Context

When comparing finding counts between the Endor Labs API and the web UI, you may notice discrepancies in the numbers. For example, the API might return 5,035 total findings while the UI shows only 4,507 findings for the same namespace. This difference can also be observed when filtering by specific finding categories or types.

Answer

The discrepancy often occurs because the Endor Labs UI is displaying findings with context.type == CONTEXT_TYPE_MAIN, while the API returns all findings regardless of their context type by default.

To get matching results between the API and UI, you may need to filter your API queries to include only findings with the main context type. Here's how:

1. Add the context type filter to your API query:

   Instead of:

   endorctl api list -n your-namespace -r Finding --list-all

   Use:

   endorctl api list -n your-namespace -r Finding --list-all -f 'context.type == CONTEXT_TYPE_MAIN'

2. For filtered queries, combine both filters:

   If you're filtering by finding categories, combine the filters like this:

   endorctl api list -n your-namespace -r Finding --list-all -f 'spec.finding_categories contains ["FINDING_CATEGORY_OPERATIONAL"] and context.type == CONTEXT_TYPE_MAIN'

3. To understand the distribution of context types:

   You can use group aggregation to see how findings are distributed across different context types:

   endorctl api list -n your-namespace -r Finding -f "meta.name==your-finding-name" --group-aggregation-paths context.type

The different context types include:

• CONTEXT_TYPE_MAIN - Main Context findings. These are what are shown in the UI on the global findings page and counts of findings on the projects page.

• CONTEXT_TYPE_CI_RUN - Findings from CI/CD runs

• CONTEXT_TYPE_REF - Reference findings

For more information about context types, refer to the Endor Labs documentation on context types.