Skip to content
AWS for Query.Farm

aws.inspector2.list_findings

Example SQL Queries

SELECT * FROM
aws.inspector2.list_findings;

Description

Lists findings for your environment.

Table Definition

Column NameColumn Data Type
filter_criteria Input Column

Details on the filters to apply to your finding results.

STRUCT(
    "aws_account_id" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "code_vulnerability_detector_name" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "code_vulnerability_detector_tags" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "code_vulnerability_file_path" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "component_id" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "component_type" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ec2_instance_image_id" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ec2_instance_subnet_id" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ec2_instance_vpc_id" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ecr_image_architecture" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ecr_image_hash" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ecr_image_pushed_at" STRUCT(
        "end_inclusive" TIMESTAMP_S,
        "start_inclusive" TIMESTAMP_S
    )[],
    "ecr_image_registry" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ecr_image_repository_name" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "ecr_image_tags" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "epss_score" STRUCT(
        "lower_inclusive" DOUBLE,
        "upper_inclusive" DOUBLE
    )[],
    "exploit_available" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "finding_arn" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "finding_status" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "finding_type" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "first_observed_at" STRUCT(
        "end_inclusive" TIMESTAMP_S,
        "start_inclusive" TIMESTAMP_S
    )[],
    "fix_available" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "inspector_score" STRUCT(
        "lower_inclusive" DOUBLE,
        "upper_inclusive" DOUBLE
    )[],
    "lambda_function_execution_role_arn" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "lambda_function_last_modified_at" STRUCT(
        "end_inclusive" TIMESTAMP_S,
        "start_inclusive" TIMESTAMP_S
    )[],
    "lambda_function_layers" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "lambda_function_name" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "lambda_function_runtime" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "last_observed_at" STRUCT(
        "end_inclusive" TIMESTAMP_S,
        "start_inclusive" TIMESTAMP_S
    )[],
    "network_protocol" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "port_range" STRUCT(
        "begin_inclusive" BIGINT,
        "end_inclusive" BIGINT
    )[],
    "related_vulnerabilities" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "resource_id" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "resource_tags" STRUCT(
        "comparison" VARCHAR,
        "key" VARCHAR,
        "value" VARCHAR
    )[],
    "resource_type" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "severity" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "title" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "updated_at" STRUCT(
        "end_inclusive" TIMESTAMP_S,
        "start_inclusive" TIMESTAMP_S
    )[],
    "vendor_severity" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "vulnerability_id" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "vulnerability_source" STRUCT(
        "comparison" VARCHAR,
        "value" VARCHAR
    )[],
    "vulnerable_packages" STRUCT(
        "architecture" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        ),
        "epoch" STRUCT(
            "lower_inclusive" DOUBLE,
            "upper_inclusive" DOUBLE
        ),
        "name" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        ),
        "release" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        ),
        "source_lambda_layer_arn" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        ),
        "source_layer_hash" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        ),
        "version" STRUCT(
            "comparison" VARCHAR,
            "value" VARCHAR
        )
    )[]
)
Show child fields
filter_criteria.aws_account_id[]
Show child fields
filter_criteria.aws_account_id[].comparison

The operator to use when comparing values in the filter.

filter_criteria.aws_account_id[].value

The value to filter on.

filter_criteria.code_vulnerability_detector_name[]
Show child fields
filter_criteria.code_vulnerability_detector_name[].comparison

The operator to use when comparing values in the filter.

filter_criteria.code_vulnerability_detector_name[].value

The value to filter on.

filter_criteria.code_vulnerability_detector_tags[]
Show child fields
filter_criteria.code_vulnerability_detector_tags[].comparison

The operator to use when comparing values in the filter.

filter_criteria.code_vulnerability_detector_tags[].value

The value to filter on.

filter_criteria.code_vulnerability_file_path[]
Show child fields
filter_criteria.code_vulnerability_file_path[].comparison

The operator to use when comparing values in the filter.

filter_criteria.code_vulnerability_file_path[].value

The value to filter on.

filter_criteria.component_id[]
Show child fields
filter_criteria.component_id[].comparison

