> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# plerion findings

> List and filter security findings.

With **plerion findings**, you can list and filter security findings across your cloud environments with support for severity, status, provider, region, and many other filters.

<Tip>
  For more about findings in the Plerion dashboard, see [Findings overview](/guides/platform/findings-overview).
</Tip>

***

## Synopsis

```bash theme={"system"}
plerion findings list [options]
```

***

## Subcommands

### list

List security findings with filtering, sorting, and pagination.

```bash theme={"system"}
plerion findings list [options]
```

#### Options

| Flag               | Type     | Description                                                               |
| ------------------ | -------- | ------------------------------------------------------------------------- |
| `--severity`       | string   | Filter by severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` (comma-separated) |
| `--status`         | string   | Filter by status: `PASSED`, `FAILED` (comma-separated)                    |
| `--provider`       | string   | Cloud provider: `AWS`, `Azure`, `GCP`, `Kubernetes` (case-insensitive)    |
| `--region`         | string   | Cloud region(s) (comma-separated, e.g. `us-east-1`)                       |
| `--resource-type`  | string   | Resource type (e.g. `AWS::S3::Bucket`)                                    |
| `--detection-id`   | string   | Detection ID(s) (e.g. `PLERION-AWS-1`)                                    |
| `--integration-id` | string   | Integration ID(s)                                                         |
| `--asset-group-id` | string   | Asset group ID(s)                                                         |
| `--environment-id` | string   | Environment: `production`, `non-production`, or UUID                      |
| `--service`        | string   | Service filter (e.g. `AWS::S3`)                                           |
| `--is-exempted`    | flag     | Show only exempted findings                                               |
| `--start`          | ISO 8601 | First observed at start date                                              |
| `--end`            | ISO 8601 | First observed at end date                                                |
| `--sort-by`        | string   | Sort field (e.g. `severityLevel`, `firstObservedAt`)                      |
| `--sort-order`     | string   | `asc` or `desc`                                                           |
| `--per-page`       | number   | Results per page (default: 50, max: 1000)                                 |
| `--ids`            | string   | Filter by finding IDs (comma-separated)                                   |
| `--asset-id`       | string   | Filter by asset IDs (comma-separated)                                     |
| `--all`            | flag     | Fetch all pages automatically                                             |

***

## Examples

```bash theme={"system"}
# List all critical and high findings
plerion findings list --severity CRITICAL,HIGH

# Failed findings in us-east-1
plerion findings list --status FAILED --region us-east-1

# All findings for a specific detection rule
plerion findings list --detection-id PLERION-AWS-16

# Pipe to jq for analysis
plerion findings list --output json | jq '.[].resourceType' | sort | uniq -c

# Fetch everything across all pages
plerion findings list --all --output json > all-findings.json

# Filter with JMESPath
plerion findings list --output json --query 'data[0].detectionId'
```

***

## Output columns

Table output includes all fields returned by the API:

| Column                      | Description                                          |
| --------------------------- | ---------------------------------------------------- |
| ID                          | Finding ID                                           |
| DETECTION ID                | Detection rule identifier (e.g. `PLERION-AWS-16`)    |
| STATUS                      | `PASSED` or `FAILED`                                 |
| SEVERITY                    | `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL` |
| CALC SEVERITY               | Calculated/contextual severity                       |
| MODIFIED SEVERITY           | Manually overridden severity                         |
| LIKELIHOOD                  | Likelihood rating                                    |
| IMPACT                      | Impact rating                                        |
| PROVIDER                    | Cloud provider (`AWS`, `Azure`, `GCP`)               |
| SERVICE                     | Cloud service (e.g. `AWS::S3`)                       |
| RESOURCE TYPE               | Resource type (e.g. `AWS::S3::Bucket`)               |
| REGION                      | Cloud region                                         |
| ASSET ID                    | Associated asset ID                                  |
| RESOURCE ID                 | Provider resource ID                                 |
| FULL RESOURCE NAME          | Full resource name                                   |
| PROVIDER FULL RESOURCE NAME | Provider-native full resource name                   |
| INTEGRATION ID              | Integration ID                                       |
| PROVIDER ACCOUNT ID         | Cloud account/subscription ID                        |
| EXECUTION ID                | Scan execution ID                                    |
| MESSAGE                     | Finding message                                      |
| EXEMPTED                    | Whether the finding is exempted                      |
| RESOURCE URL                | Link to the resource in the cloud console            |
| FIRST OBSERVED              | Timestamp first detected                             |
| LAST OBSERVED               | Timestamp last detected                              |
| CREATED AT                  | Record creation timestamp                            |
| UPDATED AT                  | Record update timestamp                              |
| SCHEMA VERSION              | API schema version                                   |