Ctrlk
Book a demoOX Security
For the complete documentation index, see llms.txt. This page is also available as Markdown.

cloudItem

Represents a comprehensive cloud security item with security context.

Examples

type CloudItem {
  id: String
  assetName: String
  service: String
  resourceId: String
  cbomId: String
  cbomProvider: String
  resourceType: String
  resourceName: String
  accountId: String
  firstSeen: String
  lastRescanAt: String
  lastScannedAt: String
  serviceKey: String
  rescannable: Boolean
  cloudProvider: String
  serviceCategory: String
  applications: [AppInfo]
  isExposed: String
  isPermissiveIdentity: Boolean
  isHighPrivilege: Boolean
  isSensitiveData: Boolean
  contextFactors: [String]
  imageSource: String
  registryType: String
  registryName: String
  imageScanStatus: String
  exposurePath: [ExposurePathItem]
  accountName: String
  subService: String
  region: String
  resourceTags: JSON
  authenticationRequired: Boolean
  reachability: CloudItemReachability
  verdict: String
  resourceArn: String
  images: [CloudItemImage]
  relatedIssues: Severities
  issueSeverityBreakdown: [CloudIssueSeverityBreakdown]
  issuesStats: IssuesStats
  cluster: String
  link: String
  imageHash: String
  workloads: [Workload]
  artifactIds: [String]
  attachedIdentities: CbomAttachedIdentities
  compliance: [CloudItemCompliance]
  usageSeries: CloudUsageSeries
  usageCoverage: String
  isAiAsset: Boolean
  isTrainingData: Boolean
  modelInfo: CloudModelInfo
  trainingDataInfo: CloudTrainingDataInfo
  tools: [CloudTool]
  dataAccess: [CloudDataAccess]
  isMcpServer: Boolean
  mcpServer: CloudMcpServer
  mcpDescription: String
  aiService: CloudAiService
  probeResults: [CloudProbeResult]
}

Fields

Field
Description
Supported fields

id String

Unique identifier for the cloud item

assetName String

Name of the cloud asset or resource

service String

Cloud service type (EC2, S3, Lambda, etc.)

resourceId String

Cloud provider's resource identifier

cbomId String

Cloud Bill of Materials identifier

cbomProvider String

Cloud provider name

resourceType String

Type of cloud resource

resourceName String

Name of the cloud resource

accountId String

Cloud account identifier

firstSeen String

Date when the resource was first discovered

lastRescanAt String

When this asset was last rechecked by an on-demand single-asset rescan, as an ISO timestamp; null until the first rescan

lastScannedAt String

When a scan or the runtime sensor last wrote the data of this asset, as an ISO timestamp. An on-demand single-asset rescan leaves the value unchanged and sets lastRescanAt instead.

serviceKey String

Stable service key of the asset (e.g. s3, ec2, iam), unlike the display label in service

rescannable Boolean

Whether an on-demand single-asset rescan can recheck this asset: an AWS, GCP or Azure asset produced by the CSPM engine, other than the account or subscription anchor, tenant-wide Entra objects and nodes derived from other assets

cloudProvider String

Cloud provider (AWS, Azure, GCP, etc.)

serviceCategory String

Category of the cloud service

applications [AppInfo]

Applications associated with this cloud resource

id String name String type String

isExposed String

Whether the resource is exposed to the internet

isPermissiveIdentity Boolean

Whether the resource has a permissive (high-privilege) identity attached.

isHighPrivilege Boolean

Whether the resource itself has high-privilege access.

isSensitiveData Boolean

Whether the resource holds sensitive data (confirmed secrets or PII).

contextFactors [String]

Severity-factor context labels for the asset. Set for runtime image assets.

imageSource String

Source of the container image if applicable

registryType String

Type of container registry

registryName String

Name of the container registry

imageScanStatus String

Status of the image security scan

exposurePath [ExposurePathItem]

