{"resources":{"portainer":{"id":"portainer","name":"portainer","fields":{"edgeGroup":{"name":"edgeGroup","type":"\u001bportainer.edgeGroup","title":"Portainer edge group","desc":"Edge group used to target Edge environments and Edge stacks. When `dynamic` is true, membership is derived from tag matches; otherwise it is a static set of explicitly assigned environments. Select an Edge group by its numeric `id`, for example `portainer.edgeGroup(id: 3)`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"edgeGroups":{"name":"edgeGroups","type":"\u0019\u001bportainer.edgeGroup","title":"Edge groups defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"edgeStack":{"name":"edgeStack","type":"\u001bportainer.edgeStack","title":"Portainer edge stack","desc":"Workload definition deployed to Edge environments through one or more Edge groups. Select an Edge stack by its numeric `id`, for example `portainer.edgeStack(id: 3)`. The deploymentType field distinguishes compose from Kubernetes stacks, and numDeployments reports how many environments the stack currently runs on.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"edgeStacks":{"name":"edgeStacks","type":"\u0019\u001bportainer.edgeStack","title":"Edge stacks defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"environment":{"name":"environment","type":"\u001bportainer.environment","title":"Portainer environment","desc":"Environment (endpoint) managed by Portainer: a Docker host, a Docker Swarm or Kubernetes cluster, or an Edge agent. The `type` field reports which of these it is and `status` whether it is currently reachable. `teamAccessPolicies` and `userAccessPolicies` capture the per-environment RBAC grants (keyed by team and user id), which together with the instance `settings` describe who can deploy workloads where. Select an environment by its numeric `id`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"environmentGroup":{"name":"environmentGroup","type":"\u001bportainer.environmentGroup","title":"Portainer environment group","desc":"Environment group (endpoint group) that bundles environments so access policies and tags can be managed together. `teamAccessPolicies` and `userAccessPolicies` capture the per-group RBAC grants, letting you audit which teams and users hold access to every environment in the group. Select a group by its numeric `id`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"environmentGroups":{"name":"environmentGroups","type":"\u0019\u001bportainer.environmentGroup","title":"Environment groups (endpoint groups) defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"environments":{"name":"environments","type":"\u0019\u001bportainer.environment","title":"Environments (endpoints) managed by the instance","provider":"go.mondoo.com/mql/providers/portainer"},"instanceId":{"name":"instanceId","type":"\u0007","title":"Unique Portainer instance identifier","provider":"go.mondoo.com/mql/providers/portainer"},"license":{"name":"license","type":"\u001bportainer.license","title":"Portainer license","desc":"License applied to the Portainer instance, covering the company it is issued to, the number of licensed nodes, and the creation and expiry times that govern which enterprise features remain available. Audit this to confirm a valid, unexpired license backs the deployment and to track how many nodes the entitlement permits.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"licenses":{"name":"licenses","type":"\u0019\u001bportainer.license","title":"Licenses applied to the instance","provider":"go.mondoo.com/mql/providers/portainer"},"settings":{"name":"settings","type":"\u001bportainer.settings","title":"Instance-wide authentication and container-security settings","provider":"go.mondoo.com/mql/providers/portainer"},"tag":{"name":"tag","type":"\u001bportainer.tag","title":"Portainer tag","desc":"Label applied to environments and environment groups on the Portainer instance so that Edge groups can target them dynamically. Auditing tags reveals how environments are grouped for policy and deployment targeting. Select a tag by its numeric `id` or `name`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"tags":{"name":"tags","type":"\u0019\u001bportainer.tag","title":"Tags defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"team":{"name":"team","type":"\u001bportainer.team","title":"Portainer team","desc":"Team and its membership within a Portainer instance. Teams group standard users so that environment access policies can be granted in bulk rather than user by user, so a team's roster is what determines who inherits those grants. Select a team by its numeric `id` and read `members` to enumerate the users that belong to it.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"teams":{"name":"teams","type":"\u0019\u001bportainer.team","title":"Teams defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"user":{"name":"user","type":"\u001bportainer.user","title":"Portainer user account","desc":"User account that authenticates to the Portainer server. The `role` field reports whether the account is a site `administrator` or a `standard` user, a key RBAC audit since administrators can reach every managed environment. Select a user by its numeric `id`, for example `portainer.users.where(role == \"administrator\")`, and traverse `teams` to see which teams it belongs to.