Searching for Executions Images
Use the search tokens below to search for Executions Images. Looking for help with writing your query? click here.
sensor.uuidsensor.uuid
Use a text value to find execution images discovered by a sensor with a specific UUID.
Example
Show execution images discovered by the sensor with a specific UUID.
sensor.uuid: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
container.image.idcontainer.image.id
Use a text value to find execution images that have a specific container image ID.
Example
Show execution images with a specific container image ID.
container.image.id: "1a2b3c4d5e6f"
job.execution.statusjob.execution.status
Use a text value to find execution images with a specific status ('Queued', 'InProgress', 'Scanned', or 'Failed').
Example
Show execution images having status as Queued.
job.execution.status: Queued
andand
Use a boolean query to express your query using AND logic.
Example
Show execution images with type Standard and with action Allow.
eventType: STANDARD and action: ALLOW
notnot
Use a boolean query to express your query using NOT logic.
Example
Show execution image that don't have Deny action.
not action: DENY
oror
Use a boolean query to express your query using OR logic.
Example
Show execution image with one of these actions - ALLOW and MONITOR.
action: ALLOW or action: MONITOR