List Container Runtime Insights

curl -X GET "https://api.prd.rad.security/accounts/example_string/container_runtime_insights?cluster_ids=example_string&namespaces=John%20Doe&pod_names=John%20Doe&container_names=John%20Doe&container_image_digests=example_string&drift_only=true&include_states=example_string&exclude_states=example_string&running_only=true&q=example_string&page=25&page_size=25&sort=example_string" \
  -H "Content-Type: application/json"

import requests
import json

url = "https://api.prd.rad.security/accounts/example_string/container_runtime_insights?cluster_ids=example_string&namespaces=John%20Doe&pod_names=John%20Doe&container_names=John%20Doe&container_image_digests=example_string&drift_only=true&include_states=example_string&exclude_states=example_string&running_only=true&q=example_string&page=25&page_size=25&sort=example_string"
headers = {
  "Content-Type": "application/json"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://api.prd.rad.security/accounts/example_string/container_runtime_insights?cluster_ids=example_string&namespaces=John%20Doe&pod_names=John%20Doe&container_names=John%20Doe&container_image_digests=example_string&drift_only=true&include_states=example_string&exclude_states=example_string&running_only=true&q=example_string&page=25&page_size=25&sort=example_string", {
  method: "GET",
  headers: {
  "Content-Type": "application/json"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://api.prd.rad.security/accounts/example_string/container_runtime_insights?cluster_ids=example_string&namespaces=John%20Doe&pod_names=John%20Doe&container_names=John%20Doe&container_image_digests=example_string&drift_only=true&include_states=example_string&exclude_states=example_string&running_only=true&q=example_string&page=25&page_size=25&sort=example_string", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api.prd.rad.security/accounts/example_string/container_runtime_insights?cluster_ids=example_string&namespaces=John%20Doe&pod_names=John%20Doe&container_names=John%20Doe&container_image_digests=example_string&drift_only=true&include_states=example_string&exclude_states=example_string&running_only=true&q=example_string&page=25&page_size=25&sort=example_string')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'

