Data retrieval settings for AWS Inspector
The following filters are available for the AWS Inspector Host Vulnerability and Container Vulnerability Integrations. These filters control which findings are retrieved from AWS Inspector.
Role required: sn_vul_aws.configure_integration - to configure the integrations.
Note: For Text-based filters, a maximum 10 values is supported in a configuration.
Host Vulnerabilities tab
| Parameter | Type | Description |
|---|---|---|
| host\_severity | glide\_list | Filter by severity: INFORMATIONAL, LOW, HIGH, MEDIUM, CRITICAL, UNTRIAGED. |
| host\_vulnerability | string | Filter by specific CVE IDs. |
| host\_resource\_type | choice | Filter by resource type: - AWS\_EC2\_INSTANCE - AWS\_LAMBDA\_FUNCTION - BOTH |
| host\_account\_id | string | Filter by AWS account IDs. |
| host\_batch\_size | integer | Number of findings per API call. Default: 1000. |
| host\_finding\_status | glide\_list | Filter by finding status: ACTIVE, SUPPRESSED, CLOSED. |
| host\_exploit\_available | choice | Filter by exploit availability: YES, NO. |
| host\_fix\_available | glide\_list | Filter by fix availability: YES, NO, PARTIAL. |
| host\_first\_observed | glide\_date\_time | Filter by first observed date. |
| host\_last\_observed | glide\_date\_time | Filter by last observed date. |
| host\_updated\_at | glide\_date\_time | Filter by last updated date. Used for delta sync. |
Container Vulnerabilities tab
| container_severity | glide_list | Filter by severity: INFORMATIONAL, LOW, HIGH, MEDIUM, CRITICAL, UNTRIAGED. |
| container_vulnerability | string | Filter by specific CVE IDs. |
| container_account_id | string | Filter by AWS account IDs. |
| container_batch_size | integer | Number of findings per API call. Default: 1000. |
| container_finding_status | glide_list | Filter by finding status: ACTIVE, SUPPRESSED, CLOSED. |
| container_exploit_available | choice | Filter by exploit availability: YES, NO. |
| container_fix_available | glide_list | Filter by fix availability: YES, NO, PARTIAL. |
| container_first_observed | glide_date_time | Filter by first observed date. |
| container_last_observed | glide_date_time | Filter by last observed date. |
| container_updated_at | glide_date_time | Filter by last updated date. Used for delta sync. |