> Source: [sk159532](https://support.checkpoint.com/results/sk/sk159532)

# sk159532 - Use the CloudGuard REST API to receive findings from external systems

| Property | Value |
|----------|-------|
| Solution ID | sk159532 |
| Date Created | 2019-08-06 |
| Last Modified | 2023-01-11 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |

## Solution

Prerequisites
-------------

You must have a CloudGuard account and create a [V2 API Key and Secret](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/CloudGuard-PM-Admin-Guide/Default.htm#cshid=API_V2).

Send a list of findings
-----------------------

The request below sends a single finding from an external system (Qualys) to CloudGuard, using the POST method:

    POST api/v2/ExternalFindings
      [
      {
        "ResourceId": "tests3bucket1",
        "ResourceType": "S3Bucket",
        "externalCloudAccountId": "1*********30",
        "vendor": "aws",
        "FindingSource": "Qualys",
        "findingSourceUrl": "http://myqualys.qualys.com",
        "findingSeverity": "Low",
        "originalFindingSeverity": "Low",
        "findingId": "10000",
        "scanId":"a",
        "findingCreatedAt": "2019-07-31T12:03:24",
        "findingTitle": "No Encryption",
        "findingDescription": "Server side encryption not enabled for S3 bucket",
        "findingStatus": "open",
        "findingCategory": "s3",
        "findingRecommendation": "enable encryption",
        "relatedFindingsRef": ["abcd"],
        "findingRulesPackage": { "id":"","name":"","provider":"","version":""
      },
      "additionalFields": [
          {
            "name": "",
            "value": "",
            "comment": ""
          }
        ]
      }
      ]  
     
### Parameters

**ResourceId**must refer to the id or name of a resource in the cloud account.

**ResourceType**is from the list of resource types for the different cloud providers.

**externalCloudAccountId** is the cloud account id in the cloud provider, and **vendor**is the cloud provider

**findingSeverity** must be in Low, Medium, or High, while the **originalFindingSeverity**can be any value.

The **findingId**field must be unique for the external source (findingSource).

This adds a finding for an S3 bucket.

Example with validation errors
------------------------------

This block has errors in the request:

    {
        "ResourceId": "tests3bucket1",
        "ResourceType": "S3",
        "externalCloudAccountId": "1**********0",
        "vendor": "aws",
        "FindingSource": "Qualys",
        "findingSourceUrl": "http://myqualys.qualys.com",
        "findingSeverity": "Low",
        "originalFindingSeverity": "Low",
        "findingId": "10000",
       ...
      }

The response indicates the problem field, in this case *resourceType* (should be *S3bucket* , not *S3*):

      {
        "failedRecords": [
            {
                "request": {
                    "resourceId": "tests3bucket1",
                    "resourceName": null,
                    "resourceType": null,
                    "externalCloudAccountId": "1**********0",
                    "vendor": "aws",
                    "findingSource": "Qualys",
                    "findingSourceDescription": null,
                    "findingSourceUrl": "http://myqualys.qualys.com",
                    "findingSeverity": "Low",
                    "originalFindingSeverity": "Low",
                    "findingId": "10000",
    				...
                 },
                "reason": "Empty or Invalid ResourceType"
            }
        ],
        "totalFailedRecords": 1,
        "totalSuccessfulRecords": 0
    }

Archive findings
----------------

Archive findings using the ExternalFindings/Archive method. The *findingSource* and *findingId*fields identify the record tab to be archived:

    
    {
        "ResourceId": "tests3bucket1",
        "externalCloudAccountId": "1**********0",
        "FindingSource": "Qualys",
        "findingId": "10000"
    
      }
    
The response is 204 (No Content).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content