Findings Commands

• getFindings

getFindings

---

Returns a list of findings based on the provided filter criteria.

Arguments

Argument Name	Description	Required
asset_ids	A comma-separated list of asset IDs to filter findings by.	Optional
asset_names	A comma-separated list of asset names to filter findings by.	Optional
asset_categories	A comma-separated list of asset categories to filter findings by. Possible values are: Account, Agent, AI Pipeline Job, AI Workspace, API Endpoint, API Gateway, API Specification, Application, Audit Logs, Backup, Certificate, Certificate Management, CICD Instance, CICD Pipeline, Cloud Service Account, Configuration Management, Container Image, Container Image Repository, Container Instance, Container Registry, Database, Dataset, Device, Disk, Domain, Event Management, External Identity Provider, General Device, Human Identity, IaC Resource, IAM Access Keys, IAM Group, IAM Policy, Image Registry, Internet Gateway, Key Management, Kubernetes Cluster, Kubernetes Resource, Load Balancer, Logging And Monitoring, Model, Model Endpoint, Network Interface, Network Security, Notebook, Organization, Organizational Policy, Organizational Unit, Other, Policy Statement, Repository, Secret, Secret Management, Security Center, Security Group, Serverless Function, Service, Software Package, Storage Bucket, Subnet, Threat Detection, VCS Organization, Virtual Network, VM Image, VM Instance, Vulnerability Management, Web.	Optional
asset_classes	A comma-separated list of asset classes to filter findings by. Possible values are: AI, API, Application, Code, Compute, Data, Device, External Surface, Identity, Management, Network, Organization, Other, Security Services.	Optional
categories	A comma-separated list of finding categories to filter findings by. Possible values are: Configuration, Vulnerability, Malware, Identity, Data, Code, Posture, Brand protection.	Optional
finding_sources	A comma-separated list of finding sources to filter findings by. Possible values are: Cortex agentless scanner, Cortex agent, Tenable, Qualys, Checkmarx, Veracode, Semgrep, Snyk, Github advanced security, Sonarqube, Zap, Nuclei, Mend, Blackduck, External code scanner, Cortex appsec, Cortex attack surface management, Cortex attack surface testing, Cortex network scanner, Cortex container registry scanner, Cortex serverless function scanner, Cortex cli scanner, Cortex data security, Rapid7 insightvm, Third party scanner.	Optional
filter_object	A JSON string representing a raw filter object. If provided, this overrides all other filter arguments.	Optional
limit	The maximum number of findings to return. Default is 50.	Optional
page_size	The number of findings to return per page. When set, manual pagination is used and limit is ignored.	Optional
page	The page number to return, starting from zero. When set, manual pagination is used and limit is ignored.	Optional

Outputs

Core.Finding.id unknown

The unique identifier of the finding.

Core.Finding.name string

The name of the finding.

Core.Finding.category string

The category of the finding (e.g., VULNERABILITY).

Core.Finding.description string

The detailed description of the finding.

Core.Finding.first_observed string

The timestamp when the finding was first observed (in milliseconds).

Core.Finding.last_observed string

The timestamp when the finding was last observed (in milliseconds).

Core.Finding.asset_id unknown

The unique identifier of the asset associated with the finding.

Core.Finding.asset_name string

The name of the asset associated with the finding.

Core.Finding.asset_class string

The class of the asset (e.g., Compute).

Core.Finding.asset_category string

The category of the asset (e.g., Container Instance).

Core.Finding.asset_type string

The type of the asset (e.g., Container Instance).

Core.Finding.asset_group_ids unknown

The list of asset group IDs associated with the finding.

Core.Finding.normalized_fields unknown

Normalized fields containing structured finding data (e.g., vulnerability details, software package info).

Core.Finding.extended_fields unknown

Extended fields containing additional finding metadata and source-specific information.

Core.FindingMetadata.filtered_count number

The total number of findings that match the filter criteria.

Core.FindingMetadata.returned_count number

The actual number of findings returned in this response.