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bportainer.user","title":"User accounts defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"version":{"name":"version","type":"\u0007","title":"Portainer server version","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer instance","desc":"Portainer container-management control plane at the root of an audit. The server version and instance-wide security settings describe the control plane itself, the user accounts and teams make up its RBAC model, and the environments (Docker hosts, Swarm or Kubernetes clusters, and Edge agents) are the hosts it manages.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.edgeGroup":{"id":"portainer.edgeGroup","name":"portainer.edgeGroup","fields":{"dynamic":{"name":"dynamic","type":"\u0004","is_mandatory":true,"title":"Whether membership is determined dynamically by tag match","provider":"go.mondoo.com/mql/providers/portainer"},"environments":{"name":"environments","type":"\u0019\u001bportainer.environment","title":"Environments in the group","provider":"go.mondoo.com/mql/providers/portainer"},"hasEdgeStack":{"name":"hasEdgeStack","type":"\u0004","is_mandatory":true,"title":"Whether the group has an associated Edge stack","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric Edge group identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Edge group name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer edge group","desc":"Edge group used to target Edge environments and Edge stacks. When `dynamic` is true, membership is derived from tag matches; otherwise it is a static set of explicitly assigned environments. Select an Edge group by its numeric `id`, for example `portainer.edgeGroup(id: 3)`.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.edgeStack":{"id":"portainer.edgeStack","name":"portainer.edgeStack","fields":{"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Time the Edge stack was created (null if unset)","provider":"go.mondoo.com/mql/providers/portainer"},"deploymentType":{"name":"deploymentType","type":"\u0007","is_mandatory":true,"title":"Deployment type: compose, kubernetes, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"edgeGroups":{"name":"edgeGroups","type":"\u0019\u001bportainer.edgeGroup","title":"Edge groups the stack targets","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric Edge stack identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Edge stack name","provider":"go.mondoo.com/mql/providers/portainer"},"numDeployments":{"name":"numDeployments","type":"\u0005","is_mandatory":true,"title":"Number of environments the stack is deployed to","provider":"go.mondoo.com/mql/providers/portainer"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Stack revision, incremented on each update","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer edge stack","desc":"Workload definition deployed to Edge environments through one or more Edge groups. Select an Edge stack by its numeric `id`, for example `portainer.edgeStack(id: 3)`. The deploymentType field distinguishes compose from Kubernetes stacks, and numDeployments reports how many environments the stack currently runs on.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.environment":{"id":"portainer.environment","name":"portainer.environment","fields":{"containerEngine":{"name":"containerEngine","type":"\u0007","is_mandatory":true,"title":"Container engine in use, for example docker or podman","provider":"go.mondoo.com/mql/providers/portainer"},"edgeId":{"name":"edgeId","type":"\u0007","is_mandatory":true,"title":"Edge agent identifier, for Edge environments","provider":"go.mondoo.com/mql/providers/portainer"},"gpuManagementEnabled":{"name":"gpuManagementEnabled","type":"\u0004","is_mandatory":true,"title":"Whether GPU management is enabled for the environment","provider":"go.mondoo.com/mql/providers/portainer"},"group":{"name":"group","type":"\u001bportainer.environmentGroup","title":"Environment group (endpoint group) this environment belongs to","provider":"go.mondoo.com/mql/providers/portainer"},"heartbeat":{"name":"heartbeat","type":"\u0004","is_mandatory":true,"title":"Whether the Edge agent is currently connected (heartbeat)","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric environment identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment name","provider":"go.mondoo.com/mql/providers/portainer"},"publicUrl":{"name":"publicUrl","type":"\u0007","is_mandatory":true,"title":"Public URL used to reach exposed containers","provider":"go.mondoo.com/mql/providers/portainer"},"securitySettings":{"name":"securitySettings","type":"\n","is_mandatory":true,"title":"Per-environment container-security overrides","desc":"Boolean flags, keyed by setting name, that relax container privileges for non-admin (regular) users. Keys: allowBindMountsForRegularUsers, allowContainerCapabilitiesForRegularUsers, allowDeviceMappingForRegularUsers, allowHostNamespaceForRegularUsers, allowPrivilegedModeForRegularUsers, allowStackManagementForRegularUsers, allowSysctlSettingForRegularUsers, allowVolumeBrowserForRegularUsers, and enableHostManagementFeatures. Any flag set to true widens the container attack surface available to unprivileged users on this environment.","provider":"go.mondoo.com/mql/providers/portainer"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Connection status: