> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/prisma-cloud-findings.md). # Prisma Cloud Findings All Prisma Cloud findings are driven by policies. While you can take action on Prisma Cloud generated alerts, findings are purely informational and provide security context. Findings inherit the attributes of the policy, such as name, severity, and description. The **Finding Type** is a set of findings with a specific security focus. Each OOTB policy (except for Attack Path policies) is classified with a finding type. The finding type is displayed as \ for custom policies and also for policies cloned from OOTB policies. The **View Finding Details** button is not visible if the finding details are not applicable for the finding type.
finding type details 1
| **Finding Type** | **Description** | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Bot Activity | A WAAS detection of web activity performed by an automated tool known as a bot. | | Config Tampering | Findings that identify alternation on critical configurations that may pose an escalated security risk. | | Cross Account Trust | A scenario where a cloud account provides access to some of its resources or services to a different cloud account. | | Defense Evasion | A scenario where an attacker performs actions to evade detection of their actions by security controls. | | High Privileged Role | An IAM role that has (risky) excessive access permissions to a cloud resource or service. | | Internet Exposure | A cloud asset, usually a compute resource such as a VM or a Container that is accessible from the public Internet. | | Keys And Secrets | Insecure findings related to keys and secrets. | | Malware | The detection of software intentionally designed to cause damage, steal data, or gain unauthorized access to computer systems or networks. | | Misconfiguration | A misconfiguration of a cloud asset, service or account, which may introduce a security weakness and allow malicious users to abuse it. | | MFA | Multi-factor authentication is not enabled for some user actions. | | Overly Permissive Resource | Cloud resources can be accessed by any user due to the overly permissive IAM policy configuration. It differs from the INTERNET\_EXPOSURE finding type, mainly identifying the resources with unrestricted inbound network firewall rules. | | Privilege Escalation | A scenario where a malicious user can potentially elevate their privileges to an asset or a service. | | Reconnaissance | Potentially malicious reconnaissance activity performed. | | Resource Hijacking | Potentially unauthorized utilization of cloud computing resources by an attacker. | | Sensitive Data | The detection of sensitive data such as credit card information, PII, usernames, and so on. | | SSH Brute Force | Findings that identify the use of trial and error to guess information like passwords and encryption keys, attempting to gain unauthorized access to a system. | | Suspicious IAM Activity | Findings that identify the IAM actions or activities that are unusual or may pose an elevated risk. | | Unencrypted Data | Data that is stored, transmitted, or processed in plain text or a format that is easily readable without the use of encryption, posing a significant security risk. | | Unused Privileges | IAM access permissions that have not been used for a certain period. These permissions are potentially unnecessary for the user/entity’s normal operation. | | User Anomaly | Suspicious cloud account user activity that could potentially point to malicious user behavior. | | Weak Password | The authentication mechanism in use is flawed, less secure, or susceptible to attacks like brute force. | | Web Attack | A WAAS detection of an active web attack performed by a potentially malicious user. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/search-and-investigate/prisma-cloud-findings.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.