Resources

Use the Inventory Resource page to:

• View all deployed resources across your cloud environments and code resources Infrastructure as Code (IaC) integrations.
• Find resources in your infrastructure that share properties, or belong to the same business unit.
• Take action on a posture violation or detected vulnerability by creating a Jira ticket, or accepting the risk.

Data in Inventory Resources is retained for 7 days. For more details, see Data Retention.

Enable Inventory Resources

Navigate the Resources Page

To access and navigate Inventory Resources page:

1. Log in to Sysdig Secure and select Inventory > Resources from the left side bar.

   Inventory displays all resources from cloud accounts, Kubernetes data sources, and IaC Git resources connected to Sysdig, along with their findings for compliance, vulnerabilities, exposure.

   Data shown in the UI is refreshed every 24 hours when a compliance evaluation is run.

2. Use the featured and unified filter to find targeted resources. If an account has an alias, use the account alias to search for the account in Inventory instead of the Account ID. Filtering based on Account ID is not currently supported if the account has an alias. See Filters and Queries.

3. Use Resource Indicators: On a resource card, hover over the Posture Policies Passing gauge, the Runtime Vulnerabilities thermometer, and the Network Exposure icon to get high-level insights about your resource.

   

4. Click a resource card to review the resource Posture, Vulnerabilities and Configuration details.

View Resource Details

Click on any resource to open the Resource Details drawer. This drawer summarizes everything Sysdig knows about a resource — all of its findings, events, misconfigurations, metadata, environment information, and more.

To open the Resource Details drawer:

1. Log in to Sysdig Secure.

2. Navigate to Inventory > Resources.

3. Perform a search or filter the resources page.

4. From the results, select a resource.

   The Resource Details drawer opens.

This drawer lets you determine the status of a resource, and answer questions, such as:

• Does this resource have a ticket open on it?
• What’s the status of the ticket?
• Is this resource under investigation by our SOC team?

Remediate Vulnerabilities with the Resource Details Drawer

A possible work flow for using the Resource Details drawer to remediate a vulnerability might be:

1. In the Sysdig Secure UI, you navigate to Inventory > Resources.
2. You select a resource. The Resource Details drawer opens.
3. On the Highlights tab, you learn the resource is exposed to the internet, and has a critical vulnerability.
4. You select the Vulnerabilities tab to learn more, and discover the critical vulnerability has a remediation.
5. The remediation involves updating a Python package. You copy the details.
6. You select Create Ticket to open a Jira ticket form.
7. You paste the details of the vulnerability and the remediation, and assign it to an engineer to implement.

Navigate Resource Detail Drawer Tabs

The Resource Details drawer features several tabs, each covering a different category of information about the resource. You can navigate through the tabs to accomplish different goals, like creating a Jira ticket, or discovering what vulnerabilities are associated with the resource.

Highlights Tab

This tab offers a high level security overview for the selected resource. It provides an overview of the Top Security Issues, Runtime Insights, Metadata, Resource Labels, and Assigned Zones.

You can copy any of the information shown here, such as the names of the assigned zones, or the attached labels.

Vulnerabilities Tab

The Vulnerabilities tab contains the latest runtime vulnerabilities scan results for that image or workload. This tab lists all of the CVEs identified on this specific resource, with information such as CVE ID, Severity, Context (In Use, Has Exploit, Has Fix, Exception Exists), the Exploit Prediction Scoring System (EPSS) score, the image it is found on, and the package/path.

Click the Severity or EPSS columns to sort the list in ascending or descending order of severity or EPSS score.

Click a CVE listing to open the full CVE details.

Here, you can:

• Learn more about the vulnerability, such as where else it was reported, and whether a fix is available.
• Create a Jira ticket, if you have integrated Jira.
• Accept the Finding in Risk Acceptance.

• Runtime image scans include the Image ID. If the image was also scanned in Pipeline or Registry, then you can view it in the Pipeline or Registry Vulnerabilities interface using the 3-dot menu.

• Cloud Host scans are performed against runtime packages.

• Use the Image ID to view container images as a first-class citizen in Inventory or the Runtime Vulnerabilities interface from Workloads.

• With Risk Spotlight enabled you can see which of your vulnerable packages are currently loaded in Runtime.

Exposure Tab

This tab shows you how a resource is exposed to the Internet. You can explore the different paths of exposure visually by clicking on each of the nodes to learn more. Clicking on the exposure finding will drill you down to learn in detail about each exposure path.

You can also pivot to examining the Resource 360 drawers for each resource involved in the exposure paths. For instance, if you navigate to an EC2 resource and view its exposure path, clicking on the internet gateway within will overlay a new resource details panel, providing more information about that gateway.

