Amazon Inspector

Amazon Web Services

Overview

Integrates with Amazon Inspector (Inspector v2) to retrieve continuous vulnerability and network-exposure findings across the configured AWS accounts and regions. Amazon Inspector scans EC2 instances, ECR container images, and Lambda functions and produces three classes of findings — package vulnerabilities, code vulnerabilities, and network reachability issues. The connector reads those findings via the Inspector v2 ListFindings API (one request per severity) and derives eight Brinqa models from the same finding stream: the scanned assets (EC2 instances and other cloud resources), the findings themselves (as vulnerabilities, static code findings, and violations), and their corresponding definitions.

Findings are fetched once per sync and cached in a local file-backed store keyed by an internal transaction id; the different models sync from that shared store so a single ListFindings sweep feeds every object class. A finding is expanded over its resources list, so finding-derived objects are emitted once per referenced resource.

Data retrieved from Amazon Inspector

Connector Object	Required	Maps to Data Model
Aws Ec2 Instance	Yes	Host
Cloud Resource	Yes	Cloud Resource
Package Vulnerability	Yes	Vulnerability
Package Vulnerability Definition	Yes	Vulnerability Definition
Code Vulnerability	Yes	Static Code Finding
Code Vulnerability Definition	Yes	Static Code Finding Definition
Network Reachability Finding	Yes	Violation
Network Reachability Finding Definition	Yes	Violation Definition

note

For detailed steps on how to view the data retrieved from Amazon Inspector in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Amazon Inspector from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Access key ID	No	—	AWS user access key ID, if not specified, the connector consults the default credentials provider chain to try and determine the \
Secret access key	No	—	AWS user secret access key, if not specified, the connector consults the default credentials provider chain to try and determine the \
Default region	No	us-east-1	Default AWS region, if not specified, the connector consults the default region provider chain to try and determine the region to use.
Assume role	No	— (empty)	Amazon Resource Name for the role to assume.
Session duration	No	900	Assume role session duration in seconds.
Page size	No	100	The maximum number of results to retrieve per operation.
Parallel requests	No	min(4, CPU cores)	Maximum number of parallel requests.

Authentication

Authentication is shared across the AWS connector bundle via the AwsConfiguration base class. The Inspector sub-connector uses the AWS SDK for Java v2 Inspector2Client, which signs every request with AWS SigV4 using credentials resolved through the following chain (in order):

1. STS AssumeRole — if assumeRoleARN is configured, the connector assumes that role (using the credentials below as the principal) and uses the resulting temporary session credentials.
2. Static access keys — if accessKey / secretKey are configured, they are used directly.
3. Default credentials provider chain — environment variables, ~/.aws/credentials, container role, or EC2 instance metadata.

Assumed-role sessions use the configurable sessionDuration (default 900 s) with a unique session name per sync. assumeRoleARN may be a comma-separated list to sync multiple accounts in one run. An Inspector2Client is constructed per role per region and closed once its region has been fully synced. Regions are discovered dynamically via EC2 DescribeRegions unless an explicit region/regions option is supplied.

Required AWS API permissions

Permission	Purpose
inspector2:ListFindings	List and page through Inspector findings (with filter criteria)
ec2:DescribeRegions	Discover the regions to query when no region option is provided
sts:AssumeRole	Only when assumeRoleARN is set

Sync Behavior

The connector performs an incremental (delta) sync. When a sync token from a prior run is available, records are filtered by updatedAt after that timestamp; on the first run, or when no sync token is present, a full sync is performed.

---

How to obtain Amazon Inspector credentials

Create an IAM user for Amazon Inspector access

For the Amazon Inspector connector to interact with the Amazon Inspector API, you must provide specific AWS credentials and permissions. To do so, follow these steps:

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

   

3. From the navigation pane under Access management, click Users, and then click Create user.

4. Provide a User name, leave the Provide user access to AWS Management Console option unchecked, and then click Next.

5. Click the Attach policies directly option, search for and select the AmazonInspectorReadOnlyAccess permission.

   

6. Click Next and then click Create user.

   The Users page displays and the new IAM user is available in the Users table.

Note: If you do not have permissions to create a new IAM user, contact your AWS administrator. For additional information, see AWS documentation.

Obtain Amazon Inspector access keys

To obtain the access keys required for the integration, follow these steps:

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the IAM dashboard.

3. From the navigation pane under Access management, click Users.

4. Choose the IAM user you created in the earlier steps.

5. Click the Security credentials tab and then click Create access key.

6. Select the Application running outside AWS use case and then click Next.

7. Provide a description and then click Create access key.

   

   Your new access keys display. You cannot view the keys again after this. Copy and save them to a safe and secure location.

