--- title: Lacework slug: connectors/lacework docTags: createdAt: 2026-06-09T16:29:37.923Z --- This connector integrates with Lacework API. ## Prerequisites The Lacework connector requires a host, Key ID, and Secret Key. ## Capabilities The Lacework connector has the following capabilities: - Audit Logs Searching - Cloud Accounts Management - Get Events - Get Vulnerabilities - Queries Management For further information about LQL you can visit the [offical LQL documentation.](https://docs.lacework.com/lql-overview) ## About Filters Filters can be optionally specified in the request body. For more information about using filters, see the [Simple & Advanced Search section](https://swimlane.lacework.net/api/v2/docs/#tag/OVERVIEW). This connector was last tested against product version: 2. # Configurations ## Lacework Auth Lacework ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | api\_key | | string | Required | | api\_secret | | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Close Alert Close Lacework Alert with a comment ### Endpoint - **URL:** `Queries/execute` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------- | | `alert_id` | string | Required | Unique identifier | | `reason` | number | Required | Response reason phrase | | `comment` | string | Optional | Parameter for Close Alert | ### Input Example `{"alert_id":"12345","reason":0,"comment":"Closing as false positive."}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ---------------- | | `message` | string | Response message | ### Output Example `{"message":"string"}` ## Create Compliance Exceptions Create Lacework Compliance Exceptions ### Endpoint - **URL:** `/api/v2/VulnerabilityExceptions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------- | -------- | ------------ | ------------------------------------------ | | `params` | object | Optional | Parameter for Create Compliance Exceptions | | `params.exceptionName` | string | Optional | Name of the resource | | `params.exceptionReason` | string | Optional | Response reason phrase | | `params.resourceScope` | object | Optional | Parameter for Create Compliance Exceptions | | `params.resourceScope.imageId` | array | Optional | Unique identifier | | `params.resourceScope.imageTag` | array | Optional | Parameter for Create Compliance Exceptions | | `params.resourceScope.registry` | array | Optional | Parameter for Create Compliance Exceptions | | `params.resourceScope.repository` | array | Optional | Parameter for Create Compliance Exceptions | | `params.resourceScope.namespace` | array | Optional | Name of the resource | | `params.vulnerabilityCriteria` | object | Optional | Parameter for Create Compliance Exceptions | | `params.vulnerabilityCriteria.cve` | array | Optional | Parameter for Create Compliance Exceptions | | `params.vulnerabilityCriteria.package` | array | Optional | Parameter for Create Compliance Exceptions | | `params.vulnerabilityCriteria.severity` | array | Optional | Parameter for Create Compliance Exceptions | | `params.vulnerabilityCriteria.fixable` | array | Optional | Parameter for Create Compliance Exceptions | | `params.expiryTime` | string | Optional | Time value | | `params.state` | number | Optional | Parameter for Create Compliance Exceptions | | `params.props` | object | Optional | Parameter for Create Compliance Exceptions | | `params.props.description` | string | Optional | Parameter for Create Compliance Exceptions | | `params.props.createdBy` | string | Optional | Parameter for Create Compliance Exceptions | | `params.props.updatedBy` | string | Optional | Parameter for Create Compliance Exceptions | | `params.exceptionType` | string | Optional | Type of the resource | ### Input Example `{"params":{"exceptionName":"string","exceptionReason":"False Positive","resourceScope":{"imageId":["string"],"imageTag":["string"],"registry":["string"],"repository":["string"],"namespace":["string"]},"vulnerabilityCriteria":{"cve":["string"],"package":[{}],"severity":["Info"],"fixable":[0]},"expiryTime":"string","state":1,"props":{"description":"string","createdBy":"string","updatedBy":"string"},"exceptionType":"Container"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | --------------- | | `data` | object | Response data | | `data.createdTime` | string | Response data | | `data.exceptionGuid` | string | Response data | | `data.exceptionName` | string | Response data | | `data.exceptionReason` | string | Response data | | `data.exceptionType` | string | Response data | | `data.expiryTime` | string | Response data | | `data.props` | object | Response data | | `data.props.description` | string | Response data | | `data.props.createdBy` | string | Response data | | `data.props.updatedBy` | string | Response data | | `data.resourceScope` | object | Response data | | `data.resourceScope.registry` | array | Response data | | `data.state` | number | Response data | | `data.updatedTime` | string | Response data | | `data.vulnerabilityCriteria` | object | Response data | | `data.vulnerabilityCriteria.severity` | array | Response data | ### Output Example `{"data":{"createdTime":"2021-12-18T08:30:00Z","exceptionGuid":"LWABC","exceptionName":"Container Vulnerability Exception","exceptionReason":"Accepted Risk","exceptionType":"Container","expiryTime":"2021-12-28T08:30:00Z","props":{"description":"This is a Container Vulnerability Exception","createdBy":"abc@xyz.com","updatedBy":"abc@xyz.com"},"resourceScope":{"registry":[]},"state":1,"updatedTime":"2021-12-18T08:30:00Z","vulnerabilityCriteria":{"severity":[]}}}` ## Create Vulnerability Exceptions Create Lacework Vulnerability Exceptions ### Endpoint - **URL:** `/api/v2/VulnerabilityExceptions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------- | -------- | ------------ | --------------------------------------------- | | `params` | object | Optional | Parameter for Create Vulnerability Exceptions | | `params.exceptionName` | string | Optional | Name of the resource | | `params.exceptionReason` | string | Optional | Response reason phrase | | `params.resourceScope` | object | Optional | Parameter for Create Vulnerability Exceptions | | `params.resourceScope.imageId` | array | Optional | Unique identifier | | `params.resourceScope.imageTag` | array | Optional | Parameter for Create Vulnerability Exceptions | | `params.resourceScope.registry` | array | Optional | Parameter for Create Vulnerability Exceptions | | `params.resourceScope.repository` | array | Optional | Parameter for Create Vulnerability Exceptions | | `params.resourceScope.namespace` | array | Optional | Name of the resource | | `params.vulnerabilityCriteria` | object | Optional | Parameter for Create Vulnerability Exceptions | | `params.vulnerabilityCriteria.cve` | array | Optional | Parameter for Create Vulnerability Exceptions | | `params.vulnerabilityCriteria.package` | array | Optional | Parameter for Create Vulnerability Exceptions | | `params.vulnerabilityCriteria.severity` | array | Optional | Parameter for Create Vulnerability Exceptions | | `params.vulnerabilityCriteria.fixable` | array | Optional | Parameter for Create Vulnerability Exceptions | | `params.expiryTime` | string | Optional | Time value | | `params.state` | number | Optional | Parameter for Create Vulnerability Exceptions | | `params.props` | object | Optional | Parameter for Create Vulnerability Exceptions | | `params.props.description` | string | Optional | Parameter for Create Vulnerability Exceptions | | `params.props.createdBy` | string | Optional | Parameter for Create Vulnerability Exceptions | | `params.props.updatedBy` | string | Optional | Parameter for Create Vulnerability Exceptions | | `params.exceptionType` | string | Optional | Type of the resource | ### Input Example `{"params":{"exceptionName":"string","exceptionReason":"False Positive","resourceScope":{"imageId":["string"],"imageTag":["string"],"registry":["string"],"repository":["string"],"namespace":["string"]},"vulnerabilityCriteria":{"cve":["string"],"package":[{}],"severity":["Info"],"fixable":[0]},"expiryTime":"string","state":1,"props":{"description":"string","createdBy":"string","updatedBy":"string"},"exceptionType":"Container"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | --------------- | | `data` | object | Response data | | `data.createdTime` | string | Response data | | `data.exceptionGuid` | string | Response data | | `data.exceptionName` | string | Response data | | `data.exceptionReason` | string | Response data | | `data.exceptionType` | string | Response data | | `data.expiryTime` | string | Response data | | `data.props` | object | Response data | | `data.props.description` | string | Response data | | `data.props.createdBy` | string | Response data | | `data.props.updatedBy` | string | Response data | | `data.resourceScope` | object | Response data | | `data.resourceScope.registry` | array | Response data | | `data.state` | number | Response data | | `data.updatedTime` | string | Response data | | `data.vulnerabilityCriteria` | object | Response data | | `data.vulnerabilityCriteria.severity` | array | Response data | ### Output Example `{"data":{"createdTime":"2021-12-18T08:30:00Z","exceptionGuid":"LWABC","exceptionName":"Container Vulnerability Exception","exceptionReason":"Accepted Risk","exceptionType":"Container","expiryTime":"2021-12-28T08:30:00Z","props":{"description":"This is a Container Vulnerability