Findings & incidents
Severity, lifecycle, audit history, and dashboard workflows.
Findings lifecycle
Classifiers and policy produce findings in Work. Every status change is kept in the finding's audit history with who made it and from where, and structured evidence is attached to the finding.
- Triage by severity, asset, and threat type.
- Move it through investigating to a disposition (resolved, accepted, false positive). Every disposition needs a note, kept as evidence.
- Optionally open a manual incident for a coordinated response.