Skip to content
AWS for Query.Farm

aws.inspector2.list_finding_aggregations

Example SQL Queries

SELECT * FROM
aws.inspector2.list_finding_aggregations
WHERE
"aggregation_type" = 'VALUE';

Description

Lists aggregated finding data for your environment based on specific criteria.

Table Definition

Column NameColumn Data Type
aggregation_type Required Input Column

The type of aggregation to perform.

VARCHAR
account_ids Input Column

The Amazon Web Services account IDs to retrieve finding aggregation data for.

STRUCT(
    "comparison" VARCHAR,
    "value" VARCHAR
)[]
Show child fields
account_ids[]
Show child fields
account_ids[].comparison

The operator to use when comparing values in the filter.

account_ids[].value

The value to filter on.

aggregation_request Input Column

Details of the aggregation request that is used to filter your aggregation results.

STRUCT(
    "account_aggregation" STRUCT(
        "finding_type" VARCHAR,
        "resource_type" VARCHAR,
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "ami_aggregation" STRUCT(
        "amis" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "aws_ecr_container_aggregation" STRUCT(
        "architectures" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "image_shas" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "image_tags" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "repositories" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "resource_ids" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "ec2_instance_aggregation" STRUCT(
        "amis" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "instance_ids" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "instance_tags" STRUCT(
            "comparison" VARCHAR,
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "operating_systems" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "finding_type_aggregation" STRUCT(
        "finding_type" VARCHAR,
        "resource_type" VARCHAR,
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "image_layer_aggregation" STRUCT(
        "layer_hashes" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "repositories" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "resource_ids" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "lambda_function_aggregation" STRUCT(
        "function_names" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "function_tags" STRUCT(
            "comparison" VARCHAR,
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "resource_ids" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "runtimes" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "lambda_layer_aggregation" STRUCT(
        "function_names" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "layer_arns" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "resource_ids" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "package_aggregation" STRUCT(
        "package_names" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "repository_aggregation" STRUCT(
        "repositories" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "sort_by" VARCHAR,
        "sort_order" VARCHAR
    ),
    "title_aggregation" STRUCT(
        "finding_type" VARCHAR,
        "resource_type" VARCHAR,
        "sort_by" VARCHAR,
        "sort_order" VARCHAR,
        "titles" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[],
        "vulnerability_ids" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )[]
    )
)
Show child fields
aggregation_request.account_aggregation

An object that contains details about an aggregation request based on Amazon Web Services account IDs.

Show child fields
aggregation_request.account_aggregation.finding_type

The type of finding.

aggregation_request.account_aggregation.resource_type

The type of resource.

aggregation_request.account_aggregation.sort_by

The value to sort by.

aggregation_request.account_aggregation.sort_order

The sort order (ascending or descending).

aggregation_request.ami_aggregation

An object that contains details about an aggregation request based on Amazon Machine Images (AMIs).

Show child fields
aggregation_request.ami_aggregation.amis[]
Show child fields
aggregation_request.ami_aggregation.amis[].comparison

The operator to use when comparing values in the filter.

aggregation_request.ami_aggregation.amis[].value

The value to filter on.

aggregation_request.ami_aggregation.sort_by

The value to sort results by.

aggregation_request.ami_aggregation.sort_order

The order to sort results by.

aggregation_request.aws_ecr_container_aggregation

An object that contains details about an aggregation request based on Amazon ECR container images.

Show child fields
aggregation_request.aws_ecr_container_aggregation.architectures[]
Show child fields
aggregation_request.aws_ecr_container_aggregation.architectures[].comparison

The operator to use when comparing values in the filter.

aggregation_request.aws_ecr_container_aggregation.architectures[].value

The value to filter on.

aggregation_request.aws_ecr_container_aggregation.image_shas[]
Show child fields
aggregation_request.aws_ecr_container_aggregation.image_shas[].comparison

The operator to use when comparing values in the filter.

aggregation_request.aws_ecr_container_aggregation.image_shas[].value

The value to filter on.

aggregation_request.aws_ecr_container_aggregation.image_tags[]
Show child fields
aggregation_request.aws_ecr_container_aggregation.image_tags[].comparison

The operator to use when comparing values in the filter.

aggregation_request.aws_ecr_container_aggregation.image_tags[].value

The value to filter on.

aggregation_request.aws_ecr_container_aggregation.repositories[]
Show child fields
aggregation_request.aws_ecr_container_aggregation.repositories[].comparison

The operator to use when comparing values in the filter.

aggregation_request.aws_ecr_container_aggregation.repositories[].value

The value to filter on.

aggregation_request.aws_ecr_container_aggregation.resource_ids[]
Show child fields
aggregation_request.aws_ecr_container_aggregation.resource_ids[].comparison

The operator to use when comparing values in the filter.

aggregation_request.aws_ecr_container_aggregation.resource_ids[].value

The value to filter on.

aggregation_request.aws_ecr_container_aggregation.sort_by

The value to sort by.

aggregation_request.aws_ecr_container_aggregation.sort_order

The sort order (ascending or descending).

aggregation_request.ec2_instance_aggregation

An object that contains details about an aggregation request based on Amazon EC2 instances.

