Findings & incidents
Severity, lifecycle, audit history, and dashboard workflows.
Findings lifecycle
Classifiers and policy produce findings in Work. Status changes append to finding_status_history (audit trigger). Attach structured evidence in finding_evidence when available.
- Triage by severity, asset, and threat type.
- Set disposition (open → investigating → resolved / false_positive).
- Optionally open a manual incident for a coordinated response.