Crucible Docs

Overview & Benefits New Engagement Wizard Settings Tab Summary Tab Console & Controls Findings Tab Intelligence Tab Action Items & Auto-Queue Reports Import Logs & Errors Auditability Engagement Hours & Scheduling

← Back to Crucible

Findings Tab

Cross-tool findings aggregation, false positive management, and evidence correlation.

Overview

The Findings tab aggregates findings from all managed tools into a single deduplicated view. When multiple tools detect the same issue (e.g., both SS3 and Fracture find the same SSL vulnerability), Crucible merges them into a single finding.

Deduplication key: (title_lower, ip, port, scope, hostname) — findings matching on all five fields are merged. The merged finding preserves data from all contributing tools.

Risk statistics at the top show counts and percentages by severity: Critical, High, Medium, Low, and Info.

Finding Details

Each finding contains:

Field	Description
Title	Short name of the vulnerability or misconfiguration
Description	Detailed explanation of what the finding is and how it was detected
Risk Level	Severity: Critical, High, Medium, Low, or Info
IP / Port / Hostname	Affected asset — where the issue was found
Service	Network service (e.g., http, ssh, mysql)
CVEs	Associated CVE identifiers, comma-separated
OWASP Mapping	OWASP Top 10 or OWASP API Top 10 category
NIST Mapping	NIST SP 800-53 or CSF control references
Tool Source	Which tool(s) produced this finding
Evidence File	Path to the evidence file (relative to the run directory)
Output Excerpt	Relevant portion of tool output that substantiates the finding (truncated to 4096 chars)
Remediation	Recommended fix or mitigation steps
Exploit Details	ExploitDB references, Metasploit module paths, and searchsploit terms (when available)

Filtering & Views

Filter the findings list to focus on specific subsets:

All Findings Default

Every finding across all tools, deduplicated. This is the default view when you open the Findings tab.

Per-Tool Filter Tool

Show findings from a specific tool only (e.g., only Fracture findings, only SS3 findings). Useful when triaging one tool's output at a time.

Per-Risk Filter Severity

Filter by severity level — show only Critical, only High, etc. Useful for prioritizing triage (start with Critical, work down).

Keyword Search Search

Free-text search across title, description, CVE, IP, hostname, and other fields. Finds findings matching any part of the search term.

Host Correlation By Host

Group all findings by IP address. Shows per-host attack surface — how many and what severity of findings affect each host. Useful for identifying the most exposed hosts.

CVE Correlation By CVE

Group findings by CVE identifier. Shows which CVEs affect multiple hosts — cross-host vulnerability exposure. Useful for identifying widespread vulnerabilities that need urgent patching.

Actions Per Finding

Each finding row has action buttons for triage and management:

Mark as False Positive Suppress

Suppress the finding — moves it from the active findings list to the false positives list (falsePositives.json). The finding is not deleted — it's fully recoverable. Use when a finding is confirmed to be a false positive after manual verification.

Recover from FP Restore

Restore a previously suppressed finding back to the active findings list. Available from the false positives view. Use when a finding was incorrectly marked as a false positive.

Risk Override Override

Change the finding's risk level (e.g., Medium → Low because the affected service is behind a firewall, or Low → High because of specific business context). The original risk is preserved; the override is recorded separately. Available as a single-finding or bulk operation.

Accept Risk Accept

Mark a finding as accepted — the risk is acknowledged by the client or engagement lead but will not be remediated (e.g., a legacy system that cannot be patched). Accepted findings remain visible but are flagged.

Add Notes Annotate

Attach free-text notes to any finding. Use for analyst commentary, reproduction steps, client context, or follow-up reminders. Notes are preserved across exports.

Attach Evidence Upload

Upload additional evidence files to associate with a finding. Use for manual screenshots, pcap captures, or supplementary documentation not produced by the tool itself.

Bulk Operations

Select multiple findings using the checkboxes on each row, then apply batch actions from the toolbar:

Bulk Suppress — Mark all selected findings as false positives
Bulk Accept — Mark all selected findings as accepted risk
Bulk Risk Override — Change the risk level of all selected findings to a specified severity

Bulk operations are useful for triaging large finding sets — for example, suppressing all Info-level findings from a specific tool, or accepting all findings related to a legacy system.

Export Formats

Export findings data in three formats, each serving a different purpose:

CSV (Merged) Deduped

Single CSV file with deduplication applied. One row per unique finding. This is the most common export — use it for client deliverables, spreadsheet analysis, and import into other tools.

Unmerged CSV Per-Tool

Preserves each tool's original findings separately — no deduplication. Multiple rows may appear for the same vulnerability if different tools detected it. Useful when you need tool-specific detail (e.g., exact nmap output vs. exact nuclei output for the same SSL finding).

XLSX (Multi-Sheet) Excel

Excel workbook with multiple sheets: a merged All Findings sheet plus individual sheets for each tool (SS3 Findings, Fracture Findings, Siphon Findings, etc.). If Nessus CSV data is present, it gets its own sheet with the original Nessus columns preserved. Best for detailed analysis and client reporting.

Snapshots & Diffing

Save point-in-time snapshots of the findings state. Each snapshot captures all findings, their risk levels, suppression status, and notes at that moment.

Compare snapshots to see the delta between two points in time:

New findings — findings present in the later snapshot but not the earlier one
Removed findings — findings present in the earlier snapshot but not the later one (remediated or suppressed)
Changed findings — findings whose risk level, notes, or status changed between snapshots

Useful for tracking remediation progress across assessment phases, or for showing a client what changed between the initial assessment and the re-test.

Scan Comparison

Compare findings between two different tool runs to identify the delta — what's new, what was fixed, what changed. Unlike snapshots (which compare the entire findings state), scan comparison focuses on a specific tool's output across runs.

← Console & Controls

Intelligence Tab →