Findings and triage
Every scan type writes to one register: Findings. It shows the active project. Administrators can select Show all projects.
Views and filters
Section titled “Views and filters”| View | Shows |
|---|---|
| All Findings | Every finding in scope. |
| Triage Queue | Findings awaiting a decision: Open and In review. |
| SLA Breached | Open, In review and To fix findings past their SLA date. |
| My Findings | Findings assigned to you. |
| Accepted Risk | Findings under an accepted-risk decision. |
Filter by severity, state, scan type, project, asset, SLA, assignee or text. Sort by severity, newest, due date or title.
Finding details
Section titled “Finding details”Select a finding to open its details:
- Scan Details: ID, scan type, asset, project, CWE, CVE, standards, CVSS and engine severity.
- Observation, Impact and Affected: what was found and where.
- Evidence: file and line or manifest, package and fixed version, known-exploited flag, EPSS score, captured evidence and reproduction steps.
- Recommendation: how to fix it.
- Operator Decision: the triage record.
- References, Comments (up to 2,000 characters) and Dates and Ownership.
Change a finding’s state
Section titled “Change a finding’s state”Under Manage Finding, choose a State and select Save Changes.
| State | Meaning | Required |
|---|---|---|
| Open | New, awaiting a decision. | |
| In review | Being assessed. | |
| To fix | Accepted for remediation. | Reason of 10 characters or more |
| Fixed | Remediated. The next complete scan of the same type confirms it, and reopens the finding if it reappears. | |
| False positive | Not an issue in this context. | Reason of 10 characters or more |
| Accepted risk | Accepted without a fix until a date. | Reason, and Accepted For (Days) from 1 to 365 (default 90) |
| Won’t fix | Deliberately not remediated. | Reason of 10 characters or more |
When an acceptance expires, the finding reopens and a Risk acceptances expired notification is raised.
Severity, owner and due date
Section titled “Severity, owner and due date”- Severity can be lowered with a reason of 10 characters or more. It can never be raised above the engine’s rating. The details show both values.
- Assign To lists active teammates. Clear it to remove the owner.
- Due Date is a date you set. It is separate from the SLA.
The SLA is counted from the date a finding was first seen, using the policy for its severity. The default policy is 7 days for Critical, 30 for High, 90 for Medium and 180 for Low. Info has no SLA. Administrators change it under Settings > Scanning > SLA.
The Due column reads, for example, Due in 5 days or Breached 2 days ago. The page header shows how many findings are past SLA.
Bulk changes
Section titled “Bulk changes”Select findings with the checkboxes to set state, owner, due date, acceptance period and reason for up to 200 findings at once. A bulk change applies to all selected findings or none.
Export
Section titled “Export”Export CSV downloads the findings that match the current filters, up to 5,000 rows. If more match, the page says the export is truncated. For PDF, HTML, JSON or SARIF, download the scan report. See Reports.
Permissions
Section titled “Permissions”Viewers can read the register. Analysts and administrators can triage, assign and export. Project access is set per user. See Users, roles and projects.