up, down, provisioning, error, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"tags":{"name":"tags","type":"\u0019\u001bportainer.tag","title":"Tags assigned to the environment","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessPolicies":{"name":"teamAccessPolicies","type":"\n","is_mandatory":true,"title":"Team access policies keyed by team id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessRoles":{"name":"teamAccessRoles","type":"\n","is_mandatory":true,"title":"Team access roles keyed by team id, with the granted role name as the value","desc":"The same grants as teamAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"tlsEnabled":{"name":"tlsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the connection to the environment uses TLS","provider":"go.mondoo.com/mql/providers/portainer"},"tlsSkipVerify":{"name":"tlsSkipVerify","type":"\u0004","is_mandatory":true,"title":"Whether verification of the environment's TLS certificate is skipped","desc":"True when Portainer is configured to accept the environment's server certificate without validating it, which leaves the control-plane connection open to interception. Only meaningful when tlsEnabled is true.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Environment type: docker, agent-docker, azure-aci, edge-agent-docker, kubernetes, agent-kubernetes, or edge-agent-kubernetes","provider":"go.mondoo.com/mql/providers/portainer"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"API endpoint URL of the environment","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessPolicies":{"name":"userAccessPolicies","type":"\n","is_mandatory":true,"title":"User access policies keyed by user id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessRoles":{"name":"userAccessRoles","type":"\n","is_mandatory":true,"title":"User access roles keyed by user id, with the granted role name as the value","desc":"The same grants as userAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"userTrusted":{"name":"userTrusted","type":"\u0004","is_mandatory":true,"title":"Whether the environment has been manually trusted by an administrator","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer environment","desc":"Environment (endpoint) managed by Portainer: a Docker host, a Docker Swarm or Kubernetes cluster, or an Edge agent. The `type` field reports which of these it is and `status` whether it is currently reachable. `teamAccessPolicies` and `userAccessPolicies` capture the per-environment RBAC grants (keyed by team and user id), which together with the instance `settings` describe who can deploy workloads where. Select an environment by its numeric `id`.","min_provider_version":"13.0.0","defaults":"name type status","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.environmentGroup":{"id":"portainer.environmentGroup","name":"portainer.environmentGroup","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the environment group","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric environment group identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment group name","provider":"go.mondoo.com/mql/providers/portainer"},"tags":{"name":"tags","type":"\u0019\u001bportainer.tag","title":"Tags assigned to the group","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessPolicies":{"name":"teamAccessPolicies","type":"\n","is_mandatory":true,"title":"Team access policies keyed by team id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessRoles":{"name":"teamAccessRoles","type":"\n","is_mandatory":true,"title":"Team access roles keyed by team id, with the granted role name as the value","desc":"The same grants as teamAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessPolicies":{"name":"userAccessPolicies","type":"\n","is_mandatory":true,"title":"User access policies keyed by user id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessRoles":{"name":"userAccessRoles","type":"\n","is_mandatory":true,"title":"User access roles keyed by user id, with the granted role name as the value","desc":"The same grants as userAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer environment group","desc":"Environment group (endpoint group) that bundles environments so access policies and tags can be managed together. `teamAccessPolicies` and `userAccessPolicies` capture the per-group RBAC grants, letting you audit which teams and users hold access to every environment in the group. Select a group by its numeric `id`.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.license":{"id":"portainer.license","name":"portainer.license","fields":{"company":{"name":"company","type":"\u0007","is_mandatory":true,"title":"Company the license is issued to","provider":"go.mondoo.com/mql/providers/portainer"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the license was created (null if unset)","provider":"go.mondoo.com/mql/providers/portainer"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Contact email on the license","provider":"go.mondoo.com/mql/providers/portainer"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the license expires (null if perpetual)","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"License identifier","provider":"go.mondoo.com/mql/providers/portainer"},"nodes":{"name":"nodes","type":"\u0005","is_mandatory":true,"title":"Number of licensed nodes","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer