Reviewing finding details and history in Security Hub CSPM

From this menu, you can review the complete JSON of a finding or add notes. A finding can have only one note attached to it at a time. This menu also provides options to set the workflow status of a finding or send a finding to a custom action in Amazon EventBridge.

From this menu, you can investigate a finding in Amazon Detective. Detective extracts entities, such as IP addresses and Amazon users, from a finding and visualizes their activity. You can use the entity activity as a starting point to investigate the cause and impact of a finding.

This tab provides a summary of a finding. For example, you can determine when a finding was created and last updated, in which account it exists, and the source of the finding. For control findings, this tab also shows the name of the associated Amazon Config rule and a link to remediation guidance in the Security Hub CSPM documentation.

In the Resources snapshot on the Overview tab, you can get a brief overview of the resources involved in a finding. For some resources, this includes an Open resource option, which links directly to an impacted resource on the relevant Amazon Web Services service console. The History snapshot shows up to two changes made to the finding on the most recent date for which history is being tracked. For example, if you made one change yesterday and another one today, the snapshot shows today's change. To review earlier entries, switch to the History tab.

The Compliance row expands to show more details. For example, if a control includes parameters, you can review the parameter values that Security Hub CSPM currently uses when conducting security checks for the control.

This tab provides details about the resources involved in a finding. If you're signed in to the account that owns a resource, you can review the resource in the applicable Amazon Web Services service console. If you're not the owner of a resource, this tab displays the Amazon Web Services account ID for the owner.

The Details row shows resource-specific details in a finding. It shows the ResourceDetails section of the finding in JSON format.

The Tags row shows tag keys and values that are assigned to the resources involved in a finding. Resources that are supported by the GetResources operation of the Amazon Resource Groups Tagging API can be tagged. Security Hub CSPM calls this operation by using a service-linked role when processing new or updated findings, and retrieves the resource tags if the Amazon Security Finding Format (ASFF) Resource.Id field is populated with the ARN of a resource. Security Hub CSPM ignores invalid resource IDs. For more information about the inclusion of resource tags in findings, see Tags.

This tab tracks the history of a finding. Finding history is available for active and archived findings. It provides an immutable trail of changes made to a finding over time, including what ASFF field changed, when the change occurred, and by which user. Each page on the tab displays up to 20 changes. More recent changes are displayed first.

For active findings, finding history is available for up to 90 days. For archived findings, finding history is available for up to 30 days. Finding history includes changes that were made manually, or automatically by Security Hub CSPM automation rules. It doesn't include changes to top-level timestamp fields, such as the CreatedAt and UpdatedAt fields.

If you're signed in to a Security Hub CSPM administrator account, finding history is for the administrator account and all member accounts.

This tab includes data from the Action, Malware, and ProcessDetails objects of the ASFF, including the type of threat and whether a resource is the target or actor. These details typically apply to findings that originate in Amazon GuardDuty.

This tab displays data from the Vulnerability object of the ASFF, including whether there are exploits or available fixes associated with a finding. These details typically apply to findings that originate in Amazon Inspector.