Path showing how the resource is exposed

type String name String cbomId String

accountName String

Human-readable name of the cloud account

subService String

Sub-service or component within the main service

region String

Cloud region where the resource is located

resourceTags JSON

Tags associated with the cloud resource

authenticationRequired Boolean

Whether authentication is required to access the asset. Asset-level verdict: the live-probe result when the asset was probed, otherwise the static config/service-model determination.

reachability CloudItemReachability

Result of the reachability probe for the asset, including whether reachability was confirmed and the observed HTTP response.

confirmed Boolean responseCode String authTagValue String conclusion String playbook String steps [String] response String

verdict String

Breach verdict for the asset (Breachable / Contained / N/A): the scanner-persisted agent-aware verdict when available, otherwise the reachability + authentication derivation.

resourceArn String

Amazon Resource Name (ARN) for AWS resources

images [CloudItemImage]

Container images associated with this resource

name String hashes [CloudItemImageHash] tags [String]

relatedIssues Severities

Security issues found in this resource, categorized by severity

info Int low Int medium Int high Int critical Int appox Int

issueSeverityBreakdown [CloudIssueSeverityBreakdown]

Breakdown of issues by policy category with severity details

name String severities Severities

issuesStats IssuesStats

Statistics about security issues found

totalIssues Int sourceTools [IssueStat] categories [IssueStat] severities [IssueStat]

cluster String

Kubernetes cluster name if applicable

link String

URL link to view the resource in the cloud console

imageHash String

Hash of the container image

workloads [Workload]

Kubernetes workloads associated with this resource

type String namespace String name String cluster String region String isExposed String consoleLink String exposurePath [ExposurePathItem]

artifactIds [String]

List of artifact identifiers associated with this resource

attachedIdentities CbomAttachedIdentities

CBOM asset related identities

users [String] groups [String] servicePrincipals [String] serviceAccounts [String] iamPolicies [String] attachedResources [String] trustedBy [String]

compliance [CloudItemCompliance]

Per-asset compliance results: each entry is a single compliance check evaluated for this asset, with its status and the framework controls it maps to.

checkId String status String frameworks JSON

usageSeries CloudUsageSeries

Generative AI usage time-series for the asset, covering invocation and token volumes over a rolling window. Set for AI service assets that publish usage metrics.

source String countMetric String tokenMetric String windowDays Int daily [CloudUsageDaily]

usageCoverage String

Reason the asset has or lacks usage data, distinguishing an idle asset from one whose usage metric is unavailable or unsupported. Absent when usage was never evaluated for the asset.

isAiAsset Boolean

Indicates whether the asset is classified as an AI asset.

isTrainingData Boolean

Indicates whether the asset holds data used to train or tune a model.

modelInfo CloudModelInfo

Structured identity of the foundation model associated with the asset.

modelName String modelVersion String vendor String family String modelClass String where String matched String

trainingDataInfo CloudTrainingDataInfo

Structured identity of the training data associated with the asset.

dataType String location String locationType String locationPath String storageType String

tools [CloudTool]

Tools the AI agent can invoke at inference time.

name String type String target String where String matched String args [String] probed Boolean skipReason String injectionSignals [String]

dataAccess [CloudDataAccess]

Data systems the asset depends on.

name String where String matched String target String

isMcpServer Boolean

Indicates whether the asset is classified as a Model Context Protocol (MCP) server.

mcpServer CloudMcpServer

Detection evidence that classified the asset as an MCP server. Absent when the asset is not an MCP server.

signals [McpServerSignal] tools [McpServerTool]

mcpDescription String

Description of the MCP server. Absent when the scanner did not record one.

aiService CloudAiService

Detection evidence that classified the asset as an AI service — an A2A agent, a self-hosted inference endpoint or a vector store. Absent when no AI-service detector matched.

kind String signals [McpServerSignal] capabilities [CloudAiServiceCapability] description String provider String protocolVersion String endpoint String declaresAuth Boolean

probeResults [CloudProbeResult]

Connectivity probe results collected for the asset during attack surface simulation.

url String type String statusCode Int curl String connectedAsset CloudProbeConnectedAsset verdict String

References

Queries using this object:

Fields with this object:

Last updated