Note: If you do not have permissions to create access keys, contact your AWS administrator. For additional information, see AWS documentation.

Create a role and assign permissions

After obtaining the Amazon Inspector access keys, the next step is to create a role and obtain the ARN that is required for the integration. To do so, follow these steps:

1. From the IAM dashboard, click Roles, and then click Create role.

2. Choose AWS account for the Trusted entity type and click Next.

3. Search for and select the AmazonInspectorReadOnlyAccess permission from the list of permissions and click Next.

4. Assign a name and description and then click Create role.

5. Back on the Roles page, click the new role and copy the value in the ARN field as shown below. The ARN, along with the access key ID and secret access key, are required for authentication in the integration configuration:

   

Note: If you do not have the permissions to create roles, contact your AWS administrator. For additional information, see AWS documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Aws Ec2 Instance

Source Field Name	SDM Attribute
AwsEc2InstanceDetails.iamInstanceProfileArn	I_AM_INSTANCE_PROFILE_ARN
AwsEc2InstanceDetails.imageId	IMAGE
AwsEc2InstanceDetails.ipV4Addresses	IPV4_ADDRESSES (multivalued)
AwsEc2InstanceDetails.ipV6Addresses	IPV6_ADDRESSES (multivalued)
AwsEc2InstanceDetails.keyName	KEY_NAME
AwsEc2InstanceDetails.launchedAt	LAUNCHED_AT
AwsEc2InstanceDetails.platform	PLATFORM
AwsEc2InstanceDetails.subnetId	SUBNET_ID
AwsEc2InstanceDetails.type	INSTANCE_TYPE
AwsEc2InstanceDetails.vpcId	VPC_ID
Finding.awsAccountId	CLOUD_ACCOUNT_ID
IPv4/IPv6 addresses classified as private	PRIVATE_IP_ADDRESSES (multivalued)
IPv4/IPv6 addresses classified as public	PUBLIC_IP_ADDRESSES (multivalued)
Resource.id	UID
Resource.id	NAME
Resource.region	REGION
Resource.tags	TAGS (multivalued)
Resource.type	CATEGORIES
union of ipV4Addresses + ipV6Addresses	IP_ADDRESSES (multivalued)

Cloud Resource

Source Field Name	SDM Attribute
AwsEcrContainerImageDetails.architecture	ARCHITECTURE
AwsEcrContainerImageDetails.author	AUTHOR
AwsEcrContainerImageDetails.imageHash	IMAGE_HASH
AwsEcrContainerImageDetails.imageTags	IMAGE_TAGS (multivalued)
AwsEcrContainerImageDetails.inUseCount	IN_USE_COUNT
AwsEcrContainerImageDetails.lastInUseAt	LAST_USED
AwsEcrContainerImageDetails.platform	PLATFORM
AwsEcrContainerImageDetails.pushedAt	SOURCE_CREATED_DATE
AwsEcrContainerImageDetails.registry	REGISTRY
AwsEcrContainerImageDetails.repositoryName	REPOSITORY
AwsLambdaFunctionDetails.architectures	ARCHITECTURES (multivalued)
AwsLambdaFunctionDetails.codeSha256	CODE_SHA_256
AwsLambdaFunctionDetails.executionRoleArn	EXECUTION_ROLE_ARN
AwsLambdaFunctionDetails.functionName	FUNCTION_NAME
AwsLambdaFunctionDetails.lastModifiedAt	SOURCE_LAST_MODIFIED
AwsLambdaFunctionDetails.layers	LAYERS (multivalued)
AwsLambdaFunctionDetails.packageType	PACKAGE_TYPE
AwsLambdaFunctionDetails.runtime	RUNTIME
AwsLambdaFunctionDetails.version	CURRENT_VERSION
Finding.awsAccountId	CLOUD_ACCOUNT_ID
LambdaVpcConfig.securityGroupIds	SECURITY_GROUP_IDS (multivalued)
LambdaVpcConfig.subnetIds	SUBNET_IDS (multivalued)
LambdaVpcConfig.vpcId	VPC_ID
Resource.id	UID
Resource.id	NAME
Resource.region	REGION
Resource.tags	TAGS (multivalued)
Resource.type	CATEGORIES

