Findings
The Findings page lists all Macie findings stored in Prism from the last refresh. You can filter by account, severity and status, search by title, and open any finding to see the full detail including the detected sensitive-data types.
Accessing Findings
In the Security Hub sidebar, click Amazon Macie > Findings. You can also reach this page pre-filtered by clicking a severity card, a finding-type row, or an account row on the Dashboard.
Macie findings also appear in the unified Security Hub findings inbox alongside CSPM, GuardDuty, Inspector and Detective findings, where an extra Engine column tags each row Amazon Macie. This page is that same inbox scoped to Macie, so the two always agree about what a finding looks like.
The page header reads Findings, with Macie findings and a running count beside it, for example Macie findings • 50+ shown. The + means more rows are available than have been loaded.
The findings list shows results from the last refresh, not live AWS data. If the list appears stale, run Refresh findings from the Dashboard.
Findings Table
Each row represents one Macie finding:
| Column | Description |
|---|---|
| Severity | Severity chip: HIGH, MEDIUM, or LOW |
| Title | The Macie finding title, truncated to one line with the full title on hover |
| Resource type | The affected resource type: S3Bucket, or S3Object for a CLASSIFICATION finding that names a specific object. The bucket name and object key are not in this column; they are in the detail drawer |
| Account | The AWS account ID where the finding was detected |
| Region | The AWS region where the finding was detected |
| Status | Active or Archived (Prism) |
| Last observed | Date and time the finding was last observed by Macie, in your browser's local time |
Rows are ordered newest-last-observed first. Click any row to open the Finding Detail drawer.
Filtering
Use the filter controls above the table to narrow the list. The Filters card is headed Narrow the list by account, severity or status and shows an N active chip once anything is set.
- Account: a dropdown listing the accounts enrolled in Macie, labelled
Name (123456789012); it defaults to All accounts. Accounts that are disabled or being removed are not offered - Search title: free-text search against the finding title
- Severity: toggle chips for
CRITICAL,HIGH,MEDIUM,LOWandINFORMATIONAL, combined with OR - Status: toggle chips labelled Active and Archived (Prism); select one or both
- Finding type: there is no chip row for this one. It is applied when you arrive from a finding-type row on the Dashboard, and appears as a removable Type: SensitiveData:S3Object/Personal chip above the filter groups
A Clear filters (N) button appears in the page header while anything is set, and every filter is reflected in the page URL, so a filtered view can be shared or bookmarked.
Arriving from the Dashboard pre-applies exactly one filter, and each kind is surfaced where you would change it: a severity card selects that severity's toggle chip, an account row selects that account in the Account dropdown, and a finding-type row adds the removable Type: chip. Only that last one carries a delete icon; the other two are cleared the same way you would have set them.
Macie findings use only the HIGH, MEDIUM and LOW severity levels. The severity chip row is shared with the other detection engines, so it also offers CRITICAL and INFORMATIONAL — Macie never emits either, so selecting them matches nothing.
The Status filter offers only Active and Archived (Prism). Archive is a Prism-local state (see below), not an AWS Macie workflow status.
Pagination
The table loads 50 findings per page. If more findings match the current filters, a Load more button appears below the table; it appends the next page rather than replacing the current one, and reads Loading… while that page is in flight.
When the List Is Empty
Two different empty states appear here, and they mean different things:
| When | What you see |
|---|---|
| One or more filters are active | No findings match these filters — Clear a filter or widen the search to see more findings. |
| No filters are active | No findings yet — Findings appear here as soon as your enrolled accounts report them. |
The second case means Macie has reported nothing for your enrolled accounts since the last refresh, not that a filter is hiding rows. If you have never run a findings refresh, run Refresh findings from the Dashboard first.
Finding Detail
Click any row to open the Finding Detail drawer on the right side of the screen.
Header
The drawer header shows:
- Finding title
- Severity chip (color-coded by severity level)
- Status chip: Active or Archived (Prism)
Overview
The section opens by repeating the finding's category and severity as chips, followed by Macie's plain-language description of what it detected, and then:
| Field | Description |
|---|---|
| Finding ID | The Macie finding ID |
| Category | POLICY (a posture issue) or CLASSIFICATION (sensitive data detected) |
| Finding type | The Macie finding type (for example, Policy:IAMUser/S3BucketPublic) |
| Account | The AWS account ID |
| Region | The AWS region |
| Occurrences | Number of occurrences aggregated into this finding; shown only when Macie reported a non-zero count |
| Sample | Yes — sampled finding when Macie flagged this finding as a sample; the row is absent otherwise |
| First seen | Date and time the finding was first observed |
| Last seen | Date and time the finding was last observed |
Any field whose value is empty is omitted entirely rather than rendered as a blank row.
Affected S3 resource
| Field | Description |
|---|---|
| Resource type | The affected resource type, S3Bucket or S3Object |
| Bucket / object | The affected bucket name, or the bucket and object key for a CLASSIFICATION finding that names a specific object |
The bucket and the object are one field, not two: Macie reports a single affected resource per finding, and Prism shows the identifier it gave.
Sensitive data
This section appears only when Macie reported sensitive-data counts for the finding, which in practice means CLASSIFICATION findings. It is a table listing each category of sensitive data Macie detected and the total count of occurrences:
| Column | Description |
|---|---|
| Data category | The sensitive-data category (for example, PERSONAL_INFORMATION, FINANCIAL_INFORMATION, CREDENTIALS) |
| Total count | The number of occurrences Macie detected in that category |
Archiving and Unarchiving
The drawer footer shows a note describing the current archive state, above a Close button and a single action button:
- If the finding is Active: the note reads "Archive this finding in Prism to remove it from active findings. This only affects Prism — the AWS Macie console is unaffected." Click Archive in Prism to archive it.
- If the finding is Archived (Prism): the note reads "This finding is archived in Prism. Unarchive to move it back to active findings. Archiving here is Prism-local — the AWS Macie console is unaffected." Click Unarchive to restore it.
The button reads Saving… while the change is in flight, then the drawer closes and the list reloads.
Archiving is local to Prism. Amazon Macie has no per-finding archive API, so this action only sets a flag in Prism's database, it does not change any state in AWS Macie. The button copy reflects this ("... in Prism"). Archiving is reversible, and a findings refresh never overwrites your local archive state.
Related Pages
- Dashboard, Summary view with drill-down links to filtered findings
- S3 Buckets, Posture inventory for the buckets these findings reference
- Enrollment, Add or remove enrolled accounts
- Security Hub Issues, Troubleshooting stale findings and refresh problems