Resources that currently have exposure analysis are:

• Buckets (including AWSS3Bucket, GCPCloudStorageBucket and AzureStorageAccountBlobServiceContainer)
• Kubernetes Workload
• Serverless (including AWSLambda, GCPCloudFunction and AzureFunction)
• Storage Account (including AzureStorageAccountBlobService, RDS)
• Virtual Machine (including Azure VM, GCPComputeInstance and EC2Instance)

Configuration Findings Tab

This tab shows you all of your failing Compliance policies for this resource and a breakdown of how many controls failed and passed within each failing policy.

Hover over the results of a failing policy to find out how many controls passed, and how many are failing.

Under Failing Controls, you can see the name of the failing control to be remediated, how many policies and requirements it belongs to, and its severity. The controls are grouped by requirement within each policy.

Hover over the number of policies or requirements to find out their name, and copy them to your clipboard with a click.

Exposure Tab

This tab shows you if and how a resource is exposed to the Internet.

Select Explore to open a diagram of the different exposure paths. Click on each of the nodes to learn more.

Under Exposure Findings, select a finding to learn about the exposure path in detail. You can discover the resource’s region, when it was last seen, and which platform it is on.

You can also pivot to looking at the Resource360 drawers for each of the resources involved in exposure paths.

Under Contributing Resources, you can find other resources in the same exposure path. Select any of the resources to open a new Resource 360 drawer for them.

Resources that currently have exposure analysis are:

• Buckets (including AWSS3Bucket, GCPCloudStorageBucket and AzureStorageAccountBlobServiceContainer)
• Kubernetes Workload
• Serverless (including AWSLambda, GCPCloudFunction and AzureFunction)
• Storage Account (including AzureStorageAccountBlobService, RDS)
• Virtual Machine (including Azure VM, GCPComputeInstance and EC2Instance)

Configuration Tab

This tab shows you different “Configurations” detected for the resource, depending on the type:

• CSPM Resource: Cloud security posture management (CSPM) resource represented in JSON or YAML format.
  • Example: A k8s Deployment Yaml file, or the EC2 Instance description in JSON format.
• Host resource: List of host-configurations detected at the Linux-Host, or Containers
  • Example: Docker iptables config, or /etc/shadow “password expiration”.
• IaC Resource: Resources that are read from a Source-Code-Repo show here that actual “Manifest” Yaml/Json that was detected as an Infra-As-Code file
  • Example: A Json representation of the Terraform HCL configuration block for a EC2 Instance.
• Images: For Images we will show an empty screen.

Packages Tab

Where a resource has packages, this tab displays all the packages Sysdig has identified on the resource, and their paths. You can see how many vulnerabilities each package contains, and context about the vulnerabilities (In Use, Has Exploit, Has Fix).

Select any Package/Path to see more details about it, such as its source, and package type. You can also check whether any update or patch is necessary.

Work with IaC Resources

If you have configured IaC scanning, you can view the resources supported by the Git-integrated scanner in the Inventory, such as YAML, Terraform, and Helm charts. The view of each code resource includes:

• resource metadata
• configuration details
• posture violations that can be remediated with automated workflows.

For more information, see IaC Support.

Search for IaC Resources

IaC resources from Git repository scans are labeled code in the Inventory UI, to distinguish them from deployed resources in your cloud environments.

1. Filter for Resource Origin = Code.

   In the resulting list, a visual tag (< >) on the logo to distinguish code resources.

   

2. Other options: Filter by Source Type, Location, Git Integration, or Repository.

View Vulnerable Resources

If you have installed the Runtime image scanner, you can view your container images in Inventory. For each resource, you can see:

• Resource metadata
• Runtime context of Package vulnerabilities
• Vulnerability details (has fix, has exploit) that support your remediation workflows

Search for Container Images

Container images from Runtime scans are a new Resource Type in the Inventory UI.

• Filter for Resource Type is Image

Other options: Filter by Platform, Image ID, Image Digest, Image Registry, Image Pullstrings or Image Tags

Search for Vulnerable Workloads

• Quickly discover workloads running container images with vulnerable packages.
• Filter for Resource Type in (Deployment, DaemonSet, CronJob, Job, etc) AND Vulnerability in CVE-2005-2541
• Other options: Filter by Resource Type AND Package, Package Path, Vulnerability Severity

Search for Vulnerable Cloud Hosts

Find cloud hosts running images with vulnerable packages.

• Filter for Resource Type in (EC2 Instance, Compute Instance) AND Vulnerability in CVE-2023-0464
• Other options: Filter for Resource Type AND ARN, Resource ID

Filters and Queries

There are two filtering options in the Inventory UI: the Sysdig unified filter bar at the top, and the Featured Filters column on the left.

Unified Filter

As in other parts of the Sysdig Secure interface, the unified filter bar allows you to build sophisticated queries using:

• Drop-down menu items and operators
• Clickable resource elements on the Inventory page

Featured Filters

The Featured Filters panel, populated by Sysdig, displays your environment’s most useful filter types. It lets you narrow down to your most prevalent and “at risk” resources and includes resource counting and risk indicators.