The operator to use when comparing values in the filter.

filter_criteria.component_id[].value

The value to filter on.

filter_criteria.component_type[]
Show child fields
filter_criteria.component_type[].comparison

The operator to use when comparing values in the filter.

filter_criteria.component_type[].value

The value to filter on.

filter_criteria.ec2_instance_image_id[]
Show child fields
filter_criteria.ec2_instance_image_id[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ec2_instance_image_id[].value

The value to filter on.

filter_criteria.ec2_instance_subnet_id[]
Show child fields
filter_criteria.ec2_instance_subnet_id[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ec2_instance_subnet_id[].value

The value to filter on.

filter_criteria.ec2_instance_vpc_id[]
Show child fields
filter_criteria.ec2_instance_vpc_id[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ec2_instance_vpc_id[].value

The value to filter on.

filter_criteria.ecr_image_architecture[]
Show child fields
filter_criteria.ecr_image_architecture[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ecr_image_architecture[].value

The value to filter on.

filter_criteria.ecr_image_hash[]
Show child fields
filter_criteria.ecr_image_hash[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ecr_image_hash[].value

The value to filter on.

filter_criteria.ecr_image_pushed_at[]
Show child fields
filter_criteria.ecr_image_pushed_at[].end_inclusive

A timestamp representing the end of the time period filtered on.

filter_criteria.ecr_image_pushed_at[].start_inclusive

A timestamp representing the start of the time period filtered on.

filter_criteria.ecr_image_registry[]
Show child fields
filter_criteria.ecr_image_registry[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ecr_image_registry[].value

The value to filter on.

filter_criteria.ecr_image_repository_name[]
Show child fields
filter_criteria.ecr_image_repository_name[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ecr_image_repository_name[].value

The value to filter on.

filter_criteria.ecr_image_tags[]
Show child fields
filter_criteria.ecr_image_tags[].comparison

The operator to use when comparing values in the filter.

filter_criteria.ecr_image_tags[].value

The value to filter on.

filter_criteria.epss_score[]
Show child fields
filter_criteria.epss_score[].lower_inclusive

The lowest number to be included in the filter.

filter_criteria.epss_score[].upper_inclusive

The highest number to be included in the filter.

filter_criteria.exploit_available[]
Show child fields
filter_criteria.exploit_available[].comparison

The operator to use when comparing values in the filter.

filter_criteria.exploit_available[].value

The value to filter on.

filter_criteria.finding_arn[]
Show child fields
filter_criteria.finding_arn[].comparison

The operator to use when comparing values in the filter.

filter_criteria.finding_arn[].value

The value to filter on.

filter_criteria.finding_status[]
Show child fields
filter_criteria.finding_status[].comparison

The operator to use when comparing values in the filter.

filter_criteria.finding_status[].value

The value to filter on.

filter_criteria.finding_type[]
Show child fields
filter_criteria.finding_type[].comparison

The operator to use when comparing values in the filter.

filter_criteria.finding_type[].value

The value to filter on.

filter_criteria.first_observed_at[]
Show child fields
filter_criteria.first_observed_at[].end_inclusive

A timestamp representing the end of the time period filtered on.

filter_criteria.first_observed_at[].start_inclusive

A timestamp representing the start of the time period filtered on.

filter_criteria.fix_available[]
Show child fields
filter_criteria.fix_available[].comparison

The operator to use when comparing values in the filter.

filter_criteria.fix_available[].value

The value to filter on.

filter_criteria.inspector_score[]
Show child fields
filter_criteria.inspector_score[].lower_inclusive

The lowest number to be included in the filter.

filter_criteria.inspector_score[].upper_inclusive

The highest number to be included in the filter.

filter_criteria.lambda_function_execution_role_arn[]
Show child fields
filter_criteria.lambda_function_execution_role_arn[].comparison

The operator to use when comparing values in the filter.

filter_criteria.lambda_function_execution_role_arn[].value

The value to filter on.

filter_criteria.lambda_function_last_modified_at[]
Show child fields
filter_criteria.lambda_function_last_modified_at[].end_inclusive

A timestamp representing the end of the time period filtered on.

