steampipe plugin install awssteampipe plugin install aws

Table: aws_inspector_finding

Amazon Inspector offers several ways to sort, group, and manage your findings. These features help you tailor findings to your environment, aggregate findings by different views, and focus on vulnerabilities to your specific AWS environment.

Examples

Basic info

select
  id,
  arn,
  agent_id as instance_id,
  asset_type,
  confidence,
  severity
from
  aws_inspector_finding;

List findings with high severity

select
  id,
  arn,
  agent_id as instance_id,
  asset_type,
  confidence,
  severity
from
  aws_inspector_finding
where
  severity = 'High';

Count the number of findings by severity

select
  severity,
  count(severity)
from
  aws_inspector_finding
group by
  severity
order by
  severity;

List last 10 days findings

select
  title,
  id,
  confidence,
  severity
from
  aws_inspector_finding
where
  created_at >= now() - interval '10' day;

List attributes for each finding

select
  title,
  id,
  jsonb_pretty(attributes) as attributes
from
  aws_inspector_finding;

Get asset attributes for each finding

select
  id,
  title,
  asset_attributes ->> 'AgentId' as agent_id,
  asset_attributes ->> 'AmiId' as ami_id,
  asset_attributes ->> 'Hostname' as hostname,
  asset_attributes ->> 'Tags' as tags
from
  aws_inspector_finding;

List EC2 instances with high severity

select
  distinct i.instance_id,
  i.instance_state,
  i.instance_type,
  f.title,
  f.service,
  f.severity,
  f.confidence
from
  aws_ec2_instance as i,
  aws_inspector_finding as f
where
  severity = 'High'
  and i.instance_id = f.agent_id;

Get service attributes for each finding

select
  id,
  title,
  service_attributes ->> 'AssessmentRunArn' as assessment_run_arn,
  service_attributes ->> 'RulesPackageArn' as rules_package_arn,
  service_attributes ->> 'SchemaVersion' as schema_version,
from
  aws_inspector_finding;

Get assessment run details for findings

select
  f.id,
  r.title,
  f.service_attributes ->> 'AssessmentRunArn' as assessment_run_arn,
  r.assessment_template_arn,
  r.finding_counts
from
  aws_inspector_finding as f,
  aws_inspector_assessment_run as r
where
  f.service_attributes ->> 'AssessmentRunArn' = r.arn;

List findings order by confidence

select
  id,
  arn,
  agent_id as instance_id,
  asset_type,
  confidence,
  severity
from
  aws_inspector_finding
order by
  confidence;

.inspect aws_inspector_finding

AWS Inspector Finding

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
agent_id	text	The ID of the agent that is installed on the EC2 instance where the finding is generated.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The ARN that specifies the finding.
asset_attributes	jsonb	A collection of attributes of the host from which the finding is generated.
asset_type	text	The type of the host from which the finding is generated.
attributes	jsonb	The system-defined attributes for the finding.
auto_scaling_group	text	The Auto Scaling group of the EC2 instance where the finding is generated.
confidence	bigint	This data element is currently not used.
created_at	timestamp with time zone	The time when the finding was generated.
description	text	The description of the finding.
failed_items	jsonb	Attributes details that cannot be described. An error code is provided for each failed item.
id	text	The ID of the finding.
indicator_of_compromise	boolean	This data element is currently not used.
numeric_severity	double precision	The numeric value of the finding severity.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
recommendation	text	The recommendation for the finding.
region	text	The AWS Region in which the resource is located.
schema_version	bigint	The schema version of this data type.
service	text	The data element is set to 'Inspector'.
service_attributes	jsonb	This data type is used in the Finding data type.
severity	text	The finding severity. Values can be set to High, Medium, Low, and Informational.
title	text	The name of the finding.
updated_at	timestamp with time zone	The time when AddAttributesToFindings is called.
user_attributes	jsonb	The user-defined attributes that are assigned to the finding.

turbot/aws