image-sprawl

Search the Falcon Kubernetes container inventory with falcon_search_kubernetes_containers filtered on the image repository or digest. Aggregate results by cluster, namespace, and cloud account rather than listing raw container records.

First determine whether it is an image scan detection (product:'cwpp') or a runtime node detection. For runtime detections, pivot from the detection's agent_id into container inventory to identify the image, then search for that image across all clusters.

Use agent_id. Hostname joins on node_name are unreliable because the same node can appear in different casings, while agent_id is the sensor's own identifier present on both records and either matches or does not.

On current builds the tool returns a payload its own schema rejects, producing a pydantic int_type error. Use falcon_search_kubernetes_containers and count the results yourself instead; this is a known upstream defect.

No. It performs read-only investigation only. Containment, pod termination, and image deletion are intentionally out of scope; the Skill hands responders decision-ready remediation options instead.

Tags are mutable: the same tag can point to different images on different clusters, and one digest can carry several tags. Digests must be normalized first, since detections report bare hex while inventory prefixes them with sha256:.