filter_criteria.lambda_function_last_modified_at[].start_inclusive

A timestamp representing the start of the time period filtered on.

filter_criteria.lambda_function_layers[]
Show child fields
filter_criteria.lambda_function_layers[].comparison

The operator to use when comparing values in the filter.

filter_criteria.lambda_function_layers[].value

The value to filter on.

filter_criteria.lambda_function_name[]
Show child fields
filter_criteria.lambda_function_name[].comparison

The operator to use when comparing values in the filter.

filter_criteria.lambda_function_name[].value

The value to filter on.

filter_criteria.lambda_function_runtime[]
Show child fields
filter_criteria.lambda_function_runtime[].comparison

The operator to use when comparing values in the filter.

filter_criteria.lambda_function_runtime[].value

The value to filter on.

filter_criteria.last_observed_at[]
Show child fields
filter_criteria.last_observed_at[].end_inclusive

A timestamp representing the end of the time period filtered on.

filter_criteria.last_observed_at[].start_inclusive

A timestamp representing the start of the time period filtered on.

filter_criteria.network_protocol[]
Show child fields
filter_criteria.network_protocol[].comparison

The operator to use when comparing values in the filter.

filter_criteria.network_protocol[].value

The value to filter on.

filter_criteria.port_range[]
Show child fields
filter_criteria.port_range[].begin_inclusive

The port number the port range begins at.

filter_criteria.port_range[].end_inclusive

The port number the port range ends at.

filter_criteria.related_vulnerabilities[]
Show child fields
filter_criteria.related_vulnerabilities[].comparison

The operator to use when comparing values in the filter.

filter_criteria.related_vulnerabilities[].value

The value to filter on.

filter_criteria.resource_id[]
Show child fields
filter_criteria.resource_id[].comparison

The operator to use when comparing values in the filter.

filter_criteria.resource_id[].value

The value to filter on.

filter_criteria.resource_tags[]
Show child fields
filter_criteria.resource_tags[].comparison

The operator to use when comparing values in the filter.

filter_criteria.resource_tags[].key

The tag key used in the filter.

filter_criteria.resource_tags[].value

The tag value used in the filter.

filter_criteria.resource_type[]
Show child fields
filter_criteria.resource_type[].comparison

The operator to use when comparing values in the filter.

filter_criteria.resource_type[].value

The value to filter on.

filter_criteria.severity[]
Show child fields
filter_criteria.severity[].comparison

The operator to use when comparing values in the filter.

filter_criteria.severity[].value

The value to filter on.

filter_criteria.title[]
Show child fields
filter_criteria.title[].comparison

The operator to use when comparing values in the filter.

filter_criteria.title[].value

The value to filter on.

filter_criteria.updated_at[]
Show child fields
filter_criteria.updated_at[].end_inclusive

A timestamp representing the end of the time period filtered on.

filter_criteria.updated_at[].start_inclusive

A timestamp representing the start of the time period filtered on.

filter_criteria.vendor_severity[]
Show child fields
filter_criteria.vendor_severity[].comparison

The operator to use when comparing values in the filter.

filter_criteria.vendor_severity[].value

The value to filter on.

filter_criteria.vulnerability_id[]
Show child fields
filter_criteria.vulnerability_id[].comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerability_id[].value

The value to filter on.

filter_criteria.vulnerability_source[]
Show child fields
filter_criteria.vulnerability_source[].comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerability_source[].value

The value to filter on.

filter_criteria.vulnerable_packages[]
Show child fields
filter_criteria.vulnerable_packages[].architecture

An object that contains details on the package architecture type to filter on.

Show child fields
filter_criteria.vulnerable_packages[].architecture.comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerable_packages[].architecture.value

The value to filter on.

filter_criteria.vulnerable_packages[].epoch

An object that contains details on the package epoch to filter on.

Show child fields
filter_criteria.vulnerable_packages[].epoch.lower_inclusive

The lowest number to be included in the filter.

filter_criteria.vulnerable_packages[].epoch.upper_inclusive

The highest number to be included in the filter.

filter_criteria.vulnerable_packages[].name

An object that contains details on the name of the package to filter on.

