Findings Management

The Findings view helps you triage, track, and remediate discovered vulnerabilities.

Viewing Findings

Navigate to Findings in the sidebar to see all discovered vulnerabilities across your targets.

Finding Details

Each finding includes:

Field	Description
Severity	Critical, High, Medium, Low, or Info
CVSS Score	0.0 - 10.0 numerical severity rating
CVE ID	Common Vulnerabilities and Exposures identifier (if applicable)
Asset	Affected IP, hostname, or service
First Seen	When the vulnerability was first discovered
Last Seen	Most recent scan confirming the vulnerability
Status	Open, In Progress, Resolved, False Positive

Severity Levels

Severity	CVSS Range	Action Required
🔴 Critical	9.0 - 10.0	Immediate remediation
🟠 High	7.0 - 8.9	Remediate within 7 days
🟡 Medium	4.0 - 6.9	Remediate within 30 days
🟢 Low	0.1 - 3.9	Remediate at convenience
⚪ Info	0.0	Informational only

Filtering & Sorting

Filter Options

• Severity: Critical, High, Medium, Low, Info
• Status: Open, In Progress, Resolved, False Positive
• Asset: Specific target or IP
• Framework: Compliance framework affected
• Date Range: First/last seen date range
• Search: Free-text search across findings

Sorting Options

• Severity (highest first) - Default
• CVSS Score
• Asset name
• First seen date
• Last seen date

Finding Actions

Change Status

Update the status of a finding:

1. Click on a finding to open details
2. Select new status from dropdown:
   • Open: Needs attention
   • In Progress: Being worked on
   • Resolved: Fixed and verified
   • False Positive: Not a real vulnerability

Assign Owner

Assign findings to team members:

1. Open finding details
2. Click Assign
3. Select team member
4. Optionally add notes

Professional Feature

Assigning findings to team members requires Role-Based Access Control, available on Professional and Enterprise plans.

Mark as False Positive

If a finding is incorrectly reported:

1. Open finding details
2. Click Mark as False Positive
3. Add justification (required)
4. Click Confirm

The AI learns from false positive feedback to improve future scans.

Create Ticket

Create a ticket for tracking remediation:

1. Open finding details
2. Click Create Ticket
3. Choose destination:
   • Internal (Peppermint)
   • Jira (Professional+)
   • GitHub Issues (Professional+)

Professional Feature

Jira and GitHub integration requires a Professional or Enterprise subscription.

AI Remediation

CyberOrigen's AI provides detailed remediation guidance for each finding.

Getting Help

1. Open a finding
2. Click AI Remediation or ask the AI Advisor
3. Get step-by-step fix instructions

Example AI Guidance

Finding: SQL Injection in /api/users endpoint

Remediation Steps:
1. Use parameterized queries instead of string concatenation
2. Implement input validation for user_id parameter
3. Add WAF rules to block SQL injection patterns

Code Fix:
- Before: query = "SELECT * FROM users WHERE id = " + user_id
+ After:  query = "SELECT * FROM users WHERE id = ?"
         cursor.execute(query, [user_id])

Verification:
- Run the scan again after deploying the fix
- Test with common SQL injection payloads
- Verify application still functions correctly

Compliance Mapping

Each finding shows which compliance controls it affects:

┌─────────────────────────────────────────┐
│ SSL/TLS Configuration Weakness          │
├─────────────────────────────────────────┤
│ Affects:                                │
│ • SOC 2 CC6.7 - Encryption in Transit   │
│ • PCI-DSS 4.1 - Strong Cryptography     │
│ • ISO 27001 A.10.1.1 - Cryptography     │
│ • HIPAA 164.312(e) - Transmission       │
└─────────────────────────────────────────┘

Remediating a finding automatically improves your compliance scores.

Bulk Actions

Perform actions on multiple findings:

1. Select findings using checkboxes
2. Click Bulk Actions
3. Choose action:
   • Change status
   • Assign owner
   • Export to CSV
   • Create tickets

Export

Export findings data:

• PDF Report: Formatted report for stakeholders
• CSV/Excel: Raw data for analysis
• JSON: Programmatic access
• SARIF: Security Analysis Results Interchange Format

API Access

# List findings
GET /api/v1/findings?severity=critical&status=open

# Get finding details
GET /api/v1/findings/{finding_id}

# Update finding status
PATCH /api/v1/findings/{finding_id}
{
  "status": "resolved",
  "notes": "Fixed in deployment v2.3.1"
}

See API Reference for full documentation.

Best Practices

1. Triage Daily: Review new findings every day
2. Prioritize by Risk: Focus on critical findings first
3. Track Progress: Update status as work progresses
4. Verify Fixes: Re-scan after remediation
5. Document Decisions: Add notes explaining status changes
6. Learn from False Positives: Report them to improve AI accuracy