Data retrieval settings for AWS Inspector

---
title: Data retrieval settings for AWS Inspector
description: The following filters are available for the AWS Inspector Host Vulnerability and Container Vulnerability Integrations. These filters control which findings are retrieved from AWS Inspector.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/aws-inspector-data-filters.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Configure the integrations, AWS Integration for Security Exposure Management, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Data retrieval settings for AWS Inspector

The following filters are available for the AWS Inspector Host Vulnerability and Container Vulnerability Integrations. These filters control which findings are retrieved from AWS Inspector.

Role required: sn\_vul\_aws.configure\_integration - to configure the integrations.

**Note:** For Text-based filters, a maximum 10 values is supported in a configuration.

## Host Vulnerabilities tab

<table><thead><tr><th>

Parameter

</th><th>

Type

</th><th>

Description

</th></tr></thead><tbody><tr><td>

host\_severity

</td><td>

glide\_list

</td><td>

Filter by severity: INFORMATIONAL, LOW, HIGH, MEDIUM, CRITICAL, UNTRIAGED.

</td></tr><tr><td>

host\_vulnerability

</td><td>

string

</td><td>

Filter by specific CVE IDs.

</td></tr><tr><td>

host\_resource\_type

</td><td>

choice

</td><td>

Filter by resource type:

 -   AWS\_EC2\_INSTANCE
-   AWS\_LAMBDA\_FUNCTION
-   BOTH

</td></tr><tr><td>

host\_account\_id

</td><td>

string

</td><td>

Filter by AWS account IDs.

</td></tr><tr><td>

host\_batch\_size

</td><td>

integer

</td><td>

Number of findings per API call. Default: 1000.

</td></tr><tr><td>

host\_finding\_status

</td><td>

glide\_list

</td><td>

Filter by finding status: ACTIVE, SUPPRESSED, CLOSED.

</td></tr><tr><td>

host\_exploit\_available

</td><td>

choice

</td><td>

Filter by exploit availability: YES, NO.

</td></tr><tr><td>

host\_fix\_available

</td><td>

glide\_list

</td><td>

Filter by fix availability: YES, NO, PARTIAL.

</td></tr><tr><td>

host\_first\_observed

</td><td>

glide\_date\_time

</td><td>

Filter by first observed date.

</td></tr><tr><td>

host\_last\_observed

</td><td>

glide\_date\_time

</td><td>

Filter by last observed date.

</td></tr><tr><td>

host\_updated\_at

</td><td>

glide\_date\_time

</td><td>

Filter by last updated date. Used for delta sync.

</td></tr></tbody>
</table>## Container Vulnerabilities tab

| | | |
|---|---|---|
|container\_severity|glide\_list|Filter by severity: INFORMATIONAL, LOW, HIGH, MEDIUM, CRITICAL, UNTRIAGED.|
|container\_vulnerability|string|Filter by specific CVE IDs.|
|container\_account\_id|string|Filter by AWS account IDs.|
|container\_batch\_size|integer|Number of findings per API call. Default: 1000.|
|container\_finding\_status|glide\_list|Filter by finding status: ACTIVE, SUPPRESSED, CLOSED.|
|container\_exploit\_available|choice|Filter by exploit availability: YES, NO.|
|container\_fix\_available|glide\_list|Filter by fix availability: YES, NO, PARTIAL.|
|container\_first\_observed|glide\_date\_time|Filter by first observed date.|
|container\_last\_observed|glide\_date\_time|Filter by last observed date.|
|container\_updated\_at|glide\_date\_time|Filter by last updated date. Used for delta sync.|