Inspector / Client / describe_findings

describe_findings#

Inspector.Client.describe_findings(**kwargs)#

Describes the findings that are specified by the ARNs of the findings.

See also: AWS API Documentation

Request Syntax

response = client.describe_findings(
    findingArns=[
        'string',
    ],
    locale='EN_US'
)
Parameters:
  • findingArns (list) –

    [REQUIRED]

    The ARN that specifies the finding that you want to describe.

    • (string) –

  • locale (string) – The locale into which you want to translate a finding description, recommendation, and the short description that identifies the finding.

Return type:

dict

Returns:

Response Syntax

{
    'findings': [
        {
            'arn': 'string',
            'schemaVersion': 123,
            'service': 'string',
            'serviceAttributes': {
                'schemaVersion': 123,
                'assessmentRunArn': 'string',
                'rulesPackageArn': 'string'
            },
            'assetType': 'ec2-instance',
            'assetAttributes': {
                'schemaVersion': 123,
                'agentId': 'string',
                'autoScalingGroup': 'string',
                'amiId': 'string',
                'hostname': 'string',
                'ipv4Addresses': [
                    'string',
                ],
                'tags': [
                    {
                        'key': 'string',
                        'value': 'string'
                    },
                ],
                'networkInterfaces': [
                    {
                        'networkInterfaceId': 'string',
                        'subnetId': 'string',
                        'vpcId': 'string',
                        'privateDnsName': 'string',
                        'privateIpAddress': 'string',
                        'privateIpAddresses': [
                            {
                                'privateDnsName': 'string',
                                'privateIpAddress': 'string'
                            },
                        ],
                        'publicDnsName': 'string',
                        'publicIp': 'string',
                        'ipv6Addresses': [
                            'string',
                        ],
                        'securityGroups': [
                            {
                                'groupName': 'string',
                                'groupId': 'string'
                            },
                        ]
                    },
                ]
            },
            'id': 'string',
            'title': 'string',
            'description': 'string',
            'recommendation': 'string',
            'severity': 'Low'|'Medium'|'High'|'Informational'|'Undefined',
            'numericSeverity': 123.0,
            'confidence': 123,
            'indicatorOfCompromise': True|False,
            'attributes': [
                {
                    'key': 'string',
                    'value': 'string'
                },
            ],
            'userAttributes': [
                {
                    'key': 'string',
                    'value': 'string'
                },
            ],
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'failedItems': {
        'string': {
            'failureCode': 'INVALID_ARN'|'DUPLICATE_ARN'|'ITEM_DOES_NOT_EXIST'|'ACCESS_DENIED'|'LIMIT_EXCEEDED'|'INTERNAL_ERROR',
            'retryable': True|False
        }
    }
}

Response Structure

  • (dict) –

    • findings (list) –

      Information about the finding.

      • (dict) –

        Contains information about an Amazon Inspector finding. This data type is used as the response element in the DescribeFindings action.

        • arn (string) –

          The ARN that specifies the finding.

        • schemaVersion (integer) –

          The schema version of this data type.

        • service (string) –

          The data element is set to “Inspector”.

        • serviceAttributes (dict) –

          This data type is used in the Finding data type.

          • schemaVersion (integer) –

            The schema version of this data type.

          • assessmentRunArn (string) –

            The ARN of the assessment run during which the finding is generated.

          • rulesPackageArn (string) –

            The ARN of the rules package that is used to generate the finding.

        • assetType (string) –

          The type of the host from which the finding is generated.

        • assetAttributes (dict) –

          A collection of attributes of the host from which the finding is generated.

          • schemaVersion (integer) –

            The schema version of this data type.

          • agentId (string) –

            The ID of the agent that is installed on the EC2 instance where the finding is generated.

          • autoScalingGroup (string) –

            The Auto Scaling group of the EC2 instance where the finding is generated.

          • amiId (string) –

            The ID of the Amazon Machine Image (AMI) that is installed on the EC2 instance where the finding is generated.

          • hostname (string) –

            The hostname of the EC2 instance where the finding is generated.

          • ipv4Addresses (list) –

            The list of IP v4 addresses of the EC2 instance where the finding is generated.

            • (string) –

          • tags (list) –

            The tags related to the EC2 instance where the finding is generated.

            • (dict) –

              A key and value pair. This data type is used as a request parameter in the SetTagsForResource action and a response element in the ListTagsForResource action.

              • key (string) –

                A tag key.

              • value (string) –

                A value assigned to a tag key.

          • networkInterfaces (list) –

            An array of the network interfaces interacting with the EC2 instance where the finding is generated.

