Back to Checks
aws

Inspector2 has no active findings older than the configured maximum age

inspector2_active_findings_within_max_age
Service: inspector2Severity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:Other

Amazon Inspector active findings are evaluated against the configurable inspector2_active_finding_max_age_days threshold (192 days by default), using the time since each finding was first observed (firstObservedAt). Suppressed and closed findings are not active and are not evaluated.

The result is reported per Region where Inspector is enabled.

Prowler logoProwlerprowler-provider-aws

Risk

Findings left open for months show that vulnerability response is not keeping up. Long-lived vulnerabilities give attackers time to discover and exploit them, and a backlog that is neither fixed nor formally accepted hides real risk from decision makers.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks inspector2_active_findings_within_max_age

Recommendation

Remediate findings within your vulnerability response timeframes. Vulnerabilities you decide not to fix should be formally accepted and suppressed with a documented justification instead of staying active indefinitely.

Remediation

Other

1In the Amazon Inspector console, open Findings and filter by Finding status = Active
2Remediate the findings first observed longest ago
3For vulnerabilities you formally accept, choose Suppression rules in the navigation pane and create a rule so they stop counting as active

Check Code

from datetime import datetime, timedelta, timezone

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.inspector2.inspector2_client import (
    inspector2_client,
)


class inspector2_active_findings_within_max_age(Check):
    """Ensure no Inspector2 finding stays active longer than the configured days."""

    def execute(self) -> list[Check_Report_AWS]:
        """Report, per Region, whether any active finding is older than the allowed days."""
        findings = []
        max_age_days = inspector2_client.audit_config.get(
            "inspector2_active_finding_max_age_days", 192
        )
        max_age = timedelta(days=max_age_days)
        now = datetime.now(timezone.utc)
        for inspector in inspector2_client.inspectors:
            if inspector.status != "ENABLED":
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=inspector)
            if inspector.findings is None:
                report.status = "MANUAL"
                report.status_extended = (
                    f"Inspector2 findings could not be retrieved in region {inspector.region}; "
                    "verify the inspector2:ListFindings permission."
                )
                findings.append(report)
                continue
            stale_ages = [
                now - finding.first_observed_at
                for finding in inspector.findings
                if finding.first_observed_at
                and now - finding.first_observed_at > max_age
            ]
            if stale_ages:
                report.status = "FAIL"
                report.status_extended = (
                    f"Inspector2 has {len(stale_ages)} active findings in region {inspector.region} "
                    f"first observed more than {max_age_days} days ago, the oldest {max(stale_ages).days} days ago."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Inspector2 has no active findings in region {inspector.region} "
                    f"first observed more than {max_age_days} days ago."
                )
            findings.append(report)
        return findings

References