Skip to main content

​
Supported Alert Fields

​
Supported Compliance Findings

​
Rules

A control states an outcome; a rule is one criterion behind it. “Ensure diagnostic settings capture the right categories” can be failed for several separate reasons, and a rule is the one each finding actually failed. Ask for them with includeRules=true on List Compliance Data and includeRule=true on List Compliance Findings. Both are opt-in: a request without them returns exactly what it returned before. A control then carries rules, each with the counts the tool publishes for that rule under that control, plus rule_counts summarising how many of its rules pass, fail or do not apply, and how many carry no state because the tool published none (unknown). The four always add up to total. A finding carries rule, the criterion it failed, as {id, vendor_id, name}. The counts belong to the pairing of a rule and a control, not to the rule alone: one criterion cited by two controls can report different numbers under each, and Leen keeps both rather than picking one. Derived means Leen computes the value because the tool does not publish it:
  1. Lacework reports assessed, violating and suppressed resources for each recommendation, but no passing count. Leen sets passed_resources to assessed minus violating minus suppressed, and unsupported_resources to resources in scope minus assessed. This assumes suppressed resources are counted within assessed ones; no tenant measured so far has had a suppressed resource to confirm it. Where the counts contradict that assumption, passed_resources falls back to assessed minus violating.
  2. Wiz publishes no state or count for a control under a framework. Leen derives them from the control’s Issues: failed_resources is the number of open Issues and skipped_resources the number of rejected ones, so both count Issues rather than resources. state is NOT_APPLICABLE for a disabled control, FAIL while it has an open Issue and PASS otherwise.
A field a tool does not publish comes back empty rather than guessed: an empty string for text, and null for a count or a state. Microsoft Defender for Cloud, for example, publishes no unsupported-resource count and no rule logic, and a definition nothing in the tenant is assessed against carries no description, remediation or severity. AWS Security Hub publishes no resource counts at all, so its counts are null rather than 0.
For any additional information about our field mappings or integrations please contact us.