> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/configure-findings.md).

# Configure Findings

Prisma Cloud ingests findings and vulnerability data from AWS GuardDuty and Inspector, which you can use to build more meaningful insights and for vulnerability management of potentially compromised assets. Once you enable malware protection and configure it on Prisma Cloud, if malware is detected during a scan, an additional finding is generated that you can view on Prisma Cloud.

* GuardDuty is currently supported only for AWS standalone and member accounts onboarded on Prisma Cloud.
* Enable EventBridge before you configure findings using GuardDuty or Inspector.
* You can use Inspector only for accounts that were onboarded as standalone accounts.
* If you are currently using Inspector Classic, you do not need to make any configuration changes and can continue to use it as is.

1. After you [Onboard Your AWS Account](/content-collections/connect/connect-cloud-accounts/onboard-aws/onboard-aws-account.md), select **Settings > Providers > Cloud Account**.
2. Select the **View** icon next to the AWS account for which you want to configure findings. Make sure that EventBridge is successfully configured for that account.
3. Select **Misconfigurations**.
4. Under **Findings**, toggle the **Disabled** button to **Enabled** for both GuardDuty and Inspector.
5. Select **Configure Findings**.

   <figure><img src="/files/ih9ipMwNPMMxSxe903Sb" alt="configure vul findings 1"><figcaption></figcaption></figure>
6. **Configure Details**.

   <figure><img src="/files/ey39kD1bYbqKuyWBdC0M" alt="aws guardduty 3"><figcaption></figcaption></figure>

   1. Select **Download EventBridge Cloud Formation Template**.

      As part of the initial onboarding when you deploy the EventBridge CFT, Prisma Cloud creates 2 separate rules on AWS, one each for GuardDuty and Inspector. Depending on your selection the corresponding rule is enabled.
   2. Log in to your AWS account and follow the steps to create a stack.
      * Select **I acknowledge that AWS CloudFormation might create IAM resources with custom names**.
      * Click **Create Stack**.
      * Wait for status to display CREATE\_COMPLETE.
7. Return to your Prisma Cloud console.
8. **Next**.
9. **Review Status**.

   Once the template is run successfully, a **Successful** message displays for each region.

   If a Warning status displays for a region(s), select **Configure Details**, download the CFT again, and complete the steps listed above.

   <figure><img src="/files/fOF6y7ytGZnjNHyYTCTa" alt="aws guardduty status 1"><figcaption></figcaption></figure>
10. **Save**.

    Verify that a **Successful** message displays for **Findings** on the account overview page.

    You can view the vulnerability and malware findings generated by AWS GuardDuty or vulnerabilities generated by AWS Inspector by running the following query on **Investigate**:

    `config from cloud.resource where api.name = 'aws-iam-list-access-keys' AND finding.source = 'AWS GuardDuty'`

    <figure><img src="/files/67sr2d4l8ylVRPB3ksO7" alt="aws guardduty findings 1"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/configure-findings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.