Packages in Container Images - Match Parameter
Searches packages using the provided parameter and returns the corresponding image repository.
CQL · Falcon Next-Gen SIEMCopy query
ImageScanEventType = ImageVulnerabilityEvent
| array:eval("CVEMapping[]", asArray="PackageName[]", function={PackageName := splitString(by="\|",field="CVEMapping",index=1)})
| array:drop("CVEMapping[]")
| array:contains(array="PackageName[]", value=?Package)
| groupBy([ImageInfo.Registry,ImageInfo.Repository])packages_in_container_images___match_parameter.yml
ByteRay
Hunting
Cloud
CSPM / ASPM / DSPM
2025-08-26
2025-11-25