You can:

• Open and close the panel from the top-left arrow symbol.

• Click In/!In or Yes/No beside any featured filter item to include it in the query you are building in the unified filter.

• View by Risk indicators associated with Vulnerabilities: Has Fix and Has Exploits

  

Featured Queries

You can structure queries in the unified filter to solve common use cases as follows:

Find Resources by Name and Attributes

• I want to search for all S3 buckets in the EU regions
  • Resource Type contains S3 AND Region startsWith eu
• I want to search for all Workloads of type host with names starting with prod
  • Resource Type is host AND Name startsWith prod
• I want to view the configuration of my GKE Worker nodes
  • Node Type is Worker AND Kubernetes Distribution is gke
• I want to search for all clusters running on OpenShift V4
  • Resource Type is Cluster AND Kubernetes Distribution is ocp4
• I want to search for all IaC resources
  • Resource Origin is Code

Find Resources Owned by Business Unit

• I want to search for all resources belonging to my PCI zones
  • Zones startsWith PCI
• I want to search for all resources labeled app:retail
  • Labels in app:retail
• I want to search for all resources within the finance namespace
  • Namespace is finance
• I want to search for all resources belonging to my docker clusters
  • Cluster contains docker

Find your Environment Blind Spots

• I want to view all resources on which there are 0 policies applied
  • Posture Applied Policy not exists
• I want to view all resources that belong to 0 zones
  • Zones not exists
• I want to view all resources that are not labeled
  • Labels not exists

Find Resources by Posture Details

• I want to view all resources on which policy X is applied
  • Posture Applied Policy is (p1)
  • Posture Applied Policy in (p1, p2, p3)
• I want to view all resources on which CIS Kubernetes V1.23 Benchmark policy is applied
  • Posture Applied Policy in CIS Kubernetes V1.23 Benchmark
• I want to view all resources that fail ISO/IEC 27001 policy
  • Posture Failed Policy in ISO/IEC 2700
• I want to view all resources that are failing at least one policy
  • Posture Failed Policy exists
• I want to view all resources that are failing at least one control
  • Posture Failed Control exists
• I want to view all resources for which a risk has been accepted on a control
  • Posture Accepted Risk yes

Find Vulnerable Resources

• I want to view all Quay.io images that have the same Image ID.
  • Resource Type is Image AND Platform is Quay.io AND Image ID is sha256:4fc533e8180ac3805582d3b2a9f8008d54d346211894d6131d92a82d17ee5458
• I want to view all images that have Log4j packages and Apache Log4j Vulnerability.
  • Resource Type is Image AND Package contains log4j AND Vulnerability in CVE-2021-44832
• I want to view all images with critical vulnerabilities that have an exploit and a fix.
  • Resource Type is Image AND Vulnerability Severity in Critical AND Has Exploit Yes AND Has Fix Yes
• I want to view all workloads that have OpenSSL packages and OpenSSL Vulnerability.
  • Resource Type is Deployment AND Package contains openssl AND Vulnerability in CVE-2023-0464
• I want to view all workloads with critical vulnerabilities that have an exploit and a fix.
  • Resource Type is DaemonSet AND Vulnerability Severity in Critical AND Has Exploit Yes AND Has Fix Yes
• I want to view all workloads with In Use packages that belong to my HR team.
  • Resource Type is StatefulSet AND In Use Yes AND Resource Labels in team:hr

Find IaC Resources

• I want to find the code for the deployment of my mobile application’s frontend.
  • Resource Origin is Code AND Resource Type is Deployment AND Location contains mobile-app AND Name contains mobile-frontend
• I want to see all Terraform code managed by the Marketing team
  • Source Type is Terraform AND Labels in OwnedBy:team-marketing AND Repository is my-git-repo

• I want to know which IaC of my EC2 Instances are failing a control
  • Resource Origin is Code AND Resource Type is EC2 Instance AND Posture Failed Control exists

• I want to see all IaC repos not being evaluated by policies
  • Git Integration is my-iac-repos AND Posture Applied Policy not exists

View a Resource’s Applied Configuration

• I want to view the bucket policy for bucket 123
  • Resource Type contains bucket AND Name contains 123 + click on resource card to scroll through configuration details
• I want to view the default runAsUser applied configuration for workload abc
  • Name is abc + click on resource card to scroll through configuration details

Use the Inventory API

Query the Secure API to get a list of multiple inventory resources or retrieve a single one.

• For details, see the Inventory entries in the API documentation.

• For API doc links for additional regions or steps to access them from within the Sysdig Secure UI, see the Developer Tools overview.

Inventory Data Dictionary

You can construct searches/filters by attribute name in the Inventory unified filter.

Additional Attributes

Attributes that appear in the interface but cannot be searched/filtered on include: