# How to identify image linked to findings in aws\_inspector2\_findings table **URL:** \ **Category:** CloudQuery Plugins\ **Created:** [June 19, 2024, 12:47pm UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175 "2024-06-19T12:47:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![funny-whale](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@funny-whale](https://community.cloudquery.io/u/funny-whale)\ **Post date:** [June 19, 2024, 12:47pm UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175/1 "2024-06-19T12:47:09Z")
\<@942479022397456425\>, \<@768428918298378241\> How do I find out which image a vulnerability finding is recorded in the `aws_inspector2_findings` table? ---
**Author:** ![marcel](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/marcel/32/48_2.png) [@marcel](https://community.cloudquery.io/u/marcel)\ **Post date:** [June 19, 2024, 3:34pm UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175/2 "2024-06-19T15:34:24Z")
Hi, can you post a few more details about what data you’re after specifically and what you currently have synced? Are the fields in our docs ([AWS Inspector2 Findings](https://hub.cloudquery.io/plugins/source/cloudquery/aws/latest/tables/aws_inspector2_findings)) missing from your destination? ---
**Author:** ![funny-whale](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@funny-whale](https://community.cloudquery.io/u/funny-whale)\ **Post date:** [June 20, 2024, 4:30am UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175/3 "2024-06-20T04:30:07Z")
Hi @marcel, we have `finding_arn` in `aws_inspector2_findings`, right? This `finding_arn` contains the ARN which is the vulnerability of the image. But now I want to find to which particular image in the account the vulnerability is for. How can I get it? ---
**Author:** ![marcel](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/marcel/32/48_2.png) [@marcel](https://community.cloudquery.io/u/marcel)\ **Post date:** [June 20, 2024, 8:36am UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175/4 "2024-06-20T08:36:30Z")
For EC2 images, you would have to sync the `aws_ec2_images` table ([https://hub.cloudquery.io/plugins/source/cloudquery/aws/latest/tables/aws\_ec2\_images](https://hub.cloudquery.io/plugins/source/cloudquery/aws/latest/tables/aws_ec2_images)) which lists the `arn` of the image. Is that what you’re after? ---
**Author:** ![funny-whale](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@funny-whale](https://community.cloudquery.io/u/funny-whale)\ **Post date:** [June 20, 2024, 11:46am UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175/5 "2024-06-20T11:46:34Z")
No, the vulnerabilities I’m getting are for the ECR images, right? So how can I find which image the vulnerability is reported in the `aws_inspector2_findings`? ---
**Author:** ![herman](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/herman/32/27_2.png) [@herman](https://community.cloudquery.io/u/herman)\ **Post date:** [June 20, 2024, 11:49am UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175/6 "2024-06-20T11:49:49Z")
I don’t have local data on hand to confirm, but I think what you’re looking for will be in the `aws_inspector2_findings` `resources` JSON column. For an image, the type will be `AWS_ECR_CONTAINER_IMAGE`, and `details -> AwsEcrContainerImage` will contain details about the specific image. Or something along those lines at least. ---
**Author:** ![funny-whale](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@funny-whale](https://community.cloudquery.io/u/funny-whale)\ **Post date:** [June 21, 2024, 4:37am UTC](https://community.cloudquery.io/t/how-to-identify-image-linked-to-findings-in-aws-inspector2-findings-table/175/7 "2024-06-21T04:37:19Z")
Hey, thanks! I was using the `23.1.0` AWS plugin version, so I couldn’t find it. I checked with `24.1.0`, and it’s there.