Triage findings by severity, assign owners, link risks and assets, and close them out.

RolesViewerEditorAdminRoute/security/findingsShown toCompliance organizations

What it is

Security findings is the single queue for things that were observed to be wrong: vulnerabilities from scanners, misconfigurations from cloud syncs, expiring certificates, identity mismatches between HR and your identity provider, and anything you record by hand. Each finding has a severity, a status, an optional owner, and can be linked to an asset and to a risk so that remediation is traceable from the observation to the register.

Where to find it

SecurityFindings

Key actions

Triage from the list

Search with "Search findings, assets, risks, owners, or CVEs..." or filter by Issue status, Severity, and Source.

Sort by severity, title, assignee, or observation date. Highest severity first is the usual triage order.

Click a row to expand it. The panel shows Description, Assignee, Severity, CVSS, Source, Asset, CVE, Status, Owner, First observed, Closed, Closed by, and Linked risk.

Click Open detail for the full page.

The insight strip counts Findings, Open ("Findings requiring remediation or triage"), In Progress ("Findings currently being worked"), and Closed ("Resolved, accepted, or marked false positive").

Change status

Each row offers the transitions that make sense for its state: Start work, Resolve, Accept, Reopen, and False Positive. Select several rows to apply a status change to all of them from the bulk bar.

Assign an owner

Select rows and click Assign findings. Pick a member under "Select an owner", or choose Unassigned to clear, then click Assign.

Link findings to a risk

Select the findings that share a root cause.

Click Link Findings to Risk, choose the risk register entry, and confirm with Link Findings.

The reverse direction works too: on the detail page, Link Risk to Finding attaches a single finding, and the risk register shows a Finding ID column that links back.

Create a manual finding

Click Add Finding. The "New finding" dialog opens.

Enter a title ("What did you find?") and a description ("Add context for this finding...").

Set the Severity, Status, Category, and Source chips. Source is Manual unless you attribute it to a connected data source.

Optionally Link asset and Link risk.

On the Details tab, fill External ID ("Auto-generated if blank"), Check name ("Defaults to the finding title"), Observed at, and Asset external ID if you have them. The Raw payload tab accepts the original scanner output.

Click Save finding.

The New finding dialog with severity, status, category, and source chips and the Details tab — A manual finding. External ID and Check name are optional and default sensibly.

Edit the detail page

Finding detail page with Properties, Asset, Linked risk, and Raw Payload sections — The detail page. Title, description, and check name edit inline.

The detail page groups everything about one finding. Properties holds Status, Severity, Category, CVE, CVSS, Provider alert, Owner, First observed, Closed, Closed by, and Closure reason. Asset ("Link an asset from the register.") opens Link Asset to Finding; Linked risk opens Link Risk to Finding. Raw Payload keeps the original provider payload "for traceability and debugging". Delete security finding at the bottom opens the Delete Security Finding confirmation.

Statuses and fields

Status	Meaning	Set by
Open`open`	Observed and not yet worked. Counted in the Open bucket.	You, a sync, or a scan
In Progress`in_progress`	Someone is remediating it. Preserved across re-scans.	You
Resolved`resolved`	Fixed. A scan that still sees the issue reopens it.	You, or a scan
Accepted`accepted`	Known and tolerated. Preserved across re-scans.	You
False Positive`false_positive`	Not a real issue. Preserved across re-scans.	You

Severity	Use it for
Critical	Exploitable now or already expired; fix immediately
High	Serious weakness with a clear path to impact
Medium	Should be fixed in the normal cycle
Low	Hygiene, hardening, or informational

Category	Typical source
Identity Access	Identity provider and HR syncs, including "Cross-source status mismatch" findings from the People directory
Vulnerability	Scanners such as Detectify, dependency alerts
Configuration	Cloud and SaaS posture checks
Compliance	Certificate coverage and other policy checks
Endpoint Posture	Device management syncs

Findings are numbered NORU-FND-n and are unique per organization, source, and external id, which is how a re-sync updates a finding in place instead of duplicating it.

Tips and gotchas

Fix synced findings at the source. The next sync upserts the finding from what the provider now reports, so the record follows the fix; manual findings are the ones whose status you must move by hand.

Deleting a synced finding is temporary. Syncs upsert by external id, so the same finding returns on the next run. Use Accept or False Positive instead; those statuses survive re-scans.

The Closed filter bucket combines Resolved, Accepted, and False Positive. Filter by Issue status to see them separately, and remember that viewers see "Read-only access" in the bulk bar instead of actions.

What Noru does not do

Noru does not fix findings, verify a fix, or re-test. It records what a source reported and what you decided. Severity and CVSS come from the source or from you; Noru does not re-score them. Linking a finding to a risk does not change the risk's likelihood or impact.

Security findings

How it works under the hoodTechnical

On this page