Threat Findings

Feature Summary

InsightCloudSec Threat Findings is a multi-cloud capability that curates runtime threat detections from customer resources. Threat Findings provides a single view that collects all runtime threat detection findings from various sources. The unified view provides various filtering options, while offering security context by associating the findings with the relevant cloud resource(s) and resource properties. This uniform solution allows users to explore findings using filters and Bot automation.

Feature Terminology

Threat FindingA data item refers to the detection of a possible malicious behavior. The finding may refer to a specific event occurring at a specific point in time or a behavior that spans a period of time.

Note: Data for reporting in Threat Findings is retained for 90 days.
Affected ResourceThe cloud resource that is affected by the malicious behavior. The resource may be the one that presents the malicious behavior or the one that is the target of the behavior.
Finding SourceThe tool or mechanism generating the findings

Feature Support

Threat Findings is available to all InsightCloudSec users from the main navigation under “Security → Threat Findings”.


Threat Findings Landing Page

For its initial release Threat Findings will display information from the following third party sources:

  • AWS Guard Duty
  • Azure Defender for Cloud
  • GCP Security Command Center

Future iterations will expand the data we support and display.

Prerequisites & Deployment

Threat Findings relies on the data that is harvested for InsightCloudSec from each Cloud Service Provider you have configured. Before getting started with Threat Findings you will need to ensure you have the following:

  • An existing InsightCloudSec installation (version 22.4.8 or later)
  • Appropriate permissions for your desired Cloud Service Providers. In order to harvest the resource information specific to Threat Findings you will need the specified permissions for the Resource Type(s) (e.g. Threat Finding) identified below. *Note: These may already be enabled/configured within your environment as part of your existing platform installation. For general information on policies/roles/permissions for each CSP refer to:

Refer to the details below to validate the individual permissions for each Cloud Service Provider (CSP)

AWS Resource Type & Required Permissions


Azure Resource Type & Required Permissions


GCP Resource Type & Required Permissions


Using Threat Findings

The main Thread Findings page displays a list of Threat Findings (with a total and percentage displayed at the top), and the top bar of navigation tools include search, and filtering.


Threat Findings Feature Navigation

General Navigation

The page displays a list of Threat Findings (with a total and percentage displayed at the top), and the top bar of navigation tools include search, and filtering.


Allows you to search the Threat Findings data for the following fields: Finding Source, Finding Type, Severity, Affected Resource Type, Affected Resource ID. Additional fields will be included in search in future versions.


The filtering capability included with Threat Findings allows you to select additive filters for various finding attributes (Finding Type, Finding Name, Finding Badge, Cloud Type, etc.) and will dynamically assign properties applicable to the attribute selected.

Users can apply additional conditions for specified filters and add additional filters to further refine the data that is displayed.


Threat Findings - Filter View

“Apply” will activate when the selected filters are populated. To exit the Filters window without applying any filters click “Esc” on your keyboard.

Pagination/Items per Page

Located at the bottom of the main Threat Findings display you can adjust the total number of items displayed on a single page and page through the full list of Threat Finding results.

Main Data Display


Threat Findings Landing Page

Viewing Threat Findings Data

The main Threat Findings view includes the columns Event Source, Finding Type, Count, Severity, Cloud Account, Resource Name & ID, Resource Type, and Last Seen. The view can be sorted ascending/descending on any of these columns.

Event Source

Identifies the source of the Threat Finding. For this current release only third-party CSP sources are supported.

Finding Type

Identifies the Finding Type and links to expanded data.


Threat Findings - Finding Type

Clicking on the link for an individual Finding Type opens a detail pane that contains additional detail for that finding, as well as a JSON display/download option.


Threat Findings - JSON Detail Example


Provides a count of the findings for the event source.


Identifies the severity of the Threat Finding (e.g. High, Medium, Low). Severities are determined by data reported through the individual 3rd-party severity information.

Resource Name & ID

Displays the Resource Name and ID. Clicking on the individual Resource ID opens the detailed resource view. This view contains the option to download the source data as well as a tabbed view (Properties, Public Access, Insight Findings, Thread Findings, etc.) Note: tabs for each resource vary based on type.


Resource Detail Example

Resource Type

Displays the Resource Type, for example Instance or Serviceaccesskey.

Last Seen

Provides the time the Threat Finding was last seen. This will vary based on when the data was last harvested.

Threat Findings and Automation (Bots)

InsightCloudSec supports the ability to build automation around notifications through our Bot capability out-of-the-box with Threat Findings. Users can export findings to SIEM (e.g. Splunk) or generate notifications for a specific scope of findings to an specific email or Slack channel.

Your Bot can be scoped with two resource types associated with Threat Findings.

For more details about Bot configuration refer to our documentation on BotFactory & Automation. In general Bots can be created in one of three ways:

1. To use the templates below from your InsightCloudSec platform installation navigate to "Automation --> BotFactory".

2. To import one of the templates on the BotFactory landing page, navigate to "Templates".


Importing a Bot template

3. From the "Templates" tab under BotFactory select the "Import Template" option and paste one of the two examples featured above into the JSON window.


Import JSON template

  1. Click "Submit" to complete the creation of your new Bot.