Findings Tab
Security findings management — filtering, actions, classification, and export
Display & Sorting
Findings sorted by risk severity (Critical first), then alphabetically. Each row: title, risk badge, IP:port, tool/source, CVE IDs.
Filtering
| Filter | Description |
|---|---|
| Risk Level | All, Critical, High, Medium, Low, Informational, Unknown |
| Search | Free-text across title, description, IP, port, tool name |
| False Positives Toggle | Switch to FP view with per-item Recover button |
Finding Actions
| Action | Description |
|---|---|
| View Details | Full title, risk, IP, port, description, CVEs, tools, commands, output files, classification |
| View Output File | Evidence viewer: text (up to 5 MB), PCAP (parsed via dpkt), images inline |
| Risk Override | Change risk level. Propagates to findings.jsonl, SQLite DBs. Audit trail in finding_risk_changes.jsonl. Persists via risk_overrides.yaml. |
| Rename | Change display title. Original preserved in finding_name_changes.jsonl. |
| Group | Merge related findings under one title. Highest risk level kept. Combined evidence. |
| Delete | Soft-delete to deleted_findings.jsonl (viewable in Deleted tab) |
| Mark False Positive | Moves to falsePositives.json / falsePositives.csv |
| Recover FP | Moves false positive back to active findings |
Classification States
Unconfirmed
Default
Default — tool-generated, not yet validated by the tester
Confirmed
Validated
Tester-validated finding
Validated
Verified
Independently verified by a second source