Package Vulnerability

Source Field Name	SDM Attribute
derived from normalized Finding.status	STATUS_CATEGORY
Finding.awsAccountId	CLOUD_ACCOUNT_ID
Finding.exploitAvailable	EXPLOIT_AVAILABLE
Finding.findingArn	UID
Finding.firstObservedAt	FIRST_FOUND
Finding.fixAvailable	FIX_AVAILABLE
Finding.inspectorScore	INSPECTOR_SCORE
Finding.lastObservedAt	LAST_FOUND
Finding.remediation.recommendation.text	RECOMMENDATION
Finding.status	SOURCE_STATUS
Finding.title	TYPE
Finding.type	CATEGORIES
normalized Finding.status	STATUS
PackageVulnerabilityDetails.source	VULNERABILITY_SOURCE
PackageVulnerabilityDetails.source	AFFECTED
PackageVulnerabilityDetails.vulnerabilityId	VULNERABILITY_ID
PackageVulnerabilityDetails.vulnerablePackages[]	VULNERABLE_PACKAGES (multivalued)
PackageVulnerabilityDetails.vulnerablePackages[].fixedInVersion	FIXED_VERSION (multivalued)
PackageVulnerabilityDetails.vulnerablePackages[].name	AFFECTED_PACKAGE_NAMES (multivalued)
PackageVulnerabilityDetails.vulnerablePackages[].remediation	PACKAGE_REMEDIATIONS (multivalued)
PackageVulnerabilityDetails.vulnerablePackages[].version	AFFECTED_VERSION (multivalued)
Resource.id	TARGETS

Package Vulnerability Definition

Source Field Name	SDM Attribute
CVE ids parsed from Finding.title	CVE_IDS (multivalued)
CVE ids parsed from Finding.title	CVE_RECORDS (multivalued)
derived from CVSS v2 vector	CVSS_V2_SEVERITY
derived from CVSS v3 vector	CVSS_V3_SEVERITY
derived from normalized Finding.severity	SEVERITY_SCORE
Finding.description	DESCRIPTION
Finding.exploitAvailable	EXPLOIT_AVAILABLE
Finding.fixAvailable	FIXABLE
Finding.remediation.recommendation.text	RECOMMENDATION
Finding.severity	SOURCE_SEVERITY
Finding.title	UID
Finding.title	NAME
Finding.type	CATEGORIES
normalized Finding.severity	SEVERITY
PackageVulnerabilityDetails.cvss[v2].baseScore	CVSS_V2_BASE_SCORE
PackageVulnerabilityDetails.cvss[v2].scoringVector	CVSS_V2_VECTOR
PackageVulnerabilityDetails.cvss[v3].baseScore	CVSS_V3_BASE_SCORE
PackageVulnerabilityDetails.cvss[v3].scoringVector	CVSS_V3_VECTOR
PackageVulnerabilityDetails.referenceUrls	REFERENCES (multivalued)
parsed from CVSS v2 vector	CVSS_V2_AC
parsed from CVSS v2 vector	CVSS_V2_AI
parsed from CVSS v2 vector	CVSS_V2_AU
parsed from CVSS v2 vector	CVSS_V2_AV
parsed from CVSS v2 vector	CVSS_V2_CI
parsed from CVSS v2 vector	CVSS_V2_E
parsed from CVSS v2 vector	CVSS_V2_II
parsed from CVSS v2 vector	CVSS_V2_RC
parsed from CVSS v2 vector	CVSS_V2_RL
parsed from CVSS v3 vector	CVSS_V3_AC
parsed from CVSS v3 vector	CVSS_V3_AI
parsed from CVSS v3 vector	CVSS_V3_AV
parsed from CVSS v3 vector	CVSS_V3_CI
parsed from CVSS v3 vector	CVSS_V3_E
parsed from CVSS v3 vector	CVSS_V3_II
parsed from CVSS v3 vector	CVSS_V3_PR
parsed from CVSS v3 vector	CVSS_V3_RC
parsed from CVSS v3 vector	CVSS_V3_RL
parsed from CVSS v3 vector	CVSS_V3_UI

Code Vulnerability

Source Field Name	SDM Attribute
CodeVulnerabilityDetails.filePath	PATH
derived from normalized Finding.status	STATUS_CATEGORY
Finding.awsAccountId	CLOUD_ACCOUNT_ID
Finding.findingArn	UID
Finding.firstObservedAt	FIRST_FOUND
Finding.inspectorScore	INSPECTOR_SCORE
Finding.lastObservedAt	LAST_FOUND
Finding.status	SOURCE_STATUS
Finding.title	TYPE
Finding.type	CATEGORIES
normalized Finding.status	STATUS
Resource.id	TARGETS

