Fetch Image Details

Parameter	Mandatory/Optional	Data Type	Description
imageSha	Mandatory	string	Specify the SHA value of a specific image in the user’s scope.
scanDetails	Optional	string	Specify the following values: For malware information: malware. For secrets information: secrets. For compliance information: compliance. You can specify multiple values separated by comma.

API request

curl -X 'GET' \
'<qualys_base_url>/csapi/v1.3/images/fa7c845c82ad89b542233b42712cf419b409f6b8b28464c441d6e2645f563bd5' \
-H 'accept: application/json' \
-H Authorization: Bearer <Token> \
-H 'Content-Type: application/json'

Response

{
  "created": "1603477517000",
  "updated": "1605017537578",
  "lastUsedDate;: " 1716251515814 ",
  "author": "Couchbase Docker Team",
  "repo": [
    {
      "registry": "docker.io",
      "tag": "latest",
      "repository": "couchbase"
    }
  ],
  "repoDigests": [
    {
      "registry": "docker.io",
      "digest": "1d811b3c382893f70f0cc0f2371a12d3671c1d5175bcc67e8c2a5c0bf4c8f976",
      "repository": "couchbase"
    }
  ],
  "label": null,
  "uuid": "5d48f83b-cddb-33ac-8fad-e8452dd116b1",
  "sha": "c64844065dcbc3d0a90c365c1f56421766a5cebf05f7ecbd3377af410fff09fd",
  "operatingSystem": "Ubuntu Linux 16.04.7",
  "customerUuid": "192cc974-1e44-cb6c-806e-f78f6441cb0d",
  "dockerVersion": "18.09.7",
  "size": 1183790011,
  "layers": [
    {
      "size": "0",
      "createdBy": "rm -rf-rt /var/lib/apt/lists/*",
      "created": "1603474389000",
      "comment": "",
      "id": null,
      "sha": null,
      "tags": null
    },
    {
      "size": "1930",
      "createdBy": "COPY file:d816a67f62bfba76d2812cefbexxxxxxxa13f3852775c3e68599df7741exxxxx in / ",
      "created": "1603477517000",
      "comment": "",
      "id": null,
      "sha": null,
      "tags": null
    }
  ],
  "host": [
    {
      "sensorUuid": "fed79006-2fa9-4b67-8f5a-272b4e02f084",
      "hostname": "host.acme.com",
      "ipAddress": "10.**.2*.*0",
      "uuid": "6ba5be85-2758-4f44-814a-b690c9ed23ee",
      "lastUpdated": "2020-11-10T14:10:29.218Z"
    }
  ],
  "architecture": "amd64",
  "imageId": "c64844065dcb",
  "lastVmScanDate": "1605017537578",
  "registryUuid": null,
  "source": [
    "GENERAL",
    "REGISTRY",
    "CONTINUOUS_ASSESSMENT"
  ],
  "totalVulCount": "0",
  "users": [
    "root"
  ],
  "isDockerHubOfficial": null,
  "isInstrumented": null,
  "instrumentedFrom": null,
  "instrumentationState": null,
  "scanType": "DYNAMIC",
  "scanTypes": [
    "DYNAMIC"
  ],
  "scanErrorCode": null,
  "scanStatus": "SUCCESS",
  "lastFoundOnHost": {
    "sensorUuid": "fed79006-2fa9-4b67-8f5a-272b4e02f084",
    "hostname": "host.acme.com",
    "ipAddress": "10.**.2*.*0",
    "uuid": "6ba5be85-2758-4f44-814a-b690c9ed23ee",
    "lastUpdated": "2020-11-10T14:10:29.218Z"
  },
  "lastScannedBySensor": "fde436ad-3686-46f9-a2e5-9f7523668d34",
  "scanErrorMessage": "Static: Package manager not found",
  "malware": {
    "imageMalwareCount": 1,
    "malwarePrediction": {
      "prediction": "malicious",
      "score": 1,
      "severity": 3,
      "category": "dropper",
      "family": "mirai"
    }
  },
  "lastMalwareScanned": null,
  "exceptions": [
    "77116d5b-aaa0-4dba-a334-9fe6a6f0dd98"
  ],
  "secrets": [
    {
      "severity": "MEDIUM",
      "filePath": "/root/foo/foo1.txt",
      "layerSha": "7afaca6fd6f46466f2f23f51c647918c7818a431792547db3a7bc033d261a1e3",
      "match": null,
      "startLine": 0,
      "secretType": "Asana Client Secret"
    },
    {
      "severity": "CRITICAL",
      "filePath": "/home/qatest/key/gcp-service-account.json",
      "layerSha": "5bc804df91a229c1f26d254b5247c699c1e1a53673ec1d30e263e7b4bda96beb",
      "match": null,
      "startLine": 0,
      "secretType": "Google (GCP) Service-account"
    }
  ],
  "lastSecretScanned": null,
  "riskScore": null,
  "riskScoreCalculatedDate": null,
  "formulaUsed": null,
  "maxQdsScore": null,
  "qdsSeverity": null,
  "criticality": 3,
  "criticalityUpdated": 1717098843553,
  "baseImage": null,
  "childImagesCount": 0,
  "sbomLayerProcessingTimestamp": null,
  "baseImageProcessingTimestamp": null,
  "isContinuouslyAssessed": true,
  "lastAssessed": "1746677220581"
  "softwares": [
    {
      "name": "libsw5:amd64",
      "version": "6.0+20160213-1ubuntu1",
      "scanType": "STATIC",
      "packagePath": null,
      "type": "MAPPED",
      "ignoredReason": null,
      "lifecycle": {
        "stage": "GA",
        "lifeCycleConfidence": "Exact",
        "eol": "-631152000000",
        "eos": "-631152000000",
        "ga": "1705622400000"
      },
      "fixVersion": null,
      "vulnerabilities": null,
      "layerSha": "p81e54f31270422d691e33eacbe3219309240a20566cd2bcca0de1f37d9m5827"
    }
  },
  {
    "name": "docker",
    "version": "25.0.5-r0",
    "scanType": "STATIC",
    "packagePath": null,
    "type": "MAPPED",
    "ignoredReason": null,
    "lifecycle": {
      "stage": "GA",
      "lifeCycleConfidence": "Exact",
      "eol": "-631152000000",
      "eos": "-631152000000",
      "ga": "1705622400000"
    },
    "fixVersion": null,
    "vulnerabilities": null,
    "layerSha": "c21e54f31270422d691e33eacbe3219309240a20566cd2bcca0de1f33d9b5617"
  }
],
"vulnerabilities": [],
"lastComplianceScanned": "1603477517000"
}

