IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Get started with CSPM Benchmark rules »
Elastic Docs ›Elastic Security Solution [8.8] ›Cloud native security ›Cloud security posture management

Findings page

edit

Findings page

edit

The Findings page displays the configuration risks identified by the CSPM and KSPM integrations.

Findings page

What are CSPM findings?

edit

CSPM findings indicate whether a given resource passed or failed evaluation against a specific security guideline. Each finding includes metadata about the resource evaluated and the security guideline used to evaluate it. Each finding’s result (pass or fail) indicates whether a particular part of your infrastructure meets a security guideline.

Group and filter findings

edit

By default, the Findings page lists all findings, without grouping or filtering.

Group findings by resource
edit
  1. Select Group by → Resource to display a list of resources sorted by their total number of failed findings.
  2. Click a resource ID to display the findings associated with that resource.
Filter findings
edit

You can filter findings data in two ways:

  • The KQL search bar: For example, search for result.evaluation : failed to view all failed findings.
  • In-table value filters: Hover over a finding to display available inline actions. Use the Filter In (plus) and Filter Out (minus) buttons.

Remediate failed findings

edit

To remediate failed findings and reduce your attack surface:

  1. Navigate to the Findings page and filter for failed findings.
  2. Click a failed finding to open the findings flyout.

  3. Follow the steps under Remediation.

    Remediation steps typically include commands for you to execute. These sometimes contain placeholder values that you must replace before execution.

« Get started with CSPM Benchmark rules »