Show child fields
aggregation_request.ec2_instance_aggregation.amis[]
Show child fields
aggregation_request.ec2_instance_aggregation.amis[].comparison

The operator to use when comparing values in the filter.

aggregation_request.ec2_instance_aggregation.amis[].value

The value to filter on.

aggregation_request.ec2_instance_aggregation.instance_ids[]
Show child fields
aggregation_request.ec2_instance_aggregation.instance_ids[].comparison

The operator to use when comparing values in the filter.

aggregation_request.ec2_instance_aggregation.instance_ids[].value

The value to filter on.

aggregation_request.ec2_instance_aggregation.instance_tags[]
Show child fields
aggregation_request.ec2_instance_aggregation.instance_tags[].comparison

The operator to use when comparing values in the filter.

aggregation_request.ec2_instance_aggregation.instance_tags[].key

The tag key used in the filter.

aggregation_request.ec2_instance_aggregation.instance_tags[].value

The tag value used in the filter.

aggregation_request.ec2_instance_aggregation.operating_systems[]
Show child fields
aggregation_request.ec2_instance_aggregation.operating_systems[].comparison

The operator to use when comparing values in the filter.

aggregation_request.ec2_instance_aggregation.operating_systems[].value

The value to filter on.

aggregation_request.ec2_instance_aggregation.sort_by

The value to sort results by.

aggregation_request.ec2_instance_aggregation.sort_order

The order to sort results by.

aggregation_request.finding_type_aggregation

An object that contains details about an aggregation request based on finding types.

Show child fields
aggregation_request.finding_type_aggregation.finding_type

The finding type to aggregate.

aggregation_request.finding_type_aggregation.resource_type

The resource type to aggregate.

aggregation_request.finding_type_aggregation.sort_by

The value to sort results by.

aggregation_request.finding_type_aggregation.sort_order

The order to sort results by.

aggregation_request.image_layer_aggregation

An object that contains details about an aggregation request based on container image layers.

Show child fields
aggregation_request.image_layer_aggregation.layer_hashes[]
Show child fields
aggregation_request.image_layer_aggregation.layer_hashes[].comparison

The operator to use when comparing values in the filter.

aggregation_request.image_layer_aggregation.layer_hashes[].value

The value to filter on.

aggregation_request.image_layer_aggregation.repositories[]
Show child fields
aggregation_request.image_layer_aggregation.repositories[].comparison

The operator to use when comparing values in the filter.

aggregation_request.image_layer_aggregation.repositories[].value

The value to filter on.

aggregation_request.image_layer_aggregation.resource_ids[]
Show child fields
aggregation_request.image_layer_aggregation.resource_ids[].comparison

The operator to use when comparing values in the filter.

aggregation_request.image_layer_aggregation.resource_ids[].value

The value to filter on.

aggregation_request.image_layer_aggregation.sort_by

The value to sort results by.

aggregation_request.image_layer_aggregation.sort_order

The order to sort results by.

aggregation_request.lambda_function_aggregation

Returns an object with findings aggregated by Amazon Web Services Lambda function.

Show child fields
aggregation_request.lambda_function_aggregation.function_names[]
Show child fields
aggregation_request.lambda_function_aggregation.function_names[].comparison

The operator to use when comparing values in the filter.

aggregation_request.lambda_function_aggregation.function_names[].value

The value to filter on.

aggregation_request.lambda_function_aggregation.function_tags[]
Show child fields
aggregation_request.lambda_function_aggregation.function_tags[].comparison

The operator to use when comparing values in the filter.

aggregation_request.lambda_function_aggregation.function_tags[].key

The tag key used in the filter.

aggregation_request.lambda_function_aggregation.function_tags[].value

The tag value used in the filter.

aggregation_request.lambda_function_aggregation.resource_ids[]
Show child fields
aggregation_request.lambda_function_aggregation.resource_ids[].comparison

The operator to use when comparing values in the filter.

aggregation_request.lambda_function_aggregation.resource_ids[].value

The value to filter on.

aggregation_request.lambda_function_aggregation.runtimes[]
Show child fields
aggregation_request.lambda_function_aggregation.runtimes[].comparison

The operator to use when comparing values in the filter.

aggregation_request.lambda_function_aggregation.runtimes[].value

The value to filter on.

aggregation_request.lambda_function_aggregation.sort_by

The finding severity to use for sorting the results.

aggregation_request.lambda_function_aggregation.sort_order

The order to use for sorting the results.

aggregation_request.lambda_layer_aggregation

Returns an object with findings aggregated by Amazon Web Services Lambda layer.

