---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# AWS Inspector data filters

# Data retrieval settings for AWS Inspector {#ariaid-title1}

* Release version: Australia
* 
* Updated April 2, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The following filters are available for the AWS Inspector Host Vulnerability and Container Vulnerability Integrations. These filters control which findings are retrieved from AWS Inspector.
Role required: sn_vul_aws.configure_integration - to configure the integrations.  
Note:  
For Text-based filters, a maximum 10 values is supported in a configuration.

## Host Vulnerabilities tab {#aws-inspector-data-filters__host-tab-filters}

{#aws-inspector-data-filters__host-tab-filters__entry__3}

| Parameter | Type | Description |
|-|-|-|
| host_severity | glide_list | Filter by severity: INFORMATIONAL, LOW, HIGH, MEDIUM, CRITICAL, UNTRIAGED. |
| host_vulnerability | string | Filter by specific CVE IDs. |
| host_resource_type | choice | Filter by resource type: * AWS_EC2_INSTANCE * AWS_LAMBDA_FUNCTION * BOTH |
| host_account_id | string | Filter by AWS account IDs. |
| host_batch_size | integer | Number of findings per API call. Default: 1000. |
| host_finding_status | glide_list | Filter by finding status: ACTIVE, SUPPRESSED, CLOSED. |
| host_exploit_available | choice | Filter by exploit availability: YES, NO. |
| host_fix_available | glide_list | Filter by fix availability: YES, NO, PARTIAL. |
| host_first_observed | glide_date_time | Filter by first observed date. |
| host_last_observed | glide_date_time | Filter by last observed date. |
| host_updated_at | glide_date_time | Filter by last updated date. Used for delta sync. |
[ ]

## Container Vulnerabilities tab {#aws-inspector-data-filters__container-vulnerabilities-filters}

{#aws-inspector-data-filters__container-vulnerabilities-filters__entry__3}

|   |   |   |
|-|-|-|
| container_severity | glide_list | Filter by severity: INFORMATIONAL, LOW, HIGH, MEDIUM, CRITICAL, UNTRIAGED. |
| container_vulnerability | string | Filter by specific CVE IDs. |
| container_account_id | string | Filter by AWS account IDs. |
| container_batch_size | integer | Number of findings per API call. Default: 1000. |
| container_finding_status | glide_list | Filter by finding status: ACTIVE, SUPPRESSED, CLOSED. |
| container_exploit_available | choice | Filter by exploit availability: YES, NO. |
| container_fix_available | glide_list | Filter by fix availability: YES, NO, PARTIAL. |
| container_first_observed | glide_date_time | Filter by first observed date. |
| container_last_observed | glide_date_time | Filter by last observed date. |
| container_updated_at | glide_date_time | Filter by last updated date. Used for delta sync. |
[ ]