Reading findings from GuardDuty, Security Hub, Inspector and IAM Access Analyzer

What's the problem

If your account already runs AWS security services, they already produce findings: threats (GuardDuty), software vulnerabilities (Inspector), resources shared outside the account (Access Analyzer). 6WAF reads these findings on every Fast Scan and shows them next to its own results, free. 6WAF only reads them, never changes these services, and they are not part of the Security Score.

How 6WAF detects it

• Every Fast Scan reads open findings in each Region you selected: GuardDuty (not archived), Security Hub (ACTIVE, workflow NEW/NOTIFIED), Inspector (ACTIVE), Access Analyzer (ACTIVE external access).
• A finding present in both Security Hub and its source service is shown once. Security Hub controls are shown as a FAILED count only, because Fast Scan and Deep Scan already check the same best practices.
• Up to 300 findings per service per Region, highest severity first. Every finding links straight to the AWS console.
• Uses only the read access FinOpsAuditRole already has (SecurityAudit). A service that is off or not readable is reported as a status, never as a finding.