> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/findings-commands.md).
# Findings Commands
* [getFindings](#getfindings)
#### getFindings
***
Returns a list of findings based on the provided filter criteria.
Arguments
| Argument Name | Description | Required |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| asset\_ids | A comma-separated list of asset IDs to filter findings by. | Optional |
| asset\_names | A comma-separated list of asset names to filter findings by. | Optional |
| asset\_categories | A comma-separated list of asset categories to filter findings by. Possible values are: Account, Agent, AI Pipeline Job, AI Workspace, API Endpoint, API Gateway, API Specification, Application, Audit Logs, Backup, Certificate, Certificate Management, CICD Instance, CICD Pipeline, Cloud Service Account, Configuration Management, Container Image, Container Image Repository, Container Instance, Container Registry, Database, Dataset, Device, Disk, Domain, Event Management, External Identity Provider, General Device, Human Identity, IaC Resource, IAM Access Keys, IAM Group, IAM Policy, Image Registry, Internet Gateway, Key Management, Kubernetes Cluster, Kubernetes Resource, Load Balancer, Logging And Monitoring, Model, Model Endpoint, Network Interface, Network Security, Notebook, Organization, Organizational Policy, Organizational Unit, Other, Policy Statement, Repository, Secret, Secret Management, Security Center, Security Group, Serverless Function, Service, Software Package, Storage Bucket, Subnet, Threat Detection, VCS Organization, Virtual Network, VM Image, VM Instance, Vulnerability Management, Web. | Optional |
| asset\_classes | A comma-separated list of asset classes to filter findings by. Possible values are: AI, API, Application, Code, Compute, Data, Device, External Surface, Identity, Management, Network, Organization, Other, Security Services. | Optional |
| categories | A comma-separated list of finding categories to filter findings by. Possible values are: Configuration, Vulnerability, Malware, Identity, Data, Code, Posture, Brand protection. | Optional |
| finding\_sources | A comma-separated list of finding sources to filter findings by. Possible values are: Cortex agentless scanner, Cortex agent, Tenable, Qualys, Checkmarx, Veracode, Semgrep, Snyk, Github advanced security, Sonarqube, Zap, Nuclei, Mend, Blackduck, External code scanner, Cortex appsec, Cortex attack surface management, Cortex attack surface testing, Cortex network scanner, Cortex container registry scanner, Cortex serverless function scanner, Cortex cli scanner, Cortex data security, Rapid7 insightvm, Third party scanner. | Optional |
| filter\_object | A JSON string representing a raw filter object. If provided, this overrides all other filter arguments. | Optional |
| limit | The maximum number of findings to return. Default is 50. | Optional |
| page\_size | The number of findings to return per page. When set, manual pagination is used and limit is ignored. | Optional |
| page | The page number to return, starting from zero. When set, manual pagination is used and limit is ignored. | Optional |
Outputs
**Core.Finding.id** *unknown*
The unique identifier of the finding.
**Core.Finding.name** *string*
The name of the finding.
**Core.Finding.category** *string*
The category of the finding (e.g., VULNERABILITY).
**Core.Finding.description** *string*
The detailed description of the finding.
**Core.Finding.first\_observed** *string*
The timestamp when the finding was first observed (in milliseconds).
**Core.Finding.last\_observed** *string*
The timestamp when the finding was last observed (in milliseconds).
**Core.Finding.asset\_id** *unknown*
The unique identifier of the asset associated with the finding.
**Core.Finding.asset\_name** *string*
The name of the asset associated with the finding.
**Core.Finding.asset\_class** *string*
The class of the asset (e.g., Compute).
**Core.Finding.asset\_category** *string*
The category of the asset (e.g., Container Instance).
**Core.Finding.asset\_type** *string*
The type of the asset (e.g., Container Instance).
**Core.Finding.asset\_group\_ids** *unknown*
The list of asset group IDs associated with the finding.
**Core.Finding.normalized\_fields** *unknown*
Normalized fields containing structured finding data (e.g., vulnerability details, software package info).
**Core.Finding.extended\_fields** *unknown*
Extended fields containing additional finding metadata and source-specific information.
**Core.FindingMetadata.filtered\_count** *number*
The total number of findings that match the filter criteria.
**Core.FindingMetadata.returned\_count** *number*
The actual number of findings returned in this response.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/findings-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.