Show child fields
filter_criteria.vulnerable_packages[].name.comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerable_packages[].name.value

The value to filter on.

filter_criteria.vulnerable_packages[].release

An object that contains details on the package release to filter on.

Show child fields
filter_criteria.vulnerable_packages[].release.comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerable_packages[].release.value

The value to filter on.

filter_criteria.vulnerable_packages[].source_lambda_layer_arn

An object that describes the details of a string filter.

Show child fields
filter_criteria.vulnerable_packages[].source_lambda_layer_arn.comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerable_packages[].source_lambda_layer_arn.value

The value to filter on.

filter_criteria.vulnerable_packages[].source_layer_hash

An object that contains details on the source layer hash to filter on.

Show child fields
filter_criteria.vulnerable_packages[].source_layer_hash.comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerable_packages[].source_layer_hash.value

The value to filter on.

filter_criteria.vulnerable_packages[].version

The package version to filter on.

Show child fields
filter_criteria.vulnerable_packages[].version.comparison

The operator to use when comparing values in the filter.

filter_criteria.vulnerable_packages[].version.value

The value to filter on.

sort_criteria Input Column

Details on the sort criteria to apply to your finding results.

STRUCT(
    "field" VARCHAR,
    "sort_order" VARCHAR
)
Show child fields
sort_criteria.field

The finding detail field by which results are sorted.

sort_criteria.sort_order

The order by which findings are sorted.

_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
aws_account_id

The Amazon Web Services account ID associated with the finding.

VARCHAR
code_vulnerability_details

Details about the code vulnerability identified in a Lambda function used to filter findings.

STRUCT(
    "cwes" VARCHAR[],
    "detector_id" VARCHAR,
    "detector_name" VARCHAR,
    "detector_tags" VARCHAR[],
    "file_path" STRUCT(
        "end_line" BIGINT,
        "file_name" VARCHAR,
        "file_path" VARCHAR,
        "start_line" BIGINT
    ),
    "reference_urls" VARCHAR[],
    "rule_id" VARCHAR,
    "source_lambda_layer_arn" VARCHAR
)
Show child fields
code_vulnerability_details.cwes[]
code_vulnerability_details.detector_id

The ID for the Amazon CodeGuru detector associated with the finding. For more information on detectors see Amazon CodeGuru Detector Library.

code_vulnerability_details.detector_name

The name of the detector used to identify the code vulnerability. For more information on detectors see CodeGuru Detector Library.

code_vulnerability_details.detector_tags[]
code_vulnerability_details.file_path

Contains information on where the code vulnerability is located in your code.

Show child fields
code_vulnerability_details.file_path.end_line

The line number of the last line of code that a vulnerability was found in.

code_vulnerability_details.file_path.file_name

The name of the file the code vulnerability was found in.

code_vulnerability_details.file_path.file_path

The file path to the code that a vulnerability was found in.

code_vulnerability_details.file_path.start_line

The line number of the first line of code that a vulnerability was found in.

code_vulnerability_details.reference_urls[]
code_vulnerability_details.rule_id

The identifier for a rule that was used to detect the code vulnerability.

code_vulnerability_details.source_lambda_layer_arn

The Amazon Resource Name (ARN) of the Lambda layer that the code vulnerability was detected in.

description

The description of the finding.

VARCHAR
epss

The finding's EPSS score.

STRUCT(
    "score" DOUBLE
)
Show child fields
epss.score

The EPSS score.

exploit_available

If a finding discovered in your environment has an exploit available.

VARCHAR
exploitability_details

The details of an exploit available for a finding discovered in your environment.

STRUCT(
    "last_known_exploit_at" TIMESTAMP_S
)
Show child fields
exploitability_details.last_known_exploit_at

The date and time of the last exploit associated with a finding discovered in your environment.

finding_arn

The Amazon Resource Number (ARN) of the finding.

VARCHAR
first_observed_at

The date and time that the finding was first observed.

TIMESTAMP_S
fix_available

Details on whether a fix is available through a version update. This value can be YES, NO, or PARTIAL. A PARTIAL fix means that some, but not all, of the packages identified in the finding have fixes available through updated versions.

