Amazon Web Services Question posted in
The official Amazon Web Services documentation can be found here.

Amazon web services – Get info from AWS CLI inspector2

I created a script to report on inspector output from the command line.

aws inspector2 list-findings --query 'findings[*].{Severity:severity,Title:title,Instance:resources[*].id,Name:resources[*].tags.name,Type:resources[*].type}' --profile MYPROFILE --output json

I noticed that the output seems to be point-in-time data vs. current data. For example, I see high vulnerability counts even after patching, but if I look in the console I see the numbers for inspector are totally different.

Is there another filter I need to use to provide current findings vs. old and outdated findings?

Thanks!

aws inspector2 list-findings --query 'findings[*].{Severity:severity,Title:title,Instance:resources[*].id,Name:resources[*].tags.name,Type:resources[*].type}' --profile MYPROFILE --output json

It is showing old data even after patching instances with vulnerabilities. This doesn’t match what I see in the AWS console in Inspector.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Thank you very much! That helped me accomplish what I was looking to do.


  2. 0

    aws list-findings outputs all the findings with their details (which include status). If you need to filter only findings that are not yet solved, you should add:

    --filter '{"findingStatus":[{"comparison":"EQUALS","value":"ACTIVE"}]}'

    This way it will show you only findings that are not yet solved (they have status ACTIVE in the Amazon Inspector).

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search