Cloud (CSPM) — Findings & compliance

A CSPM scan produces two complementary views of the same data:

• Findings — the failed checks, as real problems, in the platform's normal Findings → Tasks lifecycle (triage, suppression, re-scan reconciliation) — identical to EASM/DAST findings, tagged module = "aws".
• Posture — every check result (pass and fail), with its full compliance mapping, so you can report against any framework from a single scan.

Scan once, report against any framework. Every result carries its complete compliance tags (CIS, ISO 27001, SOC 2, NIST, PCI, …). You don't re-scan per standard — you filter the same results by framework.

Posture results

GET /org/aws/results — all CSPM results (pass + fail) for the org's connected accounts. Returns a list of result rows:

Field	Meaning
check_id	the posture check identifier
title	human title (shown for both pass and fail)
status	"pass" or "fail"
severity	info / low / medium / high / critical
service	AWS service (e.g. s3, iam, ec2)
account	the AWS account id the result is for
region	the AWS region
resource	the resource ARN
frameworks	the compliance frameworks this check maps to

Filter with query parameters — status (pass/fail), framework, service, severity, account, plus limit (≤ 2000, default 200) and offset:

# Failing checks that map to CIS, for the S3 service:
curl "$BASE/org/aws/results?status=fail&framework=CIS&service=s3" \
  -H "X-Master-Key: $MASTER" -H "X-Admin-Key: $ADMIN" -H "X-Org-Key: $ORG"

[
  {
    "check_id": "s3_bucket_public_access",
    "title": "S3 bucket allows public access",
    "status": "fail", "severity": "high",
    "service": "s3", "account": "123456789012",
    "region": "eu-north-1",
    "resource": "arn:aws:s3:::example-bucket",
    "frameworks": ["CIS", "ISO27001", "SOC2"]
  }
]

Available frameworks

GET /org/aws/frameworks — the compliance frameworks actually present in this org's cloud results (drives a "pick your standard" dropdown):

curl "$BASE/org/aws/frameworks" \
  -H "X-Master-Key: $MASTER" -H "X-Admin-Key: $ADMIN" -H "X-Org-Key: $ORG"
# ["CIS", "ISO27001", "NIST", "PCI", "SOC2", ...]

The exact set depends on what the scan mapped for your resources.

Findings (the failures, triaged)

Every failed check also derives a Finding (with a remediation Task), carried in the platform's normal findings API alongside EASM/DAST findings — so a cloud misconfiguration gets the same triage, severity model, suppression, and re-scan reconciliation. Passing and manual checks stay coverage-only (they appear in posture results, not as findings). See the Platform API Reference for the findings/tasks endpoints.

• Per-module isolation: cloud findings (module = "aws") are reconciled and de-duplicated only against other cloud findings — an EASM or DAST scan never ages or resolves them, and vice versa.
• Idempotent re-scans: a result's identity is check_id | resource-arn, so a re-scan updates the existing finding in place rather than duplicating it.

What the customer never sees

CSPM output is de-branded: the underlying scan tool's name and its own links are stripped from all titles, descriptions, and remediation text, and replaced with the product's voice. The real AWS documentation links and the real compliance mappings are preserved. (Architecture: two-hop, agentless.)