license","desc":"License applied to the Portainer instance, covering the company it is issued to, the number of licensed nodes, and the creation and expiry times that govern which enterprise features remain available. Audit this to confirm a valid, unexpired license backs the deployment and to track how many nodes the entitlement permits.","min_provider_version":"13.0.0","defaults":"company expiresAt","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.settings":{"id":"portainer.settings","name":"portainer.settings","fields":{"allowBindMountsForRegularUsers":{"name":"allowBindMountsForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may bind-mount host paths","provider":"go.mondoo.com/mql/providers/portainer"},"allowContainerCapabilitiesForRegularUsers":{"name":"allowContainerCapabilitiesForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may add container capabilities","provider":"go.mondoo.com/mql/providers/portainer"},"allowDeviceMappingForRegularUsers":{"name":"allowDeviceMappingForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may map host devices into containers","provider":"go.mondoo.com/mql/providers/portainer"},"allowHostNamespaceForRegularUsers":{"name":"allowHostNamespaceForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may share host namespaces","provider":"go.mondoo.com/mql/providers/portainer"},"allowPrivilegedModeForRegularUsers":{"name":"allowPrivilegedModeForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may run privileged containers","provider":"go.mondoo.com/mql/providers/portainer"},"allowStackManagementForRegularUsers":{"name":"allowStackManagementForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may manage stacks","provider":"go.mondoo.com/mql/providers/portainer"},"allowVolumeBrowserForRegularUsers":{"name":"allowVolumeBrowserForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may browse volume contents","provider":"go.mondoo.com/mql/providers/portainer"},"authenticationMethod":{"name":"authenticationMethod","type":"\u0007","is_mandatory":true,"title":"Active authentication method: internal, ldap, or oauth","provider":"go.mondoo.com/mql/providers/portainer"},"customLoginBanner":{"name":"customLoginBanner","type":"\u0007","is_mandatory":true,"title":"Custom login banner shown on the sign-in page","provider":"go.mondoo.com/mql/providers/portainer"},"disableKubeRolesSync":{"name":"disableKubeRolesSync","type":"\u0004","is_mandatory":true,"title":"Whether syncing of built-in Kubernetes roles is disabled","provider":"go.mondoo.com/mql/providers/portainer"},"disableKubeShell":{"name":"disableKubeShell","type":"\u0004","is_mandatory":true,"title":"Whether the Kubernetes web shell is disabled","provider":"go.mondoo.com/mql/providers/portainer"},"disableKubeconfigDownload":{"name":"disableKubeconfigDownload","type":"\u0004","is_mandatory":true,"title":"Whether kubeconfig download is disabled","provider":"go.mondoo.com/mql/providers/portainer"},"displayExternalContributors":{"name":"displayExternalContributors","type":"\u0004","is_mandatory":true,"title":"Whether community contributor attribution is displayed in the UI","provider":"go.mondoo.com/mql/providers/portainer"},"edgeAgentCheckinInterval":{"name":"edgeAgentCheckinInterval","type":"\u0005","is_mandatory":true,"title":"Default Edge agent check-in interval, in seconds","provider":"go.mondoo.com/mql/providers/portainer"},"edgePortainerUrl":{"name":"edgePortainerUrl","type":"\u0007","is_mandatory":true,"title":"URL advertised to Edge agents for reaching this Portainer instance","provider":"go.mondoo.com/mql/providers/portainer"},"enableEdgeComputeFeatures":{"name":"enableEdgeComputeFeatures","type":"\u0004","is_mandatory":true,"title":"Whether Edge Compute features are enabled","provider":"go.mondoo.com/mql/providers/portainer"},"enableHostManagementFeatures":{"name":"enableHostManagementFeatures","type":"\u0004","is_mandatory":true,"title":"Host-management features","desc":"Deprecated in favor of the per-environment securitySettings override of the same name. Portainer stopped maintaining this instance-wide flag, so it reads false regardless of how individual environments are configured.","provider":"go.mondoo.com/mql/providers/portainer","maturity":"deprecated"},"enableTelemetry":{"name":"enableTelemetry","type":"\u0004","is_mandatory":true,"title":"Whether anonymous usage telemetry is enabled","provider":"go.mondoo.com/mql/providers/portainer"},"enforceEdgeId":{"name":"enforceEdgeId","type":"\u0004","is_mandatory":true,"title":"Whether Edge agents must present a matching Edge ID","provider":"go.mondoo.com/mql/providers/portainer"},"helmRepositoryUrl":{"name":"helmRepositoryUrl","type":"\u0007","is_mandatory":true,"title":"Helm repository URL used for application templates","provider":"go.mondoo.com/mql/providers/portainer"},"isDockerDesktopExtension":{"name":"isDockerDesktopExtension","type":"\u0004","is_mandatory":true,"title":"Whether this instance runs as the Docker Desktop extension","provider":"go.mondoo.com/mql/providers/portainer"},"kubeconfigExpiry":{"name":"kubeconfigExpiry","type":"\u0007","is_mandatory":true,"title":"Lifetime of generated kubeconfig tokens, for example \"24h\"","provider":"go.mondoo.com/mql/providers/portainer"},"kubectlShellImage":{"name":"kubectlShellImage","type":"\u0007","is_mandatory":true,"title":"Custom kubectl shell image used for the