Packages in Container Images - Match Lookup File
Parses packages from ImageVulnerabilityEvents and cross-references it with a lookup file to identify matching entries.
CQL · Falcon Next-Gen SIEMCopy query
ImageScanEventType = ImageVulnerabilityEvent
| array:eval("CVEMapping[]", asArray="PackageName[]", function={PackageName := splitString(by="\|",field="CVEMapping",index=1)})
| array:drop("CVEMapping[]")
| array:dedup("PackageName[]")
| array:reduceAll(array="PackageName[]",var=PackageName, function=groupBy(PackageName))
| match(file="compromised-npm-packages-shai-hulud.csv", field="PackageName",column="PackageName", ignoreCase=true)A lookup file with a list of packages needs to be uploaded first. Example: |PackageName|Version| |---|---| |Package|1.0.0|
packages_in_container_images___match_lookup_file.yml
ByteRay
Hunting
Cloud
CSPM / ASPM / DSPM
2025-11-25
2026-03-19