Code Vulnerability Definition

Source Field Name	SDM Attribute
CodeVulnerabilityDetails.cwes	CWE_IDS (multivalued)
CodeVulnerabilityDetails.cwes	WEAKNESSES (multivalued)
CodeVulnerabilityDetails.detectorId	DETECTOR_ID
CodeVulnerabilityDetails.detectorName	DETECTOR_NAME
CodeVulnerabilityDetails.detectorTags	TAGS (multivalued)
CodeVulnerabilityDetails.referenceUrls	REFERENCES (multivalued)
CodeVulnerabilityDetails.ruleId	RULE_ID
derived from normalized Finding.severity	SEVERITY_SCORE
Finding.description	DESCRIPTION
Finding.fixAvailable	FIXABLE
Finding.remediation.recommendation.text	RECOMMENDATION
Finding.severity	SOURCE_SEVERITY
Finding.title	UID
Finding.title	NAME
Finding.type	CATEGORIES
normalized Finding.severity	SEVERITY

Network Reachability Finding

Source Field Name	SDM Attribute
derived from normalized Finding.status	STATUS_CATEGORY
Finding.awsAccountId	CLOUD_ACCOUNT_ID
Finding.findingArn	UID
Finding.firstObservedAt	FIRST_FOUND
Finding.inspectorScore	INSPECTOR_SCORE
Finding.lastObservedAt	LAST_FOUND
Finding.status	SOURCE_STATUS
Finding.title	TYPE
Finding.type	CATEGORIES
NetworkReachabilityDetails.networkPath.steps	PATH
NetworkReachabilityDetails.openPortRange	PORT
normalized Finding.status	STATUS
Resource.id	TARGETS

Network Reachability Finding Definition

Source Field Name	SDM Attribute
derived from normalized Finding.severity	SEVERITY_SCORE
finding reference URLs	REFERENCES (multivalued)
Finding.description	DESCRIPTION
Finding.fixAvailable	FIXABLE
Finding.remediation.recommendation.text	RECOMMENDATION
Finding.severity	SOURCE_SEVERITY
Finding.title	UID
Finding.title	NAME
Finding.type	CATEGORIES
normalized Finding.severity	SEVERITY

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Aws Ec2 Instance

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query (one client per region).	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one ListFindings call per value with a severity EQUALS filter.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter (PACKAGE_VULNERABILITY, NETWORK_REACHABILITY, CODE_VULNERABILITY).	none
status	findingStatus filter (ACTIVE, CLOSED, SUPPRESSED).	none
fixAvailable	fixAvailable filter (YES, NO, PARTIAL).	none
resourceType	resourceType filter (AWS_EC2_INSTANCE, AWS_ECR_CONTAINER_IMAGE, etc.).	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Cloud Resource

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query.	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one call per value.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter.	none
status	findingStatus filter.	none
fixAvailable	fixAvailable filter.	none
resourceType	resourceType filter.	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Package Vulnerability

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query.	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one call per value.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter.	none
status	findingStatus filter.	none
fixAvailable	fixAvailable filter.	none
resourceType	resourceType filter.	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Package Vulnerability Definition

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query.	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one call per value.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter.	none
status	findingStatus filter.	none
fixAvailable	fixAvailable filter.	none
resourceType	resourceType filter.	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Code Vulnerability

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query.	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one call per value.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter.	none
status	findingStatus filter.	none
fixAvailable	fixAvailable filter.	none
resourceType	resourceType filter.	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Code Vulnerability Definition

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query.	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one call per value.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter.	none
status	findingStatus filter.	none
fixAvailable	fixAvailable filter.	none
resourceType	resourceType filter.	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Network Reachability Finding

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query.	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one call per value.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter.	none
status	findingStatus filter.	none
fixAvailable	fixAvailable filter.	none
resourceType	resourceType filter.	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Network Reachability Finding Definition

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query.	Regions discovered via ec2:DescribeRegions
pageSize	Page size (maxResults) for each ListFindings call.	Shared pageSize configuration (100)
severity	Severities to fetch; one call per value.	CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED
type	findingType filter.	none
status	findingStatus filter.	none
fixAvailable	fixAvailable filter.	none
resourceType	resourceType filter.	none

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on updatedAt.

