findings

Creates, updates, deletes, gets or lists a findings resource.

Overview

Name	findings
Type	Resource
Id	aws.inspector2.findings

Fields

The following fields are returned by SELECT queries:

list_findings

Name	Datatype	Description
aws_account_id	string	The Amazon Web Services account ID associated with the finding. (pattern: <code>\d{12}</code>)
code_vulnerability_details	object	Details about the code vulnerability identified in a Lambda function used to filter findings.
description	string	The description of the finding.
epss	object	The finding's EPSS score.
exploit_available	string	If a finding discovered in your environment has an exploit available. (YES, NO)
exploitability_details	object	The details of an exploit available for a finding discovered in your environment.
finding_arn	string	The Amazon Resource Number (ARN) of the finding. (pattern: <code>arn:(aws[a-zA-Z-]*)?:inspector2:[a-z]{2}(-gov)?-[a-z]+-\d{1}:\d{12}:finding/[a-f0-9]{32}</code>)
first_observed_at	string (date-time)	The date and time that the finding was first observed.
fix_available	string	Details on whether a fix is available through a version update. This value can be YES, NO, or PARTIAL. A PARTIAL fix means that some, but not all, of the packages identified in the finding have fixes available through updated versions. (YES, NO, PARTIAL)
inspector_score	number (double)	The Amazon Inspector score given to the finding.
inspector_score_details	object	An object that contains details of the Amazon Inspector score.
last_observed_at	string (date-time)	The date and time the finding was last observed. This timestamp for this field remains unchanged until a finding is updated.
network_reachability_details	object	An object that contains the details of a network reachability finding.
package_vulnerability_details	object	An object that contains the details of a package vulnerability finding.
remediation	object	An object that contains the details about how to remediate a finding.
resources	array	Contains information on the resources involved in a finding. The resource value determines the valid values for type in your request. For more information, see Finding types in the Amazon Inspector user guide.
severity	string	The severity of the finding. UNTRIAGED applies to PACKAGE_VULNERABILITY type findings that the vendor has not assigned a severity yet. For more information, see Severity levels for findings in the Amazon Inspector user guide. (INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL, UNTRIAGED)
status	string	The status of the finding. (ACTIVE, SUPPRESSED, CLOSED)
title_	string	The title of the finding.
type_	string	The type of the finding. The type value determines the valid values for resource in your request. For more information, see Finding types in the Amazon Inspector user guide. (NETWORK_REACHABILITY, PACKAGE_VULNERABILITY, CODE_VULNERABILITY)
updated_at	string (date-time)	The date and time the finding was last updated at.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_findings	select	region		Lists findings for your environment.
create_findings_report	insert	region, reportFormat, s3Destination		Creates a finding report. By default only ACTIVE findings are returned in the report. To see SUPRESSED or CLOSED findings you must specify a value for the findingStatus filter criteria.
cancel_findings_report	exec	region, reportId		Cancels the given findings report.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_findings

Lists findings for your environment.

SELECT
aws_account_id,
code_vulnerability_details,
description,
epss,
exploit_available,
exploitability_details,
finding_arn,
first_observed_at,
fix_available,
inspector_score,
inspector_score_details,
last_observed_at,
network_reachability_details,
package_vulnerability_details,
remediation,
resources,
severity,
status,
title_,
type_,
updated_at
FROM aws.inspector2.findings
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_findings_report

Creates a finding report. By default only ACTIVE findings are returned in the report. To see SUPRESSED or CLOSED findings you must specify a value for the findingStatus filter criteria.

INSERT INTO aws.inspector2.findings (
filterCriteria,
reportFormat,
s3Destination,
region
)
SELECT 
'{{ filterCriteria }}',
'{{ reportFormat }}' /* required */,
'{{ s3Destination }}' /* required */,
'{{ region }}'
RETURNING
report_id
;

Manifest

# Description fields are for documentation purposes
- name: findings
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the findings resource.
  - name: filterCriteria
    description: |
      Details on the criteria used to define the filter.
    value:
      findingArn:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      awsAccountId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      findingType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      severity:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      firstObservedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      lastObservedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      updatedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      findingStatus:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      title_:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      inspectorScore:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      resourceType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      resourceId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      resourceTags:
        - comparison: "{{ comparison }}"
          key: "{{ key }}"
          value: "{{ value }}"
      ec2InstanceImageId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ec2InstanceVpcId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ec2InstanceSubnetId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImagePushedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      ecrImageArchitecture:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageRegistry:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageRepositoryName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageTags:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageHash:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      ecrImageLastInUseAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      ecrImageInUseCount:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      portRange:
        - beginInclusive: {{ beginInclusive }}
          endInclusive: {{ endInclusive }}
      networkProtocol:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      componentId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      componentType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vulnerabilityId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vulnerabilitySource:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vendorSeverity:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      vulnerablePackages:
        - name:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          version:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          epoch:
            upperInclusive: {{ upperInclusive }}
            lowerInclusive: {{ lowerInclusive }}
          release:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          architecture:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          sourceLayerHash:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          sourceLambdaLayerArn:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
          filePath:
            comparison: "{{ comparison }}"
            value: "{{ value }}"
      relatedVulnerabilities:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      fixAvailable:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionLayers:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionRuntime:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      lambdaFunctionLastModifiedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      lambdaFunctionExecutionRoleArn:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      exploitAvailable:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeVulnerabilityDetectorName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeVulnerabilityDetectorTags:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeVulnerabilityFilePath:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      epssScore:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      codeRepositoryProjectName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      codeRepositoryProviderType:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProvider:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProviderRegion:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProviderAccountId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudProviderOrgId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudVmImageReference:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudVmNetworkId:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudVmSubnetIds:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageRepositoryName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageRegistry:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageDigest:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageTags:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImagePushedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      cloudImageArchitecture:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudImageLastInUseAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      cloudImageInUseCount:
        - upperInclusive: {{ upperInclusive }}
          lowerInclusive: {{ lowerInclusive }}
      cloudServerlessFunctionName:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudServerlessFunctionRuntime:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
      cloudServerlessFunctionLastModifiedAt:
        - startInclusive: "{{ startInclusive }}"
          endInclusive: "{{ endInclusive }}"
      cloudServerlessFunctionExecutionRole:
        - comparison: "{{ comparison }}"
          value: "{{ value }}"
  - name: reportFormat
    value: "{{ reportFormat }}"
    valid_values: ['CSV', 'JSON']
  - name: s3Destination
    description: |
      Contains details of the Amazon S3 bucket and KMS key used to export findings.
    value:
      bucketName: "{{ bucketName }}"
      keyPrefix: "{{ keyPrefix }}"
      kmsKeyArn: "{{ kmsKeyArn }}"

Lifecycle Methods

cancel_findings_report

Cancels the given findings report.

EXEC aws.inspector2.findings.cancel_findings_report 
@region='{{ region }}' --required 
@@json=
'{
"reportId": "{{ reportId }}"
}'
;