Show child fields
aggregation_request.lambda_layer_aggregation.function_names[]
Show child fields
aggregation_request.lambda_layer_aggregation.function_names[].comparison

The operator to use when comparing values in the filter.

aggregation_request.lambda_layer_aggregation.function_names[].value

The value to filter on.

aggregation_request.lambda_layer_aggregation.layer_arns[]
Show child fields
aggregation_request.lambda_layer_aggregation.layer_arns[].comparison

The operator to use when comparing values in the filter.

aggregation_request.lambda_layer_aggregation.layer_arns[].value

The value to filter on.

aggregation_request.lambda_layer_aggregation.resource_ids[]
Show child fields
aggregation_request.lambda_layer_aggregation.resource_ids[].comparison

The operator to use when comparing values in the filter.

aggregation_request.lambda_layer_aggregation.resource_ids[].value

The value to filter on.

aggregation_request.lambda_layer_aggregation.sort_by

The finding severity to use for sorting the results.

aggregation_request.lambda_layer_aggregation.sort_order

The order to use for sorting the results.

aggregation_request.package_aggregation

An object that contains details about an aggregation request based on operating system package type.

Show child fields
aggregation_request.package_aggregation.package_names[]
Show child fields
aggregation_request.package_aggregation.package_names[].comparison

The operator to use when comparing values in the filter.

aggregation_request.package_aggregation.package_names[].value

The value to filter on.

aggregation_request.package_aggregation.sort_by

The value to sort results by.

aggregation_request.package_aggregation.sort_order

The order to sort results by.

aggregation_request.repository_aggregation

An object that contains details about an aggregation request based on Amazon ECR repositories.

Show child fields
aggregation_request.repository_aggregation.repositories[]
Show child fields
aggregation_request.repository_aggregation.repositories[].comparison

The operator to use when comparing values in the filter.

aggregation_request.repository_aggregation.repositories[].value

The value to filter on.

aggregation_request.repository_aggregation.sort_by

The value to sort results by.

aggregation_request.repository_aggregation.sort_order

The order to sort results by.

aggregation_request.title_aggregation

An object that contains details about an aggregation request based on finding title.

Show child fields
aggregation_request.title_aggregation.finding_type

The type of finding to aggregate on.

aggregation_request.title_aggregation.resource_type

The resource type to aggregate on.

aggregation_request.title_aggregation.sort_by

The value to sort results by.

aggregation_request.title_aggregation.sort_order

The order to sort results by.

aggregation_request.title_aggregation.titles[]
Show child fields
aggregation_request.title_aggregation.titles[].comparison

The operator to use when comparing values in the filter.

aggregation_request.title_aggregation.titles[].value

The value to filter on.

aggregation_request.title_aggregation.vulnerability_ids[]
Show child fields
aggregation_request.title_aggregation.vulnerability_ids[].comparison

The operator to use when comparing values in the filter.

aggregation_request.title_aggregation.vulnerability_ids[].value

The value to filter on.

_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
responses

Objects that contain the results of an aggregation operation.

STRUCT(
    "account_aggregation" STRUCT(
        "account_id" VARCHAR,
        "exploit_available_count" BIGINT,
        "fix_available_count" BIGINT,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "ami_aggregation" STRUCT(
        "account_id" VARCHAR,
        "affected_instances" BIGINT,
        "ami" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "aws_ecr_container_aggregation" STRUCT(
        "account_id" VARCHAR,
        "architecture" VARCHAR,
        "image_sha" VARCHAR,
        "image_tags" VARCHAR[],
        "repository" VARCHAR,
        "resource_id" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "ec2_instance_aggregation" STRUCT(
        "account_id" VARCHAR,
        "ami" VARCHAR,
        "instance_id" VARCHAR,
        "instance_tags" MAP(VARCHAR, VARCHAR),
        "network_findings" BIGINT,
        "operating_system" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "finding_type_aggregation" STRUCT(
        "account_id" VARCHAR,
        "exploit_available_count" BIGINT,
        "fix_available_count" BIGINT,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "image_layer_aggregation" STRUCT(
        "account_id" VARCHAR,
        "layer_hash" VARCHAR,
        "repository" VARCHAR,
        "resource_id" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "lambda_function_aggregation" STRUCT(
        "account_id" VARCHAR,
        "function_name" VARCHAR,
        "lambda_tags" MAP(VARCHAR, VARCHAR),
        "last_modified_at" TIMESTAMP_S,
        "resource_id" VARCHAR,
        "runtime" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "lambda_layer_aggregation" STRUCT(
        "account_id" VARCHAR,
        "function_name" VARCHAR,
        "layer_arn" VARCHAR,
        "resource_id" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "package_aggregation" STRUCT(
        "account_id" VARCHAR,
        "package_name" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "repository_aggregation" STRUCT(
        "account_id" VARCHAR,
        "affected_images" BIGINT,
        "repository" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        )
    ),
    "title_aggregation" STRUCT(
        "account_id" VARCHAR,
        "severity_counts" STRUCT(
            "all" BIGINT,
            "critical" BIGINT,
            "high" BIGINT,
            "medium" BIGINT
        ),
        "title" VARCHAR,
        "vulnerability_id" VARCHAR
    )
)[]
Show child fields
responses[]
Show child fields
responses[].account_aggregation

An object that contains details about an aggregation response based on Amazon Web Services account IDs.

Show child fields
responses[].account_aggregation.account_id

The Amazon Web Services account ID.

responses[].account_aggregation.exploit_available_count

The number of findings that have an exploit available.

responses[].account_aggregation.fix_available_count

Details about the number of fixes.

responses[].account_aggregation.severity_counts

The number of findings by severity.

Show child fields
responses[].account_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].account_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].account_aggregation.severity_counts.high

The total count of high severity findings.

responses[].account_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].ami_aggregation

An object that contains details about an aggregation response based on Amazon Machine Images (AMIs).

Show child fields
responses[].ami_aggregation.account_id

The Amazon Web Services account ID for the AMI.

responses[].ami_aggregation.affected_instances

The IDs of Amazon EC2 instances using this AMI.

responses[].ami_aggregation.ami

The ID of the AMI that findings were aggregated for.

responses[].ami_aggregation.severity_counts

An object that contains the count of matched findings per severity.

Show child fields
responses[].ami_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].ami_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].ami_aggregation.severity_counts.high

The total count of high severity findings.

responses[].ami_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].aws_ecr_container_aggregation

An object that contains details about an aggregation response based on Amazon ECR container images.

Show child fields
responses[].aws_ecr_container_aggregation.account_id

The Amazon Web Services account ID of the account that owns the container.

responses[].aws_ecr_container_aggregation.architecture

The architecture of the container.

responses[].aws_ecr_container_aggregation.image_sha

The SHA value of the container image.

responses[].aws_ecr_container_aggregation.image_tags[]
responses[].aws_ecr_container_aggregation.repository

The container repository.

responses[].aws_ecr_container_aggregation.resource_id

The resource ID of the container.

responses[].aws_ecr_container_aggregation.severity_counts

The number of finding by severity.

Show child fields
responses[].aws_ecr_container_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].aws_ecr_container_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].aws_ecr_container_aggregation.severity_counts.high

The total count of high severity findings.

responses[].aws_ecr_container_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].ec2_instance_aggregation

An object that contains details about an aggregation response based on Amazon EC2 instances.

Show child fields
responses[].ec2_instance_aggregation.account_id

The Amazon Web Services account for the Amazon EC2 instance.

responses[].ec2_instance_aggregation.ami

The Amazon Machine Image (AMI) of the Amazon EC2 instance.

responses[].ec2_instance_aggregation.instance_id

The Amazon EC2 instance ID.

responses[].ec2_instance_aggregation.instance_tags

The tags attached to the instance.

responses[].ec2_instance_aggregation.network_findings

The number of network findings for the Amazon EC2 instance.

responses[].ec2_instance_aggregation.operating_system

The operating system of the Amazon EC2 instance.

responses[].ec2_instance_aggregation.severity_counts

An object that contains the count of matched findings per severity.

Show child fields
responses[].ec2_instance_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].ec2_instance_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].ec2_instance_aggregation.severity_counts.high

The total count of high severity findings.

responses[].ec2_instance_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].finding_type_aggregation

An object that contains details about an aggregation response based on finding types.

Show child fields
responses[].finding_type_aggregation.account_id

The ID of the Amazon Web Services account associated with the findings.

responses[].finding_type_aggregation.exploit_available_count

The number of findings that have an exploit available.

responses[].finding_type_aggregation.fix_available_count

Details about the number of fixes.

responses[].finding_type_aggregation.severity_counts

The value to sort results by.

