For more about findings in the Plerion dashboard, see Findings overview.
Synopsis
plerion findings list [options]
Subcommands
list
List security findings with filtering, sorting, and pagination.plerion findings list [options]
Options
| Flag | Type | Description |
|---|---|---|
--severity | string | Filter by severity: CRITICAL, HIGH, MEDIUM, LOW (comma-separated) |
--status | string | Filter by status: PASSED, FAILED (comma-separated) |
--provider | string | Cloud provider: AWS, Azure, GCP, Kubernetes (case-insensitive) |
--region | string | Cloud region(s) (comma-separated, e.g. us-east-1) |
--resource-type | string | Resource type (e.g. AWS::S3::Bucket) |
--detection-id | string | Detection ID(s) (e.g. PLERION-AWS-1) |
--integration-id | string | Integration ID(s) |
--asset-group-id | string | Asset group ID(s) |
--environment-id | string | Environment: production, non-production, or UUID |
--service | string | Service filter (e.g. AWS::S3) |
--is-exempted | flag | Show only exempted findings |
--start | ISO 8601 | First observed at start date |
--end | ISO 8601 | First observed at end date |
--sort-by | string | Sort field (e.g. severityLevel, firstObservedAt) |
--sort-order | string | asc or desc |
--per-page | number | Results per page (default: 50, max: 1000) |
--ids | string | Filter by finding IDs (comma-separated) |
--asset-id | string | Filter by asset IDs (comma-separated) |
--all | flag | Fetch all pages automatically |
Examples
# List all critical and high findings
plerion findings list --severity CRITICAL,HIGH
# Failed findings in us-east-1
plerion findings list --status FAILED --region us-east-1
# All findings for a specific detection rule
plerion findings list --detection-id PLERION-AWS-16
# Pipe to jq for analysis
plerion findings list --output json | jq '.[].resourceType' | sort | uniq -c
# Fetch everything across all pages
plerion findings list --all --output json > all-findings.json
# Filter with JMESPath
plerion findings list --output json --query 'data[0].detectionId'
Output columns
Table output includes all fields returned by the API:| Column | Description |
|---|---|
| ID | Finding ID |
| DETECTION ID | Detection rule identifier (e.g. PLERION-AWS-16) |
| STATUS | PASSED or FAILED |
| SEVERITY | CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL |
| CALC SEVERITY | Calculated/contextual severity |
| MODIFIED SEVERITY | Manually overridden severity |
| LIKELIHOOD | Likelihood rating |
| IMPACT | Impact rating |
| PROVIDER | Cloud provider (AWS, Azure, GCP) |
| SERVICE | Cloud service (e.g. AWS::S3) |
| RESOURCE TYPE | Resource type (e.g. AWS::S3::Bucket) |
| REGION | Cloud region |
| ASSET ID | Associated asset ID |
| RESOURCE ID | Provider resource ID |
| FULL RESOURCE NAME | Full resource name |
| PROVIDER FULL RESOURCE NAME | Provider-native full resource name |
| INTEGRATION ID | Integration ID |
| PROVIDER ACCOUNT ID | Cloud account/subscription ID |
| EXECUTION ID | Scan execution ID |
| MESSAGE | Finding message |
| EXEMPTED | Whether the finding is exempted |
| RESOURCE URL | Link to the resource in the cloud console |
| FIRST OBSERVED | Timestamp first detected |
| LAST OBSERVED | Timestamp last detected |
| CREATED AT | Record creation timestamp |
| UPDATED AT | Record update timestamp |
| SCHEMA VERSION | API schema version |