Error Response

The following error response is seen when the sub-users don't have permission to the specified image.

{
  "errorCode": "403 FORBIDDEN",
  "message": "Request Forbidden",
  "timestamp": 1700721586546
}

The response shows a source value of “SERVERLESS_FARGATE” in this case.

API request

curl -X GET \
"<qualys_base_url>/csapi/v1.3/images/85669404084756ad51914d98c460b5b83f45848b2ec9567f08b262170db264e4" --header "Authorization: Bearer <token>"

Response

{
  "created": "1633506189000",
  "updated": "1659422877918",
  "author": "",
  "repo": [
    {
      "registry": "362990800442.dkr.ecr.ca-central-1.amazonaws.com",
      "tag": "jboss1.18",
      "repository": "cs-sensor"
    }
  ],
  "repoDigests": [
    {
      "registry": "362990800442.dkr.ecr.ca-central-1.amazonaws.com",
      "digest": "0d4bdc5749b80631a069957de99b0fa20201e38380ce90cc68786894231e429d",
      "repository": "cs-sensor"
    }
  ],
  ... "hostArchitecture": [
    "x86_64"
  ],
  "architecture": "amd64",
  "imageId": "856694040847",
  "lastScanned": "1659422877918",
  "registryUuid": null,
  "source": [
    "SERVERLESS_FARGATE"
  ],
  "totalVulCount": "42",
  "users": [
    "root"
  ],
  ...
}

Error Response

The following error response is seen when the sub-users don't have permission to the specified image.

{
  "errorCode": "403 FORBIDDEN",
  "message": "Request Forbidden",
  "timestamp": 1700721586546
}

This is applicable for subscriptions with SCA Scanning enabled and for images scanned using SCA.

API request

curl -X GET \
"<qualys_base_url>/csapi/v1.3/images?pageNumber=1&pageSize=50&sort=created%3Adesc" --header "Authorization: Bearer <token>"

Response

{
    "created": "1525522580000",
    "updated": "1661479716359",
    "sha": "0645d07d36305947d72a31282e2dd035f54fbeff6d9adb6701e9c72e75f675e8",
    "repo": [
        {
            "registry": "docker.io",
            "tag": "0.9.2",
            "repository": "known"
        }
    ],
    "repoDigests": [
        {
            "registry": "docker.io",
            "digest": "a3cfd95b4ff72c4f1f33aa98aae1d86b9ed1bfe050058fb46205540280e9937f",
            "repository": "known"
        }
    ],
    "uuid": "38aa3900-f803-32a7-9806-39233e66b85c",
    "size": 539069295,
    "vulnerabilities": {
        "severity5Count": 8,
        "severity3Count": 54,
        "severity4Count": 13,
        "severity1Count": 1,
        "severity2Count": 1
    },
    "imageId": "0645d07d3630",
    "associatedContainersCount": 1,
    "associatedHostsCount": 1,
    "lastVmScanDate": "1661479716359",
    "registryUuid": null,
    "source": [
        "GENERAL"
    ],
    "isDockerHubOfficial": false,
    "isInstrumented": false,
    "instrumentedFrom": null,
    "instrumentationState": null,
    "scanType": null,
    "scanTypes": [
        "SCA",
        "DYNAMIC"
    ],
    "scanErrorCode": null,
    "scanStatus": "SUCCESS",
    "lastFoundOnHost": {
        "sensorUuid": "2ed740ac-acba-47b5-8072-aaa739e44f0d",
        "hostname": "ip-10-20-30-40",
        "ipAddress": "10.20.30.40",
        "uuid": "721e3460-bced-4ec0-b695-3c3349eefefb",
        "lastUpdated": "2022-08-26T01:57:22.110Z"
    },
    "exceptions": [
        "77116d5b-aaa0-4dba-a334-9fe6a6f0dd98"
    ],
    "compliance": {
        "failCount": 2,
        "passCount": 0,
        "errorCount": 0
    },
    "lastComplianceScanDate": "1661479044741"
}

Error Response

The following error response is seen when the sub-users don't have permission to the specified image.

{
  "errorCode": "403 FORBIDDEN",
  "message": "Request Forbidden",
  "timestamp": 1700721586546
}