> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# plerion findings

> List and filter security findings.

With **plerion findings**, you can list and filter security findings across your cloud environments with support for severity, status, provider, region, and many other filters.

<Tip>
  For more about findings in the Plerion dashboard, see [Findings overview](/guides/platform/findings-overview).
</Tip>

***

## Synopsis

```bash theme={"system"}
plerion findings list [options]
```

***

## Subcommands

### list

List security findings with filtering, sorting, and pagination.

```bash theme={"system"}
plerion findings list [options]
```

#### Options

| Flag | Type | Description |
| - | - | - |
| `--severity` | string | Filter by severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW` (comma-separated) |
| `--status` | string | Filter by status: `PASSED`, `FAILED` (comma-separated) |
| `--provider` | string | Cloud provider: `AWS`, `Azure`, `GCP`, `Kubernetes` (case-insensitive) |
| `--region` | string | Cloud region(s) (comma-separated, e.g. `us-east-1`) |
| `--resource-type` | string | Resource type (e.g. `AWS::S3::Bucket`) |
| `--detection-id` | string | Detection ID(s) (e.g. `PLERION-AWS-1`) |
| `--integration-id` | string | Integration ID(s) |
| `--asset-group-id` | string | Asset group ID(s) |
| `--environment-id` | string | Environment: `production`, `non-production`, or UUID |
| `--service` | string | Service filter (e.g. `AWS::S3`) |
| `--is-exempted` | flag | Show only exempted findings |
| `--start` | ISO 8601 | First observed at start date |
| `--end` | ISO 8601 | First observed at end date |
| `--sort-by` | string | Sort field (e.g. `severityLevel`, `firstObservedAt`) |
| `--sort-order` | string | `asc` or `desc` |
| `--per-page` | number | Results per page (default: 50, max: 1000) |
| `--ids` | string | Filter by finding IDs (comma-separated) |
| `--asset-id` | string | Filter by asset IDs (comma-separated) |
| `--all` | flag | Fetch all pages automatically |

***

## Examples

```bash theme={"system"}
# List all critical and high findings
plerion findings list --severity CRITICAL,HIGH

# Failed findings in us-east-1
plerion findings list --status FAILED --region us-east-1

# All findings for a specific detection rule
plerion findings list --detection-id PLERION-AWS-16

# Pipe to jq for analysis
plerion findings list --output json | jq '.[].resourceType' | sort | uniq -c

# Fetch everything across all pages
plerion findings list --all --output json > all-findings.json

# Filter with JMESPath
plerion findings list --output json --query 'data[0].detectionId'
```

***

## Output columns

Table output includes all fields returned by the API:

| Column | Description |
| - | - |
| ID | Finding ID |
| DETECTION ID | Detection rule identifier (e.g. `PLERION-AWS-16`) |
| STATUS | `PASSED` or `FAILED` |
| SEVERITY | `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL` |
| CALC SEVERITY | Calculated/contextual severity |
| MODIFIED SEVERITY | Manually overridden severity |
| LIKELIHOOD | Likelihood rating |
| IMPACT | Impact rating |
| PROVIDER | Cloud provider (`AWS`, `Azure`, `GCP`) |
| SERVICE | Cloud service (e.g. `AWS::S3`) |
| RESOURCE TYPE | Resource type (e.g. `AWS::S3::Bucket`) |
| REGION | Cloud region |
| ASSET ID | Associated asset ID |
| RESOURCE ID | Provider resource ID |
| FULL RESOURCE NAME | Full resource name |
| PROVIDER FULL RESOURCE NAME | Provider-native full resource name |
| INTEGRATION ID | Integration ID |
| PROVIDER ACCOUNT ID | Cloud account/subscription ID |
| EXECUTION ID | Scan execution ID |
| MESSAGE | Finding message |
| EXEMPTED | Whether the finding is exempted |
| RESOURCE URL | Link to the resource in the cloud console |
| FIRST OBSERVED | Timestamp first detected |
| LAST OBSERVED | Timestamp last detected |
| CREATED AT | Record creation timestamp |
| UPDATED AT | Record update timestamp |
| SCHEMA VERSION | API schema version |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.