Cloud Security Posture (CSPM)

How Cloud Security Posture works

The CSPM module scans three cloud providers — AWS, Azure, and GCP — against GuardFox's built-in check library. Each scan records the provider's checks as findings, and the page rolls them up into a security score, a dashboard, and a filterable findings feed.

The check library

Each provider has a fixed set of best-practice checks. A scan writes every check in the selected provider's library as an open finding, tagged with the severity, description, and manual remediation defined for that check.

The dashboard

Four cards sit above the findings feed:

• Security Score — a compliance rating derived from open findings (see the API reference for the formula).
• Open Violations — the total number of open findings across all providers.
• Critical Severity — the count of open findings with severity Critical.
• Connected Providers — how many of the three providers currently have at least one open finding, shown as n / 3.

Finding lifecycle

Findings start as open and stay in the feed until you close them. Resolving a finding sets its status so it drops out of the open feed. Re-running a scan does not duplicate findings — an existing finding for the same provider, resource, and check is updated in place.

Running a scan

1. Open Cloud Posture from the sidebar (/cloud-posture).
2. Find the card for the provider you want — AWS Elastic, Azure Cloud, or GCP Platform.
3. Fill in the provider's configuration parameters (see below). These are recorded on the findings the scan produces.
4. Click Scan API. The button shows a spinner while the scan runs, then the findings feed and dashboard refresh.

Configuration parameters

Each provider card exposes its own fields:

What happens on a scan

• Every check in the provider's library is saved as an open finding for your organization.
• If the scan produces any Critical findings, a single alert is raised (source cspm-scanner, tagged cspm / provider / misconfiguration) and SOAR playbooks are triggered against it.
• The response reports how many checks were scanned, how many findings were saved, and the critical count.

Working with findings

Filtering the feed

Two segmented controls sit above the feed:

• Provider — all, aws, azure, or gcp.
• Severity — all, Critical, High, Medium, or Low.

Both filters are applied server-side. Click Reload Feed to re-fetch with the current selection. When no open findings match, the feed shows a "Cloud Posture Secure" empty state.

Expanding a finding

Each row shows the severity, provider icon, check name, and the resource type / region / resource ID. Click a row to expand it and reveal:

• Description — what the check flags.
• Manual Remediation Protocol — the step-by-step console fix for that check.
• Remediation CLI CoPilot — for most checks, a ready-to-run CLI command (AWS CLI, Azure CLI, or gcloud/gsutil) with a Copy Command button. A few checks that have no single CLI equivalent (for example, enforcing admin MFA via Conditional Access) show a guidance note instead.

Closing a finding

The expanded view has two buttons, Mark Resolved and Accept Risk. Both set the finding's status to resolved, which removes it from the open feed and updates the dashboard counts. There is no separate accept-risk state in the current UI.

API reference

All CSPM actions run through one endpoint, /api/cspm/scan. It is a session-authenticated app endpoint — call it from a signed-in session — and every request is scoped to your organization.

Run a scan

POST /api/cspm/scan. Body requires provider (aws, azure, or gcp) and an optional config object. Returns { provider, scanned, saved, critical }.

curl -X POST https://portal.guardfoxsecurity.com/api/cspm/scan \
  -H "Content-Type: application/json" \
  -d '{"provider":"aws","config":{"accountId":"111122223333","region":"us-east-1"}}'

List open findings

GET /api/cspm/scan. Optional query params provider and severity filter the results (open findings only, up to 200, newest first). Returns findings plus byProvider and bySeverity group counts and a total.

curl "https://portal.guardfoxsecurity.com/api/cspm/scan?provider=aws&severity=Critical"

Update a finding's status

PATCH /api/cspm/scan. Body requires id and status. Returns { success, updated }.

curl -X PATCH https://portal.guardfoxsecurity.com/api/cspm/scan \
  -H "Content-Type: application/json" \
  -d '{"id":"","status":"resolved"}'

Finding fields

Security score formula

The dashboard's Security Score is computed from open findings as:

score = max(30, 100 − 12 × Critical − 6 × High − 2 × Medium)

Low-severity findings do not affect the score, and the score never drops below 30.