Show child fields
responses[].finding_type_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].finding_type_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].finding_type_aggregation.severity_counts.high

The total count of high severity findings.

responses[].finding_type_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].image_layer_aggregation

An object that contains details about an aggregation response based on container image layers.

Show child fields
responses[].image_layer_aggregation.account_id

The ID of the Amazon Web Services account that owns the container image hosting the layer image.

responses[].image_layer_aggregation.layer_hash

The layer hash.

responses[].image_layer_aggregation.repository

The repository the layer resides in.

responses[].image_layer_aggregation.resource_id

The resource ID of the container image layer.

responses[].image_layer_aggregation.severity_counts

An object that represents the count of matched findings per severity.

Show child fields
responses[].image_layer_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].image_layer_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].image_layer_aggregation.severity_counts.high

The total count of high severity findings.

responses[].image_layer_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].lambda_function_aggregation

An aggregation of findings by Amazon Web Services Lambda function.

Show child fields
responses[].lambda_function_aggregation.account_id

The ID of the Amazon Web Services account that owns the Amazon Web Services Lambda function.

responses[].lambda_function_aggregation.function_name

The Amazon Web Services Lambda function names included in the aggregation results.

responses[].lambda_function_aggregation.lambda_tags

The tags included in the aggregation results.

responses[].lambda_function_aggregation.last_modified_at

The date that the Amazon Web Services Lambda function included in the aggregation results was last changed.

responses[].lambda_function_aggregation.resource_id

The resource IDs included in the aggregation results.

responses[].lambda_function_aggregation.runtime

The runtimes included in the aggregation results.

responses[].lambda_function_aggregation.severity_counts

An object that contains the counts of aggregated finding per severity.

Show child fields
responses[].lambda_function_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].lambda_function_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].lambda_function_aggregation.severity_counts.high

The total count of high severity findings.

responses[].lambda_function_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].lambda_layer_aggregation

An aggregation of findings by Amazon Web Services Lambda layer.

Show child fields
responses[].lambda_layer_aggregation.account_id

The account ID of the Amazon Web Services Lambda function layer.

responses[].lambda_layer_aggregation.function_name

The names of the Amazon Web Services Lambda functions associated with the layers.

responses[].lambda_layer_aggregation.layer_arn

The Amazon Resource Name (ARN) of the Amazon Web Services Lambda function layer.

responses[].lambda_layer_aggregation.resource_id

The Resource ID of the Amazon Web Services Lambda function layer.

responses[].lambda_layer_aggregation.severity_counts

An object that contains the counts of aggregated finding per severity.

Show child fields
responses[].lambda_layer_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].lambda_layer_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].lambda_layer_aggregation.severity_counts.high

The total count of high severity findings.

responses[].lambda_layer_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].package_aggregation

An object that contains details about an aggregation response based on operating system package type.

Show child fields
responses[].package_aggregation.account_id

The ID of the Amazon Web Services account associated with the findings.

responses[].package_aggregation.package_name

The name of the operating system package.

responses[].package_aggregation.severity_counts

An object that contains the count of matched findings per severity.

Show child fields
responses[].package_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].package_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].package_aggregation.severity_counts.high

The total count of high severity findings.

responses[].package_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].repository_aggregation

An object that contains details about an aggregation response based on Amazon ECR repositories.

Show child fields
responses[].repository_aggregation.account_id

The ID of the Amazon Web Services account associated with the findings.

responses[].repository_aggregation.affected_images

The number of container images impacted by the findings.

responses[].repository_aggregation.repository

The name of the repository associated with the findings.

responses[].repository_aggregation.severity_counts

An object that represent the count of matched findings per severity.

Show child fields
responses[].repository_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].repository_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].repository_aggregation.severity_counts.high

The total count of high severity findings.

responses[].repository_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].title_aggregation

An object that contains details about an aggregation response based on finding title.

Show child fields
responses[].title_aggregation.account_id

The ID of the Amazon Web Services account associated with the findings.

responses[].title_aggregation.severity_counts

An object that represent the count of matched findings per severity.

Show child fields
responses[].title_aggregation.severity_counts.all

The total count of findings from all severities.

responses[].title_aggregation.severity_counts.critical

The total count of critical severity findings.

responses[].title_aggregation.severity_counts.high

The total count of high severity findings.

responses[].title_aggregation.severity_counts.medium

The total count of medium severity findings.

responses[].title_aggregation.title

The title that the findings were aggregated on.

responses[].title_aggregation.vulnerability_id

The vulnerability ID of the finding.