Skip to main content

Findings

The Findings page lists the Amazon Inspector findings stored in Prism from the last refresh. You can filter by account, severity, and status, search by title, and open any finding to see its CVE, Inspector score, affected resource, and remediation guidance.

Accessing Findings​

In the Security Hub sidebar, click Amazon Inspector > Findings. You can also reach this page pre-filtered from the Dashboard:

  • a severity tile opens the list filtered to that severity
  • a Findings by type row opens the list filtered to that finding type
  • a Per-account findings row opens the list filtered to that account
  • a Top CVEs row opens the list with the CVE identifier in the title search
info

The findings list shows results from the last refresh, not live AWS data. If the list appears stale, run Refresh findings from the Dashboard.

Findings Table​

Rows are ordered newest first by when Inspector last observed the finding. Each row represents one Inspector finding:

ColumnDescription
SeveritySeverity chip: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, or UNTRIAGED
TitleThe Inspector finding title
Resource typeThe affected resource type as Inspector reports it (for example AWS_EC2_INSTANCE, AWS_ECR_CONTAINER_IMAGE, or AWS_LAMBDA_FUNCTION). The resource's own identifier is not in this column; it is in the detail drawer
AccountThe AWS account where the finding was detected
RegionThe AWS region where the finding was detected
StatusActive, Suppressed, or Closed
Last observedWhen Inspector last reported the finding

Click any row to open the Finding Detail drawer.

The table loads 50 findings at a time. When more are available, a Load more button appears beneath the table and appends the next page. The Results heading counts what is currently loaded, and shows a trailing + (for example 50+ shown) while further pages remain.

Filtering​

Use the Filters card above the table to narrow the list:

  • Account: a dropdown of the accounts enrolled in Inspector, shown as Account name (123456789012). It defaults to All accounts
  • Search title: free-text search against the finding title
  • Severity: toggle chips for CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, and UNTRIAGED. Multiple selections are combined with OR. UNTRIAGED is offered here because only Inspector emits it, the other engines' findings lists do not show that chip
  • Status: toggle chips for Active, Suppressed, and Closed

No filter is applied when you open the page: every chip starts unselected and the list shows all cached findings.

Arriving from a Findings by type row on the Dashboard adds a removable Type: PACKAGE_VULNERABILITY chip above the severity and status chips. There is no type dropdown on this page, the chip is how that filter is shown and removed.

While any filter is active, the Filters card header shows an N active chip and a Clear filters (N) button appears in the page header. All filters are reflected in the page URL so a filtered view can be shared or bookmarked.

note

Prism's refresh caches only findings AWS currently reports as active, and prunes those AWS stops reporting. In practice the list is therefore active findings; the Suppressed and Closed filters exist because rows written before that behaviour, in accounts that have not since completed a clean refresh, can still carry those statuses.

Empty States​

The table shows one of two messages when it has no rows, and they mean different things:

  • No findings match these filters, with "Clear a filter or widen the search to see more findings." This appears only when a filter is active, and means the filter is too narrow, not that the estate is clean
  • No findings yet, with "Findings appear here as soon as your enrolled accounts report them." This is the unfiltered case, and is the expected state shortly after enablement while Inspector is still discovering and scanning resources

Finding Detail​

Selecting a finding opens a right-hand detail drawer. Its header carries the finding title, a severity chip, and a status chip reading Active, Suppressed, or Closed. Below that are up to four sections. A field with no value is omitted rather than shown empty.

Overview​

Opens with a finding-type chip and a severity chip, followed by the finding description, then:

FieldDescription
Finding IDThe Inspector finding ARN
Finding typeShown in sentence case: Package vulnerability, Network reachability, or Code vulnerability
AccountThe AWS account the finding belongs to
RegionThe AWS region the finding was reported in
First seenWhen Inspector first reported the finding
Last seenWhen Inspector last reported the finding

Vulnerability​

Shown for findings that can carry a score or a CVE, so package-vulnerability and code-vulnerability findings. It is omitted entirely for a network-reachability finding, which carries neither by design.

FieldDescription
CVEThe CVE identifier, for package vulnerabilities
Inspector scoreInspector's score for this finding; shown as an em dash when AWS reported none
Fix availableWhether a vendor fix is published, as a chip reading YES, PARTIAL, or NO. The row is omitted when AWS reported no value

Resource​

FieldDescription
Resource typeThe affected resource type, the same value the table column shows
ResourceThe resource's own identifier, for example an EC2 instance ID, an ECR image ARN, or a Lambda function ARN

Remediation​

The remediation guidance Inspector supplies for the finding, with a View documentation link to the relevant vendor or AWS advisory where one is available. The section is omitted when AWS supplied neither.

info

Inspector findings are read-only in Prism. The drawer offers only a Close button, there is no archive, suppress, or workflow action, unlike GuardDuty, Macie, and CSPM findings. The drawer says so in its footer: Amazon Inspector owns the state of the finding, Prism mirrors it read-only, and suppressing or closing it in the Inspector console shows up here after the next refresh. A finding also leaves the list when AWS stops reporting it as active, which is what happens once you have actually remediated it, and the next refresh prunes it from the cache.