emfirge_get_findings
Get the full findings list for a previous scan, optionally filtered by severity.
Parameters
analysis_id: string · required; severity: Critical | Moderate | Low · optional
{
"analysis_id": "7f3c9a2e-4b1d-4c8a-9f2e-1a2b3c4d5e6f",
"severity": "Critical"
}
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"critical_risks": [{
"rule_id": "EMFIRGE-EC2-002", "category": "Security", "severity": "Critical", "confidence": "HIGH",
"issue": "SSH port 22 is open to the entire internet (0.0.0.0/0)",
"recommendation": "Restrict SSH access to your specific IP address only", "aws_service": "EC2",
"resource_id": "NAME_132", "resource_type": "security_group", "region": "us-east-1",
"attack_path": ["NAME_132", "NAME_140", "iam-role-AppServerRole", "acme-prod-customers"],
"blast_radius": 15, "mitre_technique_id": "T1021.004", "mitre_technique_name": "Remote Services: SSH"
}]
}
Validation, behavior, and limits
Each finding carries rule_id, category, severity, confidence, issue, recommendation, aws_service, resource_id, resource_type, region, attack_path, blast_radius, mitre_technique_id, and mitre_technique_name.
attack_path is an array of node IDs, not a string; blast_radius is an integer count of reachable resources. Some attack_path hops may be un-tokenized graph labels such as iam-role-AppServerRole.
Findings are grouped by severity into critical_risks, moderate_risks, and low_risks. A scan also returns best_practices, cost_findings, and toxic_combinations. This is read-only and does not consume scan budget; if analysis_id is not found, run a scan first.