containers
Query string to filter insights
Page number starting from 1
Page size. Default: 50
Sort by field. Default: created_at:desc
⌘I