VARCHAR
inspector_score

The Amazon Inspector score given to the finding.

DOUBLE
inspector_score_details

An object that contains details of the Amazon Inspector score.

STRUCT(
    "adjusted_cvss" STRUCT(
        "adjustments" STRUCT(
            "metric" VARCHAR,
            "reason" VARCHAR
        )[],
        "cvss_source" VARCHAR,
        "score" DOUBLE,
        "score_source" VARCHAR,
        "scoring_vector" VARCHAR,
        "version" VARCHAR
    )
)
Show child fields
inspector_score_details.adjusted_cvss

An object that contains details about the CVSS score given to a finding.

Show child fields
inspector_score_details.adjusted_cvss.adjustments[]
Show child fields
inspector_score_details.adjusted_cvss.adjustments[].metric

The metric used to adjust the CVSS score.

inspector_score_details.adjusted_cvss.adjustments[].reason

The reason the CVSS score has been adjustment.

inspector_score_details.adjusted_cvss.cvss_source

The source of the CVSS data.

inspector_score_details.adjusted_cvss.score

The CVSS score.

inspector_score_details.adjusted_cvss.score_source

The source for the CVSS score.

inspector_score_details.adjusted_cvss.scoring_vector

The vector for the CVSS score.

inspector_score_details.adjusted_cvss.version

The CVSS version used in scoring.

last_observed_at

The date and time the finding was last observed. This timestamp for this field remains unchanged until a finding is updated. 

TIMESTAMP_S
network_reachability_details

An object that contains the details of a network reachability finding.

STRUCT(
    "network_path" STRUCT(
        "steps" STRUCT(
            "component_id" VARCHAR,
            "component_type" VARCHAR
        )[]
    ),
    "open_port_range" STRUCT(
        "begin" BIGINT,
        "end" BIGINT
    ),
    "protocol" VARCHAR
)
Show child fields
network_reachability_details.network_path

An object that contains details about a network path associated with a finding.

Show child fields
network_reachability_details.network_path.steps[]
Show child fields
network_reachability_details.network_path.steps[].component_id

The component ID.

network_reachability_details.network_path.steps[].component_type

The component type.

network_reachability_details.open_port_range

An object that contains details about the open port range associated with a finding.

Show child fields
network_reachability_details.open_port_range.begin

The beginning port in a port range.

network_reachability_details.open_port_range.end

The ending port in a port range.

network_reachability_details.protocol

The protocol associated with a finding.

package_vulnerability_details

An object that contains the details of a package vulnerability finding.

STRUCT(
    "cvss" STRUCT(
        "base_score" DOUBLE,
        "scoring_vector" VARCHAR,
        "source" VARCHAR,
        "version" VARCHAR
    )[],
    "reference_urls" VARCHAR[],
    "related_vulnerabilities" VARCHAR[],
    "source" VARCHAR,
    "source_url" VARCHAR,
    "vendor_created_at" TIMESTAMP_S,
    "vendor_severity" VARCHAR,
    "vendor_updated_at" TIMESTAMP_S,
    "vulnerability_id" VARCHAR,
    "vulnerable_packages" STRUCT(
        "arch" VARCHAR,
        "epoch" BIGINT,
        "file_path" VARCHAR,
        "fixed_in_version" VARCHAR,
        "name" VARCHAR,
        "package_manager" VARCHAR,
        "release" VARCHAR,
        "remediation" VARCHAR,
        "source_lambda_layer_arn" VARCHAR,
        "source_layer_hash" VARCHAR,
        "version" VARCHAR
    )[]
)
Show child fields
package_vulnerability_details.cvss[]
Show child fields
package_vulnerability_details.cvss[].base_score

The base CVSS score used for the finding.

package_vulnerability_details.cvss[].scoring_vector

The vector string of the CVSS score.

package_vulnerability_details.cvss[].source

The source of the CVSS score.

package_vulnerability_details.cvss[].version

The version of CVSS used for the score.

package_vulnerability_details.reference_urls[]
package_vulnerability_details.related_vulnerabilities[]
package_vulnerability_details.source

