Findings

Findings in the app is /security/findings.

Use this when…

• you’re reviewing vulnerabilities or misconfigurations
• you need to show reviewers that you remediate issues
• customers ask about your vulnerability management process

Recommended workflow

1. Triage: severity, affected asset, exploitation likelihood.
2. Assign an owner and due date.
3. Link to:
   • assets impacted
   • controls that detect/prevent the issue
   • evidence of remediation (ticket closure, config change, patch record)
4. Track exceptions consciously (with time limits).

Where findings come from

Provider analyzers create or update findings during integration scans. Noru also creates platform findings for certain cross-register problems, such as connected personnel identities that disagree on lifecycle status. Each finding retains its source, external ID, originating check, observation timing, and raw provider payload where available.

Directory (/security/findings)

Search, filter, and sort by severity, status, category, source, assignee, asset, and related risk. Quick actions support open, in progress, resolved, accepted, and false-positive workflows. Bulk assignment is useful only after confirming the selected findings have the same accountable owner.

Finding detail (/security/findings/[id])

The detail page records status, severity, category, CVE/CVSS/provider link, owner, first observation, closure details, title, description, check name, external/device context, and raw payload. Link one affected asset and a risk-register entry where the finding changes organizational risk.

Status guidance

• Open: observed and awaiting triage or work.
• In progress: remediation is actively owned.
• Resolved: the condition was fixed and ideally re-observed as cleared.
• Accepted: the condition remains but authorized residual risk is accepted.
• False positive: the observation does not represent the stated condition; preserve why.

Provider syncs may reopen or resolve findings as upstream facts change. Remediate in the authoritative system and use tickets/configuration evidence to support closure. Editing raw payload is an administrative traceability feature, not a way to change the upstream scanner's result.

Compliance relevance

Findings support vulnerability, configuration, access, monitoring, incident-prevention, and corrective- action controls. Auditors usually care as much about consistent triage, due dates, exceptions, and verified closure as they do about the raw finding count.