> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans/investigate-iac-drift-detection-findings.md).

# Investigate IaC drift detection findings

To access IaC drift detection findings, navigate to **Modules** → **Application Security** → **IaC Drifts (under Issues)** → **click the Findings tab**.

IaC drift detection findings are generated when runtime cloud resources do not match the expected configuration defined in their correlated IaC rules. These findings indicate untracked or unmanaged changes in the live environment.

The Findings tab on the IaC Drift Detection page displays the complete set of raw drift findings produced by the drift scanner across all monitored cloud accounts and repositories. Unlike the Issues tab, which shows only findings that matched a unified policy, the Findings tab shows every detected drift regardless of policy evaluation status.

The Findings tab enables the following workflows:

* **Audit drift detection coverage:** Review the full scope of drift detected by the scanner to verify that drift detection is identifying configuration deviations across all monitored cloud accounts, resource types, and environments.
* **Identify policy gaps:** Compare findings in the Findings tab against issues in the Issues tab to identify drift findings that are not covered by existing unified policies. Create new policies to promote high-risk drift findings to actionable issues.
* **Review excluded findings:** Investigate drift findings that were excluded by policy filters to confirm that exclusions are intentional and do not suppress critical configuration deviations.
* **Validate detection accuracy:** Verify that drift detection is producing accurate findings and correctly identifying the differences between IaC-defined state and live cloud resource state.

{% hint style="info" %}

### Note

Findings in the Findings tab are raw scanner output and do not have resolution statuses, SLA tracking, or assignees. To track remediation for a specific drift finding, create or update a unified policy that matches the finding pattern to generate an actionable issue in the Issues tab.
{% endhint %}

The properties displayed in the IaC Drift Detection Findings table are identical to those displayed in the IaC Drift Detection Issues page. This provides a consistent data structure for security teams transitioning from raw findings to prioritized issues. Refer to [Understand the IaC drift detection table](/application-security/code-security/code-security-scanners/iac-drift-detection-scans/understand-the-iac-drift-detection-table.md) for more information.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans/investigate-iac-drift-detection-findings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.