            • (dict) –

              Contains information about the network interfaces interacting with an EC2 instance. This data type is used as one of the elements of the AssetAttributes data type.

              • networkInterfaceId (string) –

                The ID of the network interface.

              • subnetId (string) –

                The ID of a subnet associated with the network interface.

              • vpcId (string) –

                The ID of a VPC associated with the network interface.

              • privateDnsName (string) –

                The name of a private DNS associated with the network interface.

              • privateIpAddress (string) –

                The private IP address associated with the network interface.

              • privateIpAddresses (list) –

                A list of the private IP addresses associated with the network interface. Includes the privateDnsName and privateIpAddress.

                • (dict) –

                  Contains information about a private IP address associated with a network interface. This data type is used as a response element in the DescribeFindings action.

                  • privateDnsName (string) –

                    The DNS name of the private IP address.

                  • privateIpAddress (string) –

                    The full IP address of the network inteface.

              • publicDnsName (string) –

                The name of a public DNS associated with the network interface.

              • publicIp (string) –

                The public IP address from which the network interface is reachable.

              • ipv6Addresses (list) –

                The IP addresses associated with the network interface.

                • (string) –

              • securityGroups (list) –

                A list of the security groups associated with the network interface. Includes the groupId and groupName.

                • (dict) –

                  Contains information about a security group associated with a network interface. This data type is used as one of the elements of the NetworkInterface data type.

                  • groupName (string) –

                    The name of the security group.

                  • groupId (string) –

                    The ID of the security group.

        • id (string) –

          The ID of the finding.

        • title (string) –

          The name of the finding.

        • description (string) –

          The description of the finding.

        • recommendation (string) –

          The recommendation for the finding.

        • severity (string) –

          The finding severity. Values can be set to High, Medium, Low, and Informational.

        • numericSeverity (float) –

          The numeric value of the finding severity.

        • confidence (integer) –

          This data element is currently not used.

        • indicatorOfCompromise (boolean) –

          This data element is currently not used.

        • attributes (list) –

          The system-defined attributes for the finding.

          • (dict) –

            This data type is used as a request parameter in the AddAttributesToFindings and CreateAssessmentTemplate actions.

            • key (string) –

              The attribute key.

            • value (string) –

              The value assigned to the attribute key.

        • userAttributes (list) –

          The user-defined attributes that are assigned to the finding.

          • (dict) –

            This data type is used as a request parameter in the AddAttributesToFindings and CreateAssessmentTemplate actions.

            • key (string) –

              The attribute key.

            • value (string) –

              The value assigned to the attribute key.

        • createdAt (datetime) –

          The time when the finding was generated.

        • updatedAt (datetime) –

          The time when AddAttributesToFindings is called.

    • failedItems (dict) –

      Finding details that cannot be described. An error code is provided for each failed item.

      • (string) –

        • (dict) –

          Includes details about the failed items.

          • failureCode (string) –

            The status code of a failed item.

          • retryable (boolean) –

            Indicates whether you can immediately retry a request for this item for a specified resource.

Exceptions

Examples

Describes the findings that are specified by the ARNs of the findings.

response = client.describe_findings(
    findingArns=[
        'arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE/finding/0-HwPnsDm4',
    ],
)

print(response)

Expected Output:

{
    'failedItems': {
    },
    'findings': [
        {
            'arn': 'arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE/finding/0-HwPnsDm4',
            'assetAttributes': {
                'ipv4Addresses': [
                ],
                'schemaVersion': 1,
            },
            'assetType': 'ec2-instance',
            'attributes': [
            ],
            'confidence': 10,
            'createdAt': datetime(2016, 3, 22, 20, 58, 21, 1, 82, 0),
            'description': 'Amazon Inspector did not find any potential security issues during this assessment.',
            'indicatorOfCompromise': False,
            'numericSeverity': 0,
            'recommendation': 'No remediation needed.',
            'schemaVersion': 1,
            'service': 'Inspector',
            'serviceAttributes': {
                'assessmentRunArn': 'arn:aws:inspector:us-west-2:123456789012:target/0-0kFIPusq/template/0-4r1V2mAw/run/0-MKkpXXPE',
                'rulesPackageArn': 'arn:aws:inspector:us-west-2:758058086616:rulespackage/0-X1KXtawP',
                'schemaVersion': 1,
            },
            'severity': 'Informational',
            'title': 'No potential security issues found',
            'updatedAt': datetime(2016, 3, 22, 20, 58, 21, 1, 82, 0),
            'userAttributes': [
            ],
        },
    ],
    'ResponseMetadata': {
        '...': '...',
    },
}