API

• Type: AWS SDK for Java v2 (Inspector2Client) · Endpoint: inspector2:ListFindings
• Default filters: one request per severity in CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNTRIAGED

Changelog

Changelog

The Amazon Inspector connector has undergone the following changes:

Version	Description	Migration Steps
3.2.2	No changes in this release.	N/A
3.2.1	New Features - Richer package vulnerability remediation detail. Package Vulnerability findings now expose the following additional fields, giving assignees everything they need to act without navigating back to AWS Inspector: - Recommendation (RECOMMENDATION) — finding-level remediation guidance from remediation.recommendation.text - Fix Available (FIX_AVAILABLE) — whether a fix exists: YES, NO, or PARTIAL - Exploit Available (EXPLOIT_AVAILABLE) — whether a public exploit is known - Affected Version (AFFECTED_VERSION) — installed versions of the vulnerable packages - Fixed Version (FIXED_VERSION) — versions that contain the fix - Package Remediations (PACKAGE_REMEDIATIONS) — per-package remediation instructions - Affected Package Names (AFFECTED_PACKAGE_NAMES) — explicit multi-valued list of affected package names - Vulnerable Packages (VULNERABLE_PACKAGES) — full formatted package strings (name:epoch:version[-release][.arch]) - Exploit Available on Package Vulnerability Definitions. Package Vulnerability Definitions now also expose the EXPLOIT_AVAILABLE field.	N/A
3.2.0	No changes in this release.	N/A
3.1.0	Improvements - Sync failures are now visible. Previously, certain AWS API errors (throttling, server errors, transient network failures, validation errors) could be silently swallowed during multi-region sync, producing empty results without indicating a problem. These now surface as sync failures with a clear log entry detailing the HTTP status, AWS error code, request id, and service name. Per-region permission gaps (HTTP 401 / 403) still allow the sync to continue across other regions, but are now visible in logs.	N/A
3.0.20	No changes in this release.	N/A
3.0.19	No changes in this release.	N/A
3.0.18	New Features - Resource usage details on assets. Assets now include an In Use Count and Last Used date, giving better visibility into how actively each scanned resource is being used.	N/A
3.0.17	No changes in this release.	N/A
3.0.16	No changes in this release.	N/A
3.0.15	New Features - AWS account attribution. Assets now carry the originating AWS account ID, making it easier to attribute findings and resources to the correct account in multi-account environments.	N/A
3.0.14	Improvements - More robust sync for large finding sets. Finding retrieval is now partitioned by severity and processed in parallel across regions and roles, improving reliability and throughput when synchronizing large volumes of findings.	N/A
3.0.13	No changes in this release.	N/A
3.0.12	No changes in this release.	N/A
3.0.11	No changes in this release.	N/A
3.0.10	New Features - CVE identifiers on vulnerability definitions. Package Vulnerability Definitions now extract and expose CVE identifiers (CVE IDs and CVE records) parsed from the finding title, improving correlation with external vulnerability data. Bug Fixes - Correct remediation text. Remediation guidance is now stored in the remediation field instead of being incorrectly written to the severity field, so findings show accurate remediation recommendations.	N/A
3.0.9	Improvements - Streamlined EC2 instance attributes. The Platform and VPC ID attributes were removed from the EC2 instance asset model where they were not applicable.	• Aws Ec2 Instance: The Platform and VPC ID attributes are no longer populated on this model. Action: re-sync to refresh affected assets.
3.0.8	New Features - Richer asset detail. EC2 instance, container image (ECR), and Lambda function assets now include substantially more detail — for EC2: IAM instance profile, image, IPv4/IPv6 and public/private addresses, key name, launch time, subnet, and instance type; for container images: registry, repository, image hash, image tags, architecture, author, platform, and push date; for Lambda functions: code SHA-256, execution role, function name, layers, package type, runtime, version, security groups, subnets, VPC, and architectures.	N/A
3.0.7	New Features - Port attribute on Network Reachability Findings. Network Reachability Findings now expose the affected port. Bug Fixes - Correct CVSS v2 reporting. The CVSS v2 vector and base score values were swapped on Package Vulnerability Definitions; the vector and score are now reported in their correct fields.	N/A
3.0.6	New Features - Configurable parallelism. A new Parallelism level setting controls how many regions and roles are synchronized concurrently, improving throughput for accounts using multiple assume-role ARNs.	• Finding and finding-definition models renamed: The model names changed — "Static Code Finding" → "Code Vulnerability", "Static Code Finding Definition" → "Code Vulnerability Definition", "Violation" → "Network Reachability Finding", "Violation Definition" → "Network Reachability Finding Definition", "Vulnerability" → "Package Vulnerability", and "Vulnerability Definition" → "Package Vulnerability Definition". Action: re-sync to repopulate findings under the new model names.
3.0.5	Overview The Amazon Inspector connector integrates with Amazon Inspector (Inspector2) to synchronize scanned cloud resources and their security findings — package vulnerabilities, static code findings, and network reachability findings — along with the corresponding finding definitions. Category: Amazon Web Services Models	N/A