AWS Inspector - Macie Tables

AWS Inspector Tables

AWSInspectorConfigurations

Records Amazon Inspector scanning configuration settings per region, including ECR rescan durations, EC2 scan modes, and pull-date rescan policies.

Name	Type	Description
ID	integer	Auto-incremented primary key for the Inspector configuration row.
ECRRescanDuration	string	Duration after which ECR images are rescanned (e.g., `LIFETIME`, `DAYS_30`, `DAYS_180`).
ECRRescanDurationStatus	string	Status of the ECR rescan duration setting (e.g., `SUCCESS`, `PENDING`).
ECRUpdatedAt	datetime	Timestamp when the ECR scanning configuration was last updated.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.
ConfigID	integer	Unique identifier of the configuration associated with this Inspector configuration record.
EC2ScanMode	string	Scan mode for EC2 instances (e.g., `EC2_SSM_AGENT_BASED`, `EC2_AGENTLESS`).
EC2ScanModeStatus	string	Status of the EC2 scan mode setting (e.g., `SUCCESS`, `PENDING`).
ECRPullDateRescanDuration	string	Duration after which ECR images are rescanned based on last pull date (e.g., `DAYS_14`, `DAYS_60`).
ECRPullDateRescanMode	string	Mode controlling pull-date-based ECR rescan behavior.
Region	string	AWS region where this Inspector configuration applies (e.g., `us-east-1`).

AWSInspectorDelegateAdminAccounts

Stores the delegated administrator accounts for Amazon Inspector and their relationship status within an AWS Organization.

Name	Type	Description
AccountID	string	AWS account ID designated as the delegated administrator for Amazon Inspector.
RelationshipStatus	string	Status of the delegated administrator relationship (e.g., `ENABLED`, `DISABLED`).
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.
ConfigID	integer	Unique identifier of the configuration associated with this delegated admin record.

AWS Macie Tables

AWSMacieFindingCustomData

Contains custom data identifier matches found within S3 objects during Amazon Macie classification, including match counts and occurrence locations.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this Macie custom data record.
ID	integer	Auto-incremented primary key for the Macie custom data row.
AWSMacieFindingID	string	Identifier of the Macie finding associated with this custom data detection.
Arn	string	ARN of the custom data identifier used to detect the sensitive data.
Name	string	Name of the custom data identifier that matched in the S3 object.
Count	bigint	Number of occurrences of the custom data identifier match in the S3 object.
OccurrencesCellsSerialized	string	Serialized list of spreadsheet cell locations where the custom data was found.
OccurrencesLineRangesSerialized	string	Serialized list of line ranges in the object where the custom data was detected.
OccurrencesOffsetRangesSerialized	string	Serialized list of byte offset ranges in the object where the custom data was found.
OccurrencesPagesSerialized	string	Serialized list of document pages where the custom data was detected.
OccurrencesRecordsSerialized	string	Serialized list of structured data records where the custom data was found.
AWSMacieFindingFindingID	string	Foreign key referencing the FindingID of the parent AWSMacieFindings record.
AWSMacieFindingConfigID	integer	Foreign key referencing the ConfigID of the parent AWSMacieFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.

AWSMacieFindings

Central table for Amazon Macie security findings, covering sensitive data detections and policy violations with full S3 object, bucket, and actor context.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this Macie finding.
FindingID	string	Unique identifier of the Amazon Macie finding.
AccountID	string	AWS account ID in which the Macie finding was generated.
Title	string	Short, human-readable title summarizing the type of Macie finding.
Description	string	Human-readable description of the Macie finding and the sensitive data or policy issue detected.
Severity	string	Severity label of the finding (e.g., `LOW`, `MEDIUM`, `HIGH`).
SeverityScore	bigint	Numeric severity score of the finding used for prioritization.
Category	string	Category of the finding (e.g., `CLASSIFICATION`, `POLICY`).
Type	string	Macie finding type (e.g., `SensitiveData:S3Object/Personal`, `Policy:IAMUser/S3BucketPublic`).
Region	string	AWS region where the Macie finding was generated (e.g., `us-east-1`).
Partition	string	AWS partition in which the finding was generated (e.g., `aws`, `aws-cn`).
CreatedAt	datetime	Timestamp when the Macie finding was first created.

AWSMacieFindingSensitiveData

Records individual sensitive data detections within Amazon Macie findings, categorized by data type with occurrence locations across cells, lines, pages, and records.

Name	Type	Description
ConfigID	integer	Unique identifier of the configuration associated with this Macie sensitive data record.
ID	integer	Auto-incremented primary key for the Macie sensitive data row.
AWSMacieFindingID	string	Identifier of the Macie finding associated with this sensitive data detection.
Category	string	Category of sensitive data detected (e.g., `FINANCIAL_INFORMATION`, `PERSONAL_INFORMATION`, `CREDENTIALS`).
CategoryTotalCount	bigint	Total count of sensitive data occurrences for this category in the S3 object.
DetectionType	string	Type of detection method that identified the sensitive data (e.g., managed identifier type).
DetectionCount	bigint	Number of occurrences of this specific detection type within the S3 object.
OccurrencesCellsSerialized	string	Serialized list of spreadsheet cell locations where sensitive data was found.
OccurrencesLineRangesSerialized	string	Serialized list of line ranges in the object where sensitive data was detected.
OccurrencesOffsetRangesSerialized	string	Serialized list of byte offset ranges in the object where sensitive data was found.
OccurrencesPagesSerialized	string	Serialized list of document pages where sensitive data was detected.
OccurrencesRecordsSerialized	string	Serialized list of structured data records where sensitive data was found.
AWSMacieFindingFindingID	string	Foreign key referencing the FindingID of the parent AWSMacieFindings record.
AWSMacieFindingConfigID	integer	Foreign key referencing the ConfigID of the parent AWSMacieFindings record.
BatchDate	datetime	Timestamp when this record was ingested during the batch processing run.