Kaspersky Endpoint Security 12 for Linux

Request to scan Docker images with additional settings

April 15, 2024

ID 213880

Content-Type

application/json

Request body

JSON of the following type:

{

"source": "https://index.docker.io/jerbi/eicar:latest",

"params": {

"destination": "https://fake",

"skipimageifexists": true,

"custom_callbacks": {

"on_detect": {

"uri": "http://10.16.42.75:5050",

"content-type": "application/json",

"body": {

"session_id": "100",

"session_init": "20201105T072403+0300",

"infected_items": "$infected"

}

},

"on_complete": {

"body": {

"session_id": "100",

},

"uri": "http://10.16.42.75:5050/on_complete",

}

}

}

}

Additional request settings

The params section can contain the following settings:

  • destination (optional) – the server to which the scanned image will be copied.
  • skipimageifexists (optional) – do not scan or copy the image if the destination server already has an image with the same name and SHA256 hash. This setting can only be specified if the destination setting is specified.
  • custom_callbacks (optional) – describes the requests that should be sent when scan finishes:
    • on_detect – the request is sent if a threat is detected.
    • on_complete – the request is always sent when scan finishes.

In the description of the request body, you can specify the $infected substitution variable. The list of infected objects is substituted instead of this variable.

Response example:

{

"completed": "Mon, 01 Mar 2021 07:13:49 GMT",

"created": "Mon, 01 Mar 2021 07:13:42 GMT",

"progress": 100,

"scan_errors": [

{

"code": 500,

"message": "Unable to get images hash from destination registry"

}

],

"scan_params": {

"destination": "https://fake",

"skipimageifexists": true

},

"scan_result": {

"jerbi/eicar:latest": {

"started": "2021-03-01 07:13:48",

"stopped": "2021-03-01 07:13:49",

"threats": [

{

"name": "EICAR-Test-File",

"object": "[image:docker.io/jerbi/eicar:latest] /eicar.com.txt"

}

],

"verdict": "infected"

}

},

"status": "completed",

"verdicts": [

"infected"

]

}

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.