Posture Findings

The Posture > Findings page provides a detailed, filterable list of posture issues across your environment. It helps security teams investigate specific findings, understand their context, and prioritize remediation to improve your security posture.

If you click a panel or row from Posture > Overview, the Findings page opens with the same filters pre-applied.

Understand Posture Findings

The Posture Findings page provides a detailed, table-based view of all posture-related issues detected across your cloud and Kubernetes infrastructure. It is designed for security analysts and engineers to drill down into specific findings, understand their context, and take remediation actions.

Access Findings

In Sysdig Secure, go to Posture > Findings.
Use the filters and grouping options at the top to refine the results.

Use the filters at the top of the page to narrow the results and focus on the most relevant issues. You can apply a range of posture-specific filters.

Default Filters

The following filters are available by default:

Search: Filter findings by resource name.
Zone: Filter by one or more Zones, logical groupings such as accounts, clusters, or applications.
Severity: Filter findings by severity: High, Medium, or Low.
Risk Accepted: Filter findings by whether they have been accepted.

Additional Filters

Click + Add to apply more granular filters, or use filters automatically applied when drilling down from the Posture Overview dashboard:

Account ID: Cloud account, subscription, or project ID where the resource resides.
Cluster Name: Kubernetes cluster that hosts the resource.
Control Name: Name of the evaluated control.
Organization: Organization that owns the resource.
Owner: Owner of the evaluated control.
Platform: Filter by resource platform (for example, AWS, Azure, GCP, OCI, Kubernetes).
Resource Category: High-level classification of the resource (for example, Compute, Storage, Network).
Resource Family: Sub-classification within a category (for example, Application, Database, Volume).
Resource ID: Unique identifier of the resource.
Resource Name: Human-readable resource name.
Resource Type: Specific type of resource (for example, Cloud SQL Backup Run, S3 Bucket, IAM Policy).

Grouping Findings

You can group findings to change how data is presented:

None: Displays individual findings line by line.
Resource: Groups findings by affected resource, aggregating all findings for that resource into a single row.
Control: Groups findings by evaluated control, aggregating all findings for that control into a single row.

Findings Table Columns

Column definitions vary depending on how the data is grouped.

Group by None

No grouping is applied. The following columns are displayed:

Column	Description
Control	Name of the control.
Resource	Affected resource (for example, `rtb-1234567890abcdef0`, `aks-agentpool-20481852-vmss`).
Platform	Resource platform (for example, AWS, Azure, GCP, Kubernetes, Linux).
Resource Context	Additional context about the resource (for example, organization, subscription).
Severity	Severity of the finding.
Accepted	Whether the finding risk is accepted.
Zones	Relevant Zones.
First Seen	Timestamp when the finding was first observed for the resource.

Group by Resource

Column	Description
Resource	Affected resource (for example, `rtb-1234567890abcdef0`, `aks-agentpool-20481852-vmss`).
Platform	Resource platform (for example, AWS, Azure, GCP, Kubernetes, Linux).
Resource Context	Additional context about the resource (for example, organization, subscription).
Passing Score	Passing score for the resource.
Findings	Number of findings affecting the resource.
Zones	Relevant Zones.

Review Findings in Detail

Click a row to open a contextual side panel:

Flat List (No Grouping): Opens the Findings Detail panel, which includes:
- Resource details.
- Finding specifics: description, severity, and configuration summary.
- Remediation guidance.
Grouped by Resource: Opens the Resource panel, which includes:
- All configuration findings associated with the resource.
- Remediation options for each finding.

These detailed views provide full context for prioritizing and resolving issues, supporting effective security posture enforcement across your cloud environment.