Exception","createdBy":"abc@xyz.com","updatedBy":"abc@xyz.com"},"resourceScope":{"registry":[]},"state":1,"updatedTime":"2021-12-18T08:30:00Z","vulnerabilityCriteria":{"severity":[]}}}` ## Get Alert Metadata Lacework Get Alert Metadata ### Endpoint - **URL:** `/api/v2/Alerts/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------- | | `alert_id` | string | Required | Alert ID to fetch scope from | | `scope` | string | Required | Which scope to fetch | ### Input Example `{"alert_id":"string","scope":"string"}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | ------------------------------------ | | `alertId` | string | Unique identifier | | `startTime` | string | Time value | | `alertType` | string | Type of the resource | | `severity` | string | Output field: severity | | `internetExposure` | string | Output field: internetExposure | | `reachability` | string | Output field: reachability | | `derivedFields` | string | Output field: derivedFields | | `endTime` | string | Time value | | `lastUserUpdatedTime` | string | Time value | | `status` | string | Status value | | `alertName` | string | Name of the resource | | `alertInfo` | string | Output field: alertInfo | | `policyId` | string | Unique identifier | | `evolvingAlert` | string | Output field: evolvingAlert | | `entityMap` | object | Output field: entityMap | | `entityMap.RecId` | string | Unique identifier | | `entityMap.Resource` | array | Output field: entityMap.Resource | | `entityMap.Resource.KEY` | string | Output field: entityMap.Resource.KEY | | `entityMap.ViolationReason` | string | Response reason phrase | ### Output Example `{"alertId":"string","startTime":"string","alertType":"string","severity":"string","internetExposure":"string","reachability":"string","derivedFields":{"category":"string","sub_category":"string","source":"string"},"endTime":"string","lastUserUpdatedTime":"string","status":"string","alertName":"string","alertInfo":{"subject":"string","description":"string"},"policyId":"string","evolvingAlert":"string","entityMap":{"RecId":"string","Resource":[{}],"ViolationReason":"string"}}` ## Get Alerts Lacework Get Alerts API ### Endpoint - **URL:** `api/v2/Alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------ | | `start_time` | string | Required | Start time to search for Alerts | | `end_time` | string | Required | End time to search for Alerts | | `alert_filter` | string | Required | Add any alert types that should be fetched | ### Input Example `{"start_time":"string","end_time":"string","alert_filter":"string"}` ## Get Alerts and Metadata Get Alerts from Lacework ### Endpoint - **URL:** `api/v2/Alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------ | | `start_time` | string | Required | Start time to search for Alerts | | `end_time` | string | Required | End time to search for Alerts | | `alert_filter` | string | Required | Add any alert types that should be fetched | ### Input Example `{"start_time":"string","end_time":"string","alert_filter":"string"}` ## Get Cloud Accounts Lacework Get Cloud Accounts ### Endpoint - **URL:** `api/v2/CloudAccounts` - **Method:** `GET` ## Get Host Vulnerabilities Run a query against lacework ### Endpoint - **URL:** `Vulnerabilities/Containers/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------------------- | -------- | ------------ | -------------------------------------- | | `primary_query_endpoint` | string | Optional | Parameter for Get Host Vulnerabilities | | `primary_query_filter` | array | Optional | Parameter for Get Host Vulnerabilities | | `primary_query_filter.field` | string | Optional | Parameter for Get Host Vulnerabilities | | `primary_query_filter.expression` | string | Optional | Parameter for Get Host Vulnerabilities | | `primary_query_filter.values` | array | Optional | Value for the parameter | | `primary_query_filter.value` | string | Optional | Value for the parameter | | `primary_query_return_fields` | array | Optional | Parameter for Get Host Vulnerabilities | | `secondary_query_endpoint` | string | Optional | Parameter for Get Host Vulnerabilities | | `secondary_query_filter` | array | Optional | Parameter for Get Host Vulnerabilities | | `secondary_query_filter.field` | string | Optional | Parameter for Get Host Vulnerabilities | | `secondary_query_filter.expression` | string | Optional | Parameter for Get Host Vulnerabilities | | `secondary_query_filter.values` | array | Optional | Value for the parameter | | `secondary_query_filter.value` | number | Optional | Value for the parameter | | `master_key` | string | Optional | Parameter for Get Host Vulnerabilities | | `field_mappings` | object | Optional | Parameter for Get Host Vulnerabilities | | `field_mappings.agent_id` | object | Optional | Unique identifier | | `field_mappings.agent_id.ReferenceLookup` | object | Optional | Unique identifier | | `field_mappings.agent_id.ReferenceLookup.key` | string | Optional | Unique identifier | | `field_mappings.agent_id.ReferenceLookup.field` | string | Optional | Unique identifier | | `field_mappings.agent_id.ReferenceLookup.data` | string | Optional | Response data | | `field_mappings.agent_id.ReferenceLookup.multi_value` | boolean | Optional | Unique identifier | | `field_mappings.cloud_instance_id` | object | Optional | Unique identifier | | `field_mappings.cloud_instance_id.ReferenceLookup` | object | Optional | Unique identifier | | `field_mappings.cloud_instance_id.ReferenceLookup.key` | string | Optional | Unique identifier | | `field_mappings.cloud_instance_id.ReferenceLookup.field` | string | Optional | Unique identifier | ### Input Example `{"primary_query_endpoint":"Entities/Machines/search","primary_query_filter":[{"field":"severity","expression":"in","values":["Critical","High","Medium"]},{"field":"status","expression":"in","values":["New","Active"]},{"field":"fixInfo.fix_available","expression":"eq","value":1}],"primary_query_return_fields":["mid","machineTags"],"secondary_query_endpoint":"Vulnerabilities/Hosts/search","secondary_query_filter":[{"field":"severity","expression":"in","values":["Critical","High","Medium"]},{"field":"status","expression":"in","values":["New","Active"]},{"field":"fixInfo.fix_available","expression":"eq","value":1}],"master_key":"vulnerability_id","field_mappings":{"agent_id":{"ReferenceLookup":{"key":"mid","field":"mid","data":"primary_query","multi_value":false}},"cloud_instance_id":{"ReferenceLookup":{"key":"mid","field":"machineTags_InstanceId","data":"primary_query","multi_value":false}},"cloud_account_id":{"ReferenceLookup":{"key":"mid","field":"machineTags_Account","data":"primary_query","multi_value":false}},"ami_id":{"ReferenceLookup":{"key":"mid","field":"machineTags_AmiId","data":"primary_query","multi_value":false}},"vulnerability_id":"vulnId","vulnerability_meta_name":"featureKey.name","vulnerability_meta_namespace":"featureKey.namespace","vulnerability_description_text":"cveProps.description","vulnerability_reference":"cveProps.link","vulnerability_meta_version_current":"featureKey.version_installed","vulnerability_meta_version_fixed":"fixInfo.fixed_version","vulnerability_severity":"severity","vulnerability_category":"status"}}` ## Get Host Vulnerabilities Bad Run a query against lacework ### Endpoint - **URL:** `Vulnerabilities/Containers/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------ | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `filter` | array | Optional | Parameter for Get Host Vulnerabilities Bad | | `filter.field` | string | Optional | Parameter for Get Host Vulnerabilities Bad | | `filter.expression` | string | Optional | Parameter for Get Host Vulnerabilities Bad | | `filter.values` | array | Optional | Value for the parameter | | `filter.value` | string | Optional | Value for the parameter | | `returns` | array | Optional | Parameter for Get Host Vulnerabilities Bad | ### Input Example `{"start_time":"-7 days","end_time":"now","filter":[{"field":"severity","expression":"in","values":["Critical","High","Medium"]},{"field":"status","expression":"in","values":["New","Active"]},{"field":"fixInfo.fix_available","expression":"eq","value":"1"}],"returns":["mid","severity","vulnId","evalCtx","fixInfo","featureKey"]}` ### Output Example `{"evalCtx":{"exception_props":[],"hostname":"ip-10-160-5-194.ec2.internal","mc_eval_guid":"6398c97cd2e9172783de42186df1a694"},"featureKey":{"name":"p11-kit-trust","namespace":"amzn:2","package_active":0,"package_path":"","version_installed":"0:0.23.22-1.amzn2.0.1"},"fixInfo":{},"mid":6420720632738334000}` ## Get Machines Run a query against lacework ### Endpoint - **URL:** `Vulnerabilities/Containers/search` - **Method:** `GET` ## Get Report Run a query against lacework to hunt for IPs ### Endpoint - **URL:** `Reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------ | | `params` | object | Optional | Parameter for Get Report | | `params.primaryQueryId` | string | Optional | Unique identifier | | `params.secondaryQueryId` | string | Optional | Unique identifier | | `params.format` | string | Optional | Parameter for Get Report | | `params.reportType` | string | Optional | Type of the resource | ### Input Example `{"params":{"primaryQueryId":"627166550282","secondaryQueryId":"","format":"json","reportType":"AWS_SOC_Rev2"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | --------------- | | `data` | array | Response data | | `data.reportType` | string | Response data | | `data.reportTitle` | string | Response data | | `data.custGuid` | string | Response data | | `data.envGuid` | string | Response data | | `data.recommendations` | array | Response data | | `data.recommendations.ACCOUNT_ID` | string | Response data | | `data.recommendations.ACCOUNT_ALIAS` | string | Response data | | `data.recommendations.START_TIME` | number | Response data | | `data.recommendations.SUPPRESSIONS` | array | Response data | | `data.recommendations.SUPPRESSIONS.file_name` | string | Response data | | `data.recommendations.SUPPRESSIONS.file` | string | Response data | | `data.recommendations.INFO_LINK` | string | Response data | | `data.recommendations.ASSESSED_RESOURCE_COUNT` | number | Response data | | `data.recommendations.STATUS` | string | Response data | | `data.recommendations.REC_ID` | string | Response data | | `data.recommendations.CATEGORY` | string | Response data | | `data.recommendations.SERVICE` | string | Response data | | `data.recommendations.TITLE` | string | Response data | | `data.recommendations.VIOLATIONS` | array | Response data | | `data.recommendations.VIOLATIONS.reasons` | array | Response data | | `data.recommendations.VIOLATIONS.resource` | string | Response data | | `data.recommendations.RESOURCE_COUNT` | number | Response data | | `data.recommendations.SEVERITY` | number | Response data | | `data.summary` | array | Response data | ### Output Example `{"data":[],"ok":true,"message":"string"}` ## Post Comments Post a comment on the Lacework alert ### Endpoint - **URL:** `/api/v2/Alerts/{alertId}/comment` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------- | | `alert_id` | string | Required | Unique identifier | | `comment` | string | Required | Parameter for Post Comments | ### Input Example `{"alert_id":"12345","comment":"Closing as false positive."}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | --------------- | | `data` | object | Response data | | `data.id` | number | Response data | | `data.alertId` | number | Response data | | `data.createdTime` | string | Response data | | `data.entryType` | string | Response data | | `data.entryAuthorType` | string | Response data | | `data.message` | object | Response data | | `data.message.value` | string | Response data | | `data.externalTime` | string | Response data | | `data.user` | object | Response data | | `data.user.userGuid` | string | Response data | | `data.user.username` | string | Response data | | `data.updateContext` | object | Response data | ### Output Example `{"data":{"id":211250,"alertId":871115,"createdTime":"2022-07-18T18:28:30.739Z","entryType":"Comment","entryAuthorType":"UserUpdate","message":{"value":"test comment"},"externalTime":"","user":{"userGuid":"LW123_6FA99157890E373006F7EE3FA926B02C38D547BD6C79F1D","username":"support@lacework.net"},"updateContext":{}}}` ## Query IP Indicators Run a query against lacework to hunt for IPs ### Endpoint - **URL:** `Queries/execute` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------- | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `ips` | array | Optional | Parameter for Query IP Indicators | ### Input Example `{"start_time":"-1 days","end_time":"now","ips":["8.8.8.8","9.9.9.9"]}` ## Query Lacework Run a query against lacework ### Endpoint - **URL:** `Vulnerabilities/Containers/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------- | | `start_time` | string | Required | Start time to search for Alerts | | `end_time` | string | Required | Start time to search for Alerts | | `query_endpoint` | string | Required | Endpoint to query data from | | `filter` | array | Required | Parameter for Query Lacework | | `filter.expression` | string | Optional | Parameter for Query Lacework | | `filter.field` | string | Optional | Parameter for Query Lacework | | `filter.value` | string | Optional | Value for the parameter | | `filter.values` | array | Optional | Value for the parameter | | `returns` | array | Optional | Which items to return from API call | ### Input Example `{"start_time":"string","end_time":"string","query_endpoint":"string","filter":[{"expression":"string","field":"string","value":"string","values":["string"]}],"returns":["string"]}` ## Search Active Containers Search Active Containers API ### Endpoint - **URL:** `api/v2/Entities/Containers/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `data_body` | object | Optional | Data Body | | `headers` | object | Optional | Request Headers | ### Input Example `{"path_parameters":{},"parameters":{},"data_body":{},"headers":{}}` ## Search Agent Information Search Agent Information API ### Endpoint - **URL:** `/api/v2/AgentInfo/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------- | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `filters` | array | Optional | Parameter for Search Agent Information | | `filters.field` | string | Optional | Parameter for Search Agent Information | | `filters.expression` | string | Optional | Parameter for Search Agent Information | | `filters.value` | string | Optional | Value for the parameter | | `returns` | array | Optional | Parameter for Search Agent Information | ### Input Example `{"start_time":"-1 days","end_time":"now","filters":[{"field":"status","expression":"eq","value":"ACTIVE"}],"returns":["hostname","ipAddr","os","agentVersion","status"]}` ## Search Audit Logs Search Audit Logs API ### Endpoint - **URL:** `api/v2/AuditLogs/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------- | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `filter` | array | Optional | Parameter for Search Audit Logs | | `filter.field` | string | Optional | Parameter for Search Audit Logs | | `filter.expression` | string | Optional | Parameter for Search Audit Logs | | `filter.value` | string | Optional | Value for the parameter | | `filter.values` | array | Optional | Value for the parameter | | `returns` | array | Optional | Parameter for Search Audit Logs | ### Input Example `{"start_time":"-1 days","end_time":"now","returns":["accountName","createdTime","eventDescription","eventName","userAction","userName"]}` ## Search Compliance Evaluations Search Compliance Evaluations API ### Endpoint - **URL:** `api/v2/Configs/ComplianceEvaluations/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------- | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `filter` | array | Optional | Parameter for Search Compliance Evaluations | | `filter.field` | string | Optional | Parameter for Search Compliance Evaluations | | `filter.expression` | string | Optional | Parameter for Search Compliance Evaluations | | `filter.value` | string | Optional | Value for the parameter | | `returns` | array | Optional | Parameter for Search Compliance Evaluations | | `dataset` | string | Optional | Response data | ### Input Example `{"start_time":"-1 days","end_time":"now","filter":[{"field":"status","expression":"eq","value":"NonCompliant"},{"field":"account.AccountId","expression":"eq","value":"812212113623"}],"returns":["account","id","recommendation","severity","status"],"dataset":"AwsCompliance"}` ## Search Container Vulnerabilities Search Active Containers API ### Endpoint - **URL:** `api/v2/Entities/Containers/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------------- | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `filter` | array | Optional | Parameter for Search Container Vulnerabilities | | `filter.field` | string | Optional | Parameter for Search Container Vulnerabilities | | `filter.expression` | string | Optional | Parameter for Search Container Vulnerabilities | | `filter.value` | string | Optional | Value for the parameter | | `returns` | array | Optional | Parameter for Search Container Vulnerabilities | ### Input Example `{"start_time":"-1 days","end_time":"now","filter":[{"field":"severity","expression":"eq","value":"Medium"},{"field":"fixInfo.fix_available","expression":"eq","value":1},{"field":"evalCtx.image_info.digest","expression":"eq","value":"sha256:07aea1edd530054adb739335edd8d9c7fc9c0cbbd982c7250b24442fefa0d0b8"}],"returns":["imageId","severity","status","vulnId","evalCtx","fixInfo","featureKey"]}` ## Search Inventory Lacework Search Inventory API ### Endpoint - **URL:** `api/v2/Inventory/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------ | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `filter` | array | Optional | Parameter for Search Inventory | | `filter.field` | string | Optional | Parameter for Search Inventory | | `filter.expression` | string | Optional | Parameter for Search Inventory | | `filter.value` | string | Optional | Value for the parameter | | `filter.values` | array | Optional | Value for the parameter | | `returns` | array | Optional | Parameter for Search Inventory | | `csp` | string | Optional | Parameter for Search Inventory | ### Input Example `{"start_time":"-1 weeks","end_time":"now","filter":[{"field":"resourceRegion","expression":"eq","value":"ap-southeast-2"},{"field":"cloudDetails.accountID","expression":"eq","value":"16459126737"},{"field":"resourceType","expression":"in","values":["acm:certificate","ec2:customer-gateway","ec2:instance","ec2:internet-gateway","ec2:natgateway","ec2:security-group","ec2:subnet","ec2:vpc","ec2:vpc-endpoint","ec2:vpc-flow-log","ec2:vpn-connection","ec2:vpn-gateway","eks:cluster","elbv2:listener","elbv2:listener-rule","elbv2:loadbalancer","elbv2:target-group","s3:bucket"]}],"returns":["urn","cloudDetails","resourceConfig","resourceId","resourceType"],"csp":"AWS"}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |