Get organization security overview (browser session)

Returns the organisation’s fleet vulnerability overview: totals and severity counts, fixable severe and CISA known-exploited counts, scanner coverage, the top remediation candidates and the observed trend. Optionally narrowed with cluster_id or addon_slug; requires security.read.

GET /org/security/overview

Get organization security overview (browser session)

Python

import requests

url = "https://api.platform.ankra.app/org/security/overview"

headers = {"cookie": "ankra_session="}

response = requests.get(url, headers=headers)

print(response.text)

200

{
  "coverage": {
    "fresh_clusters": 123,
    "latest_report_at": "2023-11-07T05:31:56Z",
    "scanned_clusters": 123,
    "stale_clusters": 123,
    "total_clusters": 123,
    "unscanned_clusters": 123
  },
  "fixable_severe": 123,
  "generated_at": "2023-11-07T05:31:56Z",
  "observed_trend": [
    {
      "date": "2023-12-25",
      "observed": 123
    }
  ],
  "scanner": {
    "fresh_clusters": 123,
    "last_scan": "2023-11-07T05:31:56Z",
    "stale_after_seconds": 123,
    "stale_clusters": 123,
    "status": "fresh",
    "unscanned_clusters": 123
  },
  "severity": {
    "critical": 123,
    "high": 123,
    "low": 123,
    "medium": 123,
    "unknown": 123
  },
  "top_remediation_candidates": [
    {
      "actionable_count": 123,
      "affected_clusters": 123,
      "affected_workloads": 123,
      "cve_id": "<string>",
      "finding_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "fix_routes": {
        "addon_upgrade_occurrences": 123,
        "addons": [
          {
            "addon_slug": "<string>",
            "clusters": 123,
            "named_clusters": [
              {
                "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
                "cluster_name": "<string>"
              }
            ],
            "occurrences": 123,
            "target_chart_version": "<string>",
            "target_scanned_at": "2023-11-07T05:31:56Z",
            "target_verdict": "fixes",
            "target_verdict_reason": "<string>"
          }
        ],
        "image_rebuild_occurrences": 123,
        "no_fix_occurrences": 123,
        "platform_occurrences": 123,
        "route": "addon_upgrade"
      },
      "fixable_occurrences": 123,
      "last_seen_at": "2023-11-07T05:31:56Z",
      "package_name": "<string>",
      "package_type": "<string>",
      "severity": "<string>",
      "title": "<string>",
      "known_exploited": true,
      "kev_date_added": "<string>",
      "kev_due_date": "<string>",
      "kev_ransomware_use": true,
      "epss_score": 123,
      "epss_percentile": 123,
      "kev_vendor_project": "<string>",
      "kev_product": "<string>",
      "kev_vulnerability_name": "<string>",
      "kev_required_action": "<string>"
    }
  ],
  "totals": {
    "accepted_risk": 123,
    "acknowledged": 123,
    "actionable": 123,
    "observed": 123,
    "resolved": 123
  },
  "known_exploited": 123,
  "known_exploited_findings": 123,
  "intelligence": {
    "epss_synced_at": "2023-11-07T05:31:56Z",
    "kev_listed": 123,
    "kev_synced_at": "2023-11-07T05:31:56Z"
  },
  "known_exploited_overdue": 123,
  "known_exploited_ransomware": 123,
  "access_posture": {
    "clusters": 123,
    "standing_cluster_admin": 123,
    "over_policy": 123,
    "impersonate_reachable": 123,
    "unverified": 123
  }
}

Authorizations

ankra_session · string · cookie · required

Browser session. Mutations also require X-Ankra-CSRF.

Query Parameters

cluster_id · string<uuid>

addon_slug · string

Response

200

application/json

Successful response

coverage · object · required

Show child attributes

fixable_severe · integer · required

generated_at · string<date-time> · required

observed_trend · object[] · required

Show child attributes

scanner · object · required

Show child attributes

severity · object · required

Show child attributes

top_remediation_candidates · object[] · required

Show child attributes

totals · object · required

Show child attributes

known_exploited · integer · required

known_exploited_findings · integer · required

intelligence · object · required

Show child attributes

known_exploited_overdue · integer · required

known_exploited_ransomware · integer · required

access_posture · object | null · required

The clusters in scope counted by their Kubernetes access posture, evaluated at read time. null under an add-on scope, which access grants are not attributed to.

Show child attributes