I am sharing the query with you here so kindly advise. `aws-inspector-findings` serviceAttributes.assessmentRunArn="*" `aws-inspector-rex-arn` | search (accountId="*") (region="*")| dedup arn| search (severity="*")| spath OUTPUT=agentId assetAttributes.agentId | where isnotnull(agentId)| eval CreatedAt=substr(createdAt, 1, 19) | join type="left" serviceAttributes.rulesPackageArn [search `aws-inspector-runs` arn="*" | dedup rulesPackages{}.arn | rename rulesPackages{}.arn as packageArn, rulesPackages{}.name as packageName| eval row=mvzip(packageArn, packageName, "|") | mvexpand row | rex field=row "(?<packageArn>.*?)\|(?<packageName>.*)" | table packageArn packageName | rename packageArn as "serviceAttributes.rulesPackageArn"]| rename packageName as "Rules Package"| eval Links = if(isnotnull(agentId), "<a id=topology_link>Show in Topology</a> | <a id=ec2_link>Show Instance Details</a>", "") | sort -numericSeverity | join agentId type="left" [search earliest=-1d `aws-description-resource((aws_account_id="*"), (region="*") , "*")` | rename id as agentId ] | rename severity as Severity, id as Rule, agentId as "EC2 Instance ID", tags.Name as "EC2 Instance Name"| fillnull value="N/A" | table Severity, "EC2 Instance ID", "EC2 Instance Name", "Rules Package", Rule, CreatedAt, Links, title, description, recommendation, numericSeverity | search NOT [|inputlookup ignore_cve.csv]
... View more