The source of the vulnerability information.

package_vulnerability_details.source_url

A URL to the source of the vulnerability information.

package_vulnerability_details.vendor_created_at

The date and time that this vulnerability was first added to the vendor's database.

package_vulnerability_details.vendor_severity

The severity the vendor has given to this vulnerability type.

package_vulnerability_details.vendor_updated_at

The date and time the vendor last updated this vulnerability in their database.

package_vulnerability_details.vulnerability_id

The ID given to this vulnerability.

package_vulnerability_details.vulnerable_packages[]
Show child fields
package_vulnerability_details.vulnerable_packages[].arch

The architecture of the vulnerable package.

package_vulnerability_details.vulnerable_packages[].epoch

The epoch of the vulnerable package.

package_vulnerability_details.vulnerable_packages[].file_path

The file path of the vulnerable package.

package_vulnerability_details.vulnerable_packages[].fixed_in_version

The version of the package that contains the vulnerability fix.

package_vulnerability_details.vulnerable_packages[].name

The name of the vulnerable package.

package_vulnerability_details.vulnerable_packages[].package_manager

The package manager of the vulnerable package.

package_vulnerability_details.vulnerable_packages[].release

The release of the vulnerable package.

package_vulnerability_details.vulnerable_packages[].remediation

The code to run in your environment to update packages with a fix available.

package_vulnerability_details.vulnerable_packages[].source_lambda_layer_arn

The Amazon Resource Number (ARN) of the Amazon Web Services Lambda function affected by a finding.

package_vulnerability_details.vulnerable_packages[].source_layer_hash

The source layer hash of the vulnerable package.

package_vulnerability_details.vulnerable_packages[].version

The version of the vulnerable package.

remediation

An object that contains the details about how to remediate a finding.

STRUCT(
    "recommendation" STRUCT(
        "url" VARCHAR,
        "text" VARCHAR
    )
)
Show child fields
remediation.recommendation

An object that contains information about the recommended course of action to remediate the finding.

Show child fields
remediation.recommendation.text

The recommended course of action to remediate the finding.

remediation.recommendation.url

The URL address to the CVE remediation recommendations.

resources

Contains information on the resources involved in a finding. The resource value determines the valid values for type in your request. For more information, see Finding types in the Amazon Inspector user guide.

STRUCT(
    "details" STRUCT(
        "aws_ec2_instance" STRUCT(
            "iam_instance_profile_arn" VARCHAR,
            "image_id" VARCHAR,
            "ip_v4_addresses" VARCHAR[],
            "ip_v6_addresses" VARCHAR[],
            "key_name" VARCHAR,
            "launched_at" TIMESTAMP_S,
            "platform" VARCHAR,
            "subnet_id" VARCHAR,
            "type" VARCHAR,
            "vpc_id" VARCHAR
        ),
        "aws_ecr_container_image" STRUCT(
            "architecture" VARCHAR,
            "author" VARCHAR,
            "image_hash" VARCHAR,
            "image_tags" VARCHAR[],
            "platform" VARCHAR,
            "pushed_at" TIMESTAMP_S,
            "registry" VARCHAR,
            "repository_name" VARCHAR
        ),
        "aws_lambda_function" STRUCT(
            "architectures" VARCHAR[],
            "code_sha256" VARCHAR,
            "execution_role_arn" VARCHAR,
            "function_name" VARCHAR,
            "last_modified_at" TIMESTAMP_S,
            "layers" VARCHAR[],
            "package_type" VARCHAR,
            "runtime" VARCHAR,
            "version" VARCHAR,
            "vpc_config" STRUCT(
                "security_group_ids" VARCHAR[],
                "subnet_ids" VARCHAR[],
                "vpc_id" VARCHAR
            )
        )
    ),
    "id" VARCHAR,
    "partition" VARCHAR,
    "region" VARCHAR,
    "tags" MAP(VARCHAR, VARCHAR),
    "type" VARCHAR
)[]
Show child fields
resources[]
Show child fields
resources[].details

An object that contains details about the resource involved in a finding.

