Use REST API to fetch container/workload vulnerabilities

Container Vulnerabilities are available from Assets > Containers > Vulnerabilities.  The list of vulnerabilities can be exported as CVS.

To programmatically pull similar result using the REST API , the following explains how.  See Automating NeuVector for an example shell script to make API calls.

It is a two-step process to pull the vulnerabilities of containers.  First, retrieve the list of workloads, then make the call to pull the vulnerabilities for the workloads needed.

Obtain a list of workloads endpoint

/v1/workload

Sample workload details

{
            "applications": [
                "Redis"
            ],
            "author": "",
...
            "domain": "demo",
            "enforcer_id": "465e8a72afbc8cf9ad874d2ee0f3fa8cfb066724f934eb14533906e6c0536e0e",
            "exit_code": 0,
            "finished_at": "",
...
            "id": "306c7420d64c3c045c4af9b483bdf377a5d11ebea7a5723ade66a99a1a6e0e78",
            "image": "k8s.gcr.io/redis:e2e",
            "image_id": "ab65eda91060dd04525928b419085137136e37eafd1af97f1eef4ab4f5899c9c",
..
            "scan_summary": {
                "base_os": "ubuntu:14.04",
                "cvedb_create_time": "2021-01-28T10:47:23Z",
                "high": 632,
                "medium": 381,
                "result": "succeeded",
                "scanned_at": "2021-01-29T03:57:50Z",
                "scanned_timestamp": 1611892670,
                "scanner_version": "2.188",
                "status": "finished"
            },
...
        },

Iterate through and make the call for the scan results (:id is to be replaced by actual workload ID)

/v1/scan/workload/:id

Example call for the above workload

/v1/scan/workload/306c7420d64c3c045c4af9b483bdf377a5d11ebea7a5723ade66a99a1a6e0e78

Sample workload scan results