Reading a finding

A finding ties a rule to a resource: this rule fails on this resource, with a severity, a status and a proposed fix. This page describes how to read one, filter the list, ignore a finding with a reason, and how a finding closes on its own when the resource is no longer at fault.

The findings list

The "Findings" page lists every finding of the instance, all families together, within the scope selected in the header (projects, folders). Each row has five columns: "Severity", "Type", "Finding", "Resource" and "Status".

Column	Content
"Severity"	CRITICAL, HIGH, MEDIUM or LOW. The list sorts by severity.
"Type"	The family: CSPM, AI-SPM, "Vulnerability", "Secret", KSPM, HCR, DSPM or IaC.
"Finding"	The title of the finding: the rule name, or the CVE id for a vulnerability.
"Resource"	The name of the affected resource, or its id when there is no name.
"Status"	OPEN, INVESTIGATING, IGNORED, ACCEPTED, RESOLVED or FIXED.

The header counts the rows shown and, when a filter is active, the total ("of {total}"). "Export CSV" writes every filtered row, not only the page on screen. Pagination reads "Page {page} of {pages}", with "Previous" and "Next".

Until a cloud account is connected, the page shows "No cloud account connected yet" and a "Connect a cloud account" button. During a scan it shows "Scan in progress" with the phase. With no finding, it tells "No scan has run yet. Start one to populate this page." apart from "The last scan found nothing to report here."

Filters and search

The filter bar offers "Severity", "Type" and "Status"; the status values offered are those present in the data. The "Search by title, resource, CVE..." field filters on those three fields. Grouping by severity, type, status or resource folds the list into groups that show "Distinct rules" and "Affected resources".

Filters, search and grouping live in the page address: a copied address reproduces the same view. The scope selected in the header (projects, repositories) is not a row filter; it bounds the results and survives "Clear filters".

The detail panel

Clicking a row opens the detail panel on the right. It stacks: from a finding you can open its resource, then another finding of that resource, and go back through the breadcrumb. The Escape key, the "Close" button or a click outside the panel close it.

Under the title and the resource, people allowed to update findings see the actions: "Ignore" on an open finding, "Reopen" on an ignored or accepted one, and "Create a ticket" when a ticketing integration is configured. A "Resolved" or "Fixed" finding offers neither: that is the scanner's verdict, which the next scan revisits.

The tabs depend on the family:

Family	Tabs
Cloud configuration, IaC, hosts, Kubernetes	"Overview", "Remediation", "History"
Vulnerability, data	"Overview", "History"
Secret	"Overview", "Rotation", "History"
Toxic combination	"Overview", "Attack path", "Remediation", "History"

"Overview" shows the severity, the "Status", the "Detected" date, the MITRE ATT&CK techniques and CWEs the rule references, the compliance "Frameworks" covered, then "Why it matters", "Remediation" and "References" as the rule describes them, and finally the "Affected resource". The status reads "Open", "Investigating", "Resolved", "Fixed", "Ignored", "Accepted", "Revoke required" or "Suppressed".

The risk score

The "Risk score", out of 100, appears for vulnerabilities, secrets and toxic combinations, with its breakdown on click.

Family	Composition
Vulnerability	The CVSS score scaled to 35 points, 25 points when the CVE is in the CISA KEV catalogue, 10 points when the resource is exposed to the Internet.
Secret	A base by severity (critical 80, high 60, medium 40, low 20), weighted by validity (active 1, unknown 0.75, inactive 0.15), plus 10 points when the resource is exposed and 10 points beyond 90 days of exposure.
Toxic combination	The same base by severity, plus 5 points per hop of the path (15 at most) and 2 points per resource (10 at most), capped at 100.

The history

The "History" tab unrolls the life of the finding: "Found" (first observation), "Last seen" (last scan that saw it again), "Resolved", then each decision with its author: "Ignored by {actor}" followed by "Expires {date}" or "Permanent", "Reopened by {actor}", "Resolved by {actor}", or "Ignored by .ctadel.yaml in the repo" for an IaC finding covered by the repository's file. The author system means an automatic decision. Team comments join the same thread with "Add a comment..." and "Post".

Ignoring a finding

1. Open the finding and click "Ignore".
2. In "Ignore finding", pick a "Category": "False positive", "Exception" or "Other".
3. Write the "Reason". It is required.
4. Pick when the ignore "Expires": "7 days", "30 days", "90 days", "6 months", "1 year", a date in the calendar, or "Permanent". The button stays disabled until the category, the reason and the expiry are all set.

The finding switches to "Ignored". The reason, prefixed with the category, the expiry (end of the day, UTC) and your email address are recorded on the finding and in its history. At the expiry, the ignore lifts on its own: the finding is reopened within the hour, or at the next full scan, with "Reopened by system" in the history. "Reopen" does the same by hand, keeping the trace of the original ignore.

An ignored finding is not deleted: it stays in the list with the IGNORED status and counts in the filters.

Automatic closure

A finding closes without anyone's action when a scan no longer reports it: the resource was fixed, or it no longer exists. It switches to "Resolved", the resolution date is set and the history receives "Resolved by system".

• For cloud configuration, each evaluation closes the open findings that the rules no longer report, and those of disabled rules. A rule that could not be evaluated closes nothing: its findings stay as they were.
• For clusters, hosts, data and repositories, closure happens resource by resource at the end of each scan of that resource.
• For IaC, a pull request closed without being merged closes at once the findings it had introduced.

A resolved finding that the next scan reports again is reopened ("Reopened by system") and notified as new.

Closed findings are purged after the "Retention Period", 90 days by default, counted from their resolution or, failing that, their last observation. Open and ignored findings are never purged.

Limits

• The interface offers only two decisions, "Ignore" and "Reopen". The other statuses ("Investigating", "Accepted", "Revoke required") come from the scanners or from other flows of the application, not from the findings list.
• Ignoring is done one finding at a time: the list has no multiple selection.
• The interface offers no account-wide ignore rules (by family, severity, rules or projects).
• The category chosen in the ignore dialog is recorded in English in front of the reason ([False Positive], [Exception], [Other]), whatever the interface language.
• The list shows neither the dates nor the risk score; they are in the panel.
• Event detection findings (CDR) only appear for internal validation accounts, not for customers.
• Comments are plain text, with no mention and no attachment.