Show child fields
resources[].details.aws_ec2_instance

An object that contains details about the Amazon EC2 instance involved in the finding.

Show child fields
resources[].details.aws_ec2_instance.iam_instance_profile_arn

The IAM instance profile ARN of the Amazon EC2 instance.

resources[].details.aws_ec2_instance.image_id

The image ID of the Amazon EC2 instance.

resources[].details.aws_ec2_instance.ip_v4_addresses[]
resources[].details.aws_ec2_instance.ip_v6_addresses[]
resources[].details.aws_ec2_instance.key_name

The name of the key pair used to launch the Amazon EC2 instance.

resources[].details.aws_ec2_instance.launched_at

The date and time the Amazon EC2 instance was launched at.

resources[].details.aws_ec2_instance.platform

The platform of the Amazon EC2 instance.

resources[].details.aws_ec2_instance.subnet_id

The subnet ID of the Amazon EC2 instance.

resources[].details.aws_ec2_instance.type

The type of the Amazon EC2 instance.

resources[].details.aws_ec2_instance.vpc_id

The VPC ID of the Amazon EC2 instance.

resources[].details.aws_ecr_container_image

An object that contains details about the Amazon ECR container image involved in the finding.

Show child fields
resources[].details.aws_ecr_container_image.architecture

The architecture of the Amazon ECR container image.

resources[].details.aws_ecr_container_image.author

The image author of the Amazon ECR container image.

resources[].details.aws_ecr_container_image.image_hash

The image hash of the Amazon ECR container image.

resources[].details.aws_ecr_container_image.image_tags[]
resources[].details.aws_ecr_container_image.platform

The platform of the Amazon ECR container image.

resources[].details.aws_ecr_container_image.pushed_at

The date and time the Amazon ECR container image was pushed.

resources[].details.aws_ecr_container_image.registry

The registry for the Amazon ECR container image.

resources[].details.aws_ecr_container_image.repository_name

The name of the repository the Amazon ECR container image resides in.

resources[].details.aws_lambda_function

A summary of the information about an Amazon Web Services Lambda function affected by a finding.

Show child fields
resources[].details.aws_lambda_function.architectures[]
resources[].details.aws_lambda_function.code_sha256

The SHA256 hash of the Amazon Web Services Lambda function's deployment package.

resources[].details.aws_lambda_function.execution_role_arn

The Amazon Web Services Lambda function's execution role.

resources[].details.aws_lambda_function.function_name

The name of the Amazon Web Services Lambda function.

resources[].details.aws_lambda_function.last_modified_at

The date and time that a user last updated the configuration, in ISO 8601 format

resources[].details.aws_lambda_function.layers[]
resources[].details.aws_lambda_function.package_type

The type of deployment package. Set to Image for container image and set Zip for .zip file archive.

resources[].details.aws_lambda_function.runtime

The runtime environment for the Amazon Web Services Lambda function.

resources[].details.aws_lambda_function.version

The version of the Amazon Web Services Lambda function.

resources[].details.aws_lambda_function.vpc_config

The Amazon Web Services Lambda function's networking configuration.

Show child fields
resources[].details.aws_lambda_function.vpc_config.security_group_ids[]
resources[].details.aws_lambda_function.vpc_config.subnet_ids[]
resources[].details.aws_lambda_function.vpc_config.vpc_id

The ID of the VPC.

resources[].id

The ID of the resource.

resources[].partition

The partition of the resource.

resources[].region

The Amazon Web Services Region the impacted resource is located in.

resources[].tags

The tags attached to the resource.

resources[].type

The type of resource.

severity

The severity of the finding. UNTRIAGED applies to PACKAGE_VULNERABILITY type findings that the vendor has not assigned a severity yet. For more information, see Severity levels for findings in the Amazon Inspector user guide.

VARCHAR
status

The status of the finding.

VARCHAR
title

The title of the finding.

VARCHAR
type

The type of the finding. The type value determines the valid values for resource in your request. For more information, see Finding types in the Amazon Inspector user guide.

VARCHAR
updated_at

The date and time the finding was last updated at.

TIMESTAMP_S