Findings pageedit
The Findings page displays the configuration risks identified by the CSPM and KSPM integrations.
What are KSPM findings?edit
KSPM findings indicate whether a given resource passed or failed evaluation against a specific security guideline. Each finding includes metadata about the resource evaluated and the security guideline used to evaluate it. Each finding’s result (pass or fail) indicates whether a particular part of your infrastructure meets a security guideline.
Group and filter findingsedit
By default, the Findings page lists all findings, without grouping or filtering.
Group findings by resourceedit
- Select Group by → Resource to display a list of resources sorted by their total number of failed findings.
- Click a resource ID to display the findings associated with that resource.
Filter findingsedit
You can filter findings data in two ways:
-
The KQL search bar: For example, search for
result.evaluation : failedto view all failed findings. - In-table value filters: Hover over a finding to display available inline actions. Use the Filter In (plus) and Filter Out (minus) buttons.
Remediate failed findingsedit
To remediate failed findings and reduce your attack surface:
- Navigate to the Findings page and filter for failed findings.
- Click a failed finding to open the findings flyout.
-
Follow the steps under Remediation.
Remediation steps typically include commands for you to execute. These sometimes contain placeholder values that you must replace before execution.