Kubernetes web console","provider":"go.mondoo.com/mql/providers/portainer"},"logoUrl":{"name":"logoUrl","type":"\u0007","is_mandatory":true,"title":"Custom logo URL shown in the UI","provider":"go.mondoo.com/mql/providers/portainer"},"requiredPasswordLength":{"name":"requiredPasswordLength","type":"\u0005","is_mandatory":true,"title":"Minimum password length enforced for internal authentication","provider":"go.mondoo.com/mql/providers/portainer"},"snapshotInterval":{"name":"snapshotInterval","type":"\u0007","is_mandatory":true,"title":"Interval at which environment snapshots are captured, for example \"5m\"","provider":"go.mondoo.com/mql/providers/portainer"},"trustOnFirstConnect":{"name":"trustOnFirstConnect","type":"\u0004","is_mandatory":true,"title":"Whether new Edge environments are trusted automatically on first connect","provider":"go.mondoo.com/mql/providers/portainer"},"userSessionTimeout":{"name":"userSessionTimeout","type":"\u0007","is_mandatory":true,"title":"Idle user session timeout, for example \"8h\"","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer security settings","desc":"Instance-wide authentication and container-security posture. `authenticationMethod` reports whether logins are handled internally or delegated to LDAP or OAuth, and `requiredPasswordLength` is the minimum password length enforced for internal authentication. The `allow*ForRegularUsers` flags govern what non-administrator users are permitted to do when deploying workloads (running privileged containers, bind-mounting host paths, mapping host devices, sharing host namespaces, adding Linux capabilities, managing stacks, and browsing volumes), and a permissive value on any of them is a privilege-escalation path that the container runtime alone cannot reveal. The `disableKube*` flags and edge trust settings round out the instance hardening picture.","min_provider_version":"13.0.0","defaults":"authenticationMethod requiredPasswordLength","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.tag":{"id":"portainer.tag","name":"portainer.tag","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric tag identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tag name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer tag","desc":"Label applied to environments and environment groups on the Portainer instance so that Edge groups can target them dynamically. Auditing tags reveals how environments are grouped for policy and deployment targeting. Select a tag by its numeric `id` or `name`.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.team":{"id":"portainer.team","name":"portainer.team","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric team identifier","provider":"go.mondoo.com/mql/providers/portainer"},"memberRoles":{"name":"memberRoles","type":"\n","title":"Membership roles keyed by username, with leader or member as the value","desc":"Team leaders may manage the team's roster and see the team in listings that plain members do not, so the split matters when auditing who can widen a team's inherited environment access.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"members":{"name":"members","type":"\u0019\u001bportainer.user","title":"Users that are members of this team","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Team name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer team","desc":"Team and its membership within a Portainer instance. Teams group standard users so that environment access policies can be granted in bulk rather than user by user, so a team's roster is what determines who inherits those grants. Select a team by its numeric `id` and read `members` to enumerate the users that belong to it.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.user":{"id":"portainer.user","name":"portainer.user","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric user identifier","provider":"go.mondoo.com/mql/providers/portainer"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Account role: administrator, standard, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"teams":{"name":"teams","type":"\u0019\u001bportainer.team","title":"Teams this user belongs to","provider":"go.mondoo.com/mql/providers/portainer"},"theme":{"name":"theme","type":"\u0007","is_mandatory":true,"title":"UI theme preference for the account","provider":"go.mondoo.com/mql/providers/portainer"},"tokenIssueAt":{"name":"tokenIssueAt","type":"\t","is_mandatory":true,"title":"Time the current API token was issued (null if none)","provider":"go.mondoo.com/mql/providers/portainer"},"useCache":{"name":"useCache","type":"\u0004","is_mandatory":true,"title":"Whether server-side caching is enabled for this user","provider":"go.mondoo.com/mql/providers/portainer"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Login name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer user account","desc":"User account that authenticates to the Portainer server. The `role` field reports whether the account is a site `administrator` or a `standard` user, a key RBAC audit since administrators can reach every managed environment. Select a user by its numeric `id`, for example `portainer.users.where(role == \"administrator\")`, and traverse `teams` to see which teams it belongs to.","min_provider_version":"13.0.0","defaults":"username role","provider":"go.mondoo.com/mql/providers/portainer"}}}