response = http.request(request)
puts response.body

{
  "entries": [
    {
      "accountID": "example_string",
      "analysis": [
        {
          "accountID": "example_string",
          "action": "example_string",
          "category": "example_string",
          "clusterID": "example_string",
          "createdAt": "example_string",
          "deletedAt": "example_string",
          "description": "example_string",
          "falsePositive": true,
          "falsePositiveMatchedRules": [
            "example_string"
          ],
          "falsePositiveReason": "example_string",
          "id": "example_string",
          "insightID": "example_string",
          "insightIDs": [
            "example_string"
          ],
          "llmProvider": "example_string",
          "maliciousProcessIDs": [
            "example_string"
          ],
          "mitreAttackTactics": [
            {
              "id": "example_string",
              "link": "example_string",
              "name": "John Doe"
            }
          ],
          "mitreAttackTechniques": [
            {
              "id": "example_string",
              "link": "example_string",
              "name": "John Doe",
              "tactics": [
                {
                  "id": "example_string",
                  "link": "example_string",
                  "name": "John Doe"
                }
              ]
            }
          ],
          "model": "example_string",
          "partial": true,
          "prompt": "example_string",
          "promptDigest": "example_string",
          "refs": [
            "example_string"
          ],
          "remediation": "example_string",
          "severity": "example_string",
          "stale": true,
          "status": "example_string",
          "totalRequests": 42,
          "triggeredBy": "example_string",
          "updatedAt": "example_string"
        }
      ],
      "baseline": {
        "apiVersion": "example_string",
        "containers": [
          {
            "id": "example_string",
            "imageDigest": "example_string",
            "imageName": "John Doe",
            "name": "John Doe",
            "processes": [
              {
                "children": [
                  {}
                ],
                "connections": [
                  {
                    "address": "123 Main St",
                    "drift": true,
                    "hostname": "John Doe",
                    "k8sName": "John Doe",
                    "k8sNamespace": "John Doe",
                    "port": 42,
                    "timestamp": "example_string",
                    "trustedCIDR": "example_string"
                  }
                ],
                "drift": true,
                "files": [
                  {
                    "drift": true,
                    "path": "example_string",
                    "timestamp": "example_string"
                  }
                ],
                "gid": 123,
                "id": "example_string",
                "parentId": "example_string",
                "programs": [
                  {
                    "args": [
                      "example_string"
                    ],
                    "comm": "example_string",
                    "drift": true,
                    "hasPattern": true,
                    "sampleArgs": [
                      [
                        "example_string"
                      ]
                    ],
                    "timestamp": "example_string"
                  }
                ],
                "repetition": {
                  "execCount": 10,
                  "recentTimestamp": "example_string"
                },
                "timestamp": "example_string",
                "trustedIPPrefixes": [
                  {
                    "cidr": "example_string",
                    "name": "John Doe",
                    "port": 42
                  }
                ],
                "uid": 123
              }
            ]
          }
        ],
        "kind": "example_string",
        "metadata": {
          "creationTimestamp": "example_string"
        }
      },
      "baselineCaptured": true,
      "baselineID": "example_string",
      "clusterID": "example_string",
      "createdAt": "example_string",
      "deletedAt": "example_string",
      "hasDrift": true,
      "id": "example_string",
      "llmAnalysis": {
        "accountID": "example_string",
        "action": "example_string",
        "category": "example_string",
        "clusterID": "example_string",
        "createdAt": "example_string",
        "deletedAt": "example_string",
        "description": "example_string",
        "falsePositive": true,
        "falsePositiveMatchedRules": [
          "example_string"
        ],
        "falsePositiveReason": "example_string",
        "id": "example_string",
        "insightID": "example_string",
        "insightIDs": [
          "example_string"
        ],
        "llmProvider": "example_string",
        "maliciousProcessIDs": [
          "example_string"
        ],
        "mitreAttackTactics": [
          {
            "id": "example_string",
            "link": "example_string",
            "name": "John Doe"
          }
        ],
        "mitreAttackTechniques": [
          {
            "id": "example_string",
            "link": "example_string",
            "name": "John Doe",
            "tactics": [
              {
                "id": "example_string",
                "link": "example_string",
                "name": "John Doe"
              }
            ]
          }
        ],
        "model": "example_string",
        "partial": true,
        "prompt": "example_string",
        "promptDigest": "example_string",
        "refs": [
          "example_string"
        ],
        "remediation": "example_string",
        "severity": "example_string",
        "stale": true,
        "status": "example_string",
        "totalRequests": 42,
        "triggeredBy": "example_string",
        "updatedAt": "example_string"
      },
      "malicious": true,
      "ongoing": {
        "apiVersion": "example_string",
        "containers": [
          {
            "id": "example_string",
            "imageDigest": "example_string",
            "imageName": "John Doe",
            "name": "John Doe",
            "processes": [
              {
                "children": [
                  {}
                ],
                "connections": [
                  {
                    "address": "123 Main St",
                    "drift": true,
                    "hostname": "John Doe",
                    "k8sName": "John Doe",
                    "k8sNamespace": "John Doe",
                    "port": 42,
                    "timestamp": "example_string",
                    "trustedCIDR": "example_string"
                  }
                ],
                "drift": true,
                "files": [
                  {
                    "drift": true,
                    "path": "example_string",
                    "timestamp": "example_string"
                  }
                ],
                "gid": 123,
                "id": "example_string",
                "parentId": "example_string",
                "programs": [
                  {
                    "args": [
                      "example_string"
                    ],
                    "comm": "example_string",
                    "drift": true,
                    "hasPattern": true,
                    "sampleArgs": [
                      [
                        "example_string"
                      ]
                    ],
                    "timestamp": "example_string"
                  }
                ],
                "repetition": {
                  "execCount": 10,
                  "recentTimestamp": "example_string"
                },
                "timestamp": "example_string",
                "trustedIPPrefixes": [
                  {
                    "cidr": "example_string",
                    "name": "John Doe",
                    "port": 42
                  }
                ],
                "uid": 123
              }
            ]
          }
        ],
        "kind": "example_string",
        "metadata": {
          "creationTimestamp": "example_string"
        }
      },
      "severity": "example_string",
      "state": "example_string",
      "summary": {
        "container_meta": {
          "container_id": "example_string",
          "container_image_digest": "example_string",
          "container_image_name": "John Doe",
          "container_name": "John Doe",
          "runtime_name": "John Doe"
        },
        "createdAt": "example_string",
        "deletedAt": "example_string",
        "kube_meta": {
          "cluster_id": "example_string",
          "container_name": "John Doe",
          "namespace": "John Doe",
          "node_name": "John Doe",
          "pod_name": "John Doe"
        }
      },
      "updatedAt": "example_string"
    }
  ],
  "page": 25,
  "page_count": 25,
  "page_size": 25,
  "total_count": 10
}

{
  "code": "example_string",
  "request_id": "example_string",
  "status": 42,
  "validation_details": [
    {
      "code": "example_string",
      "field": "example_string",
      "message": "example_string",
      "param": "example_string"
    }
  ]
}

GET

/accounts/{account_id}/container_runtime_insights

GET

Base URLstring

Target server for requests. Edit to use your own host.

Account id

Cluster ids

Kubernetes namespaces

query

pod_namesstring

Kubernetes Pod names

query

container_namesstring

Container names

query

container_image_digestsstring

Container image digests

query

drift_onlyboolean

Only return insights with drift

query

include_statesstring

Comma-separated insight states to include. One of: no_data, capturing_baseline, baseline_captured, drift_detected

query

exclude_statesstring

Comma-separated insight states to exclude. Takes priority over include_states. One of: no_data, capturing_baseline, baseline_captured, drift_detected

query

running_onlyboolean

Only return insights for Running containers

query

qstring

Query string to filter insights

query

pageinteger

Page number starting from 1

query

page_sizeinteger

Page size. Default: 50

query

sortstring

Sort by field. Default: created_at:desc

Request Preview

Response

Response will appear here after sending the request

Path Parameters

account_idstring

Required

Account id

Query Parameters

cluster_idsstring

Cluster ids

namespacesstring

Kubernetes namespaces

pod_namesstring

Kubernetes Pod names

container_namesstring

Container names

container_image_digestsstring

Container image digests

drift_onlyboolean

Only return insights with drift

include_statesstring

Comma-separated insight states to include. One of: no_data, capturing_baseline, baseline_captured, drift_detected

exclude_statesstring

Comma-separated insight states to exclude. Takes priority over include_states. One of: no_data, capturing_baseline, baseline_captured, drift_detected

running_onlyboolean

Only return insights for Running containers

qstring

Query string to filter insights

pageinteger

Page number starting from 1

page_sizeinteger

Page size. Default: 50

sortstring

Sort by field. Default: created_at:desc