Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Vulnerability blind spots V-050
Finds the places where the vulnerability scanner cannot see what you run, grouped by account and region, with what turning it on costs.
Checks
| Checks | Needs |
|---|---|
| Finds a resource type that runs in a region where Amazon Inspector is turned off. | sw platform |
| Finds running resources that Inspector covers but does not scan, grouped by the reason it gives. | insp coverage |
| Finds image repositories in your account with running images and no scanning. | sw image |
| Finds running images that come from a registry no scanner reads, and names a pull-through cache as the fix. | sw image |
| Finds running instances that report neither to Systems Manager nor to Inspector. | sw package |
| Finds a software inventory or a scanner run that is more than a week old. | sw package |
| Finds known vulnerabilities kept open as last seen affected because the scanner lost sight of them. | sw platform |
| Finds an Inspector filter that hides findings on running resources. | insp filter |
Coverage
Read everywhere
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1190 T1562.001
How to fix
warden show for the cited records and the group's count → turn the reading on or fix what stops it (Inspector for the resource type, the Systems Manager agent, ECR scanning, a pull-through cache), by IaC or in the console; the finding states the price; read-only until then